What's the Dilly-o with consumer identity verification (KYC): a buyer's guide for credit unions

The Dilly-o

Synthetic identities can get past traditional identity checks and run for months before they default.³ We'd start by checking what your account opening platform already includes, then test any vendor on deepfake resistance and digital ID readiness before you sign. We'd also get each vendor's answer on mDLs in writing.

How we'd size up a vendor

1. Document and selfie match - ask whether the tool verifies a government ID and matches it to a live selfie.
2. Deepfake resistance matters because criminals can use deepfakes to pass video verification during account opening.³ Ask for test results from outside the vendor, not just its own claims.
3. Digital ID readiness - can the tool read and extract the data from a verifiable digital credential such as an mDL? FinCEN's FAQs say a credit union that accepts these credentials needs technology that can extract the relevant information.²
4. Fit with your account opening - does the tool already connect to your digital banking platform, account opening system and core? A listed integration saves months; a custom build adds cost and risk.

What changed this year

In September 2026, FinCEN's FAQs said a credit union may accept an unexpired government-issued verifiable digital credential if it meets the CIP documentary criteria and its CIP allows it.² The FAQs create no new rule and do not make mDLs mandatory.⁴ Nacha's fraud monitoring rule took practical effect on June 22, 2026.⁵ Its definition of false pretenses covers payments induced by misrepresenting identity, authority or account ownership.⁶

Will it work with your systems?

We've verified that MANTL and Onfido (Entrust) are both listed for Symitar credit unions on Jack Henry's Fintech Integration Network.^C Ask your digital banking and account opening providers which identity vendors they already connect to, and which data passes back to your core.

What your examiner will ask

Your CIP must include procedures to verify identity within a reasonable time after opening, and say when you use documents, non-documentary methods or both.⁷ Your Bank Secrecy Act (BSA) program must be written, approved by your board and reflected in board minutes.⁸ FinCEN's deepfake alert describes fraud typologies, gives red flags and reminds institutions of their BSA reporting duties.⁹ It notes criminals opened accounts with identities suspected to be made with generative AI.¹⁰ Have ready your updated CIP, a board-approved stance on digital IDs, your vendor due diligence and how your tool catches those red flags.

What it costs

Veriff lists three self-serve plans, priced per verification from $0.80.¹¹ Sumsub lists a Compliance tier at $1.85 with a $299 minimum, including AML and proof-of-address checks.¹² Socure does not publish pricing, and buyers report annual minimums starting around $50,000.¹³ Buyers also report Socure platform and support fees of $25,000 to $50,000, plus $48,000 to $96,000 for implementation.¹⁴

Persona's Essential plan starts at $250 a month on a 12-month contract.¹⁵ Vendr reports a $30,000 median annual contract for Persona.¹⁵ Vendr says Persona buyers at 1,000 to 5,000 verifications a month budget $25,000 to $75,000 a year.¹⁶ Vendr also reports Persona implementation fees of $5,000 to $25,000.¹⁷ FluxForce AI's fraud detection guide says to plan 90 to 120 days for a typical credit union integration.¹⁸ NCUA warns that some credit unions signed contracts with heavy termination penalties, though those terms are often negotiable.¹⁹ We'd compare per-verification rates and any annual minimums side by side.

Food for thought

FinCEN's FAQs let your CIP accept mDLs but do not require them.⁴²