State of Identity Verification

in the Crypto Industry

A data-driven report on verification practices among
crypto businesses: checks, budgets, pass rates
State of Identity Verification in the Crypto Industry 02/51

Table of contents

About this report 03 Fraud statistics 25

Methodology 04 Verification сhallenges 28

Key findings 09 Verification best practices 35

Verification processes insights 13 Future verification trends 42

Verification performance statistics 19

State of Identity Verification in the Crypto Industry 03/51

About this report

This report aims to unveil the state of identity
verification in the crypto industry with insights into key
practices and statistics. The findings should give crypto
Sumsub combined insights
businesses a clear understanding of industry from 200 industry experts
verification standards and, with that, opportunities

to level up user experience.

with analysis of its own

identity verification checks
The research was conducted by Sumsub, a tech
company that helps businesses verify clients with
holistic KYC/KYB/AML and anti-fraud solutions,

in partnership with Mercuryo, a global payment

infrastructure company, and Notabene, a regulatory
technology SaaS for managing counterparty risk

Please don't share the content of this report without giving us credit.

in cryptocurrency transactions. © Sum and Substance Ltd (UK), 2022

State of Identity Verification in the Crypto Industry 04/51

Methodology
This study aims to understand current verification The report can be divided into three pillars:
practices among crypto businesses* by focusing

on the following statistics: 01 Survey of 200 crypto

businesses
± time spent on verificatio©
±
±
pass rate¬
fraud rate¬
02 Sumsub’s verification
± verification budget¬ analytics
± user behavior
03 Surveys of experts

*In this report, the terms “crypto businesses” and “Virtual Asset

from Sumsub, Mercuryo,

Service Providers (VASPs)” will be used interchangeably and Notabene

State of Identity Verification in the Crypto Industry 05/51

Methodology
01. Survey
Surveyed businesses by type
Sumsub surveyed 200 crypto businesses on identity
verification, pass rates, budgets, and more 37.1 % Crypto exchange

15.7 % Blockchain platform

The majority of the surveyed crypto businesses were 11.4 % DeFi platform
blockchain, DeFi, and crypto exchange platforms.
Among the respondents were key decision makers, 11.4 % Payment

such as CEOs, compliance officers, and product 7.1 % Storage

managers.
5.7 % Trading

5.7 % Web 3.0

4.3 % Mining

1.4 % NFT
State of Identity Verification in the Crypto Industry 06/51

Methodology

01. Survey The number of checks performed by the surveyed

businesses varies, with the majority conducting up to

10,000 checks a month. 16.3% perform from 10,000 to

Number of checks performed monthly
100,000 checks, while 8.2% perform more than 100,000.

100–1,000 34.7%

1,000–10,000 24.5%

0–100 16.3%
8.2% of the surveyed

crypto businesses check

10,000–100,000 16.3%

more than 100,000 users

>100,000 8.2%
a month
State of Identity Verification in the Crypto Industry 07/51

Methodology

02. Sumsub’s analytics The data consists of:

Sumsub analyzed anonymized verification statistics

Hundreds of thousands

of its crypto clients from the first quarter of 2022

of identity checks performed

and compared it with data from the same period

in 2021. each day

Tens of thousands of fraud

attempts detected each month

6,500+ document types from

220+ countries and territories

State of Identity Verification in the Crypto Industry 08/51

Methodology
03. Expert content
We collected insights on verification practices,
challenges, and future trends from legal experts
certified by ICA, CySEC, and ACAMS, as well as from
crypto and fraud professionals from Sumsub, Mercuryo,
and Notabene.

