Skip to main content
Yativo requires identity verification before customers can access payment services such as virtual accounts, send money, and payment rails. Individual users go through KYC (Know Your Customer) and businesses go through KYB (Know Your Business).

Environments

KYC and KYB submissions, partial updates and lookups go to the KYC platform, not the main API. Use https://kyc-sandbox.yativo.com with sandbox customers and https://kyc.yativo.com in production. Read the host from config so you can switch. The KYC platform endpoints don’t need your API key. Endpoints on the main API, such as GET /customer/{customer_id}, do. See Sandbox KYC.
Coding assistants can read the KYC lookup data and the KYC platform guide through its MCP server at https://kyc.yativo.com/api/mcp (read-only).

Integration approaches

Hosted URLs:
  • Individual: https://kyc.yativo.com/individual/{customer_id}
  • Business: https://kyc.yativo.com/business/{customer_id}
On the hosted business form, the customer can click Save draft on any section to keep unfinished answers and come back later. Drafts aren’t checked or sent for verification. The customer can’t submit until each drafted section is saved with Next.

Build your form with the lookup endpoints

If you collect KYC or KYB data in your own UI, fill every dropdown from the KYC platform’s lookup endpoints instead of hardcoding values. They live on https://kyc.yativo.com/api, and you can try each one from the API reference.
1

Country

Load List Countries once. Send the two-letter code for nationality, every address country and issuing_country.
2

Address

When the customer picks a country, load List Subdivisions for the state dropdown, and Get Postal Code Format to validate postal_code as they type.
3

ID documents

Load List ID Types for the issuing country to fill identifying_information[].type.
4

Occupation or industry

Individuals: List Occupations for most_recent_occupation_code. Businesses: List Business Industries for business_industry. Both lists are long, so use a searchable field.
5

Purpose, funds and volume

Individuals: account purposes, sources of funds and expected monthly payments. Businesses: account purposes and sources of funds. The business lists are different from the individual ones.
6

Business activity (KYB only)

List Transaction Currencies for collection_currencies and List Transaction Countries for beneficiary_geographies.

Verification flow

1

Create a customer

Call POST /customer to create a customer record and receive a customer_id.
2

Upload documents (if using API)

Use POST /storage/upload to upload files and receive back a hosted URL. Pass those URLs in the KYC payload. Alternatively, embed files as base64-encoded strings.
3

Submit KYC or KYB

POST to https://kyc.yativo.com/api/individual-kyc/submit or https://kyc.yativo.com/api/business-kyc/submit.
4

Watch the endorsements

Listen for the endorsement.updated webhook, or read the customer’s endorsement list with GET /customer/{customer_id}. This is the only place verification results appear. See Track verification with endorsements.
5

Use each approved service

Each service becomes available when its endorsement’s status is approved. For example, a USD virtual account needs the endorsement that GET /business/virtual-account/currencies-and-endorsements lists for USD.

Upload documents

Before submitting KYC, upload any document files you will reference. Every file must be PDF, JPG, JPEG, PNG, HEIC or TIF, and between 5 KB and 30 MB. ID document images (image_front_file, image_back_file, uploaded_documents[*].file) on individual KYC accept PDF, JPG, JPEG and PNG only. Each file field accepts a hosted URL, a base64 data URI (data:image/jpeg;base64,...) or a multipart/form-data upload. Every file is virus-scanned.
Send the file as multipart/form-data with the field name document.
Use the returned document value in the selfie_image, image_front_file, proof_of_address_file, and similar fields below.

Individual KYC

Submit

This is a five-step data model submitted in one payload. All required fields must be present in a single request. A successful response means the submission passed validation and was accepted. It doesn’t mean the customer is approved. Verification runs afterwards, so treat the customer as pending until their status changes.

Step 1 — Personal details

Step 2 — Residential address

Step 3 — Identifying information

At least one government-issued ID document is required.

Step 4 — Risk and purpose

The API accepts unknown values for employment_status, expected_monthly_payments_usd, source_of_funds and account_purpose, but verification fails later if they aren’t on the lists below. The 201 response lists them under warnings, along with other values verification is likely to reject. Check warnings and fix those fields with a partial update. KYB responses can include warnings too, for example when a country isn’t covered by one service. For these four fields, send the lookup key (PascalCase, such as ReceiveSalary, SelfEmployed or LessThan5K). The snake_case form (receive_salary, self_employed, 0_4999) is accepted too. Use the lookup endpoints in Reference lookups.

