One API, every jurisdiction: how vendor-neutral KYC orchestration actually works

Every fintech leader who has scaled beyond a single market knows the pattern. You launch in one country with a single KYC vendor, ship happily for a year, then decide to open a second market — and your compliance roadmap collapses under the weight of vendor procurement, legal review, data-residency clauses, and a schema that suddenly has to speak both Aadhaar and Singpass.

Omnified was built to end that pattern. In this post we walk through the three ideas that make vendor-neutral orchestration work in production: a jurisdiction rulebook, a waterfall of best-fit vendors, and a unified decision schema with a hash-chained audit trail.

The problem is not the vendor. It is the seams.

There is no shortage of excellent KYC vendors. Singpass MyInfo in Singapore is close to magical. DigiLocker in India is a national identity rail. Onfido, Persona, Sumsub and IDfy each dominate their document-and-liveness niches. The problem is not that any of these are bad — the problem is that every one of them requires a distinct integration, a distinct data schema, a distinct compliance package, and a distinct commercial contract.

Multiply that by six markets and you have effectively built six KYC products.

Rulebooks: compliance as code, per regulator

The core of Omnified is a set of executable rulebooks — one per regulator. A rulebook encodes exactly which data fields are required, which screening lists must be hit, which vendors are permitted, and which decision thresholds apply. RBI is not FCA is not MAS is not IFSCA, and pretending otherwise is how compliance teams get in trouble.

• Required fields per customer type (individual, sole prop, private company, regulated entity).
• Sanctions and PEP lists that must be screened (OFAC, UN, EU, HMT, MAS, local).
• Approved vendors and their fallback order.
• Risk-score thresholds and four-eyes escalation triggers.
• Data-residency guarantees, per region.

Waterfall routing beats vendor loyalty

A well-designed orchestrator never bets an entire market on a single vendor. Our router tries the cheapest high-confidence path first — usually a government database call at under fifty cents — and only escalates to document plus liveness when the cheap path is inconclusive. In practice that shaves 40–60% off unit KYC cost without dropping approval rates.

"The vendor-neutral part matters. We route on quality, cost, and coverage — not on kickbacks. You bring the contracts; we bring the orchestration."

A unified schema and a hash-chained audit trail

Every verification, whichever vendor ran it, returns the same normalized JSON: a verdict, a risk score, the checks that ran, the vendors touched, and the exact cost. Every event is hash-chained into an append-only audit log that regulators can export and independently verify. That single schema is what makes a global product possible in the first place — your fraud team, your ops team, and your regulator all read the same page.

What this unlocks for product teams

The practical outcome is boring, in the best sense. A new market goes from a six-month vendor procurement project to a config change. Your engineers stop writing glue code for the ninth SDK this year. Your compliance officer stops reconciling three different sanction-hit formats by hand. And your CFO sees per-check costs drop without any drop in approval quality.

If that sounds like the shape of infrastructure you want under your KYC layer, the live demo is the fastest way to see it move. No signup, no real data — just the orchestration engine, running end to end.