Choosing an identity-verification vendor is the single highest-stakes infrastructure decision an online casino or sportsbook makes in 2026. Pick wrong and you ship a checkout flow that bleeds 30% of depositing players at the document-upload step, or worse, you fail a Malta Gaming Authority audit because your AML monitoring stopped at onboarding. The two names that dominate every iGaming RFP shortlist are Sumsub and Onfido (now part of Entrust). They are not interchangeable. One is a compliance-infrastructure platform built to carry KYC, KYB, AML, and ongoing fraud monitoring under one roof; the other is a mobile-first identity-capture specialist with deep biometric heritage and an enterprise sales motion.
This comparison runs both through the lens that actually matters for a gambling operator: per-check cost at real deposit volumes, jurisdiction coverage, SDK integration effort, latency under load, and what happens to fraud after the player clears onboarding. We tested integration paths, modeled pricing across three published 2026 sources, and built five real-world iGaming scenarios. Here is what the data says.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Sumsub vs Onfido 2026: The Verdict in 60 Seconds
If you only read one section, read this. For a regulated iGaming operator processing high volumes of regulated, friction-heavy verifications, Sumsub wins on total cost of ownership and on lifecycle coverage. It published a per-IDV price as low as $1.35 and an AML check at $0.57 (Didit’s 2026 provider comparison), against Onfido estimates of roughly $2-$3 per IDV. Sumsub also bundles KYC, KYB, AML screening, and ongoing transaction monitoring into a single platform – which matters enormously when Sumsub’s own internal data shows 76% of fraud attempts occur after the initial verification, not during it.
Onfido wins where you need a deeply polished, mobile-first capture experience backed by an enterprise vendor with the resources of Entrust behind it, and where document/biometric accuracy is the dominant requirement. But its custom enterprise pricing – annual contracts that comparison sources place in the $50,000-$200,000 range – and its narrower published iGaming-specific positioning make it a harder sell for mid-market gambling startups.
Quick scorecard
| Dimension | Sumsub | Onfido (Entrust) | Winner |
|---|---|---|---|
| Per-IDV price (published 2026) | $1.35-$1.85 | ~$2-$3 (estimated) | Sumsub |
| AML check price | $0.57 | Custom/bundled | Sumsub |
| Document type coverage | 14,000+ | ~2,500 (estimated) | Sumsub |
| Country coverage | 220+ | 195+ | Sumsub |
| iGaming-specific positioning | Explicit (Gambling IQ No.1) | General IDV | Sumsub |
| Mobile capture polish | Strong | Best-in-class | Onfido |
| Enterprise backing | Independent | Entrust | Onfido |
| Post-onboarding monitoring | Native | Add-on | Sumsub |
| Minimum commitment | $149/month | Annual enterprise | Sumsub |
| Auth flow integration | Auth0 native (May 2026) | Via Entrust IAM | Tie |
Why iGaming KYC Is a Different Beast
Generic identity verification and iGaming identity verification look similar on a slide and behave nothing alike in production. A neobank verifies a user once at account opening and rarely touches that flow again. A licensed casino verifies at registration, re-verifies at the first withdrawal, screens against sanctions and PEP lists continuously, enforces deposit limits tied to affordability checks, geofences by jurisdiction in real time, and must produce an auditable trail for regulators on demand.
That lifecycle is why the “best KYC provider” question is unanswerable in the abstract. The right answer for a fintech is frequently the wrong answer for a sportsbook. Sumsub’s positioning explicitly leans into this: Gambling IQ’s 2026 “Defenders of Trust” report ranked Sumsub the No.1 iGaming fraud-prevention provider, citing its coverage across onboarding risk, bonus abuse, account takeover, and money laundering – the four fraud vectors that define gambling specifically.
The four iGaming fraud vectors
- Onboarding risk – synthetic identities and stolen documents at registration.
- Bonus abuse – multi-accounting to farm welcome offers and free spins.
- Account takeover – credential-stuffing into funded, verified accounts.
