Sumsub Review
8.0/10London-based IDV and AML platform (Sum and Substance Ltd, founded 2015) that reads as the gaming segment leader: four named operators with quoted execs, EGBA's first IDV associate member, the deepest certification stack in the field (DIATF IDSP medium+high, first-ever GDIC, ETSI, SOC 2 I/II + SOC 3, ISO family), public per-check pricing at $1.35 Basic / $1.85 Compliance, and two dated security incidents plus a real ownership-opacity finding priced into the read.
Our read
The broadest single-platform spread in the tier: document (14,000 types cited), biometric and liveness, age, AML across 11,000+ sources, PoA, non-doc in 15+ countries, KYB, Travel Rule, and transaction monitoring, with Sumsub ID reusable KYC from the Basic tier, though the 20s/4.5s speed figures are vendor-stated.
The deepest verified trail in the field: DIATF IDSP at medium+high confidence (RTW/RTR), first vendor awarded the GDIC (ISO 29115, AVID, 2024-08-28), ETSI, SOC 2 Type I/II and SOC 3 (BARR, SOC 3 2023-05-24), and an ISO family, docked only because the ISO 27001 issuer certificate is not published and no US state register exists.
REST API plus iOS and Android SDKs plus WebSDK plus no-code, public docs at docs.sumsub.com, a sandbox with a 14-day/50-check trial, and reusable KYC passporting, with white-label and SSO at Enterprise and the SoftGamings (2024-11) edge documented, held back by no published SLA.
Deep and institutionally anchored: four named operators with quoted execs (Kaizen, Betmaster, CopyBet, Yolo Group) on two dedicated vertical pages, EGBA's first IDV associate member (2024-06-25), Gambling IQ #1 iGaming fraud vendor 2026, and 400+ iGaming clients vendor-stated, edged only by Jumio's longer named-operator list.
Two-time Gartner MQ Leader (2024, 2025) plus Forrester Wave Leader Q3 2025 plus WEF Unicorn Community (2026-01-12), priced against two dated incidents (Merkur integrator token exposure 2025-03 and a support-env breach that dwelt about 18 months, July 2024 to disclosed 2026-02-04) and a real ownership-opacity finding.
Public per-check pricing on the two main tiers ($1.35 Basic / $1.85 Compliance), billed for successful verifications only, with minimums and a 14-day/50-check trial published, and the Enterprise tier (KYB, Travel Rule, database validation) the one hidden layer.
Methodology. Our own score, a weighted average of six dimensions, tilted toward verification coverage and compliance. Weighted on the identity-verification scale, where verification coverage leads at 0.22 and compliance and certifications follows at 0.20, so a vendor that pairs the broadest single-platform spread with the deepest issuer-anchored certification trail scores at the top while two dated incidents and an ownership-opacity finding hold trust down. Read the full methodology
- The deepest gaming footprint in the tier: four named operators with quoted execs (Kaizen Gaming, Betmaster, CopyBet, Yolo Group) on two dedicated vertical pages, EGBA's first IDV associate member (2024-06-25), and Gambling IQ's #1 iGaming fraud-prevention vendor for 2026.
- Public per-check pricing on the two main tiers, $1.35 Basic and $1.85 Compliance (2026-07-11), billed for successful verifications only, with a 14-day trial that includes 50 free checks, a rare level of transparency in a mostly quote-only field.
- The most complete certification stack in the field: DIATF-certified IDSP at medium and high confidence with RTW/RTR, the first vendor ever awarded the GDIC (ISO/IEC 29115, AVID, 2024-08-28), ETSI, SOC 2 Type I and II, SOC 3 (BARR, SOC 3 completed 2023-05-24), and an ISO family.
- Two-time Gartner Magic Quadrant Leader for Identity Verification (2024 and 2025, MQ published 2025-08-25) plus a Forrester Wave Leader placement for Q3 2025, independent-analyst recognition that is organizer-verifiable.
- Broad verification spread in one platform: document plus biometric and liveness plus age plus AML across 11,000+ sources plus proof of address plus KYB plus Travel Rule plus transaction monitoring, with Sumsub ID reusable KYC from the Basic tier.
- Buyer-friendly billing that charges for successful verifications only, so unfinished or failed checks do not accrue against the monthly minimum (pricing page, 2026-07-11).
