Prime Trust KYC Requirements

Last Revision Date: 08-17-2021

Prime Trust documentation reference

From documentation.primetrust.com:

Individual accounts

For an individual who needs to open an account, the following checks need to clear for the account to open automatically:

  • CIP check:
    • Prime Trust checks if the person or company is who they say they are
    • created immediately after a contact is created
  • AML check:
    • Prime Trust checks to ensure the person or company are not on any sanctions lists
  • KYC Document Check for a proof of identity document:
    • can be created on documents uploaded to a contact
    • clearing a document check will also generally clear CIP
    • part of the CIP process and may be required as set by the account policies.

Instructions for a contact with United States as the tax country

  1. Create a Contact with the following information:
  • Name
  • Email
  • Phone Number
  • Date of Birth
  • Tax-Country (US)
  • Tax State (US)
  • SSN (tax-id)
  • IP addresss (optional, IPv4 decimal or IPv6 hexadecimal format)
  • Geolocation (optional, ISO 6709 format)
  • Primary Address:
  • Street 1
  • Street 2
  • Country (US)
  • City
  • State
  • Postal Code
note

Geolocation and IP address are newer optional attributes that can be provided to improve fraud protection.

  1. Prime Trust runs the following checks on the information as a cip-check:
  • Fraud - Returns a risk indicating the likelihood an identity is fraudulent
  • Synthetic - Returns a risk indicating the likelihood an identity is synthetic
  • Email _ Returns a risk indicating the riskiness of an email address
  • Phone - Returns a risk indicating the riskiness of a phone number
  • Address - Returns a risk (indicating the riskiness of an address
  • KYC - Returns a pass/fail equivalence for each component of Personally Identifiable Information (PII)
  • Alert List - Checks identities against watch list

KYC Document check process

  1. Upload a Photo ID to the contact and collect the following information about the ID:
  • Type of ID - kyc-document-type
  • Drivers License - front and back required (preferred for US end users)
  • Government ID - front and back required
  • Passport - preferred for international end users
  • Residence Permit
  • Issuing Country - this should be the same as the tax-country so in this case it will be US) (kyc-document-country)
  1. Create a KYC document check using the previously collected information:
  • kyc-document-type
  • kyc-document-country
  1. Set identity and identity-photo to true as the document being uploaded is a proof of identity.

  2. Set proof-of-address to false, unless unless the uploaded document is a proof of address (for example bank statement).

  3. If the following three checks clear, then the account will automatically open:

  • KYC Document Check for a document with identity and identity-photo set to true.
  • CIP Check
  • AML Check

Statuses on a contact

  • cip-cleared: false by default or if a CIP Check gets denied, true when a CIPCheck is approved
  • aml-cleared: false by default or if an AML Check gets denied, true when an AML Check is approved
  • identity-documents-verified: false by default, true when a KYC Document Check with identity: true is approved
  • proof-of-address-documents-verified: false by default, true when a KYC Document Check with proof_of_address: true is approved
  • identity-confirmed: false by default, true when a CIPCheck is approved (not reset if CIP is denied later). If this is set to true then the following information cannot be updated on a contact:
  • contact-type
  • date-of-birth
  • name
  • sex
  • tax-country
  • tax-id-number

Once this information has been submitted to Prime Trust, there are a number of outcomes outside of the successful path where CIP clears, KYC document checks clear and the AML check clear.

For US individuals each check can be treated independently of the other checks.

CIP Check

Notification of CIP status update can be tracked via account webhook.

When the status changes, you can check the status / exceptions by using the cip-checks endpoint:

  • status - pending / denied/ approved / voided
  • exceptions - array of the names of the module that failed example:
[
"namephonecorrelation"," fraud "" synthetic "," addressrisk "" alertlist "," fraud "," phonerisk","fraud "," emailrisk "," nameemailcorrelation ","kyc, ""nameaddresscorrelation",
]
  • exception-details - Prime trust will populate detailed information on different exceptions. See below for more information on exception details.

AML check

Notification of CIP status update: can be tracked via account webhook.

When the status changes, you can check the status / exceptions via the aml-checks endpoint:

status - pending / denied/ approved / voided

Any exceptions present on a pending AML check are generally due to a false positive and will be cleared manually by our Compliance team. If they believe that the hit is not a false positive they will reach out to you outside of our API to gather more information. Tracking the status on the AML-Check itself should be sufficient.

