Field Guide
Identity and trust: KYB, KYC and ongoing monitoring
06
Market and trends
4 min read · Chapter 6 of 10
Who holds the power
Power here follows who can stop you onboarding. As I read it, the regulator sets the floor, the partner sets the bar, and one partner's consent order can reset the bar for everyone on that bank.
- The sponsor bank holds the veto. It sets risk appetite, prohibited businesses, vendors, alert deadlines and exits, and it can override your decision to keep a customer. When its regulator issues an order, its rules change for every fintech on it at once: Evolve's 2024 order required the Fed's approval before any new fintech partner or product.
- Card networks set the payfac rules, run MATCH and fine the acquirer, which fines you.
- Regulators set the floor and reach most platforms through the bank. Licensed firms meet them directly: Block paid $80M to 48 state regulators and $40M to New York's regulator in 2025, with no bank in between.
- Data brokers hold coverage. Whether a person with a thin credit file can be verified without a document is decided by bureau data.
- Registries are gaining power where the state verifies at the source. Companies House stopped about 27,000 suspicious filings in 2025-26.
- Wallet makers (Apple, Google, Samsung) decide whether a verifier can read a mobile driver's licence.
- Applicants hold the truth and the documents, and they leave if you're slow.
Tailwinds and headwinds
These are the forces I'd expect everyone in identity and compliance to watch as of October 2026, and each one helps some players and hurts others. Two of them show up on both sides, AI fraud and AI doing analysts' work, and the US is easing while the EU, the UK and Canada tighten.
Tailwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| Cheap AI-made fake IDs and deepfake selfies, which Entrust says rose by more than half in 2025, push companies to add data, device and behaviour checks for each applicant. | Data and signal owners (LexisNexis Risk Solutions, Experian, TransUnion, BioCatch, Prove, Socure); identity vendors that defend against faked camera feeds (Veriff, Incode, Entrust); orchestration (Persona, Sardine) | Platforms whose losses come right after onboarding (instant payouts, credit); document-only checks sold on price; good applicants, who face more steps |
| The EU, the UK and Canada are tightening their rules, and from July 2027 the EU requires every customer's file to be refreshed on a fixed cycle. | Vendors strong in Europe (Veriff, Entrust, GBG, Kyckr, Moody's, ComplyAdvantage, Quantexa, Hawk); registries such as Companies House; certified UK digital ID providers | EU fintechs and e-money firms, which carry the cost; US platforms with EU customers, which need new data fields; data-only checks, which don't count in the EU |
| AI agents are starting to clear alerts and chase documents, and FinCEN's April 2026 proposal counts AI tools as evidence that a program works. | Monitoring and case vendors built around AI (Sardine, Unit21, Hawk, Quantexa); KYB vendors that automate review (Middesk, Baselayer); platforms whose cost is mostly analysts | Outsourced review shops and offshore analyst teams; incumbents slow to add AI |
| The 2025 GENIUS Act and new national trust charters for crypto firms create stablecoin issuers that must run their own KYC, monitoring and sanctions programs. | Identity and screening vendors strong in crypto (Sumsub, Persona, ComplyAdvantage, LSEG's World-Check); monitoring vendors (Sardine, Hawk, Unit21) | Unlicensed and offshore crypto firms, once exchanges may offer only compliant stablecoins; possibly sponsor banks, if their fintechs get charters of their own |
| Since October 2024, a UK payment firm that receives scam money pays half the victim's refund, and the EU has agreed rules on impersonation scams that should follow. | Behaviour and device signals (BioCatch, Experian, LexisNexis Risk Solutions, Sardine); shared fraud data such as Cifas | UK and EU digital banks and e-money firms that onboard fast and lightly |
Headwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| The US cut its ownership register to foreign companies, relaxed suspicious activity reporting and has lifted several orders on sponsor banks, though big penalties continue for monitoring that can't keep up. | US fintechs and sponsor banks with fewer constraints (The Bancorp, Coastal Community Bank, Lead Bank) | Vendors and consultants whose US pitch is regulatory (NICE Actimize, LSEG's World-Check, LexisNexis on the compliance side); lookback and remediation consultants |
| Deepfakes and faked camera feeds make the document plus selfie check less trusted on its own, and only about a third of the selfie-to-ID systems DHS tested met all its goals. | Data, device and behaviour vendors (LexisNexis Risk Solutions, Experian, BioCatch, Prove, Socure); signed digital IDs (ID.me, CLEAR, the wallet makers) | Document-only checks and web capture; probably the slower-growing public incumbents (Mitek, GBG) |
| Biometric lawsuits and closed ownership registers raise the cost of holding identity data, and Texas won more than a billion dollars each from Meta and Google. | Data-only and signed-credential checks; vendors that keep no templates; banks and their vendors, which Illinois's law exempts | Identity vendors that rely on selfies and sell outside finance (Persona, Veriff, Incode, Entrust); marketplaces and gig platforms without the exemption; KYB vendors that relied on public registers |
| Payment platforms such as Stripe include onboarding checks in their price, and bigger companies and private equity keep buying the specialists, which could squeeze standalone vendors. | Stripe and other payment platforms; bureaus (Experian, TransUnion, LexisNexis Risk Solutions); Moody's and Dun & Bradstreet | Single-layer identity, screening and KYB tools selling to startups and scale-ups; sponsor-bank programs competing with rented ones |
| If AI agents clear most alerts, the analyst budget, which is the biggest part of compliance spend, could shrink, though I haven't seen measured headcount cuts yet. | Buyers; vendors built around AI | Outsourced review shops and offshore teams; tools priced per seat or per reviewed case; lookback consultants |
If I could watch only one thing, it would be whether the final FinCEN program rule and the exams that follow it accept alerts cleared by AI, because that decides how fast the biggest pool of money, analyst time, moves to software.