Notifications
Clear all
Topic starter
10/06/2026 10:38 pm
TL;DR: SEPBLAC-aligned Video KYC in Spain now requires real-time recording, auditable evidence, and human review in the onboarding flow, according to Sumsub. For identity teams, the shift is not the video itself but the governance burden around proof, oversight, and regulator-ready records.
NHIMG editorial — what this means for NHI practitioners
Questions worth separating out
Q: How should teams govern recorded video KYC in regulated onboarding flows?
A: Teams should govern recorded video KYC as a regulated evidence process, not just an identity check.
Q: Why do human-in-the-loop approvals matter for identity verification?
A: Human-in-the-loop approvals matter because some onboarding regimes require a named reviewer to validate the recorded evidence before acceptance.
Q: What breaks when identity evidence is not recorded end to end?
A: When identity evidence is not recorded end to end, the organisation cannot prove how the onboarding decision was made.
Practitioner guidance
- Map verification evidence to audit requirements Identify exactly which artifacts must be retained for SEPBLAC-style review, including the recorded session, document images, liveness checks, timestamps, and reviewer identity.
- Separate capture, review, and approval duties Assign clear responsibility for the person who reviews the video, the person who approves the onboarding decision, and the team that administers the platform.
- Test evidence integrity before go-live Validate that recordings cannot be altered without detection and that access to stored identity evidence is restricted to authorised roles.
What's in the full announcement
Sumsub's full article covers the operational detail this post intentionally leaves for the source:
- How the real-time recording flow is structured for Spanish onboarding sessions and reviewer approval.
- Which regulated sectors the capability is intended to support, including financial services, crypto, payments, and trading.
- How the solution positions the recorded trail for SEPBLAC-aligned evidence and AML oversight.
- What the independent legal review is intended to support in the compliance workflow.
👉 Read Sumsub's announcement on SEPBLAC-aligned video KYC recording →
Video KYC in Spain: what it means for IAM and compliance teams?
Explore further
11/06/2026 2:45 am
Spain’s video KYC requirement is an auditability problem first and an identity problem second. The real change is that onboarding now has to produce defensible evidence, not just a pass or fail outcome. That pushes identity verification into the same governance conversation as AML recordkeeping, operator oversight, and retention control. Practitioners should treat recorded verification as a regulated control surface, not an optional compliance enhancement.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What should compliance teams check before scaling video KYC?
A: Compliance teams should check whether the verification record is complete, retained correctly, and restricted to authorised reviewers. They should also confirm that the workflow matches the regulatory model in each market, because a reusable onboarding journey can still fail local evidence requirements if the governance rules do not travel with it.
👉 Read our full editorial: Spain video KYC raises the bar for auditable onboarding controls