- Money laundering – layering deposits and withdrawals to clean funds.
Why onboarding-only verification fails operators
The most expensive mistake an operator makes is treating KYC as a one-time gate. Sumsub’s internal data indicates 76% of fraud attempts occur after initial verification – meaning a vendor that only checks the document at signup leaves three-quarters of your fraud surface unguarded. This is the structural argument for a platform that carries transaction monitoring and ongoing screening rather than a pure capture SDK. Operators building a full stack should study how a complete verification pipeline is wired end to end; our Sumsub KYC API 12-step integration guide walks the exact request/response flow you’ll inherit.
Company Profiles: Sumsub and Onfido in 2026
Understanding the corporate trajectory of each vendor matters because it predicts roadmap priorities, pricing flexibility, and support responsiveness over a multi-year contract.
Sumsub: the compliance-infrastructure platform
Sumsub has spent 2025 and 2026 deliberately repositioning from “identity-capture vendor” to “compliance infrastructure platform.” Its 2026 messaging ties everything to end-to-end KYC, KYB, and AML rather than document scanning alone. The Gambling IQ 2026 ranking built directly on its 2025 recognition among leading sector fraud-prevention firms, signaling consistent investment in the vertical. In May 2026 Sumsub shipped a native Auth0 integration that embeds identity verification directly into login flows – a meaningful signal that it sees verification as a continuous, session-level concern rather than a one-time onboarding event.
Onfido: now part of Entrust
The defining 2025-2026 fact about Onfido is that it is now part of Entrust, the identity and security giant. This brings enormous resources and an established enterprise IAM portfolio, but it also folds Onfido into a broader security-platform sales motion. 2026 comparison sources describe Onfido as mobile-first, with strong AI-powered biometric and document verification and a heavy emphasis on user experience. What those same sources note is that Onfido publishes far less granular public pricing and far less iGaming-specific detail than Sumsub does – a recurring theme across every 2026 source we pulled.
What the asymmetry in public data tells you
Across every 2026 comparison we reviewed, concrete pricing, rankings, and gambling-specific claims were abundant for Sumsub and sparse for Onfido. That asymmetry is itself a buying signal: Sumsub competes on transparency and vertical specificity, Onfido competes through enterprise relationships and brand. Neither is wrong, but they imply very different procurement experiences.
Pricing Deep Dive: The Per-Check Math That Decides Budgets
Pricing is where the abstract “which is better” question becomes a concrete number on a CFO’s spreadsheet. We modeled three published 2026 sources. The headline: Sumsub publishes specific, low per-unit pricing; Onfido sells custom enterprise contracts.
| Pricing element | Sumsub | Onfido (Entrust) |
|---|---|---|
| Basic plan entry | $149/month minimum commitment | Custom quote |
| Compliance plan entry | $299/month | Custom quote |
| Per-check (comparison source) | $1.85/check | $2-$3/IDV (estimated) |
| Per-IDV (Didit 2026) | $1.35/IDV | Custom |
| Per-AML check | $0.57 | Bundled/custom |
| Typical annual enterprise contract | Volume-discounted | $50,000-$200,000 |
Modeling a 50,000-verification month
Consider a growing sportsbook processing 50,000 IDV checks plus 50,000 AML screenings monthly. At Sumsub’s published $1.35 per IDV and $0.57 per AML check, that is $67,500 + $28,500 = $96,000/month before volume discounting (and Sumsub volume-discounts aggressively at this tier). At Onfido’s estimated $2-$3 per IDV, the IDV line alone runs $100,000-$150,000/month – and AML is typically a separate add-on. The gap widens as you scale.
Hidden costs operators forget
Per-check pricing is only the visible tip. Re-verification at withdrawal, repeated AML rescreening (sanctions lists update constantly), proof-of-address checks, and KYB for affiliate partners all add line items. A platform that bundles these – Sumsub’s model – produces a more predictable blended cost than stitching add-ons onto a capture-only SDK. For operators in regulated markets like Australia, where layered fraud detection is mandatory, the economics compound; our breakdown of the Australian pokies technology stack and AI fraud detection shows how those monitoring costs stack on top of base KYC.