KYC document check

status - pending / failed / verified

When status change, you may check the status / exceptions via the kyc document check endpoint:

KYC Document Checks help run checks against identity and address documents that are provided to Prime Trust. To open an account or to ensure that funds are not contingently held for an end user once sent in the contact should have a cleared KYC document check for identity set to true.

Note that similar to a CIP check, the KYC document check will remain in a pending state and have exceptions on the checks. If a new document is uploaded to clear the raised exceptions, then a new kyc document check should be created.

There are a number of exceptions that can be set on documents including the following.

Document-related failures

These failures will show up if the document is specified as a proof of identity document:

  • date_of_birth_auto_check_failed - The date of birth on the document does not match the date of birth listed on the contact.
  • document_valid_auto_check_failed - The document provided is not valid (for example is expired or is fake).
  • tax_country_auto_check_failed - The country that issued the id does not match the tax country listed on the contact.

Address-related failures:

This failure will show up if the document is specified as a proof of address document.

address_auto_check_failed - The address on the document did not match the address on the contact.

Using webhooks

Prime Trust will send webhook events that notify your application any time an event happens on your account, such as newly created or updated CIP/AML/document checks.

If the CIP check is pending / manually reviewed, then you should also track the request for required_information (via webhook) to look out for “required information” left by Prime Trust’s compliance officers. Use the required information webook as instructions for next steps that are required to complete KYC

Posible required information values can be found at: https://developers.primetrust.com/docs/kyc-webhooks

Simulating exceptions in sandbox:

Sandbox will generate a random CIP / AML response and there are some values that will trigger specific responses. For example:

  • KYC exception: use tax_id 555551111; it will also generate exception details: Unable to verify SSN (R920), together with other exception and exception details
  • AML exception : Use name: Jane Doe to trigger watchlist pending response
  • Fraud: use phone number 1-202-555-1111 to trigger fraud exception

Using the above values will trigger a specific module. Be advised using the values may also trigger modules in addition to the one listed above.

When creating a contact or an account with a contact in the sandbox environment using POST /v2/contacts and POST /v2/accounts respectively, you have the ability to trigger CIP, AML, and KYC checks using the contact’s name attribute. The contact’s name needs to be prefixed with "sandbox_exceptions" followed by a whitespace delimited string of desired exception codes that correspond to specific errors per type of check (shown below).

CIP + AML Approved:

"contact-type" : "natural_person",
"name" : "Just name" ,
"email" : "email@example.com",
"date-of-birth" : "1982-02-29",
"tax-id-number" : "743056565",
"tax-country" : "US",
"primary-phone-number" : {
"country" : "US",
"number" : "+18121212212",
"sms" : false
},
"primary-address" : {
"street-1" : "1 street",
"street-2" : "",
"postal-code" : "98112",
"city" : "Seattle",
"region" : "WA",
"country" : "US"
}

CIP denied: (over fraud, kyc)

"contact-type" : "natural_person",
"name" : "Just name",
"email" : "email@example.com",
"date-of-birth" : "1982-02-29",
"tax-id-number" : "743056565",
"tax-country" : "US",
"primary-phone-number" : {
"country" : "US",
"number" : "+12025551111,
"sms" : false
},
"primary-address" : {
"street-1" : "1 street",
"street-2" : "",
"postal-code" : "98112",
"city" : "Seattle",
"region" : "WA",
"country" : "US"
}

CIP pending:

"contact-type" : "natural_person",
"name" : "Just name",
"email" : "email@example.com",
"date-of-birth" : "1982-02-29",
"tax-id-number" : "743056565",
"tax-country" : "US",
"primary-phone-number" : {
"country" : "US",
"number" : "+12025551111,
"sms" : false
},
"primary-address" : {
"street-1" : "1 street",
"street-2" : "",
"postal-code" : "98112",
"city" : "Seattle",
"region" : "WA",
"country" : "US"
}

CIP check exception details

Possible values:

