A KYC verification service checks that your customers are who they say they are, usually through an API, a hosted flow or a team of people working on your behalf. It can take a lot of work off your hands. It does not take your legal responsibility, and sales pages rarely lead with that.
Itexus is a trusted partner
Itexus delivered the app according to the requirements. The team met all development milestones and deliverables. They were efficient, friendly, and cooperative. Itexus team was very timely with updates, a regular meeting cadence, and ad-hoc questions and answers via Slack. The team was very responsive and still is.
Stive Jackson
RMD, Investing Fund
Itexus’ work positions the business well for an imminent launch. They excel at managing their team, presenting frequent product demos to ensure that the project is aligned with development goals. An affordable price structure coupled with remarkable technical skill makes them an attractive partner.
Phill Osolinski
CEO Ryze Rewards
The assigned team was easy to work with and they are especially strong collaborators and communicators. They demonstrated flexibility, professionalism, and trust in everything they did, and completed the work on time and budget.
Sue Wollan Fan
CEO Mango Connects
Itexus excelled at both experimental AI and sprint-oriented UI/UX tasks. Itexus did strong project management work, too, a necessity in such a complicated project.
Jesse Dubin
Senior PM Standard&Poors
They’re a great group of developers who really understand the reality of business.
Andreea Vanacker
CEO SPARKX5
This guide explains what these services do, what the rules in the EU, UK and US say about outsourcing, and what to check before you sign. If you already know you want a shortlist, see our comparison of KYC service providers.
What a KYC verification service does
Services cover different parts of the KYC verification process.
| Type of service | What it does | What you still do |
| Identity verification | Checks documents and faces or data sources, returns a result | Set policy, decide on the customer |
| Screening data or tools | Checks names against sanctions, politically exposed person and adverse media data | Review matches, decide |
| Business verification | Confirms a company exists and helps find its owners | Assess ownership and risk |
| Managed KYC | Staff carry out checks and assemble files | Approve policy, decide, report |
| Workflow or CLM software | Runs your process and connects providers | Set the rules, make the decisions, and do what the software doesn't |
What you can and cannot outsource
European Union
The clearest rule is in the EU's Anti-Money Laundering Regulation, Article 18, which applies from 10 July 2027. Firms may outsource tasks to service providers, but must notify the supervisor before the provider starts, and "shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks".
Article 18(3) lists what cannot be outsourced:
- the proposal and approval of the business-wide risk assessment
- the approval of internal policies, procedures and controls
- the decision on the risk profile attributed to a customer
- the decision to enter into a business relationship or carry out an occasional transaction
- reporting suspicious activity and threshold-based reports to the Financial Intelligence Unit, with a narrow exception for a group company in the same Member State
- the approval of the criteria for detecting suspicious or unusual transactions
So a vendor can collect and check, and even recommend, but the firm must own the decision. Article 18 also requires a written agreement, regular controls, a provider that applies the firm's policies, and an ability to show the supervisor you understand what the provider does. It also bars outsourcing to providers in third countries the Commission has listed under Articles 29 to 31, unless the provider is in the same group and the group conditions are met. Article 18(7) makes one exception to the list above: certain collective investment undertakings may, with their supervisor's approval, outsource the risk profile, onboarding decision and reporting tasks to a service provider.
Not every vendor is outsourcing. Recital 47 says that using third-party software, databases or screening services yourself is not, where the provider does not itself perform the requirement. Where an API check falls needs a judgment, so record yours and confirm it with counsel. Article 76 adds separate conditions for automation: the system may process only data obtained under the customer due diligence chapter, decisions to enter, refuse or keep a relationship or to change the level of due diligence need meaningful human intervention, and the customer can ask for an explanation and challenge the decision, except in relation to a suspicious activity report.
Until July 2027, national laws implementing Directive (EU) 2015/849 apply.
United Kingdom
Regulation 39 of the Money Laundering Regulations 2017 allows customer due diligence by an agent or outsourcing service provider, provided that the arrangements leave the firm liable for any failure to apply the measures. Relying on another regulated firm has the same result: "the relevant person remains liable for any failure to apply such measures."
United States
The bank CIP rule, 31 CFR 1020.220, has a specific reliance provision, but it is narrow. It covers a customer who also has an account or similar formal relationship with another financial institution, where reliance is reasonable, the institution is subject to an AML program rule and regulated by a Federal functional regulator, and it contracts to certify annually that it has an AML program and will perform the specified requirements. The beneficial ownership rule, 31 CFR 1010.230(j), has a matching provision. This is where the US differs: the agencies said when adopting the CIP rule (68 FR 25090) that a bank "will not be held responsible" for the other institution's failure if its reliance was reasonable and it holds the required contracts and certifications.