Document and Country Coverage: 14,000+ vs ~2,500
Coverage breadth is decisive for iGaming because players arrive from everywhere and present every conceivable document. A 2026 comparison reports Sumsub supports 14,000+ document types across 220+ countries. Onfido’s coverage, while strong and mobile-optimized, is estimated lower in published comparisons – roughly 2,500 document types across 195+ countries.
Why breadth beats depth for gambling
A fintech serving one regulated market can succeed with narrow, deep coverage. A casino licensed in Malta but accepting players from Latin America, Southeast Asia, and Eastern Europe cannot. Every document type your vendor doesn’t recognize becomes a manual review – and manual review is the single most expensive operation in a compliance team, both in headcount and in the abandonment it causes when players wait hours for approval.
The manual-review cost multiplier
Industry benchmarks place manual review cost at $3-$15 per case depending on geography and complexity. If a narrower document library pushes even 5% more verifications into manual queues, on 50,000 monthly checks that is 2,500 extra manual cases – $7,500-$37,500/month in pure operational cost, before counting lost deposits from frustrated players who never come back.
Integration and Developer Experience
The vendor you choose lives inside your codebase for years. Integration effort, SDK quality, and documentation determine how fast you ship and how painful every future change becomes.
Sumsub SDK integration
Sumsub exposes a token-based flow: your backend mints an access token, the client SDK launches the verification flow, and webhooks deliver the result asynchronously. A minimal backend token request looks like this:
POST /resources/accessTokens?userId=PLAYER_123&levelName=igaming-kyc
Host: api.sumsub.com
X-App-Token: YOUR_APP_TOKEN
X-App-Access-Sig: HMAC_SHA256_SIGNATURE
X-App-Access-Ts: 1718524800
# Response
{
"token": "_act-sbx-9f3c...",
"userId": "PLAYER_123"
}You then pass that token to the Web or Mobile SDK and subscribe to the applicantReviewed webhook to capture the GREEN/RED decision.
// Webhook payload your server must handle
{
"applicantId": "65f...",
"externalUserId": "PLAYER_123",
"type": "applicantReviewed",
"reviewResult": {
"reviewAnswer": "GREEN", // GREEN = pass, RED = fail
"rejectLabels": []
},
"levelName": "igaming-kyc"
}Onfido SDK integration
Onfido follows a comparable pattern – create an applicant, generate an SDK token, launch the capture flow, then poll or webhook for the check result. Its mobile SDKs are widely regarded as best-in-class for capture UX, with sophisticated on-device document framing and liveness guidance.
POST /v3.6/applicants
Authorization: Token token=YOUR_API_TOKEN
Content-Type: application/json
{ "first_name": "Player", "last_name": "OneTwoThree" }
# Then create an SDK token
POST /v3.6/sdk_token
{ "applicant_id": "a-123", "application_id": "com.casino.app" }Webhooks, sandboxes, and time-to-first-verification
Both vendors offer robust sandboxes and webhook-driven async results. In practice, teams report a faster time-to-first-verification with Sumsub’s all-in-one dashboard (where you configure verification “levels” visually) versus Onfido’s more code-first applicant model. Neither is a blocker; the difference is days, not weeks.
Verification Speed and Accuracy Benchmarks
Speed and accuracy are the two numbers your conversion team and your compliance team fight over. Faster auto-approval lifts deposit conversion; tighter fraud catch protects the license. The best vendor optimizes both simultaneously.
| Metric | Sumsub | Onfido | Source basis |
|---|---|---|---|
| Median auto-decision time | ~30-60 sec | ~30-90 sec | Vendor docs / comparisons |
| Document types | 14,000+ | ~2,500 | 2026 comparison |
| Country coverage | 220+ | 195+ | 2026 comparison |
| Liveness/biometric | Active + passive | Best-in-class biometric | Vendor positioning |
| Post-onboarding monitoring | Native transaction monitoring | Add-on | Signzy 2026 |
The 76% post-verification fraud statistic
The most important benchmark in this entire comparison is not a speed number – it is Sumsub’s finding that 76% of fraud attempts occur after initial verification. This single statistic reframes the buying decision away from “who scans documents fastest” toward “who protects the account across its lifetime.” Onfido’s heritage is capture; Sumsub’s 2026 platform extends natively into ongoing monitoring and fraud prevention, per the 2026 Signzy guide.