CodeDescription
R001"IP count is greater than 12 within the last week"
R002"IP count is greater than 16 within the last week"
R003"IP address geolocation places user more than 7000 miles from address"
R004"IP count is greater than 20 within the last week"
R005"IP count is greater than 4 within the last month"
R006"IP address geolocation places user more than 200 miles from address"
R007"IP count is greater than 40 within the last 3 months"
R008"IP time zone is offset from GMT by more than -400 minutes"
R009"IP count is greater than 1 within the last hour"
R106"Identity element in Alert List"
R110"Alert List email address match"
R111"Alert List SSN/ITIN match"
R113"Alert List phone number match"
R186"Global Watchlist sources selected are correlated with the input identifiers"
R187"Address resolves to a High-Intensity Drug Trafficking Area"
R188"Address resolves to a High-Intensity Financial Crime Area"
R350"DOB indicates individual is less than 16 or more than 100 years old"
R351"DOB indicates COPPA review"
R352"DOB indicates an age between 13 and 15"
R353"DOB indicates an age between 16 and 17"
R354"DOB indicates age is correlated with higher fraud rates"
R355"DOB indicates an improbable age"
R401"Device token was not previously encountered"
R402"Invalid device token"
R403"Device is a virtual device"
R405"The Device Risk module was called, but a device token was not provided"
R520"Emailrisk score represents high risk"
R551"Email address is invalid"
R557"Email address is disposable"
R558"Email address is auto-generated"
R559"Email address cannot be resolved to the individual"
R561"Email address is less than 180 days old"
R562"Email address domain is less than 180 days old"
R563"Email address domain is invalid"
R564"Email address username is invalid"
R565"Email address domain represents high risk"
R566"Email address has not been seen before"
R567"Email address top-level domain represents high risk"
R601"Phone number associated address is not correlated with the input address"
R602"Phone number associated address is not correlated with the input country"
R603"Phone number is invalid"
R604"Phone number has not been actively used within the past 90 days"
R605"Phone number has not been actively used for more than 90 days"
R606"Phone number is not actively used"
R607"Phone number associated address is partially correlated with the input address"
R608"Phone number cannot be resolved to the individual"
R610"IP address geolocation places user more than 100 miles from address"
R611"Phone number is not allowed for consumers"
R613"Phone number is fixed or traditional VoIP"
R614"Phone number is toll-free"
R615"Phone number is non-fixed or over-the-top VoIP"
R616"Phone number is prepaid"
R617"Phone number is not associated with a major US carrier"
R618"Phone number has been in service between 90 and 365 days"
R619"IP address is a known proxy"
R620"Phonerisk score represents high risk"
R621"Phone number has been in service less than 7 days"
R622"Phone number has been in service between 7 and 30 days"
R623"Phone number has been in service between 30 and 90 days"
R624"Phone number has been changed more than once in the past 90 days"
R625"Phone number has ported within the past 24 hours"
R626"Phone number has been ported within the past 2 to 7 days"
R627"Phone number has been ported within the past 7 to 30 days"
R628"Phone number has been ported within the past 30 to 60 days"
R629"Phone number has been ported more than once in past 90 days"
R630"Phone subscriber has been correlated with the input phone number for less than 7 days"
R631"Phone subscriber has been correlated with the input phone number for between 7 and 30 days"
R632"Phone subscriber has been correlated with the input phone number for between 30 and 90 days"
R633"Phone subscriber has been correlated with the input phone number for between 90 and 365 days"
R635"The device has changed once within the past 7 days and at least once more within the past 90 days"
R636"Mobile device tenure is less than 90 days"
R637"Mobile SIM tenure is less than 90 days"
R639"IP address originates from outside of the US or US territories"
R640"IP address originates from an OFAC sanctioned country"
R641"Proxy is from services that change location to beat DRM,TOR points, temporary proxies and other masking services"
R642"IP address is associated with a cloud hosting provider and is likely a proxy. Users are not usually located in a hosting facility"
R643"IP address is associated with a location allowing public internet access"
R644"IP proxy is cloud-based"
R645"IP proxy is TOR-based"
R646"IP proxy is VPN-based"
R647"IP proxy is cloud-security-based"
R701"Address is inactive, not receiving mail, or vacant"
R702"Address is not confirmed as deliverable"
R703"Address is invalid or does not exist"
R704"Address is a correctional facility"
R705"Address cannot be resolved to the individual"
R707"Address is a commercial mail receiving agency or commercial mail drop"
