Fifteen parts
What is identity verification orchestration?
An identity verification (IDV) orchestration platform is a control layer that sits between a business and its many verification, fraud, and compliance vendors. It decides, in real time, which checks to run, in what order, and how to react to each result. Instead of hard-wiring one document-verification or biometrics supplier into your onboarding flow, you route each customer through a configurable workflow that can cascade across providers, fail over when one is down, step up friction only for risky cases, and record every decision in a single audit trail.
As one IDV vendor describes it, orchestration acts as a control layer that coordinates verification steps and decision logic across systems, and it sits between your existing systems rather than replacing them.
One clarification matters for both readers and search. IDV orchestration, the topic here, coordinates verification and compliance vendors during onboarding. That is a different job from IAM or access orchestration, which coordinates login, single sign-on, and authentication journeys. Much of the content ranking for "identity orchestration" conflates the two. They are a related family, but a different job.
A common misconception
Common misconception
"Orchestration is just calling several APIs in sequence."
Sequential API calls are static plumbing: fixed connections that always fire the same checks in the same order.
Orchestration applies conditional, risk-based decision logic. It can reorder checks, skip unnecessary ones, reuse a prior result, and route around a failed provider. The intelligence is in the routing, not the connections.
Why single-vendor identity verification breaks
Traditional identity verification was a set of siloed point solutions bolted directly into onboarding code: one document API here, one biometrics SDK there, a sanctions screen somewhere else, each integrated separately, each with its own data model, logs, and failure modes. That fragmentation produces duplicated checks, inconsistent risk decisions, and a poor customer experience. It also creates a single point of failure. If the one hard-wired provider is down, cannot read a given document, or does not cover a country, the customer is simply blocked.
Coverage and match-rate gaps
No single vendor wins in every country, document type, or fraud scenario. Match rates, coverage, price, and uptime vary by provider and by market. The average financial institution already runs several verification providers, which is why the practical question has moved from "which vendor" to "how do I combine them well".
Uptime and the single point of failure
When your only provider times out or errors, a hard-wired flow has nowhere to go. Orchestration lets a second provider pick up the request so the legitimate customer is not turned away.
Fraud that evolves faster than any one check
Attacks now combine techniques and mutate quickly. Sumsub's 2025 to 2026 Identity Fraud Report found that the most sophisticated attacks rose 180% year on year, and that 76% of fraud attempts occur after KYC, during day-to-day activity. iProov's 2025 Threat Intelligence Report reported native virtual-camera attacks up 2665% and face-swap attacks up 300% versus 2023. Both are vendor threat reports, credible and widely cited, but attribute them as vendor research. The takeaway holds either way: a fixed single check cannot keep pace, so defenders need to add and swap detection signals as threats evolve.
How an orchestration platform works
Under the hood, an orchestration platform is made of four moving parts, and it exposes three routing patterns you need to understand.
The core components
- Verification components and connectors. The individual checks: document authentication, passive and active liveness, face match and face search, device and network intelligence, sanctions and PEP screening, AML monitoring, and KYB or company data. Orchestration does not perform these; it sequences and conditions them.
- Workflows. A workflow maps the paths a user can take through those components, including manual review steps and calls to external data. Modern platforms expose this as a no-code or low-code builder so product and risk teams, not only engineers, can design, test, and change flows.
- Decision engine. The brain. It evaluates the available signals in real time and decides the most efficient path: when to trigger biometrics, when a document check alone is enough, when to reuse a prior result, and how to handle exceptions. This is risk-based, not one-size-fits-all.
- Sessions and profiles. Each interaction is a logged session that follows the workflow rules and ends in a defined outcome. Persistent customer profiles let the platform reuse a verified result instead of re-checking.
The three routing patterns
Almost every orchestration decision reduces to one of three patterns. Each solves a different problem and carries a different trade-off.
| Pattern | What it does | The trade-off |
|---|---|---|
| Cascade / waterfall | Providers are ordered. If the first cannot match a record, the query moves to the next, and the next, until one succeeds. This lifts overall match rate above what any single vendor can achieve. | Each step adds latency, complexity, and cost. A naive waterfall that always tries everyone is slow and expensive. |
| Failover / fallback | If a provider is down, times out, or errors, orchestration automatically routes to an alternative so the customer is not blocked. This is the resilience and uptime story. | You need a genuinely capable second provider for the same market, or failover just moves the block. |
| Step-up verification | Extra checks are added only when confidence drops or risk rises, keeping friction off the majority of legitimate users. | Getting the risk thresholds wrong either waves through bad actors or adds friction to good ones. |
Note
A waterfall is not always better
An uncontrolled waterfall inflates cost and latency because it tries everyone. The value is in deciding when to cascade, per market, against a cost and latency budget, not in cascading everything.
Orchestration vs point solutions vs IAM orchestration
It helps to place orchestration next to the two things it is most often confused with: a single hard-wired vendor, and IAM (access) orchestration.
| Approach | What it coordinates | When it fits |
|---|---|---|
| Single-vendor API | One provider, hard-wired into onboarding code. | Single market, low volume, one document type, low fraud exposure. |
| DIY multi-API | Several providers you wire and sequence yourself in code. | You have engineering to build and maintain the routing, retries, and audit logging. |
| IDV orchestration platform | Verification, fraud, and compliance vendors, with routing, failover, step-up, and one audit trail. | Multiple vendors, multi-country coverage, evolving fraud, and an audit burden. |
| IAM / access orchestration | Login, single sign-on, and authentication journeys, not onboarding verification. | A different job entirely: managing how users sign in, not how they are first verified. |
The 2025 to 2026 picture
Three forces are pushing orchestration from nice-to-have to default: a growing market, tightening regulation, and worsening fraud.