Reading accuracy claims skeptically
Every vendor publishes a flattering pass-rate or fraud-catch figure. Treat all of them as directional. The only accuracy number that matters is the one you measure in your own sandbox against your own traffic mix. Both vendors support enough sandbox volume to run a meaningful bake-off before you commit a contract – and you absolutely should.
5 Real-World iGaming Test Scenarios
Abstract specs don’t pay out. Here are five concrete scenarios every operator hits, and how each platform’s architecture handles them.
Scenario 1: First-deposit registration at scale
A marketing campaign drives a 10x traffic spike on a Friday night. The vendor must auto-decision the majority instantly without melting under load. Both scale, but Sumsub’s broader document library means fewer of those new players drop into manual review – directly protecting the conversion you paid to acquire.
Scenario 2: First-withdrawal re-verification
A player who deposited weeks ago requests a withdrawal, triggering enhanced due diligence. This is where lifecycle platforms shine: Sumsub can re-screen against updated sanctions/PEP lists and pull the player’s existing verification record without a fresh capture. A capture-only approach forces redundant friction.
Scenario 3: Bonus-abuse multi-accounting
One fraudster opens 40 accounts with subtly altered identities to farm welcome bonuses. Detection requires device fingerprinting, document cross-matching, and behavioral signals – exactly the “full spectrum” coverage Gambling IQ credited Sumsub with in 2026. Pure document verification catches almost none of this.
Scenario 4: Account takeover on a funded account
Credential stuffing succeeds against a verified, funded account. The defense is verification at the session/login layer – which is precisely why Sumsub’s May 2026 Auth0 integration matters: it lets you re-challenge identity at login, not just at onboarding. Operators running youth-facing or strictly age-gated products face an even higher bar; our analysis of Roblox’s facial age-verification rollout for 144M users shows how session-level re-checks are becoming the regulatory baseline.
Scenario 5: AML layering across deposits
A player cycles deposits and withdrawals to launder funds. Catching this requires ongoing transaction monitoring with rule-based and ML-driven alerts – native to Sumsub’s platform, an add-on or external integration for a capture-first vendor.
Compliance and Regulatory Fit
An iGaming verification vendor that doesn’t map to your license conditions is worthless no matter how fast it scans a passport. Regulatory fit is non-negotiable.
UKGC, MGA, and the major regimes
Operators licensed by the UK Gambling Commission must enforce age and identity verification before deposit and run continuous AML controls under the proceeds-of-crime framework. The Malta Gaming Authority imposes parallel obligations across the EU-facing market. Both vendors support these regimes; the differentiator is whether AML monitoring is native (Sumsub) or assembled from parts (Onfido plus Entrust components). For broader market context, see our coverage of best sweepstakes casino sites.
FATF Travel Rule and sanctions screening
For crypto-accepting operators, the FATF Travel Rule and continuous sanctions/PEP screening are mandatory. Sumsub’s published $0.57 AML check and native screening cadence make ongoing compliance a line item rather than a project. This is the part of the stack capture-only vendors most often under-serve.
Audit trails and regulator-ready reporting
When a regulator asks for the full verification and monitoring history of a flagged account, you need it in minutes, not days. Platforms that keep KYC, AML, and monitoring in one system produce a coherent audit trail by default. Stitched-together stacks force manual reconciliation across vendors – the exact scenario that turns a routine audit into a fine.
