KYC Identity Verification Module for WHMCS

What does KYC verification add to WHMCS?

It adds an identity check between an order and its fulfilment, so a stolen card cannot buy a server that goes live straight away. KYC stands for Know Your Customer: confirming that a buyer is a real, named person before you serve them. The module asks for a government ID such as a passport, driver's license or national ID, an optional selfie, and proof of address such as a utility bill or bank statement.

Through a provider API it can also screen customers against PEP and sanctions lists, including OFAC, EU and UK lists. Services tied to a failed or expired check are suspended automatically.

Can I set different rules for different products?

Yes. Each product gets its own KYC level, so a low-cost plan can ask for basic checks while high-value services require the full set. You also choose when the check is triggered:

• At signup
• On the first purchase
• When a customer's lifetime spend passes an amount you set
• For products in a chosen category

Admins work through a review queue with a document viewer, and can approve, reject or ask for more information. Every decision is written to an audit log for compliance reporting. Customers follow a guided wizard in the client area to upload files, take a selfie and track their status, in English, Spanish, French, German, Arabic or Hindi, with translation files for adding more.

Where are customer documents kept?

On your own server, encrypted with AES-256 and readable only by an authenticated admin. Files are never reachable through a direct URL.

What do you need, and what does it not cover?

Requirements: WHMCS 8.13 (tested), PHP 8.1 or newer, and writable secure storage on the server. Manual review works without any third-party service. For automated identity scoring, liveness detection, OCR or sanctions screening, add API keys for Onfido, SumSub or Jumio.

Limits: the module gives you the tools, not a compliance policy. Whether your business must run KYC, and what counts as enough proof, depends on where you operate and your payment processors' rules, so confirm that with a qualified adviser.