- Ownership opacity is real and dated: Sumsub filed that it could not identify who controlled the company from October 2023 to May 2024, its 2022 Series B backer is still unnamed, and no formal valuation was ever announced despite unicorn framing (Rekt via CryptoTimes, 2026-04-15, which Sumsub disputed).
- A support-environment breach dwelt roughly 18 months undetected: an external actor submitted a malicious attachment via a third-party support ticketing platform in July 2024, discovered only in a January 2026 review and disclosed 2026-02-04, exposing names with a subset also including email or phone (production and biometrics untouched, per Sumsub).
- The Merkur blast radius: even as a third-party integrator's authentication misconfiguration rather than a Sumsub-side breach, exposed Sumsub API tokens in verification links reportedly affected up to about 800,000 players and about 70,000 ID copies (statement 2025-03-17), and the token-in-link design was the pivot.
- The marketplace complaint pattern centers on false rejections from strict rule setups (G2, 109 reviews, 2026-07-11), a recurring buyer-side friction that makes rule tuning part of the rollout cost.
Operators that want one platform for KYC, age, AML, and Travel Rule with published entry pricing and a real free trial, plus crypto-casino and multi-market books that need broad document coverage and reusable KYC.
Buyers who require a named US state gaming supplier registration, which Sumsub does not hold because it sells IDV and not geolocation, or buyers who weight ownership transparency and audited financials heavily.
Markets & licensing
Sumsub's register anchor is not a gambling license or a US state supplier list, it is a certification stack, and it is the deepest in the identity-verification field. Sum and Substance Ltd is a DIATF-certified Identity Service Provider at medium and high confidence (including Right to Work and Right to Rent for UK and Irish citizens), the first vendor ever awarded the Global Digital Identity Certification (AVID, based on ISO/IEC 29115, 2024-08-28), and the holder of ETSI certifications, SOC 2 Type I and II, SOC 3 (BARR Advisory, SOC 3 completed 2023-05-24), and an ISO family in its Trust Center. The DIATF, GDIC, ETSI, and SOC trail is register-grade and issuer-anchored, and the ISO 27001 issuer certificate sits behind a Trust Center access request, so ISO grades claimed only. No US state gaming registration exists, which is expected: no IDV vendor holds one.
There is no US state gaming vendor registration on record for Sumsub, and that is the expected shape for an identity-verification vendor rather than a gap: state registrations are a geolocation-supplier concern. Operators that specifically need a named PA PGCB or MGC supplier entry should look at the geolocation specialists in this directory, while operators that need onboarding, age, and AML compliance will find the certification trail more relevant than a state list.
Sumsub is a DIATF-certified IDSP at medium and high confidence with Right to Work and Right to Rent scope, the strongest verified UK compliance position in this tier alongside GBG and Entrust.
- UK DIATF certified IDSPUnited Kingdom
- Certified Identity Service Provider under the DCMS UK Digital Identity and Attributes Trust Framework at medium and high levels of confidence, including Right to Work and Right to Rent schemes (RTW/RTR limited to UK and Irish citizens) · Added to the certified-provider list reported Nov 2023 (Biometric Update)
- Global Digital Identity Certification (GDIC)Global (ISO/IEC 29115)
- First vendor ever awarded the certification, completing the pilot before any other provider · Issued by AVID Certification Services Ltd, announced 2024-08-28 (Biometric Update)
- ETSI certificationsEU / ETSI standards
- Video identification, electronic identification (eID), electronic signatures, auto identification, and KYB · Late Jul 2024, per Biometric Update coverage
- SOC 2 Type I / Type II and SOC 3AICPA (BARR Advisory)
- SOC 2 Type I and Type II plus a SOC 3 general-use report · Audited by BARR Advisory, P.A. - SOC 3 examination completed 2023-05-24 - SOC 2 Type II and PCI DSS AOC gated behind Trust Center access request
- ISO family (Trust Center)ISO/IEC standards
- ISO/IEC 27001, ISO 27017, ISO 27018, ISO 22301, PCI DSS, ETSI 119/319 · Listed in the Trust Center with reports access-gated, ISO 27001 issuer certificate not published, so ISO grades claimed only
Licensing tier: Depth without a US register: the DIATF IDSP medium+high plus first-ever GDIC plus ETSI plus SOC 2 I/II plus SOC 3 stack beats every rival in the identity-verification tier for issuer-anchored certification, and the one gap is the ISO 27001 issuer certificate, which sits behind a Trust Center request (claimed only).
