--- title: Identity Governance & AML Infrastructure entity: SwissChain Holding SA jurisdiction: Switzerland doc_type: infrastructure status: in_progress last_reviewed: 2026-03-09 owner: TBD evidence_level: public source_urls: [] related_docs: [] --- # SUMSUB Identity Governance, AML & Travel Rule Infrastructure (Regulatory & Technical Memorandum) ## I. Systemic Role within SwissChain Control Architecture Within SwissChain's overall control architecture, Sumsub operates as the primary identity governance, AML and Travel Rule orchestration layer. It provides end-to-end verification and screening across natural persons, legal entities, transactions and virtual asset transfers, effectively functioning as the policy execution engine for customer due diligence, sanctions and PEP controls, and counterparty risk management across jurisdictions. Operationally, this positions Sumsub upstream of trade execution and custody: no client or transaction should progress to the DFNSbacked custody layer or to trading/fiat rails without passing through Sumsubdriven checks calibrated to SwissChain's risk appetite and regulatory perimeter. This separation is structurally important because it allows SwissChain to demonstrate to banks, listing venues and supervisors that governance over "who can transact" and "under what conditions" is concentrated in a dedicated, certifiably secure identity and AML platform rather than scattered across product systems. The systemic function extends beyond onboarding. Sumsub's transaction monitoring, sanctions screening and Travel Rule modules enable continuous control of client behaviour, counterparties and wallet interactions, including those involving unhosted wallets and external VASPs. In risk terms, this means Sumsub is not merely a KYC intake tool but part of the ongoing risk engine: it monitors transactional patterns, screens counterparties against sanctions, PEP and adverse media sources, and determines whether Travel Rule obligations are correctly fulfilled and documented for each qualifying transfer. For SwissChain, the implication is that Sumsub is a systemic vendor: failure, misconfiguration or unavailability would directly impact SwissChain's ability to comply with FATF Recommendations 10, 15 and 16, EU AML rules and Travel Rule obligations for CASPs, and related expectations of banking partners and listing authorities. ## II. Legal Nature, Regulatory Perimeter and Market Positioning Sumsub is a private technology provider offering identity verification, business verification, AML screening, fraud prevention and Travel Rule services to financial institutions, fintechs, VASPs, gaming operators, marketplaces and other digital platforms. It does not operate as an exchange, depository institution or brokerdealer, and does not itself take client asset risk; instead, it processes personal and business data, performs screening and monitoring, and exposes decisioning outputs via APIs and dashboards to regulated clients. This legal posture means that SwissChain does not outsource regulatory accountability for AML/CFT to Sumsub but outsources the technical and operational implementation of significant components of its CDD and monitoring framework, remaining responsible for policy definition and oversight. Sumsub publicly reports serving clients across crypto, fintech, gaming, mobility and other sectors, and has been recognized as a Leader in industry assessments such as the Gartner Magic Quadrant for Identity Verification for two consecutive years (2024 and 2025) and the IDC MarketScape for identity verification in financial services. According to publicly available materials, Sumsub supports over 14,000 document types across more than 220 countries and territories in 50+ languages, and its verification platform processes verification volumes in the millions daily. The company's Travel Rule solution publicly reports integration with over 1,800 VASPs and more than 400 reachable VASPs across widely used protocols including TRP, GTR, CODE and Sygna, supporting more than 10,000 assets and securing over USD 3.4 trillion in transactions in 2025. This scale and positioning are material in institutional due diligence: SwissChain can evidence reliance on a vendor with extensive production experience in financial and virtual asset sectors, rather than a niche or unproven supplier, thereby reducing perceived implementation and continuity risk. ## III. Certification and Assurance Framework Sumsub publicly discloses a security and privacy posture aligned with major international standards, including ISO/IEC 27001 for information security management, ISO/IEC 27017 for cloud security, ISO/IEC 27018 for protection of personally identifiable information in public clouds, SOC 2 Type II for control effectiveness over time, PCI DSS for payment data security and ISO 9001 for quality management. ISO/IEC 27001, 27017 and 27018 provide a structured ISMS, cloudspecific controls and cloud privacy protections, respectively, which are directly relevant to supervisory expectations on thirdparty ICT and data processing risk, including under EU DORAaligned guidance and FINMA outsourcing circulars. SOC 2 Type II attestation demonstrates that Sumsub's security and availability controls are not only designed appropriately but have operated effectively across the audit period, which is a key criterion for Big4 assurance teams when relying