Most teams plug in a KYC provider, see a green checkmark, and call compliance "done."
Then the edge cases arrive: a document that's valid but mismatched, a name in a different alphabet, a selfie that half-passes. The provider returns a score, not a decision. Someone still has to make the call — fast, under audit, without blocking honest users.
We've built the layer that sits between the verification API and the compliance officer. Real-time moderation queues where a reviewer sees the full context of a user, flags cluster by rule, and every action is logged for the audit trail. The integration with the KYC/KYB provider is maybe 20% of the work. The other 80% is the review workflow, the state machine behind an application, and making sure a rejected user can be re-examined without losing history.
Our take: compliance tooling lives or dies on the operator's screen, not the API contract. A verification vendor tells you what it thinks. Your own moderation layer is where policy actually gets enforced — and it's the part you can't outsource.
For teams running KYC in production: how much of your compliance logic sits in the vendor versus in tooling you built yourselves?