How to choose KYC software in the UK: seven criteria, what eight providers publish, the rules that apply and a checklist for marketplaces.
Choose KYC software by matching it to your risk, not to a leaderboard. The right UK KYC software should: verify identity documents with a liveness check; cover business checks (KYB) if you onboard companies; screen against UK sanctions and PEP lists and keep re-screening; keep an audit trail you can show a regulator or auditor; store data in line with UK GDPR; publish pricing you can model; and integrate with your platform in days, not quarters. If you run a marketplace, add one more test: can it check sellers, both individuals and limited companies, in one flow?
The rest of this guide explains each criterion, the UK rules behind them, the questions to ask any vendor (including us), and a short checklist you can take into a demo.
TrustVerify publishes this guide and is one of the providers listed; weigh our entry with that in mind. Each line describes what the provider's own public pages say (accessed 30 Oct 2026). No ratings, and no prices: pricing models change, so ask each vendor, and see our plans for ours.
| Provider | What its public pages describe | Read more |
|---|---|---|
| Entrust (Onfido) | Document and facial similarity reports, a watchlist report and a no-code Workflow Studio (Entrust docs) | Onfido alternative for marketplaces |
| Veriff | ID verification across 230+ countries and territories, optional AML screening and a KYB product (Veriff) | Veriff alternatives UK |
| Sumsub | A compliance suite covering KYC, KYB using registries including Companies House, AML and fraud prevention (Sumsub) | Sumsub alternatives UK |
| Jumio | Identity verification; see Jumio for its current products | — |
| Trulioo | Identity and business verification; see Trulioo for its current products | — |
| ComplyCube | Identity verification and AML screening; see ComplyCube for its current products | — |
| Ondato | Identity verification and AML screening; see Ondato for its current products | — |
| TrustVerify | UK marketplaces checking individuals and businesses: ID document checks, Companies House, PSC/UBO and LEI (UK only), sanctions and PEP screening with re-screening | TrustVerify KYC |
KYC (know your customer) software checks that a person is who they say they are, and records the evidence. A typical flow captures an identity document, takes a selfie with a liveness check, matches the face to the document photo, checks the address, and screens the person against sanctions, PEP (politically exposed person) and adverse media sources. The result, plus the evidence behind it, is stored so you can show why you approved or declined someone.
Most UK businesses now need more than identity checks alone. If you onboard companies, you also need KYB (know your business): Companies House checks, directors, and persons with significant control (PSCs). If you run a marketplace, you need both for your sellers — see our explainer KYC vs KYB vs KYS: which checks should a marketplace run on sellers?
| Criterion | What good looks like | Question to ask |
|---|---|---|
| 1. Coverage | Identity, business (KYB) and AML screening in one platform | Is KYB and AML screening included, or sold separately? |
| 2. Liveness and spoofing resistance | Liveness check on the selfie, face match to the document, document validity checks | How is liveness tested, and what happens when it fails? |
| 3. UK compliance fit | Supports your obligations under UK rules, with an audit trail | Can you show a sample audit record for one check? |
| 4. Ongoing monitoring | Re-screening of existing customers for sanctions, PEP and adverse media | How are alerts raised and reviewed after onboarding? |
| 5. Data protection and hosting | UK data hosting, clear retention and deletion rules | Where is identity and biometric data stored, and for how long? |
| 6. Pricing transparency | Published plans, clear caps and overage terms | What exactly does extra volume cost? |
| 7. Integration and workflow | API, webhooks, rules and a review queue | How long does a typical integration take? |
Many teams start with KYC, then discover they need KYB for business customers, AML screening for sanctions and PEPs, and re-screening of customers they have already approved. Buying these from separate vendors splits your audit trail and your bill. One platform that covers identity, business and AML checks keeps the evidence and the decision in one record.
A document check alone does not prove the person holding it is present. Look for a liveness check during the selfie step, a match between the selfie and the document photo, and checks on the document itself rather than just reading its printed text. Ask what happens when a check fails: a good system routes uncertain cases to a person, not to an automatic approval.
Your obligations depend on what your business does (see the UK rules section below). Whatever applies, the software should record what was checked, when, against which source, and who made the final decision. That record is what an auditor, a bank partner or a regulator will ask for.
Onboarding is a single moment; risk changes afterwards. Sanctions lists are updated frequently, people become PEPs, and companies change directors. Ongoing AML monitoring re-screens approved customers and raises an alert for review when something changes.
Identity documents and selfies are personal data, and biometric data used to identify someone is special category data under UK GDPR. Confirm where data is hosted, how long images are retained, how deletion works, and whether the vendor will sign a data processing agreement.
