Custom KYC vs Sumsub, AU10TIX and Onfido

Short answer: buy a vendor unless your verification volume makes per-check pricing a dominant cost, your document mix includes types vendors deprioritise, you need control of the accept thresholds, or identity documents cannot leave your infrastructure. We built a custom pipeline for a FinTech client that removed €40,000 a year — but the decision turned on volume and data residency, not on quality.

The two options

	Buy a vendor	Build custom
Examples	Sumsub, AU10TIX, Onfido, Veriff, Persona	A pipeline built on your document mix
Time to first check	Days	Weeks
Cost model	Per verification, forever	One-time build, then hosting
Document coverage	Very broad, global	What you train and validate for
Compliance coverage	Included, with attestations	Yours to establish
Accept thresholds	Vendor’s, sometimes tunable	Yours, as configuration
Data residency	Vendor’s infrastructure	Yours, including on-prem
Unusual document types	Deprioritised if rare	Add what you need
Cost at 100k checks/yr	Scales linearly	Roughly flat
Liveness / anti-spoofing	Mature, included	Separate component to scope

Where vendors genuinely win

Document breadth. Sumsub and AU10TIX cover passports and IDs from essentially everywhere, with the templates and validation rules already built. Replicating global coverage is not a sensible use of engineering time for most companies.

Compliance coverage. They provide attestations, audit support and regulatory alignment as a product. That is real, and it is expensive to establish yourself.

Liveness and anti-spoofing maturity. Defeating a photograph of a photograph, deepfakes and injection attacks is an arms race vendors run full-time.

Speed and low volume. At a few thousand checks a year, per-check pricing is far cheaper than any build.

If you verify modest volumes across many countries and want compliance handled, buy. That is the right answer for most companies.

Vendors are the right answer more often than a firm that sells custom document AI development is supposed to admit, and the cases below are the ones where they stop being.

Where building wins

Per-check pricing has become the line item. This is the most common trigger. Verification pricing scales linearly and never stops. A build is largely fixed cost. Model both across three years at your projected volume — the crossover is a specific number, not a philosophy.

Data residency. Some jurisdictions and banking partners forbid sending identity documents to a third-party processor. That single constraint eliminates vendors outright. Our FinTech client hit this alongside volume.

Your document mix is unusual. If a meaningful share of your applicants present documents vendors handle poorly — regional IDs, older formats, non-standard proofs of address — you inherit their failure rate with no way to fix it.

You need the threshold. Face-match similarity is a score, and where the accept threshold sits is a policy decision with a real false-accept versus false-reject trade-off. Vendors set it, sometimes expose a dial. Building makes it configuration your compliance team owns, logged on every decision.

You want the escalation rules. Which cases go to a human, and why, is a business decision. A build makes it explicit.

What a custom build actually looks like

From the pipeline we shipped:

Classify before extracting. A YOLOv8n classifier identifies the document type and locates it in frame. This turns open-ended reading into bounded extraction — and gates the expensive pipeline, which is where a 70% compute reduction against baseline came from.
Normalise the image. Deskew, perspective correction, glare suppression and contrast normalisation before a character is read. Most accuracy is won here.
Extract at field level. PaddleOCR against located regions, not regex over raw text.
Validate against what the document guarantees. Checksums on document numbers, plausible date ranges, per-country character sets. A misread that breaks a rule becomes a caught exception.
Match the face. DeepFace produces a similarity score; the threshold is policy, not a constant.
Escalate the uncertain. Every field carries confidence. Roughly the routine 90% of the queue automated; the reviewer kept the cases needing judgement.

Result: 98% field-detection accuracy on real-world photograph quality, 70% less compute, €40,000 a year of manual review removed.

The cost model

Ask your vendor for per-check pricing at your projected 3-year volume. Then compare against a fixed build cost plus hosting.

Two things teams get wrong:

Underestimating the build, because they scope it as OCR. It is document intelligence — classification, validation, review tooling and integration — and integration is usually the largest share.
Underestimating vendor cost growth, because they model today’s volume rather than the volume that justified the project.

What both options must have

Calibrated confidence, not just accuracy. 98% that knows its uncertain 2% is safe; 99% with no confidence signal is not.
A human on the cases that warrant one. Automation that decides everything including what it should not is a liability with lower headcount.
Decision logging. What was decided, on what input, under which threshold.
A defined unknown-document path. Unseen types should escalate, never be guessed at.

A decision shortcut

Build if two or more are true:

Per-check cost is already material at current volume
Identity documents cannot leave your infrastructure
Your document mix includes types vendors handle poorly
You need to own the accept threshold and escalation rules
You already have engineering capacity to operate it

Fewer than two? Buy. The vendors are good, and compliance coverage alone often justifies them.

Tools referenced

EpochC builds KYC and identity verification automation and OCR / document AI. See the KYC case study, the document intelligence guide, or book a call.

Custom KYC vs Sumsub, AU10TIX and Onfido: build vs buy compared