on vendor controls. Data protection assurances are anchored in Sumsub's explicit alignment with EU GDPR, UK GDPR and CCPA, with privacy notices distinguishing between Sumsub acting as data controller for its own business and as a service provider (processor) for client use of the verification platform. Crucially for SwissChain's cross-border posture, Sumsub enables storage and processing of applicants' personal data within chosen AWS regions and automatically routes verification flows to the designated regional domain, allowing enforcement of data residency and data transfer risk appetites at configuration level. Sumsub publicly reports 99.996% platform uptime, indicating operational resilience aligned with highavailability expectations for critical infrastructure. While Sumsub does not publicly disclose every detail of its incident response metrics, RTO/RPO or penetration testing cadence, SwissChain can rely on this certification and privacy framework as a baseline, subject to contractual augmentation (e.g. SLA commitments, breach notification timelines) and periodic review of underlying reports under NDA to satisfy audit and supervisory expectations for outsourced critical services. ## IV. Core Technical Architecture and Control Surface Sumsub's platform combines user verification (KYC), business verification (KYB), transaction monitoring, AML screening, fraud prevention and Travel Rule functions within a single orchestration environment. The identity verification stack supports more than 14,000 document types across over 220 countries and territories and covers 50+ languages, using AIdriven OCR and document classification to handle multiple scripts, including nonLatin alphabets, while layering biometric checks and liveness detection for identity proofing. Sumsub publicly notes that its verification processes are designed to complete within seconds, balancing speed with accuracy, and that fraud prevention capabilities leverage behavioural analysis and pattern recognition to detect synthetic identities, document manipulation and account takeover attempts. In addition to traditional documentbased KYC, Sumsub's public materials reference nondocument verification capabilities compliant in more than 20 countries and capable of verifying users via government or banking databases, which gives SwissChain additional flexibility to adapt identity methods to jurisdictional requirements and market expectations without changing providers. AML and sanctions screening are performed in real-time against global watchlists, PEP lists and adverse media sources, with Sumsub indicating in its public product materials the use of more than 40,000 independent data sources spanning over 240 countries and territories for AML screening. Public documentation refers explicitly to coverage of UN Security Council sanctions and the EU consolidated sanctions list, and generically to "global sanctions and watchlists" and PEP/adverse media. While Sumsub does not publicly enumerate every national regime such as OFAC or HM Treasury individually, these details must be verified in vendor due diligence files to ensure alignment with SwissChain's sanctions policy. Transaction monitoring capabilities extend to rulebased detection of suspicious activity, combining behavioural analysis with sanctions, PEP and adverse media hits and integrating with blockchain analytics partners for crypto flows. The Travel Rule module is architected as a protocolagnostic layer connected to a directory of more than 1,800 VASPs and 400+ reachable VASPs through major protocols such as TRP, GTR, CODE and Sygna, covering more than 10,000 assets and having secured USD 3.4 trillion in transactions in 2025 according to public reporting. It incorporates VASP due diligence data (jurisdiction, regulatory status and other risk attributes), unhosted wallet verification, integrated AML checks and an advanced rules engine, with full API and webapp access. Sumsub publicly reports that the Travel Rule solution offers over 10 ready-to-use jurisdiction-specific compliance rule bundles covering 35+ jurisdictions and supports automated compliance workflows. For SwissChain, this means Travel Rule compliance can be embedded directly into transaction initiation and review flows rather than treated as a separate point solution, with the same case management and audit trail mechanisms used for broader AML and fraud workflows. ## V. Risk Mitigation Mechanics and Residual Risk Sumsub's riskmitigation value derives from both coverage and orchestration. On the coverage side, the ability to verify users and documents across more than 220 jurisdictions with over 14,000 document types and 50+ languages reduces the likelihood of weak or fragmented onboarding processes for specific geographies, which is a recurrent weakness in cross-border digital asset businesses. The operational scale—Sumsub publicly reports processing verification volumes in the millions per day and is recognized in industry assessments as serving thousands of clients—enables continuous retraining of fraud and anomalydetection models, including spoof and synthetic identity detection, which is pertinent to FATF's focus on emerging fraud typologies and online onboarding risks. On the orchestration side, Sumsub's unified platform allows SwissChain to define riskbased workflows that combine KYC/KYB, sanctions and PEP screening, transaction