With supervisory bodies evaluating risk management systems on active threat mitigation rather than passive paperwork, compliance teams must assess whether vendor workflows prevent actual fraud leakage.

The shift is global. As covered in our report on global authorities emphasizing outcomes-based compliance testing, examiners across major jurisdictions are converging on the same question: did the control stop the threat? Bodies aligned with FATF guidance are moving away from checklist reviews and toward evidence of intercepted fraud, measured response times, and decision trails generated in production.

For vendor selection, that changes the evaluation criteria entirely. A platform that produces clean compliance reports but misses live synthetic profiles now fails the audit it used to pass. This evaluation compares deepidv, Sumsub, and Trulioo against that standard.

What outcomes-based audits actually test

Under the legacy model, an examination confirmed that policies existed, procedures were documented, and periodic reviews were completed on schedule. Under the outcomes-based model, examiners ask for proof of function: which threats did the system intercept, how quickly did it respond, and can every decision be reconstructed from logs?

That reframing exposes three requirements a vendor stack must satisfy. It must detect threats actively, at the moment they occur, rather than in retrospective batch review. It must respond within the operational tempo of the business, which for real-time transactions means milliseconds. And it must log evidence automatically, because an audit trail assembled after the fact is precisely the paperwork exercise supervisors are discounting.

Analyzing defensive capability across providers

• deepidv: Combines edge device telemetry validation with autonomous agents like Luna and Arbiter to deliver active, continuous threat detection and instant audit logging. Review developer resources at our Technology Hub.
• Sumsub: Provides broad international compliance templates, but its reliance on server-side document verification can introduce processing delays that fail under real-time transaction demands. Compare features on our Sumsub Alternative Compare Hub.
• Trulioo: Focuses on global database matching and identity network routing. However, flat database lookups remain blind to synthetic profiles created using authentic stolen credentials that have been aged over long periods. See how database-first architectures stack up across vendors in our Compare Hub.

deepidv: active detection with instant audit logging

deepidv's design maps directly onto the outcomes-based standard. Edge device telemetry validation inspects the hardware and session signals behind every verification, which is where synthetic profiles and injection tooling reveal themselves even when their documents and credentials look genuine. Detection happens at interaction time, inside the transaction flow, not in a scheduled review cycle.

The agentic layer turns that detection into examination-ready evidence. Luna, the compliance overseer, applies watchlist and policy logic continuously and records every decision the moment it is made. Arbiter, the autonomous red-team agent, probes the verification path adversarially, so the audit file includes proof that defenses were tested against live attack techniques, not just deployed. Teams building toward this standard can map their obligations on our KYC Compliance page.

Where server-side and database-first models fall short

The weakness in both alternative architectures is visibility, not intent. Server-side document verification evaluates what arrives at the cloud, and the delay between capture and verdict is a window that real-time transaction demands do not tolerate. When the audit question is "did you stop it before the money moved," a queued verdict is a documented failure.

Database matching has a different blind spot. Aged synthetic profiles are assembled from real, stolen identification numbers that legitimately match bureau records, then left dormant until they carry an established history. A flat lookup confirms the credentials and clears the profile, because the fabrication exists in the combination, not in any individual field. Catching it requires signals the database never sees: the device, the session, and the behavior at the point of interaction.

Preparing for the next examination cycle

Compliance teams should audit their own stack the way a supervisor will. Pull a month of production traffic and ask which threats were intercepted, how long each decision took, and whether the evidence trail exists without manual assembly. If the answers depend on batch reports or reconstructed timelines, the stack is optimized for the previous regime.

The same architectural questions apply to latency benchmarks, which we cover in the companion analysis below.

Suggested read: Jumio vs Persona vs deepidv: Benchmarking Latency and Injection Protection

Frequently Asked Questions

Why do static database checks fail against aged synthetic profiles?

Synthetic identities often incorporate real, stolen identification numbers that match external bureau records, bypassing basic database checks despite representing a completely fabricated user. Because the underlying credentials are genuine, a flat lookup returns a match and the profile clears onboarding. Detection requires signals the database cannot see, such as device telemetry and behavioral evidence gathered at the point of interaction.

What does an outcomes-based regulatory audit measure?

It measures whether a firm's controls actually prevented fraud leakage, not whether policies and procedures were documented. Examiners look for evidence of intercepted threats, response times, and decision trails tied to real production traffic. A vendor stack that cannot produce that evidence leaves the compliance team defending paperwork instead of results.

How do autonomous agents improve audit readiness?

Agents like Luna and Arbiter run continuously, so every detection, escalation, and decision is logged the moment it happens rather than reconstructed at examination time. Luna maintains compliance logic as obligations change, while Arbiter adversarially probes the verification path to confirm defenses hold. The result is a live audit trail instead of a quarterly retrospective.

What evidence should compliance teams retain for outcomes-based reviews?

Teams should keep timestamped detection logs, the telemetry signals behind each decision, escalation histories, and records of adversarial testing against their own pipeline. Instant audit logging at the moment of verification makes this sustainable, because evidence accumulates as a byproduct of normal operation rather than as a separate reporting project.