All graphs and infographics are based

on our internal statistics and the
completed surveys. The data has been
aggregated and anonymized.
State of Identity Verification in the Crypto Industry 09/51

Key findings
01. Insights into verification checks

84.3% of the crypto businesses that took part

in Sumsub’s survey verify their users

79.7% use automated KYC solutions to comply with

AML obligations and onboard users quickly

76.9% of businesses that manually verify their

users plan to switch to automated
verification
State of Identity Verification in the Crypto Industry 10/51

Key findings
01. Insights into verification checks
Identity verification requirements
93.6% perform all of the checks necessary for AML within businesses
compliance, including ID verification, AML ID verification 93.6%
screening, and address verification
AML screening 72.3%

Selfie 70.2%

Liveness 68.1%

Address verification 59.6%

Source of funds verification 36.2%

50 Twitter
State of Identity Verification in the Crypto Industry 11/51

Key findings
02. Average verification time and pass rates

1–3 mins is the average user verification time for

38.8% of businesses employing automated Whats’s your average verification
verification time?
1–3 mins 38.8%
Crypto businesses were also asked about what they
perceive to be a “good” verification time 3–5 mins 22.4%

<1 min 20.4%

67.3% of the crypto businesses surveyed want

>10 mins 12.2%
their onboarding process to take less than
three minutes 5–10 mins 6.1%

50 Twitter
40.8% expect over 90% of users to successfully
pass verification
State of Identity Verification in the Crypto Industry 12/51

Key findings
03. User profiles 04. Future plans of crypto businesses

80% of crypto platform users

79.5% of respondents plan to enter
are male
new markets or acquire new licenses

The average user age is 30 55.1% plan to increase their verification budget—
which could be connected to plans to scale up
and enter new markets, level up fraud defenses,
English, Portuguese, Spanish improve onboarding processes, etc.
are the three most popular
languages
Verification

processes insights
Key figures, verification budgets, user profiles
Verification processes insights 14/51

Identity verification in crypto businesses: key figures

79.7% use an automated KYC solution for
verification Number of verification solutions used
48.9% of businesses using automated verification
employ only one solution for all their needs.
40.4% of such businesses use 2–3
verification solutions for business continuity
reasons

40.4% of surveyed companies use 2–3 verification 4.3% >5

solutions 6.4% 4–5
40.4% 2–3
48.9% 1

50 Twitter
Verification processes insights 15/51

Goals of identity verification

Сrypto businesses that fall under AML regulations are

required to implement identity verification by law. The main goal of using an identity

verification solution

But regulatory compliance isn’t the only

Stay compliant with the regulations 55.3%

benefit of identity verification. Businesses

also view building trust with users/ Build trust in your business 19.1%

partners and fraud prevention as their

main goals in using identity verification Reduce the number of fraud attemps 17%

solutions.
Work with trusted partners,

vendors, payment providers

8.5%

More information about balancing AML compliance and pass rates

can be found in our crypto guide

50 Twitter
Verification processes insights 16/51

Verification budgets
Monthly budget for verification
solutions
1,000–10,000 55.1%

10,000–100,000 20.4%

<1,000 18.4%

>100,000 6.1%
More than half of businesses spend $1,000–$10,000

on verification solutions monthly.

50 Twitter

20.4% of businesses spend from $10,000 to $100,000,

and 6% spend over $100,000.
Verification processes insights 17/51

User profiles

80% 30 years old English, Portuguese,

of crypto platform users are is the average user age. 
 Spanish, Vietnamese,

male, although the gender In 2021, the average user Russian

ratio varies by country. 
 age was 33 years old, so we
For instance, in Fiji and 
 are the five most popular
can see that this audience 

the Philippines, this ratio 
 languages among users, 

is getting younger. These
is practically equal. so businesses might
statistics could be taken into
consider localizing their
consideration when building
interfaces into these
the onboarding process, as
languages.
younger users expect faster
verification and user-friendly
interfaces.
State of Identity Verification in the Crypto Industry 18/51

User profiles

Hour/Day Monday Tuesday Wednesday Thursday Friday Saturday Sunday

0
11 am – 6 pm, weekdays 7
8

is when the majority of users undergo 9

10
verification 11
12
13
14
15
16
17
18
19
20
21
Lowest Highest 22
23
Verification

performance statistics
Verification time and pass rates
Verification performance statistics 20/51

Average verification time: automated vs manual

Automated verification Manual verification

Average verification time Average verification time

1–3 mins 38.8% >10 mins 46.2%

3–5 mins 22.4% <1 min 23.1%

<1 min 20.4% 5–10 mins 15.4%

>10 mins 12.2% 3–5 mins 7.7%

5–10 mins 6.1% 1–3 mins 7.7%

50 Twitter 50 Twitter
Verification performance statistics 21/51

Average verification time: automated vs manual

1–3 minutes
Verification time expectations

is the average user verification time for 38.8% of among crypto businesses
surveyed businesses employing automated verification.
For 22.4% of such businesses, the average time is 3–5 1–3 mins 36.7%
minutes.
<1 min 30.6%