The compliance footprint is standards-led rather than jurisdiction-licensed: DIATF and GDIC anchor the UK and global positions, EGBA membership anchors the EU gaming relationship, and the underlying IDV/AML product serves regulated operators worldwide.
No restricted-market list applies: Sumsub is a compliance layer operators integrate rather than a licensed operator, and it sells into the UK on a DIATF certification and across the EEA as an EGBA associate member (2026-07-12).
Platform & capabilities
The feature set: what's built in. Capabilities light up when present. Anything not shown isn't offered or isn't disclosed.
Integrations & engineering
One contract and one API instead of a separate deal per studio, feed, or PSP. Here's what connects, how fast, and on what stack.
Everything funnels through one integration: REST API for a custom build, native iOS and Android SDKs and a WebSDK for embedded flows, or no-code journeys for teams without engineering time. Document, biometric, liveness, age, AML, PoA, and non-doc checks ride the same connection, Sumsub ID passports a verified identity across an operator's products, and the deeper Enterprise tooling (KYB, Travel Rule, transaction monitoring) plugs into the same dashboard. A sandbox and a 14-day trial with 50 free checks let a team prove the flow before signing.
No firm vendor SLA on integration time is published (2026-07-12). The public docs and sandbox let engineering start immediately, and the no-code flows shorten a basic go-live, but the real calendar depends on the tier and the rule tuning, which the marketplace complaint pattern flags as the effort-heavy step.
Products & tools
One platform for the whole onboarding job: document plus biometric and liveness, age checks, AML screening across 11,000+ sources, proof of address, non-doc validation, KYB, Travel Rule, and transaction monitoring, with Sumsub ID reusable KYC carried from the Basic tier up.
Identity Verification & Onboarding
Document plus selfie and liveness onboarding with age verification and proof of address, delivered through API, mobile SDKs, WebSDK, and no-code flows, with Sumsub ID reusable KYC passporting a verified identity across an operator's products from the Basic tier up.
- Document identity verification with 14,000 document types cited across vendor materials (2026-07-11)
- Passive and active liveness with face match, plus age verification from document DOB
- Sumsub ID reusable KYC included from the Basic tier, so a verified player can carry across products
- Document-free verification in 15+ countries via database validation (vendor-stated)
- Vendor-stated 20 sec average verification with a document, 4.5 sec without (2026-07-11)
AML Screening & Ongoing Monitoring
PEP, sanctions, and adverse-media screening across 11,000+ global sources with ongoing AML monitoring, added at the Compliance tier and extended with transaction monitoring and financial and non-financial monitoring at Enterprise.
- Screening across 11,000+ global sources for PEP, sanctions, and adverse media (vendor-stated)
- Ongoing AML monitoring that re-screens onboarded players against list changes
- Transaction monitoring, device intelligence, and risk scoring at the Enterprise tier
- Travel Rule support for crypto-facing operators, bundled at Enterprise
- Case management and review workflow behind the screening surface
Business Verification & Travel Rule
Business verification (KYB) with beneficial-ownership checks and Travel Rule support for crypto-facing operators, both grouped in the Enterprise tier alongside non-doc verification and database validation.
- KYB with corporate document checks and beneficial-ownership screening
- Travel Rule messaging for VASP-to-VASP transfers, relevant to crypto casinos
- Non-doc verification and database validation at the Enterprise tier
- White-label and SSO available at Enterprise (vendor-stated)
- 50+ interface languages cited on the gambling page (2026-07-11)
Developer Platform & SDKs
A REST API with iOS and Android SDKs, WebSDK, and no-code flows, documented publicly at docs.sumsub.com, with a sandbox and a 14-day trial that includes 50 free checks before any contract.
- Public developer hub at docs.sumsub.com with REST API reference
- Native iOS and Android SDKs plus WebSDK and no-code journey flows
- Sandbox environment with a 14-day free trial and 50 free checks
- Reusable KYC passporting exposed to integrators as Sumsub ID
- Documented Sumsub x SoftGamings integration edge (2024-11)
On the record
The history that matters: the milestones, the scale, the awards, and who runs it.
