Pre-KYC

# Pre-KYC **Pre-KYC** answers "**Who is this user?**". It verifies the user holds a genuine government document and, optionally, that they meet an age floor, come from an allowed country, and clear the OFAC sanctions list. It's the richest workspace: the only one where you can also ask the user to **reveal** document fields. Use it when you need identity-grade assurance before (or instead of) a full KYC process (hence the name). ## What the user proves - They hold a **genuine, government-signed document** (at your chosen [security level](/docs/self-enterprise/flows/disclosures/#security-level)). - Optionally, that they meet a **minimum age**, without revealing their birth date. - Optionally, that their document's country is **not on your denylist** (country stays hidden) or **is on your allowlist** (nationality is revealed). - Optionally, that they **clear the OFAC sanctions list**. ## What you receive - A `valid` / `invalid` result via the [`verification.completed` webhook](/docs/self-enterprise/webhooks/events/), with the enforced rules echoed in `proof_attributes`. - A [nullifier](/docs/self-enterprise/get-started/how-it-works/#one-account-per-person-nullifiers) for duplicate detection. - The values of any **Additional data** reveals you enabled. Pre-KYC is the only workspace with reveals: `Full name`, `ID number`, `Date of birth`, `Gender`, `Nationality`, `Expiration date`, `Issuing state` Each reveal is off by default. A reveal returns real personal data, so request only what you need and handle it accordingly. See [Disclosures](/docs/self-enterprise/flows/disclosures/#additional-data-reveals). For example, a `valid` webhook for a flow with an 18+ floor, a country denylist, OFAC on, and the **Full name** and **Nationality** reveals enabled carries: ```json { "minimumAge": 18, "excludedCountries": ["PRK", "IRN"], "ofac": true, "name": "JANE DOE", "nationality": "USA" } ``` The first three keys echo the rules that were enforced (the pass/fail answer is the event's `status`); `name` and `nationality` are reveal values, present only on `valid` and only for fields you enabled. ## Rules you can configure | Rule | Default | Notes | | ------------------ | ----------- | ---------------------------------------------------------------------------------- | | Security level | Hi-security | Standard also accepts non-chip documents like KYC attestations. | | Minimum age | 18 | 13–110. Pass/fail only. The birth date stays hidden. | | Excluded countries | — | Denylist. The user's country is never revealed. | | Included countries | — | Allowlist, mutually exclusive with the denylist. Forces the Nationality reveal on. | | OFAC | On | Checked against the daily-updated US Treasury list. | | Additional data | All off | The seven reveals above. | ## Use cases - **Fintech and regulated onboarding**: screen users (age, geography, sanctions) before running an expensive full-KYC provider, or replace one where attribute-level verification is enough. - **Marketplaces**: verify both sides of a trade without storing PII yourself. - **Compliance gating**: block sanctioned or restricted-region users at signup with an auditable record. - **Account recovery / high-trust actions**: re-verify a user's identity attributes before sensitive changes. ## Cost **25 credits** per completed verification (tied with Custom Config for the highest), reflecting the document-level assurance and reveals. See [Credits and usage](/docs/self-enterprise/billing/credits-and-usage/).

On this page

What the user proves
What you receive
Rules you can configure
Use cases
Cost

Pre-KYC answers “Who is this user?”. It verifies the user holds a genuine government document and, optionally, that they meet an age floor, come from an allowed country, and clear the OFAC sanctions list. It’s the richest workspace: the only one where you can also ask the user to reveal document fields.

Use it when you need identity-grade assurance before (or instead of) a full KYC process (hence the name).

What the user proves

They hold a genuine, government-signed document (at your chosen security level).
Optionally, that they meet a minimum age, without revealing their birth date.
Optionally, that their document’s country is not on your denylist (country stays hidden) or is on your allowlist (nationality is revealed).
Optionally, that they clear the OFAC sanctions list.

What you receive

A valid / invalid result via the verification.completed webhook, with the enforced rules echoed in proof_attributes.
A nullifier for duplicate detection.
The values of any Additional data reveals you enabled. Pre-KYC is the only workspace with reveals:

Full name, ID number, Date of birth, Gender, Nationality, Expiration date, Issuing state

Each reveal is off by default. A reveal returns real personal data, so request only what you need and handle it accordingly. See Disclosures.

For example, a valid webhook for a flow with an 18+ floor, a country denylist, OFAC on, and the Full name and Nationality reveals enabled carries:

{
  "minimumAge": 18,
  "excludedCountries": ["PRK", "IRN"],
  "ofac": true,
  "name": "JANE DOE",
  "nationality": "USA"
}

The first three keys echo the rules that were enforced (the pass/fail answer is the event’s status); name and nationality are reveal values, present only on valid and only for fields you enabled.

Rules you can configure

Rule	Default	Notes
Security level	Hi-security	Standard also accepts non-chip documents like KYC attestations.
Minimum age	18	13–110. Pass/fail only. The birth date stays hidden.
Excluded countries	—	Denylist. The user’s country is never revealed.
Included countries	—	Allowlist, mutually exclusive with the denylist. Forces the Nationality reveal on.
OFAC	On	Checked against the daily-updated US Treasury list.
Additional data	All off	The seven reveals above.

Use cases

Fintech and regulated onboarding: screen users (age, geography, sanctions) before running an expensive full-KYC provider, or replace one where attribute-level verification is enough.
Marketplaces: verify both sides of a trade without storing PII yourself.
Compliance gating: block sanctioned or restricted-region users at signup with an auditable record.
Account recovery / high-trust actions: re-verify a user’s identity attributes before sensitive changes.

Cost

25 credits per completed verification (tied with Custom Config for the highest), reflecting the document-level assurance and reveals. See Credits and usage.

Was this page helpful?