What Competitor Comparisons Don’t Cover
We read the top-ranking 2026 “Sumsub vs Onfido” and “Onfido alternatives” articles. Nearly all of them are vendor switch-pages, generic alternatives lists, or feature-matrix tables. Here is what every one of them skips – and what an operator actually needs.
Jurisdiction-specific KYC requirements
The generic comparisons treat “KYC” as one thing. In reality, the UK demands age verification before any spend, Germany’s interstate treaty imposes deposit-limit cross-checks, and Ontario’s iGaming regime has its own standards. No mainstream comparison maps vendor capabilities to these specific license conditions – yet that mapping is the entire procurement question for a real operator.
Real-time geofencing and the GeoComply layer
Almost no KYC comparison mentions that identity verification is only half the regulated stack. Operators also need real-time geolocation (the category GeoComply dominates) to prove a player is physically within a licensed jurisdiction at the moment of play. Your KYC vendor must integrate cleanly with that layer; neither generic comparison even raises it.
Post-onboarding lifecycle economics
The feature-matrix articles compare onboarding accuracy and stop there – ignoring the 76%-of-fraud-after-onboarding reality. The true cost and risk of an iGaming KYC vendor is dominated by what happens over the months after the first check, and that is exactly the dimension the standard coverage omits.
Use-Case Recommendations by Operator Type
There is no universal winner. There is a right answer for your specific operation.
Mid-market casino startup
Choose Sumsub. The $149/month entry point, published per-check pricing, all-in-one KYC+AML+monitoring, and explicit iGaming positioning let a lean team launch compliant without an enterprise procurement cycle or a custom-quote negotiation.
Enterprise sportsbook with existing Entrust stack
Consider Onfido. If you already run Entrust IAM and value a single security-vendor relationship with best-in-class mobile capture, the integration synergy and enterprise support may outweigh the per-check premium.
Crypto-native and high-AML-risk operators
Choose Sumsub. Native AML at $0.57/check, FATF Travel Rule support, and continuous transaction monitoring address the highest-risk surface directly rather than bolting it on.
Pros and Cons Summary
Sumsub
Pros: Published, low per-check pricing ($1.35 IDV / $0.57 AML); 14,000+ document types across 220+ countries; native KYC+KYB+AML+monitoring; explicit iGaming No.1 ranking (Gambling IQ 2026); $149/month entry; May 2026 Auth0 login-flow integration.
Cons: Mobile capture UX, while strong, is rated a step behind Onfido’s; independent vendor without a giant parent’s enterprise IAM portfolio.
Onfido (Entrust)
Pros: Best-in-class mobile-first capture and biometrics; backing and resources of Entrust; mature enterprise support; strong AI-powered document and biometric verification.
Cons: Custom enterprise pricing (~$2-$3/IDV; $50,000-$200,000 annual contracts); less public iGaming-specific detail; AML/monitoring is more add-on than native; narrower published document coverage.
Final Verdict: Which Wins for iGaming in 2026?
For the specific job of verifying gamblers under regulatory pressure across a global player base, Sumsub is the stronger 2026 choice for most operators. The decision rests on four data points, not on brand preference: lower published per-check cost, dramatically broader document coverage, native lifecycle monitoring that addresses the 76% of fraud occurring after onboarding, and an explicit, independently-recognized iGaming specialization (Gambling IQ’s No.1 ranking).
Onfido remains an excellent identity-verification engine and the right call for enterprises already invested in Entrust or those for whom mobile-capture polish is the single dominant requirement. But for a gambling operator weighing total cost of ownership, regulatory lifecycle fit, and fraud coverage that extends past the signup screen, the published 2026 evidence points to Sumsub. Run both in sandbox against your own traffic before signing – but go in expecting Sumsub to win on the numbers that decide an iGaming budget. For broader market context, see our coverage of leading online casino sites.
Biometric Liveness and Deepfake Defense in 2026
The single fastest-moving threat in identity verification right now is the AI-generated injection attack. In 2024 a deepfake passed as a novelty; by 2026 it is a commodity tool sold on Telegram for the price of a video game. For iGaming – where a successful spoof unlocks real money – liveness detection is no longer a nice-to-have feature buried in a spec sheet. It is the front line.
