Sumsub’s Forrester recognition and what it means for IDV governance

At a glance

What this is: This is a vendor article about Forrester’s IDV evaluation and SumSub’s claims about scale, language coverage, and onboarding speed across the customer journey.

Why it matters: It matters because identity verification is no longer just an onboarding check, but a lifecycle governance control that affects fraud, compliance, and customer trust.

By the numbers:

• SumSub says it can securely onboard users in just 20 seconds.
• SumSub says it supports 50+ interface languages.
• SumSub says it covers compliance with 220+ countries and territories.

Context

Identity verification only becomes useful when it is governed as part of the wider identity lifecycle, not treated as a one-time onboarding gate. In regulated and fraud-sensitive environments, the operational question is whether identity proofing, authentication, transaction review, and account closure are connected controls or disconnected checks.

The SumSub article uses Forrester recognition to argue for breadth across the customer journey, but the real governance issue is stronger than ranking. IAM, fraud, and compliance teams have to decide whether IDV is evidence of trust, a policy input, or a continuously managed control that can be revisited when risk changes.

Key questions

Q: How should identity verification teams handle trust after onboarding?

A: They should treat onboarding as the start of trust governance, not the end. The strongest approach is to bind the approved identity to a persistent device signal, then use that continuity to decide whether later sessions deserve friction, step-up checks, or direct access. That reduces unnecessary re-verification while still exposing handoffs and takeover conditions.

Q: Why do fast identity verification flows sometimes create governance risk?

A: Speed becomes a risk when it replaces assurance rather than supporting it. A rapid flow can still be weak if it is not aligned to the specific decision being made, the customer risk tier, and the fraud exposure of the use case. Governance has to define the required confidence level before optimisation starts.

Q: What are the signs that an IDV programme is not covering the right population?

A: Common signs are high manual-review rates in specific geographies, repeated fallback to exceptions for certain document types, and uneven customer drop-off across language groups. Those symptoms usually mean coverage and policy are misaligned with the actual customer base, not that the verification process itself is failing uniformly.

Q: How can security teams tell when identity verification is too weak?

A: Look for workflows that rely on one document check, allow recovery without independent signals, or have no step-up path when context changes. If the process cannot distinguish a genuine claimant from someone holding stolen data, it is too weak for high-trust actions.

Technical breakdown

Why IDV is now a lifecycle control, not a single checkpoint

Identity verification is the process of establishing that a user, business, or transaction is real enough to be trusted for a specific business action. In practice, that trust should not stop at account creation. Once login, payments, trading, or account closure enter the flow, the verification model becomes a lifecycle control that must keep pace with risk, regulator expectations, and fraud patterns across the customer journey.

Practical implication: treat IDV as a governed control surface that extends beyond onboarding into ongoing access and transaction decisions.

How onboarding speed interacts with fraud and compliance

Faster onboarding is only valuable when it does not lower the assurance needed for the relevant use case. The technical trade-off is between friction, coverage, and confidence in the identity signal. Features such as OCR, document checks, and non-document methods change how evidence is collected, but governance determines when that evidence is sufficient for regulated or high-risk actions.

Practical implication: align verification depth to the decision being made, not to a generic onboarding target.

Why document coverage and localisation matter to assurance

IDV systems often fail at the edges, where document types, languages, or jurisdictions are not well supported. Coverage across 50-plus languages, thousands of document types, and country-specific compliance requirements matters because identity confidence is only as strong as the weakest supported population or region. Gaps here create uneven assurance and inconsistent customer treatment.

Practical implication: validate whether your IDV coverage matches your actual customer geography and document population.

NHI Mgmt Group analysis

Forrester recognition does not answer the governance question that matters: whether identity verification is being operated as an onboarding feature or as a lifecycle control. A Leader label may reflect market fit and capability breadth, but practitioners still have to decide where verification evidence feeds policy, escalation, and account closure decisions. The material issue is not ranking, but control placement across the identity lifecycle.

Speed claims are only meaningful when assurance is measured at the point of use: 20-second onboarding is operationally attractive, but it does not by itself tell you whether the right checks were performed for the right risk tier. A fast flow can still be weak governance if it is disconnected from fraud rules, transaction monitoring, or post-onboarding review. Practitioners should judge the control by decision quality, not by completion time alone.

Identity coverage gaps create unequal trust outcomes across customer populations: support for thousands of document types and dozens of languages matters because unsupported users often get pushed into manual review, exceptions, or abandonment. That produces inconsistent assurance and policy drift across regions. The practical conclusion is that verification coverage is an identity governance issue, not just an operations metric.

Multistage identity governance is the real market direction: the category is moving away from one-off proofing toward controls that span onboarding, authentication, transactions, and closure. That shift aligns IDV more closely with fraud prevention and lifecycle governance than with point-solution identity checks. Teams should expect procurement decisions to be judged on how well evidence follows the customer journey.

Identity verification must be evaluated against the decision it supports, not the vendor category it sits in: a system that works for low-risk retail onboarding may be inappropriate for crypto, trading, or other regulated flows. The same control can serve different assurance thresholds, but only if governance defines the threshold first. Practitioners need to anchor IDV design in use-case risk, not in product messaging.

From our research library:

• Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.

What this signals

Lifecycle scope is now the differentiator: practitioners should expect IDV programmes to be judged less on first-pass verification and more on whether identity evidence can be reused across login, transaction, and closure decisions. That is where fraud, compliance, and customer experience meet, and where fragmented controls start to fail.

Coverage gaps will keep creating uneven assurance if teams do not test languages, document types, and jurisdictional fit against their actual customer mix. The operational lesson is simple: if the control does not fit the population, the policy will drift toward manual exception handling.

For practitioners

• Define where IDV evidence is reused Map which verification outputs can influence login, step-up checks, transaction approval, and account closure so the control is not trapped at onboarding.
• Tier verification by risk scenario Set different assurance levels for crypto, trading, finance, and other regulated flows so friction matches the business action being authorised.
• Test regional document and language coverage Compare your live customer mix with supported document types, interface languages, and jurisdiction coverage to find exception paths before they become manual bottlenecks.
• Review fraud controls alongside onboarding KPIs Track pass rates, false accepts, false rejects, and downstream fraud signals together so speed metrics do not hide weak assurance.

Key takeaways

• Identity verification should be managed as a lifecycle control that influences more than onboarding if it is to support fraud and compliance objectives.
• The article’s strongest operational claims are about scale, including 20-second onboarding, 50-plus languages, 14,000 document types, and coverage across 220-plus countries and territories.
• Practitioners should evaluate IDV by the quality of the downstream decision it supports, not by speed alone.

Key terms

• Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.
• Assurance Level: An assurance level is the degree of confidence an organisation has that an identity proofing or authentication outcome is accurate. Higher assurance usually means stronger checks, more evidence, and more governance overhead. The key is matching assurance to the transaction risk, not applying one standard everywhere.
• Manual Review: Manual review is the human escalation path for cases that automated identity checks cannot resolve cleanly. It matters because edge cases often reveal whether the programme can explain exceptions, preserve evidence, and maintain consistent decision quality under fraud pressure.
• Customer Lifecycle Loyalty: Customer lifecycle loyalty is the practice of aligning rewards with changing relationship states such as onboarding, active use, growth, and retention. It treats loyalty as an ongoing governance problem, where eligibility, value, and communication need to stay consistent as the relationship evolves.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.