R708"Address is a PO Box"
R709"Address is commercial or dual-purpose"
R710"Address is a military location"
R711"Address is a unique ZIP code, or corporate only, routing all mail internally by the assigned organization rather than by the USPS"
R712"Address ZIP code is invalid"
R713"Address mismatch between city, state, and ZIP code"
R714"Address is fuzzy matched to the address on record"
R720"Addressrisk score represents high risk"
R804"Document image doesn't meet the minimum color requirements"
R810"Document pattern and layout integrity check failed"
R819"Image captured from a screen, or is a paper copy of an ID"
R820"Document headshot has been modified"
R822"First name extracted from document does not match input first name"
R823"Last name extracted from document does not match input last name"
R824"Address extracted from document does not match input address"
R825"DOB extracted from document does not match input DOB"
R826"Document Number extracted from document does not match input number"
R827"Document is expired"
R831"Cannot extract the minimum information from barcode"
R832"Document Number extracted from document does not match with barcode or MRZ"
R833"Cannot extract the minimum required information from MRZ"
R834"Selfie fails the liveness check"
R835"More than one face detected in the selfie"
R836"Document image does not correlate with self-portrait"
R838"Minimum amount of information cannot be extracted from document"
R839"Name extracted from document does not match with barcode or MRZ"
R840"Address extracted from document does not match with barcode or MRZ"
R841"DOB on document does not match DOB on barcode or MRZ"
R842"Expiration date on document does not match date on barcode or MRZ"
R843"Issue date on document does not match date on barcode or MRZ"
R844"Dates on document are not valid"
R845"Minimum age criteria not met"
R850"Self-portrait or the headshot is not usable for Facial Match"
R851"Document number is an example number, or is not valid"
R852"Submitted document is a temporary ID"
R853"Unable to classify the ID or this is an unsupported ID type"
R855"First name did not match with any known Nick name or Alias"
R856"Obstructions on the face affecting the liveness"
R857"No face found in the selfie frame"
R858"The age on the document doesn't correlate with the selfie predicted age"
R901"SSN/ITIN cannot be resolved to the individual"
R902"Name cannot be resolved to the individual"
R903"DOB cannot be resolved to the individual"
R907"SSN has been reported as deceased"
R909"Identity has been reported as deceased"
R911"SSN issued prior to DOB"
R913"SSN/ITIN is invalid"
R916"Address is invalid or does not exist"
R919"Address cannot be resolved to the individual"
R920"SSN/ITIN cannot be resolved to the individual"
R922"DOB cannot be resolved to the individual"
R923"SSN/ITIN was fuzzy matched to the SSN/ITIN on record"
R924"Address was fuzzy matched to the address on record"
R927"Name does not correlate with the name for the resolved individual"
R928"SSN/ITIN is associated with multiple last names"
R930"First name does not correlate with the first name for the resolved individual"
R932"Address is a correctional facility"
R933"Last name is not correlated with the SSN/ITIN on record"
R934"First name is not correlated with the SSN/ITIN on record"
R939"SSN/ITIN is correlated with the first name but not the last name"
R940"SSN/ITIN not found in public records"
R941"SSN/ITIN is correlated with at least 1 other name and address"
R943"First name was fuzzy matched to the name on record"
R944"Last name was fuzzy matched to the name on record"
R946"DOB was fuzzy matched to the DOB on record"
R947"SSN/ITIN is not the primary SSN/ITIN for the resolved identity"
R948"Address mismatch between city, state, and ZIP code"
R953"SSN was randomly-issued by the SSA and cannot be resolved to the individual"
R954"SSN/ITIN entered is an ITIN"
R955"SSN/ITIN is correlated to multiple identities"
R956"Identity is correlated to multiple SSN/ITINs"
R957"DOB is not on record and cannot be verified"
R961"Address ZIP code is invalid"
R963"Address ZIP code only serves PO Boxes"
R964"Address is a commercial or institutional address"
R972"Address is a commercial mail receiving agency or commercial mail drop"
R973"Address is a unique ZIP code, or corporate only, routing all mail internally by the assigned organization rather than by the USPS"
R975"MLA covered borrower status"
R976"Identity is associated with an active duty alert"
R977"Identity is associated with an active duty alert and a fraud victim initial alert"
R978"Identity is associated with a fraud victim initial alert"
R979"Identity is associated with an active duty alert and a fraud victim extended alert"
R980"Identity is associated with a fraud victim extended alert"
R998"SSA could not confirm the Name, SSN, and DOB are correlated"
R999"SSA confirmed the identity is reported as deceased"
V836"Self-portrait was not considered in decision"