10+ minutes
3–5 mins 20.4%
is the average user verification time for 46.2%

of businesses that manually check their users. 5–10 mins 6.1%

>10 mins 6.1%

36.7% of businesses consider up to three minutes
a good onboarding time, while 30.6% want their 50 Twitter
onboarding process to take less than one minute.
Verification performance statistics 22/51

Average verification time: Sumsub

The standard verification process

includes ID document checks, Liveness
& Face Match (facial biometrics), AML
screening, and proof of address checks.

For users in Europe and the CIS, these

processes take less than a minute.

Verification takes less

than a minute for users


in Europe and the CIS

Q1, 2022 50 Twitter

Verification performance statistics 23/51

Average pass rates: automated vs manual

Automated verification Manual verification

Average pass rates Average pass rates

70–90% 42.9% 50–70% 61.5%

50–70% 24.5% 70–90% 23.1%

>90% 16.3% >90% 15.4%

30–50% 8.2% 30–50% 0%

0–30% 8.2% 0–30% 0%

50 Twitter 50 Twitter
Verification performance statistics 24/51

Average pass rates: automated vs manual

70–90%
is the average pass rate for 42.9% of crypto businesses
employing automated verification. Businesses that
manually check their users (61.5%) see 50–70% pass
rates.

Crypto businesses
have high expectations for pass rates. 47.3% of them
consider 70–90% to be a good pass rate, while 40.5%
expect no less than 90% of their users to successfully
pass verification. It can be difficult to achieve such high
pass rates in emerging markets, so it’s important to
choose a verification solution that can maintain high

pass rates in emerging markets.
Fraud statistics
Fraud detection levels and country-specific statistics
Fraud statistics 26/51

Fraud detection: automated vs manual

Automated verification Manual verification

Evaluation of fraud detection level Evaluation of fraud detection level

Medium 49% Medium 53.8%

Strong 46.9% Strong 30.8%

Weak 4.1% Weak 15.4%

50 Twitter Twitter

Crypto businesses employing automated verification 15.4% of businesses using manual verification feel that
reported a 16.1% higher fraud detection level than those they have weak fraud detection capabilities, compared
performing manual checks. to just 4.1% of businesses performing automated
checks.
Fraud statistics 27/51

Fraud by country
According to Sumsub’s data, the most
forged documents in Q1 2021 were
Kenyan, Iraqi, and Cameroonian IDs.

However, in Q1 2022, fraudsters shifted

their focus to IDs from Asia (Vietnam,
Bangladesh, and Pakistan). The US
and Canada were also in the top ten
countries in terms of forgery attempts.

17.09% of all forged documents are

Vietnamese ID cards and driver’s licenses

50 Twitter
Verification challenges
Onboarding users in emerging markets, detecting fraud,

complying with shifting regulations, and more

Verification challenges 29/51

Main challenges: automated vs manual

Automated verification Manual verification
Main verification challenges Main verification challenges
False rejections/false approvals 36.7% Long verification time 53.8%

Low converison rate 36.7% Challenges with expanding to new regions 46.2%

Working in emerging markets 32.7% False rejections/false approvals 38.5%

Long verification time 30.6% Fraudsters bypass the verification process 23.1%

Challenges with expanding to new regions 28.6% Strict regulatory requirements 23.1%

Fraudsters bypass the verification process 26.5% Working in emerging markets 15.4%

Strict regulatory requirements 24.5% Low converison rate 7.7%

50 Twitter 50 Twitter
Verification challenges 30/51

Main challenges: automated vs manual

36.7% of businesses using automated verification
identify false rejections/approvals and low
conversion rates as their main challenges.
32.7% find working in emerging markets
challenging.