Sum and Substance Ltd, trading as Sumsub, was founded in 2015 by Andrew Sever (CEO), Peter Sever, Jacob Sever, and Vyacheslav Zholudev (CTO), and is headquartered in London at 30 St Mary Axe, with offices in Berlin (R&D), Miami, Singapore, and Dubai. Funding ran from a 2017 seed (Flint Capital) through a 2020 Series A (MetaQuotes) to a 2022 Series B described only as an unnamed corporate VC fund, with total disclosed raise around $36.6M per trackers. The core business is multi-industry IDV and AML across crypto, fintech, trading, and gaming, and gaming is a named vertical with its own page and a product lead (Kris Galloway, Head of iGaming Product) rather than the whole company, though the gaming footprint is deep and specific. Revenue is estimate-class only, with getlatka reporting about $85.6M ARR for 2024 against a vendor-stated 2024 that more than doubled, and no audited financials exist.
Brands & clients on the platform
Corporate
Leadership
Milestones
- 2015
Andrew Sever, Peter Sever, Jacob Sever, and Vyacheslav Zholudev found Sum and Substance Ltd (Sumsub) in London as an IDV and AML platform.
- 2017-2020
Raises a 2017 seed (Flint Capital) and a 2020 Series A (MetaQuotes), building the multi-industry IDV/AML product across crypto, fintech, and trading.
- 2022
Closes a Series B described only as a multi-million-dollar corporate VC fund, with the investor never named, taking total disclosed raise to about $36.6M.
- 2023
Completes the SOC 3 examination (BARR Advisory, 2023-05-24) and reports vendor-stated revenue up about 50%, expanding into Miami, Singapore, and Dubai.
- 2024
Named the first IDV associate member of EGBA (2024-06-25), awarded the first-ever GDIC (AVID, ISO/IEC 29115, 2024-08-28), added ETSI certifications, and placed a Leader in the debut Gartner MQ for Identity Verification.
- 2025
Named a Gartner MQ Leader for the second consecutive year (MQ published 2025-08-25, furthest in Completeness of Vision) and a Forrester Wave Leader for Identity Verification Solutions in Q3 2025.
- 2025
A third-party integrator used by Merkur AG exposes Sumsub API tokens via an authentication misconfiguration (statement 2025-03-17), reportedly affecting up to about 800,000 players and about 70,000 ID copies, with German regulator GGL reprimanding Merkur entities, not Sumsub.
- 2026
Joins the WEF Unicorn Community (2026-01-12) and is ranked #1 iGaming fraud-prevention vendor by Gambling IQ (2026-01-19), then discloses a July 2024 support-environment breach on 2026-02-04, followed by the Rekt/CryptoTimes ownership-opacity piece on 2026-04-15 that Sumsub disputed.
Where they're pushing next
- iGaming, where the four named operators, EGBA membership, and Gambling IQ #1 ranking anchor a deepening vertical
- Crypto and Travel Rule compliance, served through the Enterprise tier
- Reusable identity via Sumsub ID, passporting verified players across an operator's products
Awards & recognition
Trust signals
The checks an operator runs before signing: incidents, enforcement, ownership, and longevity, from our research.
- Security incidents: Minor
Sumsub vs alternatives
The same attributes, side by side, from our normalized provider set, useful for seeing where this vendor fits against its peers.
| Attribute | Sumsub | Veriff | Jumio | iDenfy |
|---|---|---|---|---|
| Founded | 2015 | 2015 | 2010 | 2017 |
| Team | 500+ | — | — | 55+ |
| US market | — | Available | Available | — |
| Pricing | Public | Not published | Not published | Public |
| Country coverage | Document-free verification in… | 230+ countries | 200+ countries and territories | Document verification for ID… |
| UK DIATF | Certified IDSP | UK DIATF gamma | Yes | Not certified |
The take: Sumsub is the segment leader on the strength of the deepest certification stack in the field plus four named operators plus public pricing, and it sits above the field on those three legs together. Veriff and Jumio are the broad-coverage rivals, with Jumio carrying a longer named-operator roster but a heavier legacy file, while iDenfy is the pricing-transparency contrast that publishes an even finer per-check schedule but with a thinner certification trail. Pick Sumsub when you want one platform for onboarding, age, and AML with published entry pricing, and weigh the two dated incidents and the ownership-opacity finding against the capability.
