Find every owner. Verify every UBO.

You are integrating Didit into an Ultimate Beneficial Owner (UBO) verification flow for an obliged entity (fintech, bank, EMI, payments PI, crypto exchange, marketplace, gaming operator). Three obligations on every onboarded company:

  1. Pull the legal entity from the registry — name, officers, share capital, registered address, status.
  2. Walk the ownership chain — surface every natural-person UBO above the 25% threshold (or whoever exercises control without ownership).
  3. Know Your Customer (KYC) each UBO + screen the entity AND each UBO against 1,300+ sanctions, Politically Exposed Persons (PEP), and adverse-media lists.

Bundle pricing (live, verified 2026-05-16):
  - User Verification (KYC) bundle: $0.33 per person (Sessions API call — ID + Liveness + Face Match + Device & IP + AML)
  - AML Screening standalone: $0.20 per check on the entity, or bundled into each UBO KYC
  - Ongoing AML Monitoring: $0.07 per person per year (automatic — no extra endpoint)
  - First 500 verifications free every month, forever

PRE-REQUISITES
  - Production API key from https://business.didit.me (sandbox key in 60 seconds, no credit card).
  - Webhook endpoint with HMAC SHA-256 verification of the X-Signature-V2 header.
  - A workflow_id from the no-code Workflow Builder that bundles ID Verification + Passive Liveness + Face Match 1:1 + Device & IP Analysis + AML Screening.
  - Business Verification (Know Your Business (KYB)) module enabled in the Business Console. KYB is the entry point — it returns the entity record + the discovered UBOs that drive the rest of the flow.

STEP 1 — Open the KYB record on the legal entity

  Business Verification spawns the entity check, pulls officers + share capital + registered address from the local registry (220+ jurisdictions supported), runs entity AML on 1,300+ lists, and surfaces every natural-person UBO above your configured threshold (default 25%).

  When the KYB completes, the response contains an array of discovered UBOs — name, date of birth, nationality, ownership percentage, role (direct shareholder, indirect via holding, control without ownership, nominee, senior-management fallback).

STEP 2 — Loop: open one KYC session per discovered UBO

  POST https://verification.didit.me/v3/session/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body:
    {
      "workflow_id": "<wf id with KYC + AML modules>",
      "vendor_data": "<your entity-id>::ubo::<ubo-index>",
      "callback": "https://<your-app>/kyb/ubo/callback",
      "metadata": {
        "purpose": "ubo_verification",
        "entity_id": "<your internal entity id>",
        "ubo_name": "<full name as discovered>",
        "ownership_pct": "<percent rounded to one decimal>"
      }
    }

  Response: 201 Created with the hosted session URL. Send the UBO an email or text with the URL — they complete the verification on their phone, hosted by Didit, no app install. Sub-2-second median verdict.

STEP 3 — Read the signed webhook on each UBO KYC completion

  Didit POSTs to your callback. Session statuses are Title Case With Spaces:

  Body (excerpted):
    {
      "session_id": "<uuid>",
      "vendor_data": "<entity-id>::ubo::<ubo-index>",
      "status": "Approved",
      "id_verification": { "status": "Approved" },
      "liveness": { "status": "Approved" },
      "face": { "status": "Approved", "similarity_score": 0.94 },
      "ip_analysis": { "status": "Approved" },
      "aml": { "status": "Approved", "hits": [] }
    }

  Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.

  Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.

  Aggregate at the entity level: the entity is onboarded only when EVERY UBO returns Approved AND the entity AML returns no blocking hit.

STEP 4 — Retrieve the full decision later

  GET https://verification.didit.me/v3/session/{sessionId}/decision/
  Headers:
    x-api-key: <your api key>

  Returns the full decision payload: document scan + extracted Machine-Readable Zone (MRZ), biometric similarity, AML hit list with source-watchlist references, device + IP risk signals, 200+ fraud signals, HMAC signature on the entire payload.

  Use this to assemble the per-entity evidence pack a supervisor expects to see: registry extract + ownership chart + per-UBO decision + entity AML + signed timestamps.

STEP 5 — Ongoing AML monitoring is automatic

  Every approved person (entity officer, UBO) is re-screened DAILY against the same 1,300+ lists. There is NO separate endpoint to call.

  When a previously-approved UBO crosses an AML threshold:
    - The session status changes to "In Review" or "Declined" automatically.
    - A signed webhook fires with the new hits + a link back to the original onboarding evidence.
    - A case opens in the Business Console for your compliance team.
    - File a Suspicious Activity Report (SAR) directly from the case if your jurisdiction requires it.

  Cost: $0.07 per person per year on heavy-volume accounts (single-digit dollars on a million-UBO base — orders of magnitude cheaper than a manual review queue).

WEBHOOK EVENT NAMES
  - Sessions: status changes flow through the standard session webhook (verify X-Signature-V2).
  - The KYB entity check fires the same webhook on completion.

CONSTRAINTS
  - Session statuses use Title Case With Spaces (Approved, In Review). Never UPPER_SNAKE_CASE on a session.
  - The 25% UBO threshold is a default; configure your own per workflow (some jurisdictions require 10% or 5% for high-risk client categories).
  - When no person meets the threshold, the AML package allows you to fall back to a senior-management UBO — surface that explicitly in the metadata.
  - Default record retention is 5 years post-relationship per the EU AML package (extensible up to 10 years per member-state guidance).
  - 200+ fraud signals are evaluated on every KYC session at no extra cost — surface the score via the session decision payload, do not re-query.

Read the docs:
  - https://docs.didit.me/sessions-api/create-session
  - https://docs.didit.me/sessions-api/retrieve-session
  - https://docs.didit.me/core-technology/aml-screening/overview
  - https://docs.didit.me/core-technology/aml-screening/continuous-monitoring-aml-screening
  - https://docs.didit.me/integration/webhooks

Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.