53.8% of businesses using manually checks

experience long verification times. Difficulty
entering new markets (46.2%) and false
rejection or approvals (38.5%) are also
among the challenges.
For crypto businesses that employ manual verification,
another challenge is avoiding human error. 15.4% of
them regularly detect mistakes caused by human error
while 61.5% detect them slightly less frequently.
Verification challenges 31/51

Main challenges
01. Onboarding users in emerging markets

Crypto businesses are seeking to enter emerging Peter Sever

markets in Africa, CIS, and Asia, where virtual Chief Strategy Officer
currencies are gaining popularity.

Before entering these markets, make sure that

However, it can be hard to process ID and proof
your verification provider employs accurate
of address documents (utility bills and bank statements)
Optical Character Recognition (OCR) technology
in these jurisdictions, since they’re often written in non- that can recognize non-Latin characters. Also,
Latin characters or are missing certain security ask your provider for information on accepted
features. documents and pass rates in your target market.
Verification challenges 32/51

Main challenges
02. Verifying user addresses

National AML legislation requires crypto businesses to

verify the addresses of users. This enables businesses
to identify risks posed by users and prevent access
from restricted countries.

However, asking users to submit proof of address

documents, such as bank statements and utility bills,
can result in significant drop-offs. Also, these
documents are generally easy to forge, since they To solve this problem, businesses could offer an
typically have no security features. alternative approach: address verification via
geolocation services, no proof of address
documents required.
Verification challenges 33/51

Main challenges
03. Working in a constantly shifting

regulatory landscape
Peter Sever
Chief Strategy Officer AML legislation on virtual assets is evolving year by
year, bringing more types of assets under regulation
Building AML compliance requires significant effort. and forcing crypto businesses to comply on par with
Even if a business outsources to a KYC solution, it other financial institutions.

must still construct baseline AML infrastructure. This

includes implementing an AML compliance program, This makes crypto businesses particularly sensitive

hiring a money laundering reporting officer, and so to new developments in AML regulation and verification
on. Start preparing in advance for future changes so
tools.
you have the time to get compliant before new rules
—and penalties—kick in.
Verification challenges 34/51

Main challenges
04. Preventing fraud

Sumsub’s anti-fraud team noticed a growing number


of fraudsters using deepfakes and 3D projections

to bypass verification.

Such fraudsters obtain leaked documents and project

the face of the true document holder onto their own,
thanks to increasingly sophisticated—and available—
fraud tools.

AI-based facial biometric solutions such

More insights on fraud statistics, emerging fraud types
 as Liveness / Face Match can fight back
and their effects can be found in our Identity Fraud Study
against these attacks
Verification best practices
Expert insight on automation, dividing verification into levels,

and Travel Rule compliance

Verification best practices 36/51

Best practices: balancing compliance and pass rates

Automating verification
This allows businesses to speed up onboarding, so that users don’t go

to competitors over long wait times. According to Sumsub’s experience,

automation can achieve average verification times as low as 50 seconds,

with 70% less time spent on compliance tasks. It also reduces verification
costs by up to 40%.

Extensive regulatory requirements often

complicate the verification process. This
leads to increased user verification time
Tailoring verification to different customer segments
and, ultimately, losing customers during
onboarding.

based on their risk profiles or other criteria. Businesses might consider

making the onboarding process complex for high-risk clients, while keeping

Here are a few suggestions for staying it minimal for lower-risk ones.
AML compliant while maintaining high
pass rates:
Verification best practices 37/51

Best practices: splitting verification into levels

Dividing verification into levels*, for instance,
For instance, when a user signs up

a ‘sign-up level’ or a ‘full verification level’, for the first time, the business can
reduces drop-offs during onboarding and secures
transactions.
implement a level that identifies them
without a complex verification
procedure.​​
80.6% of crypto businesses This can be limited to collecting their name and
split identity verification into verifying their phone number and email. This way,

several steps the user gets acquainted with the service and is more
motivated to go through the full verification procedure
when they actually want to perform a transaction.
*A level is a set of steps that users

need to go through in order to get verified

Verification best practices 38/51

Best practices: splitting verification into levels

Simple identification

without verification:

Limited

O Collection of basic

informatioU crypto-to-crypto

O Email/Phone verification transactions

Face

Authentication:

Onboarding O Liveness Withdrawal

Full verification

(KYC):

O Identity and address

Unlimited crypto-

verificatioU to-crypto,

O Liveness/Face Matc crypto-to-fiat,

O AML screening fiat-to-crypto

transactions

User action Required checks An example of optimized level-based verification

Verification best practices 39/51

“For a project to grow, it needs to balance regulatory

compliance and pass rates. In other words, the challenge
is to avoid making the onboarding process too rigid,
causing users to drop off, while keeping it secure enough
to fight fraud and other financial crimes.

