Sumsub Launches Reusable KYC Gateway With MiniPay as First Partner

Sumsub launched its Reusable KYC Gateway at Token2049 Singapore on October 7, letting users of the MiniPay stablecoin wallet verify their identity once and reuse it with the wallet’s regulated partners, eight of which already rely on Sumsub for verification.

The launch matters to compliance teams because it moves a customer due diligence step out of each partner’s onboarding flow and into a shared credential, while the legal responsibility for the check stays where it is. Each partner remains accountable to its own regulator. Reusable KYC changes who collects the documents and how often a customer is asked for them, not who answers for the result.

MiniPay is active in more than 70 countries and has had more than 20 million wallets opened, Sumsub said. The wallet is self-custodial, so it has no obligation to verify users itself. Its partners, which include on and off ramps, card issuers and payment providers, have each run their own KYC.

How the reusable KYC Gateway works

A user prompted to verify can either reuse one of 15 million existing Sumsub IDs or complete a new check with an identity document and a selfie. The user must then actively agree to link that verified identity to their MiniPay account.

The first time the user deals with a regulated partner, they give a one-off consent to share their identity with it. The partner then obtains the verified data directly from Sumsub ID. Identity documents and biometric data move between Sumsub and the partner and never pass through MiniPay.

That makes Sumsub the holder of the credential and the data. MiniPay holds the link between the wallet and the verified identity, plus the user’s consent to it.

The Gateway sits alongside Reusable KYC Share in Sumsub’s reusable KYC range. Share works by token: a firm that already verified a customer generates a share token and a receiving firm fetches the data with it, a flow described in the integration documentation of the crypto on-ramp Transak. The Gateway is aimed at a different buyer. Sumsub said it is available to non-regulated businesses that connect users to a network of regulated partners, as MiniPay does.

What MiniPay’s partners get from reusable KYC

Partners can finish onboarding without extra screens, Sumsub said, while still applying their own compliance rules. Further checks are triggered for higher-risk transactions. Sumsub’s product page puts it as “Your checks, your policy, your decision.”

Sumsub said MiniPay partners have seen verification conversion climb from roughly 70% to 95% since the move, and KYC completion times fall by as much as 50%. Eight MiniPay partners now rely on Sumsub for verification. Sumsub did not name them in its announcement.

The company said repeat verification is common in its own base. “Repeated KYC checks across the same ecosystem are inconvenient for everyone, and one in three applicants we see have already verified with us before,” said Andrew Novoselsky, chief product officer at Sumsub.

Murray Spark, senior director of business development at Opera, which develops MiniPay, framed it as an extension of self-custody. “Users hold their own funds, and now they also control their own verified identity,” he said. “They decide what to share and with whom, and that matters more and more as our partner network expands across new markets.”

Reusable KYC under reliance rules

Reusing a verified identity is a form of reliance on a third party, which anti-money laundering rules permit under conditions. The Financial Action Task Force (FATF), the global standard setter, addresses it in Recommendation 17. A firm may rely on another institution for identification and verification of the customer, but the relying firm keeps ultimate responsibility for the outcome.

FATF’s Guidance on Digital Identity, published in March 2020, says reliance on digital identity systems should reflect their assurance levels, particularly for identity proofing, and whether those levels suit the money laundering and terrorist financing risk of the customer, product and jurisdiction. The guidance is not binding.

The EU’s anti-money laundering regulation, Regulation (EU) 2024/1624, sets the same logic in law. Article 48 allows obliged entities to rely on other obliged entities for the first three customer due diligence steps in Article 20(1). Those cover identifying the customer, verifying identity and identifying the beneficial owner. The firm relied on must apply equivalent due diligence and record-keeping rules and be supervised accordingly, and the relying firm stays fully responsible. The regulation applies from July 10, 2027.

Where a partner takes data from Sumsub, the legal question is whether Sumsub’s check meets that standard for the partner’s own license and market. Sumsub’s announcement names no regulators or licensing regimes, and its product page refers only to “regulated partners.” The Gateway therefore supplies verified data and documents. It does not itself settle which rulebook applies in each of MiniPay’s markets.

Consent, data protection and crypto rules

The consent design bears on the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, for any partner serving people in the EU or UK. Under GDPR, data collected for one purpose should be limited to what is necessary, and consent must be specific, informed and freely given. A one-off consent to share an identity with a named partner, with the user choosing what goes where, is the pattern Sumsub describes.

Biometric data used to identify a person is a special category under GDPR Article 9, which raises the bar for any firm that receives it. Keeping documents and biometrics out of MiniPay’s hands reduces what the wallet itself must protect. It means each receiving partner takes on the controller duties for the data it fetches.

For crypto-asset service providers in the EU, the Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, has applied to those firms since December 30, 2024. They are also covered by the EU transfer-of-funds rules and, from 2027, by the AML regulation. The partners on MiniPay’s network that are on and off ramps would fall under that regime where they serve EU customers.

The wider market for reusable KYC

Reusable identity is a crowded area. Sumsub’s own Share product already lets firms pass verified customers between one another, and the Gateway extends the idea to an ecosystem operator that does not hold the data. The pitch to partners is lower drop-off at onboarding. The pitch to regulators has to rest on audit trails, assurance levels and clear allocation of responsibility.

For compliance officers at partner firms, the questions that follow are practical ones. They include what evidence of the original check they receive, how they record their reliance, and how they handle a customer whose circumstances change after the first verification. Sumsub’s announcement leaves each partner’s own rules and higher-risk triggers in place for those decisions.

The next test is the EU’s anti-money laundering regulation, which applies from July 10, 2027 and will set the reliance conditions for any partner that serves customers in the bloc.