Put identity verification inside your WHMCS

This addon wires identity checks straight into your WHMCS order flow. Clients verify in your client area. Orders activate automatically once they pass. Your team stays focused on customers — not documents.

The addon is the WHMCS integration layer — nothing more. All document scanning, liveness, and face matching happen inside Sumsub, using the verification level you configure in your own Sumsub account. The addon never touches your clients' IDs, never runs a liveness check, and never makes a verification decision. It makes Sumsub's output usable where you already work: inside WHMCS. (Sumsub is billed separately by Sumsub.)

Why WHMCS providers need this

• Chargebacks and stolen cards — every fraudulent signup costs you the chargeback fee plus a service you already provisioned. Verifying identity up front kills this at the source.
• Compliance pressure is real — EU AMLD, NIS2, and national AML laws increasingly require customer due diligence for digital services. NIS2 Article 28 asks domain registrars and resellers to verify registrant data. Identity verification is the first piece.
• Manual review drains support — staff reviewing IDs, flagging orders, chasing documents, and cancelling orders nobody completed is a cost you can automate away.

Every piece is WHMCS-native

No proxy dashboards. No second login. No parallel CRM.

• At checkout — order placed → your rules decide whether it needs KYC → the addon creates the Sumsub applicant → order status set to Pending KYC. Everything else activates in seconds, as before.
• In the client area — a verification page + sticky banner inside your theme, hosting the Sumsub WebSDK so clients never leave your portal.
• In real time — a signed Sumsub webhook advances the order the moment the review finishes; a secret-protected cron is the safety net, sends reminders, and cleans up.
• Before the registrar call — for domain orders in scope, the registration or transfer command is held until the registrant has verified (v1.9).
• In the admin panel — a KYC dashboard in your Addons menu: every status, every applicant, every held order, with manual approval and a full audit trail in your WHMCS database. Light and dark admin themes.

What the addon actually does (WHMCS side)

• Order-flow integration — holds matching orders as Pending KYC, releases them via the native AcceptOrder API once approved, re-checks when a client switches the payment gateway on a held invoice. Renewals are never held.
• Five rule types, combined your way — require KYC by product group, by domain TLD (e.g. .cn, .ru), by payment gateway, by order size (amount, item count, or spend over a time window), or by client country (billing address or IP). Each rule acts as a trigger (any match = KYC) or a condition (all must match), so "KYC only for crypto payments over 200 EUR from outside the EU" is one screen, not custom code. Flag individual clients to always require KYC.
• Domain registrant verification (v1.9, NIS2 Article 28) — when the registrant is a third party (a WHMCS contact), the verification link goes to the registrant's own e-mail, not the account holder's. A fail-closed guard in front of the registrar module blocks registration and transfer until the registrant has passed; held commands are re-issued automatically afterwards. Account holders can resend, correct the registrant's name, adopt the verified name, or switch the registrant from the client area. A verified registrant's phone or country change triggers re-verification.
• Checks after approval — age gate (under 18 rejected), name match against the WHMCS account, document country versus billing country, and a duplicate-identity check across clients using a salted document fingerprint (no document data is stored). Mismatches are held for admin review, never silently accepted or silently rejected. Changing name, company, or country on an already verified account re-opens the review.
• Reminders and automatic cancellation — reminder e-mails at the intervals you set (default 24 h and 72 h), optional automatic cancellation of orders nobody completes, and admin alerts (e-mail and optional webhook) for every review that needs a human, every stale queue, and every license problem — throttled so you get one alert, not fifty.
• Audit log and retention — every manual approval, flag, settings change, hold, cancellation, and registrant event is recorded with the acting admin, searchable from the admin area. Verification data is purged automatically after the retention period you configure (default 5 years), with the purge itself logged.
• Sumsub applicant linking — creates the applicant per client (and per registrant) at checkout, stores the applicant ID, keeps both records in sync through the lifecycle, including client re-verification after rejection.
• Secured real-time sync — signed Sumsub webhook (applicantReviewed / applicantWorkflowCompleted, HMAC SHA1/256/512) plus an incremental, lock-protected cron that only touches applicants with pending changes and does a full sweep once a day.
• 14 e-mail templates, all yours to edit — six for clients (verification request, reminder, approved, rejected, retry, cancellation) and eight for registrants and account holders, created automatically on activation and editable under WHMCS e-mail templates.
• Admin dashboard — every applicant and registrant with status pills, Sumsub risk tags, hold reasons in plain words, a live status check, manual approval for edge cases, and a built-in setup guide and status guide. Settings persist across deactivate/reactivate.
• Theme-friendly — client-facing pages inherit your theme (Lagom2, Twenty-One).

What you get

• Unlimited client and registrant verifications (Sumsub fees billed separately by Sumsub)
• Free updates for the whole license year
• Email support from the engineers who wrote the code
• 30-day money-back guarantee · license key emailed instantly

Install in under 10 minutes

Unzip the download and copy the modules/ folder into your WHMCS root, activate in WHMCS Admin, paste your Sumsub keys and license key, configure your KYC rules, add the cron entry and the webhook URL. The built-in setup guide walks you through every step. Upgrades from any earlier version run automatically.

Requirements: WHMCS 9.x, PHP 8.x with the ionCube loader, a Sumsub account with a configured verification level.

Note: This addon requires your own Sumsub account. Sumsub handles and bills for the actual identity verification. TPC Hosting builds and supports the WHMCS integration.