Step 5 — Supporting documents

Virtual account flags

Rejections to handle

Duplicate person (409). An individual submission is rejected if it matches a different customer on your account by bvn or nin; by the same ID document (same type, issuing_country and number); or by the same email, or phone with the same calling_code, when the first name, last name and date of birth (where both have one) also match. Nothing is saved, and the response names the existing customer:
Use the customer in duplicate_of. Resubmitting under the same customer_id isn’t a duplicate. Customers on other Yativo accounts are never matched. If two different people really share a detail, contact Yativo support to clear the match. Sandbox doesn’t run this check. Placeholder names (403). A submission is refused with 403 {"message": "Access denied."} if any name field contains test, yativo or admin (any case, anywhere in the value, so "Tester" matches), or an email contains test. This covers individual names, business_legal_name, business_trade_name and every associated person. The customer_id is then blocked permanently, even with corrected data. Use realistic names when testing. Country values. Send ISO alpha-2 codes. Common variants such as UK, usa or a full English name are converted automatically, but alpha-2 is the supported format.

KYC example request


Business KYB

Submit

Step 1 — Business basics

Step 2 — Addresses

Both registered_address and physical_address use the same structure:

Step 3 — Associated persons

At least one person is required. Include all UBOs, directors, and authorized signers. People who own less than the ownership threshold are dropped from the submission, and the response’s warnings tell you who was dropped. Directors, signers and controllers (is_director, is_signer or has_control true) are always kept, whatever they own. The threshold is ownership_threshold (5–100, default 25). At least one person must meet it. A director, signer or controller doesn’t count towards this unless they own enough. The combined ownership_percentage of everyone with has_ownership: true can’t exceed 100. Each person’s identifying_information needs at least one ID that isn’t a tax ID, such as a passport or national ID. Associated persons use image_front and image_back, not the _file names used in individual KYC: For a Naira account in the business’s name, add a bvn entry (11-digit number, no image) for a Nigerian associated person. See naira in What each endorsement needs.

Step 4 — Risk and purpose

Step 5 — Regulated activity

Step 6 — Business documents

At least one document is required.

Step 7 — Business identifying information (optional)

Business-level ID documents (e.g. business licence).

Step 8 — Extra documents

extra_documents is an array of { "type": "...", "file": ... }. These are required:

Optional business profile

Describe the business’s activity in three nested objects, not as top-level fields. All are optional. A value outside the allowed list doesn’t block the submission, but it comes back in warnings. extra_business_info collections_data payouts_data
KYB also accepts the virtual account flags.

KYB example request


Track verification with endorsements

A customer’s KYC or KYB result is only available through their endorsements. Each endorsement is one service, such as base, sepa or cobo_pobo, with its own status. A customer can be approved for one service and still be under review for another, so there’s no single overall status to check. Don’t rely on customer_kyc_status or is_va_approved to decide what a customer can use. Check the endorsement for the service you need.

Listen for endorsement.updated

Yativo sends endorsement.updated whenever any of a customer’s endorsements changes. endorsements is the customer’s full current list:
Store the list and compare it with your copy to see what changed.

Read the current endorsements

To check on demand, for example when your server starts up or you missed a webhook, read the customer’s endorsement list:

What each endorsement needs

You don’t request endorsements directly. Which ones are attempted depends on your submission, mainly the virtual account flags and whether the data is complete enough. A missing field or document doesn’t fail the submission. It leaves that endorsement below approved until you fix it. Three endorsements reject outright instead of waiting in under_review:
  • cobo_pobo: no identifiable registration document, or a representative with no ID document
  • brazil: any of the items listed above is missing
  • asian: the country isn’t supported. This can also decline an endorsement that was approved before
BVN. Any BVN you submit, for an individual or an associated person, must be 11 digits and match a real record. If it doesn’t, every endorsement is declined, spei included, with errors: ["Unable to verify customer information"].

Endorsements that failed to start

If an endorsement can’t be submitted at all, because a required document or field is missing or invalid, it stays at not_started (declined for virtual_card and naira) and errors says why, for example ["Missing required documents: ID document front image, selfie"]. Fix the data with a partial update or a full resubmission, and the endorsement is submitted again automatically. errors, requirements_due and future_requirements_due are always arrays of readable messages, and empty when there are none.

Which endorsement a service needs

cURL

Update a KYC submission

Use this endpoint to correct information or provide missing documents after a rejection.
Send only the fields you need to correct. customer_id is always required.

