Sumsub review: fintech-grade KYC used for age checks

What Sumsub says about Ofcom’s rules

Sumsub’s guide to age verification rules notes that Ofcom requires highly effective age assurance to keep children from pornography, and that in July 2026 Ofcom said inference-based methods should be replaced or supplemented unless they can be shown to be highly effective. The same guide reports Ofcom’s finding that only two of four dating services it analysed had liveness detection. Sumsub itself does not claim an Ofcom approval. Its regulatory credential for age is a positive assessment from Germany’s KJM, dated July 2022.

How much does Sumsub cost?

Sumsub publishes two plans: Basic at $1.35 per verification with a $149 monthly minimum, and Compliance at $1.85 with a $299 minimum. Only successful verifications are billed, and a custom plan is available above that. The free trial lasts 14 days with 50 checks.

A “verification” bundles several features, including ID, liveness and face match, and a site that uses only some of them still pays the full price. For an age-only use, the Basic minimum equals about 110 verified visitors a month.

Sumsub age estimation and the suggested buffer

Sumsub estimates age from a selfie with a liveness check and only asks for an ID from visitors who look too young. The site picks the buffer. Sumsub suggests 3, 7 or 10 years depending on the sector: with a 10-year buffer, anyone who looks 28 or younger shows an ID, and with 7 years the threshold is 25. Sumsub advertises 99.8% estimation accuracy without publishing a method or date. Results come back by webhook, with the estimated age and a decision, and the flow is set up in a no-code workflow builder.

Other ways Sumsub can check age

Beyond the selfie, Sumsub covers more than 14,000 document types, non-document checks against government, banking and credit sources in 4.5 seconds, video identification and European open banking in 28 countries. The open banking product is built for regulated businesses and can read balances and transaction history, far more than an age gate needs. Visitors can keep their verification in Sumsub ID and reuse it with other Sumsub clients. Integration runs through the API, a WebSDK, iOS and Android SDKs or a Unilink.

The Sumsub support data breach

On 4 February 2026, Sumsub disclosed that in July 2024 an attacker used a malicious attachment sent through a third-party support ticketing platform to reach an internal support environment. The activity was only found during a security review in January 2026. The exposed data was mainly names, sometimes with email addresses or phone numbers. Sumsub says no ID images, biometrics or bank details were accessed, and that live verification workflows were not affected.

Can you trust Sumsub?

Sumsub is an established vendor, but ratings split by audience: business users give it 4.6 out of 5 on G2 across 125 reviews, while Trustpilot shows 1.3 out of 5 across 282 reviews, mostly complaints about verification and support. Sum and Substance Ltd is an English company, number 09688671, at 30 St Mary Axe in London, founded in 2015, with offices in Limassol, Riga, Berlin, Singapore, Miami, Dubai and Tel Aviv. It claims more than 4,000 clients and holds ISO/IEC 27001, SOC 2 Type 2, PCI DSS and iBeta Level 1 and 2 certifications. The site sets data retention, and for Illinois residents biometric data is kept for three years at most.

Sumsub strengths and limitations