Peter Sever The way that a business complies with regulations often
Chief Strategy Officer depends on its size; the bigger the business, the stricter
the compliance requirements it follows. So, if a startup
pursues the requirements for a big company, it might lack
the resources to grow.”
Verification best practices 40/51

Best practices: Travel Rule compliance

In 2019, the FATF expanded Travel Rule requirements 
 For instance, the reporting requirements

to VASPs, prescribing them to collect and share certain of a transaction differ depending on whether 

information on participants in transactions above 
 the counterparty VASP is located in the same
a certain threshold. Before transferring information jurisdiction or a foreign nation.
collected in line with the Travel Rule, the FATF requires
that VASPs identify their counterparty. Notabene, 

However, the FATF recognizes that proper
a regulatory technology SaaS for managing
identification of counterparty VASPs isn’t always
counterparty risk in cryptocurrency transactions, shares
possible. In addition, the FATF isn’t aware of any
its insights into identifying counterparty VASPs below.

technically proven means of identifying VASPs

managing beneficiary wallets.
Compliance with the Travel Rule is dependent on proper
identification of the counterparty. Accordingly, Travel
Rule criteria is contingent upon how the counterparty

is qualified.
Verification best practices 41/51

Best practices: Travel Rule compliance

The first phase of the due diligence process is to
determine whether the transaction is with another By completing this due diligence process, VASPs
VASP. Blockchain analytics companies are employed 
 shield themselves from illicit and sanctioned actors
for this purpose. If the transaction counterparty 
 and ensure the confidentiality of shared Travel Rule
is determined to be a VASP, the due diligence 
 information. To mitigate the impact of this process
process must consider several factors: on transaction volume and speed, it’s essential to
employ scalable and reusable due diligence
processes.
robustness of the counterparty’s data storage
and security framework

licensing and registration requirements of the

jurisdiction where the counterparty is based

whether the counterparty is complying

with the Travel Rule

Future verification trends
Future plans of crypto businesses and expert takes

on incoming regulatory and verification-related changes

Future verification trends 43/51

Future verification plans of crypto businesses

More and more crypto businesses are planning
Here is what the surveyed companies revealed about
to scale up and enter new markets. To stay compliant their plans for the next 12 months:
with regulatory requirements while maintaining high
pass rates, most businesses introduce automated
verification solutions. 79.5% 55.1%
plan to enter new markets plan to increase their
or acquire new licenses verification budget

61.2% 76.9%
don't plan to switch their plan to switch from
existing KYC provider manual to automated
verification
Future verification trends 44/51

Future regulatory changes

Regulations on virtual assets are still evolving.

In the long run, regulatory rules are expected to be
Here’s what Sumsub’s legal department has to say harmonized. An initial example is the proposed Markets
about future regulatory trends. in Crypto-assets (MiCA) regulation.

Extension of types of regulated

services
We expect that more and more countries will adopt 

the FATF’s functional approach to defining VASP
activities and implement it into their national legislation. 

This approach might evolve over time to encompass
new types of services, as new methods of using virtual
assets keep appearing. There were some precedents
already; DeFi weren’t regulated before, but now there
are certain circumstances in which they can be
considered VASPs.
Future verification trends 45/51

Future regulatory changes

Tightening regulations Broadening of the Travel Rule

This includes tougher registration and licensing implementation
requirements, the ubiquitous introduction of the Travel
As for the Travel Rule, the European Parliament’s
Rule, and so on. Stricter demands, such as demands 

Committee on Economic and Monetary Affairs recently
for share capital and/or requirements for KYC systems,
approved amendments to Europe’s Transfer of Funds
are being introduced in countries where registration 