Partial update on the KYC platform

To correct a few fields on a submission, send only those fields to the KYC platform:
Fields use the same names and rules as the submit endpoints. On these endpoints, state and postal_code are checked against the country’s subdivision and postal code formats. An empty body returns 400 No fields provided., and a customer with no submission returns 404. Endorsements that failed to start are submitted again automatically once the update is saved. The response lists them in resubmitted_endorsements, for example ["asian"], and each shows under_review while it runs.
cURL

Resubmit one endorsement

After a customer updates their ID document or selfie, re-run verification for one endorsement without touching the others:
endorsement is one of base, sepa, spei, faster_payments, naira, virtual_card, asian or brazil. This works for individual customers only. For a business, or for cobo_pobo, native, eurde, usd_latam or eur_latam, use the KYC platform endpoint below.
cURL
Success
A 200 means the resubmission was queued, not that verification finished. Watch for endorsement.updated, or check the endorsement’s status with GET /customer/{customer_id}. Its metadata.last_resubmission shows whether the resubmission itself could be processed: service in the customer’s endorsement list is title-cased, for example "Faster payments". Compare it with the lowercase form you sent.

On the KYC platform (individual or business)

Works for individual and business customers, for any endorsement: base, sepa, eurde, spei, asian, virtual_card, naira, cobo_pobo, faster_payments, native, brazil, usd_latam or eur_latam. The endorsement moves to under_review right away and its errors are cleared. If the stored data can’t be submitted, it returns to its previous status and errors.resubmission_failed says why. You can call it 30 times a minute.

Service endorsements

Each endorsement unlocks one service. Its status is the verification result for that service.

Endorsement statuses

Only approved means the service is available. Treat every other status as not yet usable. If an endorsement link has expired, regenerate it and share the new URL with the customer:

Reference lookups

The KYC platform serves the lists your form needs. Prefix each path with https://kyc.yativo.com/api: The same occupation and country data is also available on the main API:

Occupation codes

Get the full list of valid occupation codes for most_recent_occupation_code:

Supported countries

Get the list of countries supported for customer registration and verification:

Enum reference values

employment_status

expected_monthly_payments_usd

source_of_funds

account_purpose

high_risk_activities (KYB)

The source_of_funds and account_purpose lists above are for individual KYC. KYB uses its own lists.

KYB account_purpose

charitable_donations, ecommerce_retail_payments, investment_purposes, other, payments_to_friends_or_family_abroad, payroll, personal_or_living_expenses, protect_wealth, purchase_goods_and_services, receive_payments_for_goods_and_services, tax_optimization, third_party_money_transmission, treasury_management

KYB source_of_funds

KYB source_of_funds values are PascalCase: BusinessLoans, Grants, InterCompanyFunds, InvestmentProceeds, LegalSettlement, OwnersCapital, PensionRetirement, SaleOfAssets, SalesOfGoodsAndServices, ThirdPartyFunds, TreasuryReserves

business_type (KYB)

cooperative, corporation, llc, partnership, sole_prop, trust, other

ID types by country

The accepted type values under identifying_information depend on the issuing country. Get the full list for a country from List ID Types. Common types available globally: Countries also accept country-specific types, for example: Use GET /auth/verification-locations to check which countries are supported, and consult the full ID type reference in the API reference section.

Webhooks

KYC and KYB results arrive as endorsement.updated events. There’s no separate KYC status event. See Track verification with endorsements.

Error handling

The KYC platform returns validation errors in its own shape, with 422:
validation_errors lists every failing field. field_labels gives a readable name for each, and field_hints gives advice where available. Show both next to the matching form field. KYB returns "message": "Validation failed." and may add notices about associated persons below the ownership threshold.

Common errors and fixes


Go-live checklist

Sandbox is forgiving. Production isn’t. Before switching:
  • Every request, lookups included, goes to the production host, read from config rather than hardcoded.
  • Lookup values cached from sandbox are fetched again from production, or fetched live.
  • No sandbox test values are hardcoded. See Sandbox KYC.
  • Nigerian customers send their own bvn and nin, and their name and date of birth match their BVN record.
  • No real customer has a placeholder name or email.
  • You handle 409 duplicates by reusing duplicate_of, show 422 errors field by field, and treat 403 Access denied. as final for that customer_id.
  • A 200 or 201 is shown as “submitted, pending review”, never “approved”.
  • You’ve submitted one real individual (and one real business, if you onboard businesses) on production and seen the endorsement results end to end.

Implementation notes

  • KYC review typically completes within 24 hours. Complex cases may take longer.
  • Use Idempotency-Key on all POST and PUT requests to prevent duplicate submissions.
  • Files can be passed as hosted URLs (from POST /storage/upload) or base64-encoded strings — both are accepted.
  • For Nigerian nationals or residents (nationality or residential_address.country is "NG"), bvn and nin are mandatory regardless of which ID type is provided.
  • state accepts "US-CA" and "CA". Send the bare code from the subdivisions lookup.
  • Use the PATCH endpoints in Update a KYC submission for small corrections instead of resubmitting everything.