On our reading, an ordinary identity verification vendor is not such an institution, so using one should be treated as a tool or service within your own program and not as a way to transfer responsibility. Confirm how this applies to you with counsel.
Reliance and outsourcing are different
These two terms are easy to mix up, and the difference affects what you need in place.
| Reliance | Outsourcing | |
| Who does the work | Another regulated firm, under its own obligations | A service provider, working to your policies |
| Typical example | A partner bank has already checked the customer | A provider carries out a required check for you, such as a managed review team |
| EU rule (from July 2027) | Articles 48-49, for identification, beneficial owners and purpose of the relationship only | Article 18 |
| UK rule | Regulation 39(1)-(6) | Regulation 39(7)-(8) |
| Who stays responsible (EU and UK) | You | You |
Under the AMLR, "the ultimate responsibility for meeting the customer due diligence requirements shall remain with the obliged entity which relies on another obliged entity". The firm relied on must provide the information without delay and in any case within 5 working days. In the UK, it must be obtained immediately, with arrangements to get copies immediately on request.
What to check before you sign
Evidence you can get back. UK reliance arrangements require information immediately. That rule does not extend to outsourcing, but regulation 40 still requires you to keep copies of what was obtained. Whichever route you use, you will have to answer for each decision. Check what the provider returns: the result, the reasons, the images, and how long they keep them.
Coverage on your customers. Published coverage numbers tell you what is supported and not how well it works. Ask for a pilot on your own countries and document types, and measure completion, false rejections and manual reviews.
Who does what when automation can't decide. Is it a provider's analyst or your team? How fast? Is the analyst's decision a recommendation or final? That has to fit with who may make the decision under your rules.
Sub-processors and locations. Article 18 also covers sub-outsourcing, and identity data is sensitive. Ask where data is processed and stored and by whom, and how data subject requests work.
Full cost. Entry prices often leave out screening and monitoring. Our provider comparison shows some published rates and why they are not like for like.
A way out. Confirm you can export records in a usable format. Keep provider logic behind your own integration layer so you can switch or add a second vendor.
Buy, build or integrate?
For most teams, buying the verification itself is the sensible default, since document fraud detection and global coverage are expensive to reproduce. The work that remains is the part specific to you: connecting providers to your onboarding and core systems, recording decisions and building tools for reviewers. Our guide on KYC integration into financial software covers the technical choices, and building your own KYC from scratch covers when custom makes sense.
Itexus does not sell a verification service. We integrate them. In published projects, that has included Sumsub on a MENA wealth platform, Alloy and Vouched on a banking app for migrants, and Socure on a white-label banking app. See our API integration services if you are planning similar work.
This article is general information and not legal advice. Your obligations depend on your license and jurisdictions, so confirm them with qualified counsel. Regulatory status was checked on 6 November 2026.
Frequently Asked Questions
What is a KYC verification service?
A service that checks customer identity for a business, usually by verifying documents, faces or data sources, or by screening names against watchlists. It can be software, a data feed, or staff working on your behalf.
If I use a KYC vendor, am I still responsible?
Yes. The EU's AMLR says firms remain fully liable for outsourced tasks from July 2027, and UK regulation 39 keeps the firm liable. In the US, the narrow reliance provision applies to regulated institutions, which an ordinary vendor generally is not, on our reading.
Can a vendor make the onboarding decision for me?
Under AMLR Article 18, from July 2027, the decision to enter into a relationship and the customer's risk profile cannot be outsourced. Automated decisions on the relationship also need meaningful human intervention under Article 76. Under those EU rules, a vendor can automate checks and make a recommendation, but your organization has to own the decision and its rules. UK regulation 39 has no such list, but the firm stays liable for any failure to apply the measures.
What is the difference between reliance and outsourcing in KYC?
Reliance means using checks already done by another regulated firm under its own obligations. Outsourcing means a provider does tasks for you, under your policies. Under the EU and UK rules, you remain responsible in both cases. The US bank CIP reliance provision works differently: a bank that meets its conditions is not held responsible for the other institution's failure, provided its reliance was reasonable and it holds the required contracts and certifications. Check how this applies to you with counsel.
How much does a KYC verification service cost?
Published entry rates run from about $0.80 to $1.50 per verification or evaluation at the vendors we compared, often with a monthly minimum and with screening or monitoring sometimes extra. They are not like for like, plans for regulated firms cost more, and enterprise pricing is usually negotiated.