Active vs passive liveness
Liveness comes in two flavors. Active liveness asks the user to perform an action – turn the head, blink, follow a dot – and is harder to fake but adds friction. Passive liveness analyzes a single selfie or short video for the micro-textures, depth cues, and lighting consistency that distinguish a real face from a screen replay or rendered model, with zero user effort. Sumsub deploys both active and passive liveness; Onfido’s biometric stack is widely rated best-in-class on the capture and facial-matching side, a direct inheritance of its mobile-first DNA.
Injection attacks vs presentation attacks
The distinction that separates serious 2026 vendors from laggards is whether they defend against injection attacks, not just presentation attacks. A presentation attack holds a photo or mask up to the camera. An injection attack bypasses the camera entirely, feeding a synthetic video stream straight into the SDK through a virtual camera or a compromised device. Defending injection requires device-integrity signals, SDK tamper detection, and server-side stream analysis – capabilities that map naturally onto a platform that already runs server-side monitoring. This is one more area where a lifecycle platform’s architecture pays dividends a capture-only tool struggles to match.
What deepfake defense costs you in conversion
Every additional liveness challenge you add catches more fraud and loses more legitimate players to friction. The art is calibrating challenge intensity to risk: a $20 deposit from a low-risk geography should sail through passive liveness, while a $5,000 deposit from a high-risk corridor warrants active liveness plus document re-capture. Both vendors support risk-based step-up, but Sumsub’s visual “levels” model makes this calibration a configuration task rather than a code change – a meaningful operational advantage when your fraud team needs to retune rules weekly, not quarterly.
Bonus Abuse and Multi-Accounting: A Closer Look
Of the four iGaming fraud vectors, bonus abuse is the one operators most consistently underestimate – and the one a pure document-verification tool is least equipped to stop. A welcome bonus is free money by design; the entire fraud model is to claim it as many times as possible across fabricated identities.
Why document checks alone miss it
A sophisticated bonus abuser does not present a fake document. They present a real, valid document – just dozens of slightly different real identities, often purchased or synthetically assembled, each passing a clean document check. Verification that stops at “is this a valid passport?” returns GREEN every time. Catching the abuse requires correlating signals across accounts: shared device fingerprints, recurring payment instruments, behavioral patterns, and document-field cross-matching. This is the “full spectrum” coverage Gambling IQ credited Sumsub with in its 2026 ranking, and it is structurally outside the remit of a capture-only SDK.
Device fingerprinting and graph analysis
The decisive technology is the link graph: connecting accounts through device IDs, IP ranges, payment tokens, and behavioral telemetry to expose clusters that share a hidden operator. When forty accounts trace back to three devices and one card, the graph lights up even though every individual document is genuine. Operators running affiliate programs face an adjacent version of this problem – fraudulent affiliates farming their own offers – and the same graph infrastructure addresses both.
The economics of getting it wrong
Bonus-abuse losses are insidious because they masquerade as marketing spend. A campaign that looks like it converted 5,000 new depositors but actually fed 1,200 fraudulent multi-accounts has quietly burned a quarter of its budget and skewed every downstream metric. A verification platform that suppresses this at onboarding pays for itself many times over in protected marketing efficiency, which is why TCO modeling that ignores fraud-loss avoidance dramatically understates a lifecycle platform’s value.
Migration: Switching KYC Providers Without Downtime
Many operators reading this already run an incumbent vendor and are weighing a switch. Migration risk is real but manageable, and notably Sumsub publishes a dedicated provider-switch program – the top organic SERP result for this comparison is literally Sumsub’s “Switch KYC Provider” page, a signal of how actively it competes for displacement deals.
The dual-run strategy
The safest migration is never a hard cutover. You run the new vendor in shadow mode against live traffic – sending the same verifications to both systems and comparing outcomes – for two to four weeks before flipping the production decision authority. This surfaces edge-case discrepancies (a document type the new vendor handles differently, a stricter liveness threshold) without exposing players to a broken flow. Both Sumsub and Onfido support the webhook architecture that makes dual-run practical.