Regulation, requiring that all transfers of crypto-assets
or authorization requirements exist. Such changes have
include information on the source of the asset and its
already been introduced in Estonia and Belgium 

beneficiary—which is to be made available to 

and proposed in Lithuania.
the competent authorities. This would also cover
transactions from unhosted wallets. In addition, 

the removal of the de minimis threshold was proposed,
which means that the Travel Rule will apply to all virtual
assets transactions, regardless of value.
Future verification trends 46/51

Expected trends in verification practices

Introduction of the Self-sovereign identity (SSI) will In other words, users will have a single token that
replace traditional identity documents. Using the SSI contains their personal data that they can use for
system, individuals will store their personal data on 
 verification anywhere.

their devices (wallets) and have full control over it.

Another possibility is the introduction of "soulbound"
tokens, a concept similar to SSI. In May 2022, the
founder of Ethereum, Vitalik Buterin, co-authored 

a paper, in which he outlined the idea of "soulbound"
tokens (SBTs)—non-transferable tokens that store an
individual's attributes and achievements in blockchain
wallets. This can be pictured as an extended resume
that contains educational credentials, employment
history, hashes of works of art, and much more.
Future verification trends 47/51

Expected trends in verification practices

Verification solutions for holders of private wallets.

User verification for the metaverse

As decentralized crypto businesses might fall under The metaverse is an immersive virtual environment that
regulation, there’s a need to create a verification exists in real time. Among some examples are Roblox
solution fit for their processes. Such solutions might and Fortnite. Metaverses have their own economy,
differ from those intended for centralized crypto often built on virtual assets, and are likely to fall under
businesses. As of May 2022, there are more than 
 regulation as they continue to expand. One possibility is
4.5 million unique user addresses on DeFi platforms. 
 that users will have to get verified in order to get access
Once regulations kick in, all of these users will have 
 to the metaverse.
to be verified.
Future verification trends 48/51

“It's clear that regulators are trying 


to introduce certain frameworks similar to
those of other financial products. However,
the challenges here are very different, which
is why the industry is wary of over-
regulation, which could harm innovation.

Andrew Ilinsky
Product Owner We believe that, one way or another,
compliance will remain an important factor 

in the pace of crypto adoption.

And therefore tools like Sumsub will become 


a much-needed layer to facilitate companies
and help the industry grow.”
 49/51

How Sumsub can help

Sumsub provides a KYC/AML solution designed for the Balance compliance and pass rates. Customize user
crypto industry. It covers the whole onboarding cycle, journeys that meet your internal policies and double
including customer identification and verification, AML your overall pass rate. Build unique flows from a wide
monitoring, and crypto transactions screening—all in range of checks, including ID, proof of address,
one place. liveness, phone number, email, and more.

Prevent fraud. Sumsub filters out bad actors by Scale up anywhere in the world. Welcome clients from
thoroughly verifying personal documents, detects any region with the power to process over 6,500 kinds
fabricated photos and pre-recorded videos, pre- of documents issued in 220+ countries and territories,
screens bank card images for fraud patterns, 
 all while ensuring equally high pass rates. If you’re going
and so much more. to conquer new markets, Sumsub’s experienced team 

is always ready to support you.

KYC/AML KYB Video Identification Payment Fraud Prevention Face Authentication Crypto Check
 50/51

Powered by

Sumsub provides an all-in-one Mercuryo is a rapidly growing Notabene is a regulatory

technical and legal toolkit to payment infrastructure company technology SaaS for managing
cover KYC/KYB & AML needs. 
 that provides global access to counterparty risk in
It’s a single platform for fast and cheap money transfers cryptocurrency transactions.
converting more customers, for businesses with a bank-level Market-leading crypto
speeding up verification, oversight. Working together with exchanges and financial
reducing costs, and fighting industry leaders, Mercuryo institutions leverage our
digital fraud. Thanks to its high leverages a range of payment software, tools, integrations, 

pass rates and strong legal solutions to accelerate growth and comprehensive data to
expertise, Sumsub stands and boost the revenue of comply with new regulatory
among the leading players 
 enterprises worldwide. requirements, including FATF’s
in the verification market. crypto Travel Rule.
Want to stay compliant

while maintaining high pass rates?

Get a free demo

IN IN IN IN IN
[email protected]