KYC starts as part of account onboarding. When a customer is added to an account, the
account type determines whether identity verification is required and which KYC form and
provider apply. The invited customer then completes provider verification and the KYC form
in the Zquence user interface.
Third-party systems should not create KYC records, mint provider SDK tokens, submit customer
answers, or delete KYC data. Those actions belong to the authenticated customer journey.
Use the read-only endpoints below to synchronize progress and retrieve compliance evidence.
All endpoints are tenant and environment scoped and require API-key scope kyc.read.
A customer can exist before their KYC record is created. Treat 404 from status, record,
history, or export endpoints as “KYC has not started” unless the customer ID is invalid.
KYC payloads and exports can contain regulated PII. Store downloaded exports according
to your tenant retention policy and regional data-residency obligations.
