How do you choose KYC software?
Write the requirements sheet before you take a demo, then score vendors on what actually differentiates them rather than on feature lists. Decode the pricing model — per-verification against monthly minimums — and run a pilot on your own traffic before you sign. The pilot is what surfaces the truth a demo is built to hide.
This guide is for the founder, compliance owner, or product lead picking KYC software. By the end you'll have a requirements sheet, a weighted scorecard, and a pilot plan that surfaces the truth demos are built to hide.
Write the requirements sheet first
Vendor websites all say the same things, so start from your own constraints. One page, four sections:
| Section | Questions to answer |
|---|---|
| Regulatory | Which regulators and rules apply? What does your CIP/CDD program require you to collect and verify? Do you need ongoing monitoring or point-in-time checks? |
| Geography | Which countries and document types, today and in 18 months? "Global coverage" claims hide wild quality variance between a US driver's license and an uncommon national ID |
| Volume & shape | Checks per month now and at plan. Steady flow or spiky launches? Spikes change which pricing model hurts |
| Data | Where must data live? Who is allowed to process it? If your customers are privacy-sensitive, whether the vendor sends PII to third-party model providers is a buying criterion, not a footnote |
Every criterion on the scorecard traces back to this sheet. Anything that doesn't trace back is a feature you're being sold, not one you need.
Score what actually differentiates
Six criteria separate KYC vendors in practice. Weight them for your situation and score each vendor 1 to 5:
- Verification accuracy, both directions. Ask for false-acceptance and false-rejection rates on YOUR document mix, not the global brochure number. A vendor that catches every fraudster but bounces 8% of real customers is quietly taxing your growth. The false-rejection rate is where the demo goes quiet.
- Coverage depth where you operate. For your top five countries: which checks run, against which sources, at what pass rate. Get it in writing.
- Integration effort. SDK quality, webhook design, sandbox realism, docs you can judge yourself in an afternoon. If the sandbox needs a sales call, expect the API to need one too.
- Manual-review tooling. Some volume always lands with humans. Look at the review console your team will live in: case detail, audit trail, second-opinion workflow. A weak console silently doubles review cost.
- Auditability. When a regulator asks "how was this customer verified", the answer should be an export, not a support escalation.
- Data handling. Where images are stored, retention controls, encryption, subprocessor list, and whether AI models run in-house or on someone else's cloud. Read the subprocessor list before the sales deck; it's more honest.
Decode the pricing model
KYC pricing has three standard shapes, and each punishes a different mistake:
- Per-check is clean at low volume, but failed and retried attempts often bill too. Ask exactly which events cost money: a user who retries a blurry capture three times can be three charges.
- Platform fee plus usage favors steady volume, punishes early stage. Watch the monthly minimums; they're where the "from $X" pricing goes to die.
- Contract with commitments brings the unit price down and locks you in before you've measured real pass rates. Never commit volume before piloting.
Model your real funnel against each shape, including retries and manual reviews. Then ask each vendor the question their pricing page avoids: "what does a user who fails and never converts cost me?"
Pilot before you sign
A demo shows the happy path with pristine documents. Run a two-week pilot instead, with rules set in advance:
- 100+ real verification cases across your actual document mix, including your problem countries
- Seed known-bad cases: an expired document, a photo of a screen, a name that hits a watchlist. You're buying a fraud filter; test it with fraud
- Measure first-attempt pass rate, false rejections (follow up with bounced real users), median and p95 verification time, and how many cases land in manual review
- Have your own engineer do the integration, and log the hours. Integration effort is a real price component
- Test support: file one technical ticket mid-pilot and time the answer
Two vendors piloted side by side on the same cases beats any comparison matrix on the internet, including ours.
Red flags that end evaluations
- No sandbox without a signed contract
- Accuracy claims with no methodology behind them
- "Unlimited free manual review" (someone is paying for those humans; find out how)
- A subprocessor list they won't share, or one that quietly routes your customers' documents through third-party AI APIs
- Pressure to commit annual volume before a pilot
Any one of these is survivable. Two is a pattern. Move on.
Once you've chosen, the integration playbook is here: how to integrate a KYC API. For the fraud your new software will face on day one, see how to spot a fake ID, and for the regulatory foundations, what KYC actually requires. If in-house AI and zero third-party PII exposure are on your requirements sheet, that's the corner Verifa built its KYC/AML platform in. Fintech teams should also read KYC for fintech, which maps the checklist onto US, EU and UK frameworks.