Pricing & terms
Sumsub publishes pricing. Ranges are below, and final terms are quoted per project.
Basic is $1.35/verification ($149/month min). Compliance is $1.85/verification ($299/month min). Enterprise is custom. Billed for successful verifications only, with a 14-day trial and 50 free checks (2026-07-11)
Turnkey
White-label
Support & account management
The service layer operators inherit: availability, the channels support runs on, and language coverage.
Frequently asked
The things operators actually ask before signing.
Does Sumsub publish its pricing?+
Yes, on the two main tiers, which is rare in this field. As of 2026-07-11 the Basic tier is $1.35 per verification with a $149/month minimum (ID verification, liveness and face match, email and phone verification, Sumsub ID, reusable KYC), and the Compliance tier is $1.85 per verification with a $299/month minimum, adding AML screening, ongoing AML monitoring, and proof of address. The Enterprise tier, which adds non-doc verification, database validation, KYB, fraud detection, ongoing monitoring, and Travel Rule, is custom and quote-only. Billing charges for successful verifications only, and a 14-day free trial includes 50 free checks.
Which gambling operators actually use Sumsub?+
Four operators appear on Sumsub's gambling page with quoted executives (checked 2026-07-11): Kaizen Gaming (George Moschetas, Director of Product, Account & Services), Betmaster (Anna Feltfebel, Compliance Manager), CopyBet (Denis Kulakov, COO), and Yolo Group (Liisa Proode, Product Owner). Sumsub is also the first identity-verification provider to join EGBA as an associate member (2024-06-25) and was ranked #1 iGaming fraud-prevention vendor by Gambling IQ for 2026. Vendor-stated scale is 400+ active iGaming clients.
Was Sumsub itself breached in 2025 or 2026?+
There are two dated incidents, and neither was a breach of Sumsub's core production. In March 2025 a third-party integrator used by Merkur AG exposed Sumsub API tokens through an authentication misconfiguration (statement 2025-03-17). Trade press reported up to about 800,000 players and about 70,000 ID copies affected, and German regulator GGL reprimanded the Merkur entities, not Sumsub. Separately, a support-environment breach disclosed 2026-02-04 traced to a malicious attachment submitted via a third-party support ticketing platform in July 2024, undetected for about 18 months, exposing names with a subset also including email or phone. Sumsub states biometric data, ID images, and core production were not accessed.
Is Sumsub certified for UK and global compliance?+
Yes, and its certification trail is the deepest in the tier. It is a DIATF-certified Identity Service Provider at medium and high levels of confidence, including Right to Work and Right to Rent for UK and Irish citizens, and it was the first vendor ever awarded the Global Digital Identity Certification (AVID, based on ISO/IEC 29115, 2024-08-28). It also holds ETSI certifications, SOC 2 Type I and Type II, SOC 3 (BARR Advisory, SOC 3 completed 2023-05-24), and an ISO family in its Trust Center.
Who owns Sumsub, and why is ownership flagged as a concern?+
Sumsub is founder-led (Andrew Sever is CEO), but the ownership picture is genuinely opaque and that opacity is itself a 2026 finding. Per Rekt via CryptoTimes (2026-04-15), Sumsub filed that it could not identify who controlled the company from October 2023 to May 2024, and its 2022 Series B backer, described only as a corporate VC fund, remains unnamed. No formal valuation was ever announced despite the company joining the WEF Unicorn Community in January 2026. Sumsub disputed the piece's framing and said the reporters did not seek comment before publication.
What does Sumsub verify, and how broad is the coverage?+
In one platform: document identity verification (14,000 document types cited), biometric and liveness with face match, age verification, AML screening across 11,000+ global sources with ongoing monitoring, proof of address, non-doc and database validation (document-free in 15+ countries), KYB business verification, Travel Rule, and transaction monitoring, with Sumsub ID reusable KYC from the Basic tier up. The vendor-stated speed figures are 20 seconds average with a document and 4.5 seconds without. Pilot against your own document mix.