Account activation & KYC
The dossier that unlocks live payments, how review works, and what it changes.
Sandbox needs nothing from you beyond an email address. Production needs a verified identity, because moving other people's money is regulated everywhere Wajub operates.
Until your compliance record is verified, your team stays in sandbox. The Dashboard refuses to
switch to live, so no live key can be created, not even by wajub login. Verification is what flips
your team to live.
Start by choosing what you are
The first decision shapes the whole dossier, so make it deliberately. Wajub recognises eight legal entity types: individual, company, NGO, educational institution, religious organisation, political organisation, government entity and other. Each carries its own subtypes, an LLC and an SA being two shapes of the same company type.
The split that matters for your workload is individual against everything else. An individual, a freelancer or a sole proprietor, files no company documents at all. Every other type files four.
The type changes in one direction only. Once verified as an individual, you can move to
another type from Settings → Compliance. Your dossier goes back to unverified and asks for
what the new type requires on top of what you already filed. No other change of type is offered.
The six steps
Verification lives in the Dashboard under Settings → Compliance, and it is a wizard rather than a single form. Each step unlocks the next, so you cannot upload documents before your contact details are verified.
- Project info. Your business category and activity, plus a description of what you sell, at least ten characters and at most a thousand. This is also where a regulated activity gets flagged.
- Legal info. Legal name, address, country, incorporation date and country for companies and NGOs, tax and VAT numbers, source of funds. You verify a company email and a company phone here, both by code. Change either afterwards and its verification is cleared.
- Online presence. At least one live URL, website, app store listing or social account. The step will not pass with zero entries.
- Documents. The company file, skipped entirely for individuals.
- Persons. The directors, owners and beneficial owners, each with their own identity documents.
- Review & Submit. A summary of everything, and the Submit for verification button.
What Submit for verification actually checks
The button stays inert until the dossier is complete, and the rules are exact rather than indicative. Reading them now is faster than discovering them one refusal at a time.
Everyone must have a business category, a product description, a legal name with a full address, a verified company email, a verified company phone, and at least one online presence.
If you are a company, an NGO or any other organisation, you upload four documents at the company level, and the fourth is waived only for government entities.
| Document | What it is |
|---|---|
| Business registration certificate | Proof that the entity is legally registered. |
| Articles of association | The founding document describing structure and rules. |
| Location plan | A map or plan showing where the business physically operates. |
| Tax certificate | Confirmation of tax registration. Not required for government entities. |
You also register at least one person marked as the legal representative, and that person needs an identity document on file. Passport, national ID card or residence permit all count.
If you are an individual, there are no company documents. You register yourself and provide three things: an identity document, a proof of address, and a liveness check. The liveness check is a real-time session, done in the Dashboard or through a link you send, which is the easier route when the person to verify is not the one sitting at the keyboard. A video file you upload yourself does not count as one.
If your activity is regulated, and payment processing, money transfer, lending, crypto exchange, investment, gambling, lottery, telemedicine and online pharmacy all are, you must attach a valid licence on top of everything above. A licence that is expired or already rejected does not count, and the dossier will not submit without one.
File rules
Documents are accepted as PDF, JPG, JPEG or PNG, up to 10 MB each.
Scan legibly. An unreadable document is the cheapest possible rejection, and it costs you a full review cycle.
After you submit
Your record moves to pending and the Dashboard tells you to expect an answer within 48 hours. You
receive a confirmation email immediately, and the compliance team works from there.
While you wait, the dossier is read only: you cannot edit fields or add people until a decision comes back.
Your sandbox integration is untouched. This is the right window to finish it, exercise the failure paths, and work through the Going Live checklist so that approval is the only thing standing between you and your first real payment.
Watch the outcome from your own code
Compliance emits webhooks, so your application can react to a decision without anyone refreshing a Dashboard tab. Subscribe an endpoint to the events you care about and they arrive in the usual signed envelope.
| Event | Fires when |
|---|---|
compliance.submitted | Your dossier enters review. |
compliance.verified | You are approved and live opens. |
compliance.rejected | The dossier is refused, with a reason. |
compliance.changes_requested | Something specific needs fixing before a decision. |
compliance.inquiry.created | Compliance opens a follow-up question after verification. |
compliance.inquiry.resolved | That question is closed. |
The payload carries the new status, the one it came from, and the rejection reason when there is one, which is enough to route an alert to the right person on your side.
These events only reach live endpoints that list them by name. A sandbox endpoint never
receives them, and an endpoint subscribed to * does not either, so add them to your live endpoint
configuration explicitly.
When you are approved
Your compliance record becomes verified, your team switches to live, and your live limits are
set.
Live keys are then created the same way sandbox keys were, by switching the environment in the Dashboard and minting a new one. See Setup your account for where that lives. A sandbox key is never promoted into a live one.
Your limits, single, daily and monthly, for both collection and payout, depend on your business and its activity, and the Dashboard shows them.
Verification is not permanent. Wajub sets a re-verification date twelve months out and warns you thirty days before it falls due, so plan on refreshing documents once a year.
When it comes back for changes
A refusal is not final. rejected comes with a written reason, and changes_requested means
something specific is missing or unreadable. Either way the dossier reopens for editing and you
resubmit the same record.
These are the causes that actually recur.
| Cause | What to do |
|---|---|
| Unreadable or partial scan | Rescan the full page, all four corners visible. |
| Name on the document does not match the declared legal name | Use documents in the exact registered name, or correct the legal name. |
| Online presence is a placeholder or an offline URL | Publish something real before resubmitting, the URL is opened. |
| Product description too vague | Say what you sell, to whom, and at what typical amount. |
| Regulated activity declared with no licence | Attach the licence, or correct the activity if it was mis-selected. |
| Beneficial owners missing | Register every owner, with their identity document and ownership percentage. |
Once you are verified, further questions arrive through compliance inquiries rather than through a new review. Those live in the Dashboard next to your dossier, they thread like a conversation, and you can attach files to a reply. They are the normal channel for ongoing AML follow-ups and they do not suspend your account by themselves.
Some activities are never eligible
Weapons, illegal substances, and unlicensed gambling are refused whatever the dossier looks like, as is anything unlawful in the countries you operate in. If your activity is regulated and you hold the licence, declare it at step one rather than hoping the question does not come up.