Global KYC Regulatory Atlas
The only two things we hold are a Decentralized Identity Foundation Associate Membership and a
did:solidus listing in the W3C DID Method Registry. A membership is not a certification. A
registry listing is a listing, not a W3C standard, not a ratification, not an endorsement.
Neither is a compliance credential and neither should be read as one.
What we hold, in full
| status | |
|---|---|
| SOC 2 Type I / Type II | not held, no auditor engaged or selected. detail |
| ISO 27001 | not held, no ISMS exists. detail |
| ISO/IEC 30107-3 · accredited PAD lab testing | not held, never submitted. detail |
| eIDAS QTSP | not held, 2027 target via a partner that does not exist. detail |
| External security audit / penetration test | not performed |
| GDPR / KVKK compliance assessment | not performed, no DPIA, no DPO, no records of processing. GDPR · KVKK |
| MASAK obligated-party status · Turkish licence | not held, and our pipeline does not perform the required registry match. detail |
| FATF Travel Rule · IVMS 101 | not built, code-verified absence. detail |
| Sanctions · PEP · adverse media · transaction monitoring | not built |
| Data residency guarantee | none offered. detail |
| DIF Associate Membership | held, a membership, not a certification |
did:solidus W3C DID Method Registry |
held, a registry listing, not a standard |
Corrections to what this page and our security page said before
We found the following on our own live pages on 2026-07-31, and every one of them is wrong:
- "Credential attestation model satisfies VASP Travel Rule", marked Current. No Travel Rule or IVMS 101 code exists anywhere in our codebase. A comparison row on the same page said "Not offered": that row was the accurate one.
- "EU data residency option" and "Solidus EU region satisfies this" for a German regulator's requirement. There is no EU region and no residency option.
- "Right to erasure: supported", marked Current, and "account deletion removes all off-chain data within 24 hours". No account-deletion path exists in the codebase.
- "No PII persisted post-session." Identity documents are retained on a 30-day timer and session recordings on a 365-day timer.
- "SOC 2 Type II, Audit in progress." Our own compliance record says the audit has not been performed and no engagement exists.
- Enhanced due diligence and source-of-funds copy reading as shipped. All of it is
not-built.
There is no per-country acceptance matrix on this page, and the one that was here before was not produced by anything in the pipeline. Document acceptance is a per-organisation policy, not a fixed global list, and we will not publish a table our own system cannot generate.
What Solidus Verify actually is, in regulatory terms
An identity-proofing input. Document authentication, liveness, face match, and a credential the person keeps and can present again.
That is the whole of it. It is genuinely the input a regulated business needs for the identification leg of customer due diligence, and it is not the rest of what any of these regimes require.
And it never moves your obligation. A business subject to AML, data-protection or licensing rules remains fully liable for its own compliance whether or not it uses us. Whether a supervisor would treat third-party verification as satisfying a given duty is unsettled, see reliance.
About "2027"
Several rows above carry an internal 2027 horizon for independent certification. A horizon is not a plan and not a commitment, and one of them, the eIDAS row, is additionally contingent on a partnership that does not exist. Do not build a procurement timeline on it.