monitoring, Travel Rule checks and fraud analytics into consistent decision trees, rather than relying on manual bridging between loosely integrated tools. This makes it possible to calibrate risk scores and escalation paths so that, for example, highrisk jurisdictions, adverse media signals and suspicious crypto wallet behaviour are jointly evaluated before assets are moved to or from DFNSsecured wallets. Continuous monitoring of sanctions, PEP/adverse media and transaction patterns supports compliance with FATF Recommendations 10 (ongoing due diligence), 15 (new technologies) and 16 (wire transfers/Travel Rule), provided SwissChain sets appropriate parameterization and manual review capacities. However, the concentration of identity and AML controls in a single vendor introduces correlated vendor and model risk. SwissChain's ability to detect sanctions exposure, synthetic identities or suspicious Travel Rule flows becomes dependent on Sumsub's uptime, data quality and model performance, and on the breadth of sanctions lists actually implemented behind the generic "global sanctions" label. Residual risk therefore includes: potential blind spots in sanctions coverage if certain national lists are not included or updated; opacity of AI model decisioning; and operational dependency on Sumsub's infrastructure and AWS regions. These must be mitigated through contractual SLAs, independent testing of screening outputs, periodic benchmarking with alternative data sources, and governance processes that allow SwissChain to override, supplement or, if necessary, replace Sumsub's decisions in specific risk scenarios. ## VI. Integration with SwissChain Stack and Control Flows Technically, Sumsub integrates into SwissChain's onboarding portals, CRM, trading frontends, payment rails and custody workflows via APIs and SDKs, so that all client and counterparty onboarding and key transactional events are routed through a consistent verification and screening layer. User and entity data, verification outcomes, risk scores and watchlist hits are returned to SwissChain's internal systems of record, where they become part of the master customer and counterparty profile that governs entitlements, product access and transaction thresholds. This ensures that downstream components—DFNS custody orchestration, core ledgers, matching engines and payment gateways—operate on identities and counterparties whose risk has been assessed under a uniform policy framework. For custody sequencing in particular, integration between Sumsub and DFNS allows SwissChain to impose technical enforcement of riskbased rules on actual key usage. For example, DFNS wallet policies and whitelists can be configured so that withdrawals to external addresses are permissible only if the originator and beneficiary identities have been verified in Sumsub, if the Travel Rule counterparty VASP has an acceptable risk rating and regulatory status, and if the target wallet has passed blockchain analytics screening via Sumsub's integration capabilities. This linkage between identity/AML decisioning and cryptographic signing enforces that highrisk or noncompliant transactions are technically blocked before private key operations occur, which is central to demonstrating that SwissChain's AML and sanctions policies are hardwired into its custody infrastructure rather than merely documented. ## VII. Auditability, Supervisory Defensibility and Strategic Implications Sumsub's integrated case management, analytics and FIU reporting capabilities provide a unified audit trail for every onboarding event, alert, Travel Rule transfer and sanctions/PEP hit, including investigator actions and final decisions. For SwissChain, this allows external auditors and regulators to trace specific customer journeys and transactions from initial verification through to ultimate outcomes, using consistent log formats and data exports rather than reconstructing evidence from multiple unaligned systems. The Travel Rule solution explicitly emphasizes verifiable trails per transaction, including unhosted wallets, which assists in satisfying requirements to demonstrate complete originator and beneficiary information flows and timely sharing with counterparties. Strategically, positioning Sumsub as the central identity and AML infrastructure partner, supported by ISO and SOC 2 Type II attestations, GDPRaligned processing and a large, VASPrich Travel Rule network, allows SwissChain to articulate a coherent institutional control narrative to banks, listing venues and investors: that its exposure to sanctions, AML and Travel Rule failures is mitigated by a mature, independently audited RegTech stack operating at global scale. At the same time, SwissChain must document in its vendor governance framework that this reliance is controlled: Sumsub is classified as a critical outsourced function, subject to periodic performance and coverage reviews, scenario testing, and the ability to layer additional controls or invoke replacement options if risk tolerance is exceeded. Managed in this way, Sumsub becomes not simply a verification vendor but a core institutional control pillar, materially strengthening SwissChain's banking defensibility and listing readiness by showing that identity, AML and Travel Rule compliance are implemented through an industrialised, auditdefensible infrastructure rather than internal ad hoc builds.