Perform KYC verification

POST/

Use this endpoint to verify the identity of an account holder in the United States, either a user or a business. You can perform KYC verification on an account holder, provided the following are true:

The KYC status of the account holder is UNVERIFIED, LIMITED, or ACTIVE.
The account holder has not been submitted for KYC verification more than twice.

Required fields

In order to perform KYC verification, the user or business resource on which you perform the check must have the following fields configured with valid values:

User Fields Required for KYC	Business Fields Required for KYC
- `first_name` (legal first name only, no prefixes) - `last_name` (legal last name only, no suffixes) - `address1` (cannot be a PO Box) - `city` - `state` - `postal_code` - `country` - `birth_date` - `identifications` (nine digits, no delimiters) - `email` (required in some cases) - `phone` (required in some cases)	- `business_name_legal` (128 char max) - `business_name_dba` (“Doing Business As” or fictitious business name; enter the legal business name in this field if your business does not use a fictitious business name) - `office_location` (cannot be a PO Box; `state` field must use a valid state, provincial, territorial, or federal abbreviation) - `identifications` (nine digits, no delimiters) - `incorporation.incorporation_type` - `incorporation.state_of_incorporation` - `date_established` - `proprietor_or_officer` - `beneficial_owner` (maximum of four beneficial owners) - `proprietor_is_beneficial_owner` (required if the business proprietor or officer is also a beneficial owner) - `attestation_consent` - `attester_name` - `attestation_date` - `general_business_description`

Valid state, provincial, territorial, and federal abbreviations

The following list includes all valid two-letter abbreviations for US states, territories, and military (APO/FPO/DPO) addresses. It also includes two-letter abbreviations for Canadian provinces and territories and three-letter abbreviations for supported countries. State, provincial, territorial, and federal abbreviations are case sensitive, and must be in uppercase as they appear in this list:

AL: Alabama
AK: Alaska
AB: Alberta
AS: American Samoa
AZ: Arizona
AR: Arkansas
AE: Armed Forces
AA: Armed Forces Americas
AP: Armed Forces Pacific
BC: British Columbia
CA: California
CAN: Canada
CO: Colorado
CT: Connecticut
DE: Delaware
DC: District of Columbia
FL: Florida
GA: Georgia
GU: Guam
HI: Hawaii
ID: Idaho
IL: Illinois
IN: Indiana
IA: Iowa
KS: Kansas
KY: Kentucky
LA: Louisiana
ME: Maine
MB: Manitoba
MD: Maryland
MA: Massachusetts
MI: Michigan
MN: Minnesota
MS: Mississippi
MO: Missouri
MT: Montana
NE: Nebraska
NV: Nevada
NB: New Brunswick
NH: New Hampshire
NJ: New Jersey
NM: New Mexico
NY: New York
NF: Newfoundland
NC: North Carolina
ND: North Dakota
NT: Northwest Territories
NS: Nova Scotia
NU: Nunavut
OH: Ohio
OK: Oklahoma
ON: Ontario
OR: Oregon
PA: Pennsylvania
PE: Prince Edward Island
PR: Puerto Rico
QC: Quebec
RI: Rhode Island
SK: Saskatchewan
SC: South Carolina
SD: South Dakota
TN: Tennessee
TX: Texas
USA: United States of America
UT: Utah
VT: Vermont
VI: Virgin Islands
VA: Virginia
WA: Washington
WV: West Virginia
WI: Wisconsin
WY: Wyoming
YT: Yukon Territory

Request body

Fields	Description
business_token string Optional	Specifies the business account holder on which to perform the identity check. Do not pass this field if your request includes the `user_token` field. Send a `GET` request to `/businesses` to retrieve business tokens. Allowable Values: 1–36 chars
manual_override boolean Optional	Set to `true` to designate a user account holder as having passed a verification check without Marqeta performing the check through one of its KYC providers. Use this override when you perform verification through another mechanism, such as an alternative KYC provider or directly with the account holder. You must obtain explicit, written approval from Marqeta before using the `manual_override` field for KYC verification. This feature is only available to programs that are enabled to perform their own Customer Identification Program (CIP) KYC verification. Consult your Marqeta representative for more information. Allowable Values: `true`, `false` Default value: `false`
notes string Optional	Notes pertaining to a manual override. This field is returned in the response only when the `manual_override` field is set to `true`. Allowable Values: 255 char max
reference_id string Optional	Can be specified only if `manual_override=true`. If you verified a user account holder’s identity by performing a KYC verification outside of the Marqeta platform, you can use the `reference_id` field to store the reference number returned by that KYC provider. NOTE: When you submit a KYC verification request with `manual_override=false`, the Marqeta platform performs the verification through one of its KYC providers. If the KYC provider responds with a reference identifier, that identifier is passed to you by way of this field in the response. Allowable Values: 32 char max
token string Optional	The unique identifier of the identity check. If you do not include a token, the system will generate one automatically. This token is necessary for use in other API calls, so we recommend that rather than let the system generate one, you use a simple string that is easy to remember. This value cannot be updated. Allowable Values: 1–36 chars
user_token string Optional	Specifies the user account holder on which to perform the identity check. Do not pass this field if your request includes the `business_token` field. Send a `GET` request to `/users` to retrieve user tokens. Allowable Values: 1–36 chars Existing user token