Sales-gated, quote-only pricing makes it hard for smaller teams to forecast. Look for published plans, explicit monthly caps and clear terms for extra volume, so finance can see the cost before you scale.
A clean API with webhooks and a test environment decides whether you go live in days or months. Also check the operations side: which checks run for which seller type, and a review queue for cases that need a human decision. A WooCommerce plugin you can install, and a Shopify app, matter if that is where your sellers already are. See integrations.
Take a marketplace in Birmingham that sells refurbished phones and laptops. Half the sellers are private individuals clearing a drawer. Half are limited companies importing handsets. Chargebacks hurt, but the worse loss is a buyer who receives a brick and a seller who has already been paid. The team shortlists vendors and scores them against the seven criteria above, using their own sellers rather than a demo persona.
Coverage. They refuse a tool that can only check a passport. Every company seller needs a Companies House lookup, officers, and people with significant control, then a sanctions and PEP screen on the company and on the person opening the account. If those results live in three products, the decision record is three exports. One record is the point of criterion 1. Our explainer KYC vs KYB vs KYS is the map of which seller gets which check.
The selfie step. They ask each vendor what happens when the selfie step fails or is skipped. The acceptable answer is a hold for a person, not an automatic approval. They also ask to see the face-match result as its own figure, next to whatever summary number the vendor shows. A summary that hides a failed match is not an audit trail.
UK fit. They ask for one sample record: document fields, what was screened, when, and who approved. They compare that record with what their payment partner asked for last quarter. If the vendor cannot produce the sample, they stop.
Monitoring. A seller who passed in January can be designated in June. They ask how a re-screen is raised and where a person reviews it. A monitoring toggle that never creates an alert is not monitoring. Ongoing monitoring is the version of that question aimed at TrustVerify.
Data protection. They ask where images are stored, how long they are kept, how deletion works, and whether a data processing agreement is on offer. They do not treat a logo on a security page as an answer. Identity documents and selfies are personal data, and biometric data used for identification is special category data. The ICO's guidance is the briefing they give their own counsel.
Price and integration. They ask for the included volume and what the next seller costs after the cap, and they write those numbers down. This guide does not repeat price lists. Ours is on plans. They then time a sandbox check from their own staging site and reject a webhook whose signature they cannot verify. The last step is the same 20 to 50 real applications, names removed from the write-up, through the final two vendors: how many were approved, how many were held, and how long a reviewer needed.
Write the expected record before you sit in a demo. For the Birmingham marketplace, a company seller's record has:
| Field | Why it is there |
|---|---|
| Person: document type, number, expiry, and whether the selfie matched the document photo | So you can show the individual was checked |
| Company: name, number, status, officers, people with significant control | So a real company number is not mistaken for an authorised applicant |
| Screen: sanctions and PEP outcome, and whether adverse media was part of that screen | A screen that did not run must say so |
| Decision: approved, held or refused, by whom, and why | The payment partner asks for this, not for a logo |
| Later: whether the subject is enrolled for re-screening | January's approval expires as news |
If a product cannot show that row, it is not yet a system of record, however polished the capture screen is. Review queues are where a held company check is worked. What a trust score is explains the 0–100 number you may see beside the row, and why it must not be the only gate. Open-source signals explains why a missing measurement is left blank rather than filled in as a pass.
This section is a summary, not legal advice. Check with your adviser which rules apply to your business.
Your customers will mostly show a UK passport or a UK photocard driving licence. Some hold a biometric residence permit (BRP), though many BRPs are now replaced by eVisas. Check the vendor reads each one, plus non-UK passports and ID cards if you need them. TrustVerify's KYC software for UK businesses covers all three; see accepted documents.
TrustVerify is built for UK marketplaces that need to verify sellers, both individuals and businesses. We cover liveness checks, and the selfie is matched to the photo on the ID document. One platform covers:
To compare plans, see our plans. Related reading: KYC vs KYB vs KYS, what a trust score is, identity verification, the TrustVerify platform and our glossary.
We are a newer entrant, so we'd rather you judge us on the criteria above than on a list. Book a 30-minute demo below and run your own sellers through it.
KYC, KYB, AML screening and fraud prevention in one place, with published pricing.
KYC
Documents a Marketplace Can Accept for KYC, and How to Handle the Rest
Which ID documents marketplaces commonly accept for seller KYC, what to do with documents outside that list, and how to get clear images first time.
KYC
Passport MRZ and Selfie Checks Explained for Marketplace Teams
What a passport MRZ is, how its check digits work, what a selfie-to-document match confirms, and what neither check proves on its own.
KYC
Proof of Address Checks: What They Prove and What They Don't
What a proof of address document actually shows, its limits for marketplace seller checks, and how to use it alongside stronger signals.