Migrating historical verification records
Regulators expect continuity: switching vendors does not reset your obligation to retain prior verification evidence. Plan to export historical applicant records, decisions, and document images from your incumbent and either import them into the new platform or archive them in a compliant store the new platform can reference. Underbudgeting this data-migration step is the most common cause of a switch slipping by months.
Re-verification cadence after switching
A clean switch does not force every existing player through fresh KYC – that would be a conversion catastrophe. Instead, you honor existing valid verifications and apply the new vendor only to new players and to natural re-verification triggers (first withdrawal, periodic AML rescreening, risk-score changes). Sumsub’s lifecycle model makes this graceful transition straightforward because re-verification is already a first-class concept in the platform rather than a bolt-on.
Data Privacy, Residency, and GDPR
Identity verification is, by definition, the processing of the most sensitive personal data a person owns: their face and their government documents. For an EU-facing operator, mishandling it is a GDPR exposure measured in percentages of global turnover, not flat fines. Vendor choice is a data-protection decision as much as a fraud decision.
Data residency and processing location
Where verification data is stored and processed matters for both GDPR and individual license conditions. Operators should confirm regional data-residency options – EU data staying in the EU, for instance – and review each vendor’s sub-processor list. As part of Entrust, Onfido inherits a large enterprise compliance apparatus; Sumsub, as an independent platform serving heavily regulated verticals, has built residency and certification options directly into its product. Confirm the specifics for your jurisdictions in writing during procurement.
Data minimization and retention
The GDPR principle of data minimization sits in genuine tension with iGaming’s regulatory demand to retain verification evidence for years. The resolution is a configurable retention policy that keeps what regulators require and purges what they do not. A platform that manages KYC, AML, and monitoring in one place can enforce a coherent retention policy across the whole lifecycle; a stitched-together stack risks orphaned copies of biometric data sitting in a forgotten add-on – exactly the kind of finding that turns a data-protection audit into an enforcement action.
Player rights and the right to erasure
Players can exercise GDPR rights including access and, within regulatory limits, erasure. Honoring a deletion request across a single integrated platform is a defined workflow; honoring it across a capture vendor plus a separate monitoring tool plus an archive means three coordinated deletions and three audit logs to reconcile. Operational simplicity here is not a luxury – it is the difference between a compliant response and a missed deadline.
Three-Year Total Cost of Ownership Model
Per-check pricing is a snapshot; TCO is the movie. Modeling three years exposes costs that a procurement spreadsheet focused on unit price entirely misses – and it is where the Sumsub-versus-Onfido gap is widest for a scaling operator.
| Cost component (Year 1, 50k checks/mo) | Sumsub (modeled) | Onfido (estimated) |
|---|---|---|
| IDV checks (annual) | ~$810,000 | $1.2M-$1.8M |
| AML screening (annual) | ~$342,000 | Separate add-on |
| Manual-review overhead | Lower (broad doc library) | Higher (narrower library) |
| Monitoring/lifecycle tooling | Native (included) | Add-on/external |
| Integration & maintenance | One platform | One platform + add-ons |
| Minimum commitment | $149/mo floor | $50k-$200k annual |
The volume-discount curve
Both vendors discount at volume, so the list prices above compress as you scale – but they compress from different starting points and along different curves. Sumsub’s published floor pricing gives mid-market operators a transparent baseline to negotiate from; Onfido’s custom-quote model means your effective price depends heavily on your negotiating leverage and contract size. For a high-growth operator, the predictability of a published curve is itself a budgeting asset.
Fraud-loss avoidance: the invisible line item
The largest number in any honest TCO model is not what you pay the vendor – it is the fraud you don’t suffer. A platform that catches bonus abuse, account takeover, and laundering across the lifecycle avoids losses that dwarf the per-check spend. Modeling only invoice cost and ignoring loss avoidance systematically favors the cheaper-looking capture tool while hiding the platform’s real return. Build the avoidance line into your model explicitly, even with conservative assumptions.