Sample request body

Sample request body for a user

JSON

{
  "token": "my_userkyc01",
  "user_token": "my_user01",
  "manual_override": false
}

Sample request body for a business

JSON

{
  "token": "my_bizkyc01",
  "business_token": "my_biz01"
}

Response body

Fields	Description
business_token string Conditionally returned	The business account holder on which the identity check was performed. Allowable Values: Existing business token
created_time datetime Returned	Time when the KYC verification was performed. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
last_modified_time datetime Returned	Time when the KYC verification was last updated. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
manual_override boolean Conditionally returned	If `true`, the user account holder is designated as having passed a verification check without Marqeta performing the check. This override is used when verification is performed through another mechanism, such as an alternative KYC provider or directly with the account holder. Allowable Values: `true`, `false`
notes string Conditionally returned	Notes pertaining to a manual override. This field is included in the response only when the `manual_override` field is set to `true`. Allowable Values: 255 char max
reference_id string Conditionally returned	If you verified the account holder’s identity by performing a KYC verification outside of the Marqeta platform, you can use the `reference_id` field to store the reference number returned by that KYC provider. This field is included in the response only when the `manual_override` field is set to `true`. NOTE: When you submit a KYC verification request with `manual_override=false`, the Marqeta platform performs the verification through one of its KYC providers. If the KYC provider responds with a reference identifier, that identifier is passed to you by way of this field in the response. Allowable Values: 32 char max
result object Conditionally returned	Contains information about the KYC verification result. Allowable Values: Existing KYC verification object
result.codes array of objects Conditionally returned	An array of KYC verification result code objects. Allowable Values: One or more KYC verification result code objects
result.codes[].code string Conditionally returned	For any `pending` or `failure` outcome, see the User KYC failure codes table, the Outcome reasons for the business table, or the Outcome reasons for individuals associated with a business table. Allowable Values: `AddressIssue`, `DateofBirthIssue`, `Denied KYC`, `NameIssue`, `NoRecordFound`, `OFACFailure`, `RiskIssue`, `SSNIssue`, `warm address alert`, `Watchlist`
result.codes[].message string Conditionally returned	Result code description. Allowable Values: 255 char max
result.status string Conditionally returned	KYC verification status. Allowable Values: `success`, `failure`, `pending`
token string Conditionally returned	The unique identifier of the identity check. Allowable Values: Existing identity check token
user_token string Conditionally returned	The user account holder on which the identity check was performed. Allowable Values: Existing user token

Sample response body

Sample response body for a user

JSON

{
  "token": "my_userkyc01",
  "user_token": "my_user01",
  "result": {
    "status": "failure",
    "codes": [
      {
        "code": "AddressIssue"
      }
    ]
  },
  "manual_override": false,
  "created_time": "2025-02-08T19:52:58Z",
  "last_modified_time": "2025-02-08T19:52:58Z"
}

Sample response body for a business

JSON

{
  "token": "my_bizkyc01",
  "business_token": "my_biz01",
  "status": "pending",
  "created_time": "2025-02-08T19:52:58Z",
  "last_modified_time": "2025-02-08T19:52:58Z",
  "results": [
    {
      "component": "BUSINESS",
      "reference_id": "xxxxx",
      "outcome": "success",
      "outcome_reasons": []
    },
    {
      "component": "PROPRIETOR",
      "reference_id": "yyyyy",
      "outcome": "pending",
      "outcome_reasons": [
        "SSNIssue",
        "DOBIssue"
      ]
    },
    {
      "component": "BENEFICIAL_OWNER1",
      "reference_id": "aaaaa",
      "outcome": "pending",
      "outcome_reasons": [
        "AddressIssue"
      ]
    },
    {
      "component": "BENEFICIAL_OWNER2",
      "reference_id": "bbbbb",
      "outcome": "success",
      "outcome_reasons": []
    },
    {
      "component": "BENEFICIAL_OWNER3",
      "reference_id": "ccccc",
      "outcome": "success",
      "outcome_reasons": []
    },
    {
      "component": "BENEFICIAL_OWNER4",
      "reference_id": "ddddd",
      "outcome": "success",
      "outcome_reasons": []
    }
  ]
}

Getting Started

Testing

Card Issuing

Card Processing

Accounts & Money Movement

Risk, Fraud, and Disputes

Cardholder User Experience

Perform KYC verification

Required fields

Valid state, provincial, territorial, and federal abbreviations

Request body

Sample request body

Response body

Sample response body

​Required fields

​Valid state, provincial, territorial, and federal abbreviations

​Request body

​Sample request body

​Response body

​Sample response body

Required fields

Valid state, provincial, territorial, and federal abbreviations

Request body

Sample request body

Response body

Sample response body