KYC Identity Verification for WHMCS

Put identity verification inside your WHMCS

This addon wires identity checks straight into your WHMCS order flow. Clients verify in your client area. Orders activate automatically once they pass. Your team stays focused on customers — not documents.

The addon is the WHMCS integration layer — nothing more. All document scanning, liveness, and face matching happen inside Sumsub, using the verification level you configure in your own Sumsub account. The addon never touches your clients' IDs, never runs a liveness check, and never makes a verification decision. It makes Sumsub's output usable where you already work: inside WHMCS. (Sumsub is billed separately by Sumsub.)

Why WHMCS providers need this

Chargebacks and stolen cards — every fraudulent signup costs you the chargeback fee plus a service you already provisioned. Verifying identity up front kills this at the source.
Compliance pressure is real — EU AMLD, NIS2, and national AML laws increasingly require customer due diligence for digital services. Identity verification is the first piece.
Manual review drains support — staff reviewing IDs, flagging orders, and chasing documents is a cost you can automate away.

Every piece is WHMCS-native

No proxy dashboards. No second login. No parallel CRM.

At checkout — order placed → the addon creates the Sumsub applicant → order status set to Pending KYC.
In the client area — a verification page + sticky banner inside your theme, hosting the Sumsub WebSDK so clients never leave your portal.
Via cron — polls for results → accepts orders using the native WHMCS AcceptOrder API → sends your WHMCS email templates.
In the admin panel — a KYC dashboard in your Addons menu: every status, every applicant, with a manual-approve override and an audit trail in your WHMCS database.

What the addon actually does (WHMCS side)

Order-flow integration — holds matching orders as Pending KYC, releases them via AcceptOrder once approved, using native WHMCS statuses throughout.
Sumsub applicant linking — creates the applicant per client at checkout, stores the applicant ID, keeps both records in sync through the lifecycle.
Client-area embed — verification page + sticky banner inside your client area (the WebSDK itself is Sumsub's).
Age gate (under 18) — reads the date of birth Sumsub returns and rejects applicants under 18.
Name match vs WHMCS account — compares the name Sumsub extracts from the ID with the WHMCS client record; on mismatch, resets the applicant and emails them to retry.
Granular targeting rules — require KYC by product group, by individual domain TLD (e.g. .cn, .ru), or for specific flagged customers. Shared hosting keeps activating in seconds.
Secured real-time sync — a signed Sumsub webhook (applicantReviewed / applicantWorkflowCompleted, HMAC SHA1/256/512) advances orders in real time, with a secret-protected cron as the activation safety net.
Admin dashboard — lists every applicant and status, Sumsub risk tags, a live status check, and manual-approve for edge cases; settings persist across deactivate/reactivate.
Theme-friendly — client-facing pages inherit your theme (Lagom2, Twenty-One).

What you get

Unlimited client verifications (Sumsub fees billed separately by Sumsub)
Free updates for the whole license year
Email support from the engineers who wrote the code
30-day money-back guarantee · license key emailed instantly

Install in under 10 minutes

Upload the ZIP to /modules/addons/, activate in WHMCS Admin, paste your Sumsub keys, set which product groups require KYC, add the cron entry. Done.

Note: This addon requires your own Sumsub account. Sumsub handles and bills for the actual identity verification. TPC Hosting builds and supports the WHMCS integration.

There are no reviews yet!

Be the first to review KYC Identity Verification for WHMCS.

Version Compatibility

Compatible with WHMCS v9.0

Full Version Compatibility

Selected versions of WHMCS v9.0
9.0.0 - 9.0.6

Support for this product

The best place to start if you need help with a specific product is to contact the developer. All WHMCS Marketplace developers have both a website and support URL listed.

Visit Website Contact Support

Developed By TPC Hosting

Changelog

v1.2 Released July 1st, 2026

Latest Version

1.2 — 23 June 2026 (current)

The release that made the addon configurable from inside itself, and hardened it for production use on someone else's WHMCS.

Added

Settings tab — all credentials moved into the addon's own mod_sumsub_settings table, so they survive deactivate/reactivate. Secrets are never echoed back.
Mandatory KYC tab — require verification by product group, by individual domain TLD, or with a master toggle for all domain orders.
Customers tab — flag individual clients as KYC-required regardless of what they order, from the tab or from a button on the client profile.
Setup Guide tab — end-to-end walkthrough with a live readiness checklist and copy-ready webhook and cron URLs for your install.
Status Guide tab — reference for every status and fail reason the dashboard can show.
Latin-name matching as a mandatory check, plus an admin nav restyle.

Changed

Addon folder renamed sumsub → tpckycsumsub; module label is now "TPC KYC - Sumsub". Existing settings migrate automatically on first load after the upgrade.
A failed name match now holds the record for manual review instead of auto-failing the customer.
Applicants resolve by their stable externalUserId, so a verified result still displays after an applicant is reset or recreated at Sumsub.
Dashboard: newest-first ordering, plus a full client-side table with per-page sizing, sort on any column, and search across all columns.
Webhook secret split out of the App Secret Key into its own WEBHOOK_SECRET setting.

Fixed

Webhook signature verification now reads Sumsub's X-Payload-Digest headers — previously every delivery was rejected with HTTP 403.
Cron matches the KYC name against tblclients order-insensitively.
The user-verification email now receives the verification_url merge field.
Duplicate KYC rows prevented via a unique index on userId.
Cron output is timestamped; the cron secret can be passed via CLI argument as well as a GET parameter.
30-second cURL timeouts throughout, to stop requests hanging indefinitely.

Security

HMAC signature verification on the webhook — blocks spoofed status updates.
CSRF protection on the client-area KYC form and on manual-approve, which moved from a GET link to a protected POST form.
IDOR and XSS fixes in the status-check endpoint via strict userId validation and output escaping.
API payloads built with json_encode to prevent JSON injection; applicant IDs URL-encoded.
License enforcement hardened — every entry point now fails closed.

1.1 — 5 March 2026

Added

Age gate — applicants under 18 are rejected automatically, with under_18 recorded as the fail reason.
Name matching against the WHMCS client record, with ASCII normalisation and a name_mismatch fail reason.
Sumsub RED review answers now fail the record and store the reject label as the fail reason.
Fail reasons surfaced in the admin dashboard.

Fixed

Full name stored correctly on the KYC record.
placeOfBirth removed from the Sumsub applicant payload.
Missing failed status language key added; the init status now displays as "Initialized".

1.0 — 1 March 2026

First release. Sumsub applicant creation at checkout, orders held as Pending KYC, client-area verification page hosting the Sumsub WebSDK, status-sync cron with automatic order activation via AcceptOrder, admin dashboard, and license validation.