Documentation for integrations before August 2021

note

The rest of this page does not apply to new integrations

Individual accounts

For an individual who needs to open an account, the following checks need to clear for the account to open automatically:

  • CIP check:

    • Prime Trust checks if the person or company is who they say they are
    • created immediately after a contact is created
  • AML check:

    • Prine Trust checks to ensure the person or company are not on any sanctions lists
  • KYC Document Check for a proof of identity document:

    • can be created on documents uploaded to a contact
    • clearing a document check will also generally clear CIP
    • part of the CIP process and may be required as set by the account policies.

United States tax country and United States address contact

For a contact with tax-country of US and a US address:

  1. Create a Contact with the following information:
  • Name

  • Email

  • Phone Number

  • Date of Birth

  • Tax-Country (US)

  • Tax State (optional)

  • SSN (tax-id)

  • IP addresss (optional, IPv4 decimal or IPv6 hexadecimal format)

  • Geolocation (optional, ISO 6709 format)

  • Primary Address:

    • Street 1

    • Street 2

    • Country (US)

    • City

    • State

    • Postal Code

  1. Prime Trust runs the following checks on the information as a cip-check:
  • Name Match (Corresponding CIP exception: name_auto_check_failed)

  • Address Match (Corresponding CIP exception: address_auto_check_failed)

  • Date of Birth Match (Corresponding CIP exception: date_of_birth_auto_check_failed)

  • SSN Match (Corresponding CIP exception: tax_id_auto_check_failed)

  1. Upload a Photo ID to the Contact and collect the following information about the ID:
  • Type of ID (kyc-document-type)

  • Drivers License (Front and Back Required)(Preferred for US end-users)

  • Government ID (Front and Back Required)

  • Passport (Preferred for International end-users)

  • Residence Permit

  • Issuing Country (This should be the same as the tax-country so in this case it will be US) (kyc-document-country)

  1. Create a KYC Document Check using the previously collected information:
  • Kyc-document-type

  • Kyc-document-country

  • Set identity or identity-photo to true as the document being uploaded is a proof of identity

  • Set proof-of-address to false

If the following three checks clear then the account will automatically open:

  • CIP Check

  • AML Check (This is only run after the CIP check is approved)

  • KYC Document Check for a document with identity or identity-photo set to true.

Statuses on a contact

  • cip-cleared:

    • false by default or if a CIP Check gets denied
    • true when a CIP Check is approved
  • aml-cleared:

    • false by default or if an AML Check gets denied
    • true when an AML Check is approved
  • identity-documents-verified:

    • false by default
    • true when a KYC Document Check with identity: true is approved
  • proof-of-address-documents-verified: false by default, true when a KYC Document Check with proof_of_address: true is approved

  • identity-confirmed:

    • false by default

    • true when a CIPCheck is approved (not reset if CIP is denied later). If this is set to true then the following information cannot be updated on a contact:

      • contact_type

      • date_of_birth

      • name

      • sex

      • tax_country

      • tax_id_number

Once this information has been submitted to Prime Trust there are a number of outcomes, ignoring the happy path where CIP clears, KYC Document Checks clear and the AML check clear.

For US individuals each check can be treated independently of the other checks.

CIP-Check

on a CIP-Check for a US Individual are automatically added to the CIP Check once the information of the individual is run against select third party databases in the case that some of the individual checks don’t match/clear:

The exceptions that are possible are as follows along with how to resolve the check.

address_auto_check_failed

There was a failure when trying to verify the address provided for the contact. Update the address on the Contact. Rerun on PATCH

Alternatively if the address is correct but did not verify for multiple reasons, a separate proof of address document can be uploaded to the Contact and this document can be specified as a proof of address document. Though the document check may clear automatically based on the document uploaded and kyc-document-check created note that the CIP Check will still need to manually reviewed by a Prime Trust compliance officer for this specific case.

address_manual_check_failed

There was a failure when trying to manually verify the address provided for the contact. Update the address on the Contact.