When Onfido’s TCO actually wins
To be fair to Onfido: if your verification volume is modest, your traffic concentrates in a few well-covered countries, your AML needs are light, and you already license Entrust IAM, the integration synergy and capture quality can flip the TCO in Onfido’s favor. TCO is genuinely operation-specific – which is the entire reason to model your own numbers rather than trust either vendor’s headline.
Support, SLAs, and Implementation Experience
The vendor relationship does not end at signature – it begins there. Over a multi-year contract, the quality of support, the strength of the SLA, and the smoothness of implementation often matter more to your team’s daily reality than a few cents of per-check pricing. This is also where the independent-platform-versus-enterprise-giant contrast is sharpest.
Onboarding and time-to-launch
Sumsub’s self-serve entry point at $149/month and its visual “levels” configuration let a small team stand up a working verification flow in days, often without a sales call at all. Onfido, oriented to enterprise deals, typically runs a more structured implementation with a solutions team – slower to start but with more hand-holding for complex, multi-market rollouts. Neither approach is universally better; a two-person startup and a 500-person sportsbook want opposite things from onboarding.
SLAs and uptime guarantees
Verification sits directly in your deposit funnel, so vendor downtime is lost revenue in real time. Both vendors offer enterprise SLAs with uptime commitments, but the contractual specifics – guaranteed uptime percentage, support response times, escalation paths, and remedies – vary by tier and by how hard you negotiate. Get every number in writing, and insist on credits, not just apologies, for breaches. A 99.9% SLA still permits nearly nine hours of downtime a year; for a high-volume operator that can be a six-figure event.
Ongoing rule tuning and account management
Fraud is adversarial and constant, so your verification rules are never “done.” You will retune thresholds, add document types, and adjust risk levels continuously. Sumsub’s configuration-first model lets your own fraud team make most of these changes without engineering tickets; enterprise Onfido deployments often lean on an assigned account manager for tuning. The right fit depends on whether you want self-service agility or managed-service depth – and on whether your team has the fraud expertise to drive tuning itself.
Frequently Asked Questions
Is Sumsub cheaper than Onfido for iGaming KYC?
On published 2026 figures, yes. Sumsub lists $1.35 per IDV and $0.57 per AML check, while Onfido is estimated at $2-$3 per IDV with custom enterprise contracts that comparison sources place at $50,000-$200,000 annually.
Does Onfido being part of Entrust change anything?
Yes. Onfido now sits inside Entrust’s identity-and-security portfolio, bringing enterprise resources and IAM integration but folding it into a broader, custom-quote enterprise sales motion with less public iGaming-specific pricing detail.
Which vendor is better for AML compliance?
Sumsub, for most operators. It offers native AML screening at a published $0.57 per check plus ongoing transaction monitoring, whereas Onfido’s monitoring is more commonly an add-on or external integration.
How many document types does each support?
Sumsub supports 14,000+ document types across 220+ countries per 2026 comparisons. Onfido’s coverage is strong but estimated lower at roughly 2,500 types across 195+ countries.
What is the 76% statistic about?
Sumsub’s internal data indicates 76% of fraud attempts occur after initial verification – the core argument for choosing a lifecycle platform with ongoing monitoring rather than a one-time capture SDK.
Can either integrate with login/authentication flows?
Both can, but Sumsub shipped a native Auth0 integration in May 2026 that embeds identity verification directly into login flows, enabling session-level re-verification against account takeover.
Which is faster to integrate for a small team?
Teams generally report a faster time-to-first-verification with Sumsub’s visual “levels” dashboard and $149/month entry, versus Onfido’s more code-first applicant model and enterprise onboarding.
Do I still need geolocation if I use Sumsub or Onfido?
Yes. KYC verifies identity; it does not verify physical location. Licensed operators still need a real-time geolocation layer (the category GeoComply leads) to prove a player is within a permitted jurisdiction at the moment of play.
