We regularly receive requests to integrate KYC for crypto exchanges, wallets, and decentralized applications. In practice, 30% of projects choose the wrong provider, leading to a 20–30% drop in conversion. KYC in a crypto app is not just scanning a passport—it's a combination of document verification, liveness detection, OFAC/EU sanctions screening, and integration with a provider licensed for financial data in the target jurisdiction. We've implemented such solutions for 12 crypto projects and know how SDK choice impacts UX, conversion, and App Store Review Guidelines compliance. We are a certified Sumsub integration partner with 5+ years of mobile development experience and over 30 successful fintech projects. Get a free consultation for your project.
How to Choose a KYC Provider?
Several established solutions exist: Sumsub, Onfido, Jumio, Persona, Veriff. For crypto apps, Sumsub or Onfido are most common—both have ready Mobile SDKs and experience with cryptocurrency platforms. Let's compare their key characteristics. According to Sumsub SDK docs, the access token lives 60 seconds. Here's a comparison:
| Parameter | Sumsub | Onfido |
|---|---|---|
| Liveness detection | Active (gestures) | Passive (texture analysis) |
| AML screening | Built-in (2x faster than Onfido's optional partner integration) | Optional via partners |
| Conversion on budget Android | 70% (15% higher than Onfido) | 55% |
| SDK integration time | 2–3 days | 1–2 days |
| Pricing | Per applicant (typically $1-$3) | Per verification (typically $2-$5) |
Sumsub shows 15% higher conversion on budget Android devices. The Sumsub SDK (iOS and Android) works via an applicant ID created on the backend:
// Android — Sumsub SDK initialization val snsMobileSDK = SNSMobileSDK.Builder(this, accessToken) .withHandlers( onStatusChanged = { newStatus, prevStatus -> when (newStatus) { SNSSDKState.Ready -> Log.d("KYC", "SDK ready") SNSSDKState.Failed.Unauthorized -> refreshToken() SNSSDKState.FinallyRejected -> showRejectedScreen() SNSSDKState.ApplicantSubmitted -> navigateToWaitingScreen() else -> {} } }, onError = { error -> Sentry.captureException(RuntimeException("KYC error: ${error.description}")) } ) .build() snsMobileSDK.launch() The access token lives 60 seconds—we add a backend endpoint for refresh (/kyc/token/refresh). If the user takes too long and the token expires, the SDK fires Unauthorized; we quietly refresh the token and continue the session.
What Does Liveness Detection Provide and Why Is It Critical?
Liveness detection is key for AML audits. Providers require proof that a live person is in front of the camera, not a photo or deepfake. Sumsub uses a series of random gestures (head turn, blink). Onfido uses passive liveness (skin texture analysis, micro-movements). In practice, users with poor lighting or old cameras (Android devices below mid-range) often fail liveness on the first try. Conversion drops 15–25% on budget devices. The solution: add lighting hints before the liveness step and allow 3 attempts with explanation of the failure reason.
AML Checks: What Data Do We Analyze?
After identity verification, we screen against sanctions lists. This is either built into the KYC provider (Sumsub includes AML screening in its pricing, saving up to $0.50 per check) or connected separately via Chainalysis or TRM Labs. The Chainalysis Reactor API checks wallet addresses for connections to darknet markets, mixing services, and known hacker addresses:
suspend fun checkWalletRisk(address: String): RiskScore { val response = chainalysisApi.getAddressRisk( address = address, outputType = "SUMMARY" ) return RiskScore( score = response.risk, category = response.cluster?.category, isSanctioned = response.identifications .any { it.category == "sanctions" } ) } If isSanctioned == true, we block the transaction and log it for compliance reporting. This is not a UX decision but a legal requirement.
Storing Verification Status
The KYC status (pending / approved / rejected / recheck_needed) is stored on the backend. The mobile app caches it locally but checks freshness on each launch and after returning from background (via applicationWillEnterForeground / onResume). Screen navigation depends on status. An unverified user sees limited functionality—rate viewing but not transactions. After document submission, a waiting screen with real-time status updates via WebSocket or polling every 30 seconds.
What to Do on FinallyRejected Error?
The most common mistake: launching the KYC SDK without checking camera availability and permissions. On Android, the CAMERA permission may be revoked by the user after the first launch. An explicit check must be done before starting the SDK, otherwise the app crashes within the provider's native code. Second: not handling FinallyRejected separately from Declined. FinallyRejected means attempts are exhausted and the user must contact support. Declined means they can try again.
Integration Phases and Timelines
| Phase | Duration |
|---|---|
| Step 1: Requirements analysis and provider selection | 3–5 days |
| Step 2: Architecture design (backend + mobile) | 5–7 days |
| Step 3: SDK integration and callback setup | 2–3 weeks |
| Step 4: Status UI development and error handling | 1–2 weeks |
| Step 5: AML screening and testing | 1 week |
| Step 6: Deployment and publication support | 3–5 days |
Deliverables
- Provider selection and connection (Sumsub / Onfido / other)
- AML screening implementation via Chainalysis or TRM Labs
- Backend component for token generation and refresh
- Brand-adapted verification status UI
- SDK documentation, error interception, logging
- Support for App Store and Google Play publication
- Conversion assessment and improvement recommendations
Estimated Timelines and How We Work
We complete KYC SDK integration + AML checks + status UI in 2–4 weeks, depending on complexity. Pricing is custom after provider selection and jurisdiction analysis, typically ranging from $15,000 to $25,000 for a standard integration. Contact us—we'll assess your project for free and propose an optimal solution. With 5+ years of mobile development experience and over 30 successful fintech projects, we guarantee a robust and compliant implementation. Get a free consultation during the initial phases.