Identity & Verification

The largest section of this Lexicon, and the one a buyer is most likely to arrive on.

These are the words a compliance officer uses in the first ten minutes of a procurement conversation: customer due diligence, enhanced due diligence, KYB, politically exposed persons, ultimate beneficial owners, sanctions screening, adverse media screening, the FATF Travel Rule, SOC 2, ISO 27001, periodic review, remediation. Each is defined here on its own terms, without a vendor's framing attached, because a company that cannot define the buyer's vocabulary has no business selling into it.

It is also the section where Solidus ships the least, and each entry says so in its own status field rather than making you infer it. Most of the compliance operations named above are not-built: they are industry vocabulary we document, not features we sell.

What this area actually covers

Three different things get called "identity," and conflating them is the most common mistake in this market:

1. Verification, a one-time act. Someone presents a document and a face; a system decides whether the document is genuine, whether the face is alive, and whether the two match. That is IDV, and it is a bounded engineering problem with measurable error rates.
2. Compliance, an ongoing obligation. A regulated business must know who its customers are, keep knowing, screen them against lists, and prove to a regulator that it did. That is KYC, AML, CDD and everything downstream. It is a legal duty, not a feature.
3. Portability, whether the result of (1) survives past the party who paid for it. This is the only one of the three where Solidus is doing something the incumbents are not, and it is why credential portability is the term to read first.

The industry sells (1) as a subscription to satisfy (2), and (3) does not exist in its product model, every relying party re-runs the check. Solidus issues a W3C Verifiable Credential the user holds and re-presents, so the second and Nth relying party verify a credential instead of re-running the verification.

What Solidus ships here, precisely

Shipped: IDV and the KYC pipeline (document capture, OCR, liveness, face match), onboarding, credential portability, pairwise DIDs, level of assurance, non-custodial wallet, session-fixation defence. On testnet: pass rate, drop-off rate, manual-review queue, presentation-attack detection, liveness detection, guardian recovery, verification reuse. Not built: the 28 above.

All of it runs on a public testnet. There is no mainnet and no token. The KYC engine is native, Solidus built it rather than reselling Onfido, Sumsub or Jumio, which means the accuracy numbers that matter in this category are ours to earn and have not been independently measured. Nothing here is certified, compliant, or attested by anyone.

Where this category ends

• Comparisons against named vendors live on verify.solidus.network, not here. A Lexicon entry for KYC defines KYC; it does not argue that we beat Sumsub.
• Cryptography, how selective disclosure and unlinkability actually work, is its own section.
• Regulation, the specific obligations behind the vocabulary, splits into the EU and Türkiye sections, because the duties differ and merging them produces wrong advice.
• Unit economics, what a verification costs and what reuse saves, is the economics section.

Origin

Nearly every entry here composes someone else's concept; a handful implement a specification written elsewhere; none are Solidus inventions. KYC was defined by financial regulators, IDV by the document-security industry, verifiable credentials by the W3C. The one thing Solidus originated sits in the consensus section, not this one.