Account activation & KYC

The dossier that unlocks live payments, how review works, and what it changes.

Sandbox needs nothing from you beyond an email address. Production needs a verified identity, because moving other people's money is regulated everywhere Wajub operates.

The mechanism is blunt and worth understanding before you start: until your compliance record is verified, your team stays in sandbox. The Dashboard refuses to switch to live, so no live key can be created, not even by wajub login, and every live transaction and payout limit is zero. Verification is what flips your team to live and turns those limits into real numbers.

Start by choosing what you are

The first decision shapes the whole dossier, so make it deliberately. Wajub recognises eight legal entity types: individual, company, NGO, educational institution, religious organisation, political organisation, government entity and other. Each carries its own subtypes, an LLC and an SA being two shapes of the same company type.

The split that matters for your workload is individual against everything else. An individual, a freelancer or a sole proprietor, files no company documents at all. Every other type files four.

The type changes in one direction only. Once verified as an individual, you can move to another type from Settings → Compliance. Your dossier goes back to unverified and asks for what the new type requires on top of what you already filed. No other change of type is offered.

The six steps

Verification lives in the Dashboard under Settings → Compliance, and it is a wizard rather than a single form. Each step unlocks the next, so you cannot upload documents before your contact details are verified.

Project info. Your business category and activity, plus a description of what you sell, at least ten characters and at most a thousand. This is also where a regulated activity gets flagged.
Legal info. Legal name, address, country, incorporation date and country for companies and NGOs, tax and VAT numbers, source of funds. You verify a company email and a company phone here, both by code. Change either afterwards and its verification is cleared.
Online presence. At least one live URL, website, app store listing or social account. The step will not pass with zero entries.
Documents. The company file, skipped entirely for individuals.
People. The directors, owners and beneficial owners, each with their own identity documents.
Review. A summary of everything, and the Submit button.

What Submit actually checks

The button stays inert until the dossier is complete, and the rules are exact rather than indicative. Reading them now is faster than discovering them one refusal at a time.

Everyone must have a business category, a product description, a legal name with a full address, a verified company email, a verified company phone, and at least one online presence.

If you are a company, an NGO or any other organisation, you upload four documents at the company level, and the fourth is waived only for government entities.

Document	What it is
Business registration certificate	Proof that the entity is legally registered.
Articles of association	The founding document describing structure and rules.
Location plan	A map or plan showing where the business physically operates.
Tax certificate	Confirmation of tax registration. Not required for government entities.

You also register at least one person marked as the legal representative, and that person needs an identity document on file. Passport, national ID card or residence permit all count.

If you are an individual, there are no company documents. You register yourself and provide three things: an identity document, a proof of address, and a liveness check. The liveness check is a real-time session, done in the Dashboard or through a link you send, which is the easier route when the person to verify is not the one sitting at the keyboard. A video file you upload yourself does not count as one.

If your activity is regulated, and payment processing, money transfer, lending, crypto exchange, investment, gambling, lottery, telemedicine and online pharmacy all are, you must attach a valid licence on top of everything above. A licence that is expired or already rejected does not count, and the dossier will not submit without one.

File rules

Documents are accepted as PDF, JPG, JPEG or PNG, up to 10 MB each. Uploads are rate limited to ten per minute, so a bulk drag and drop of a dozen files will pause partway through rather than fail.

Scan legibly. An unreadable document is the cheapest possible rejection, and it costs you a full review cycle.

After you submit

Your record moves to pending and the Dashboard tells you to expect an answer within 48 hours. You receive a confirmation email immediately, and the compliance team works from there.

Two things freeze while you wait. The dossier itself becomes read only, you cannot edit fields or add people until a decision comes back. And your live limits stay at zero, since only a verified status lifts them.

Your sandbox integration is untouched. This is the right window to finish it, exercise the failure paths, and work through the Going Live checklist so that approval is the only thing standing between you and your first real payment.

Watch the outcome from your own code

Compliance emits webhooks, so your application can react to a decision without anyone refreshing a Dashboard tab. Subscribe an endpoint to the events you care about and they arrive in the usual signed envelope.

Event	Fires when
`compliance.submitted`	Your dossier enters review.
`compliance.verified`	You are approved and live opens.
`compliance.rejected`	The dossier is refused, with a reason.
`compliance.changes_requested`	Something specific needs fixing before a decision.
`compliance.inquiry.created`	Compliance opens a follow-up question after verification.
`compliance.inquiry.resolved`	That question is closed.

The payload carries the new status, the one it came from, and the rejection reason when there is one, which is enough to route an alert to the right person on your side.

compliance.verified

{

"id": "evt_7Yh2Mp4kQ9vB5nL6hR1cY8dF",

"event": "compliance.verified",

"livemode": true,

"api_version": "2026-10-11",

"created": "2026-05-24T10:21:08+00:00",

"data": {

"legal_name": "Boutique Amina SARL",

"type": "company",

"status": "verified",

"previous_status": "pending",

"rejection_reason": null,

"risk_level": "low",

"submitted_at": "2026-05-22T09:04:11+00:00",

"verified_at": "2026-05-24T10:21:08+00:00"

}

These events only reach live endpoints that list them by name. A sandbox endpoint never receives them, and an endpoint subscribed to * does not either, so add them to your live endpoint configuration explicitly.

When you are approved

Four things happen at once. Your compliance record becomes verified, your team switches to live, your default payment provider is attached, and your limits are recalculated upward.

Live keys are then created the same way sandbox keys were, by switching the environment in the Dashboard and minting a new one. See Setup your account for where that lives. A sandbox key is never promoted into a live one.

How high your limits land is not a single number. Verification sets the baseline, and it is then adjusted by your entity type, by how risky your declared activity is, and by the risk score computed from your dossier. A registered company selling retail goods ends up meaningfully higher than a sole proprietor running a betting service. Your actual limits, single, daily and monthly, for both collection and payout, are shown in the Dashboard.

Verification is not permanent. Wajub sets a re-verification date twelve months out and warns you thirty days before it falls due, so plan on refreshing documents once a year.

When it comes back for changes

A refusal is not final. rejected comes with a written reason, and changes_requested means something specific is missing or unreadable. Either way the dossier reopens for editing and you resubmit the same record.

These are the causes that actually recur.

Cause	What to do
Unreadable or partial scan	Rescan the full page, all four corners visible.
Name on the document does not match the declared legal name	Use documents in the exact registered name, or correct the legal name.
Online presence is a placeholder or an offline URL	Publish something real before resubmitting, the URL is opened.
Product description too vague	Say what you sell, to whom, and at what typical amount.
Regulated activity declared with no licence	Attach the licence, or correct the activity if it was mis-selected.
Beneficial owners missing	Register every owner, with their identity document and ownership percentage.

Once you are verified, further questions arrive through compliance inquiries rather than through a new review. Those live in the Dashboard next to your dossier, they thread like a conversation, and you can attach files to a reply. They are the normal channel for ongoing AML follow-ups and they do not suspend your account by themselves.

Some activities are never eligible

Weapons, illegal substances, and unlicensed gambling are refused whatever the dossier looks like, as is anything unlawful in the countries you operate in. If your activity is regulated and you hold the licence, declare it at step one rather than hoping the question does not come up.