Auto_check_failed *Waiting for Results* *Manual*

There was a technical error in processing the CIP Check. Prime Trust's compliance team will manually review the check (manual_review_required will also be present).

date_of_birth_auto_check_failed

There was a failure when trying to verify the date of birth for the contact. Update/check the date of birth for the contact.

manual_review_required

This CIP Check needs to be reviewed by a Prime Trust compliance officer. This happens when there is an auto_check failure or if the CIP Check can not be automated.

If any of the third party checks fail then this exception will be added to the array/list of exceptions.

Name_auto_check_failed

There was a failure when trying to match the name provided to the rest of the information provided for the Contact. Update/check the name for the Contact.

Tax_id_number_auto_check_failed

There was a failure when trying to verify the tax-id-number provided. Update/check the tax-id-number for the Contact.

Tax_id_number_manual_check_failed

There was a failure when trying to manually verify the tax-id number provided for the Contact. Update/check the tax-id-number for the Contact.

The status of the CIP Check will remain pending and these exceptions will be added to the exceptions array. If the information on the contact is updated and the cip-cleared status is still pending then the CIP Check will be reprocessed for a US Individual.

If the CIP Check is manually reviewed then you should also track the exception-details field to look out for notes left by Prime Trust’s compliance officers.

AML-Check

Any exceptions present on a pending AML check are generally due to a false positive and will be cleared manually by our Compliance team, if they believe that the hit is not a false positive they will reach out to you outside of our API to gather more information. Tracking the status on the AML-Check itself should be sufficient.

KYC Document Check

KYC Document Checks help run checks against identity and address documents that are provided to Prime Trust. To open an account or to ensure that funds are not contingently held for an end user once sent in the contact should have a cleared KYC Document Check for identity set to true.

Note that similar to a CIP Check the KYC Document Check will remain in a pending state and have exceptions on the checks. If a new document is uploaded to clear the raised exceptions then a new kyc-document-check should be created.

There are a number of exceptions that can be set on documents including the following:

General exceptions

auto_check_failed

There was a technical error and this document could not be automatically verified. The quickest way to resolve this is to upload a new document or generate a new kyc document check on the existing document. Alternatively you can wait for a Prime Trust compliance officer to review the document.

manual_review_check_failed

The document is being reviewed manually by a Prime Trust compliance officer.

Identity Related Failures

These failures will show up if the document is specified as a proof of identity document.

date_of_birth_auto_check_failed

The date of birth on the document does not match the date of birth listed on the Contact. Update the date of birth on the Contact or provide a new document which lists the date of birth provided on the contact.

document_valid_auto_check_failed

The document provided is not valid (for example is expired or is fake). Provide a new valid document.

tax_country_auto_check_failed

The country that issued the id does not match the tax country listed on the contact. Provide a new document that matches the tax country specified on the Contact or update the tax country on the Contact and generate a new KYC Document Check.

Address Related Failures

These failures will show up if the document is specified as a proof of address document.

address_auto_check_failed

The address on the document did not match the address on the contact. Either update the address on the Contact if possible or request for a proof of address.

Simulating exceptions in sandbox

When creating a Contact or an Account with a Contact in Sandbox by using POST /v2/contacts and POST /v2/accounts respectively, you have the ability to trigger CIP, AML and KYC checks using the Contact’s name attribute. The Contact’s name needs to be prefixed with sandbox_exceptionsfollowed by a whitespace delimited string of desired exception codes that correspond to specific errors per type of check.

Example:

“Contact's name”: “sandbox_exceptions 2 4”

Result: This will create a Contact with a CIP check that has an exception attribute including deceased_auto_check_failed and an AML check with an exception attribute including currency_risk_auto_check_failed

List of available codes per Document Check type:

AML check

0 -> access_auto_check_failed

2 -> currency_risk_auto_check_failed

8 -> sanctions_screening_auto_check_failed

CIP check

0 -> access_auto_check_failed

1 -> address_auto_check_failed

3 -> date_of_birth_auto_check_failed

4 -> deceased_auto_check_failed

6 -> name_and_address_auto_check_failed

7 -> name_auto_check_failed

10 -> tax_id_number_auto_check_failed

KYC document check

0 -> access_auto_check_failed

1 -> address_auto_check_failed

3 -> date_of_birth_auto_check_failed

5 -> document_valid_auto_check_failed

9 -> tax_country_auto_check_failed

Last updated on