Market
Analyst estimates vary by scope, so treat them as attributed ranges rather than a single fact. Market.us put the KYC orchestration platform market at roughly USD 2.8 billion in 2025, projected to about USD 9.6 billion by 2035 at a 12.9% CAGR. Separately, SkyQuest valued the broader identity verification market at USD 12.52 billion in 2024, forecast to about USD 40.69 billion by 2032 at a 14.9% CAGR. Consolidation confirms that fragmentation is the problem, not the solution: Entrust completed its acquisition of Onfido in April 2024, reportedly for up to USD 650 million, though terms were not officially disclosed. Even so, credible alternatives remain, so buyers stay multi-vendor by choice.
Regulation
The FATF's Guidance on Digital Identity (March 2020) set the risk-based framing that orchestration operationalises: match the assurance level to the risk, allow reliable non-face-to-face onboarding, and support tiered customer due diligence. The guidance is non-binding, but influential. In the EU, eIDAS 2.0 (Regulation (EU) 2024/1183) entered into force on 20 May 2024; member states must offer an EU Digital Identity Wallet by the end of 2026, with mandatory private-sector acceptance expected during 2027. In the US, FinCEN issued alert FIN-2024-Alert004 on 13 November 2024 on GenAI and deepfake schemes used to circumvent identity verification, driven by a rise in related suspicious activity reports. Regulators now explicitly expect institutions to detect AI-generated identity fraud, which favours layered, multi-signal verification.
Regulatory milestones to plan around
A short timeline of the checkpoints that shape verification design.
- March 2020: FATF Guidance on Digital Identity establishes the risk-based, tiered CDD framing (non-binding).
- 20 May 2024: eIDAS 2.0 (Regulation (EU) 2024/1183) enters into force.
- 13 November 2024: FinCEN alert FIN-2024-Alert004 on GenAI and deepfake identity fraud.
- End of 2026: EU member states must offer an EU Digital Identity Wallet.
- During 2027: mandatory private-sector acceptance of the EUDI Wallet expected.
- 2028: the EU's Anti-Money Laundering Authority (AMLA) begins direct supervision of selected institutions.
How AI helps orchestration
Used defensively, AI is what makes orchestration more than a router. Passive and active liveness, injection-attack detection, and face-match models become swappable signals: components you can add, weight, or replace as threats shift, without re-plumbing onboarding. Machine learning evaluates document, biometric, device, and behavioural signals to route each user to the least-friction safe path, reserving step-up checks for genuine risk. Autonomous agents are beginning to coordinate sub-tasks such as liveness, deepfake verification, and document reading across a pipeline, though agentic KYC remains an emerging trend rather than settled practice.
AI on the defender’s side
Where Zenoo's AI genuinely applies
Zenoo runs 10 specialised AI agents that automate the compliance work around verification, not the biometric check itself. The KYB Researcher returns a structured dossier of 50+ fields in under 60 seconds, versus 2 to 4 hours manually. Alert triage pre-classifies up to 80% of screening alerts, cutting per-alert disposition from 20 to 45 minutes down to 2 to 3 minutes. A vendor-integration agent produces field mappings in under 30 minutes, versus 2 to 3 days, which is what makes adding or swapping a provider in the waterfall practical rather than a project. Registry outcomes: investigation time from 22 hours to 12 minutes, and a 95% reduction in false positives, typically within 90 days.
How AI is abused against verification
The same generative AI that helps defenders is being industrialised by attackers, which is precisely why a fixed single check no longer holds.
- Deepfake social engineering at scale. In the Arup case (Hong Kong, January 2024) a finance employee was convinced by a video call in which the CFO and colleagues were all AI deepfakes, and authorised 15 transfers totalling USD 25.6 million in a single day.
- Synthetic identity fraud. Deloitte's Center for Financial Services projects US AI-enabled fraud losses of USD 40 billion by 2027, up from USD 12.3 billion in 2023, a 32% CAGR. Sumsub reports synthetic-identity document fraud up over 300% in the US.
- Injection and virtual-camera attacks. iProov reports native virtual-camera attacks up 2665% and face swaps up 300% versus 2023, with emulators used to hide virtual cameras from detection.
- Generative AI as a cheap bypass. FinCEN's November 2024 alert records fraudsters using GenAI as a low-cost tool to open accounts and defeat identity controls.
- Sophistication over volume. Sumsub found overall fraud volume flat or down, but the most sophisticated multi-technique attacks up 180%, and flags agentic AI scams for 2026.
AI as the threat
Why this favours orchestration
Because attacks combine techniques and mutate quickly, no fixed single check holds for long. The defensive posture that keeps up is the ability to add, weight, and swap detection signals as they emerge, which is exactly what orchestration provides. It routes to best-in-class detectors; it is not itself the detector.
Do you need orchestration?
You probably do not need a platform for a single-market, single-document, low-fraud flow. The signals below are what tip the balance.
- You already run, or are about to run, more than one IDV vendor.
- You onboard across multiple countries with different document types and match rates.
- You see meaningful drop-off at the verification step and suspect friction or false rejections.
- Fraud is rising, or you need to add and swap detection signals quickly.
- Provider outages have blocked legitimate customers with no fallback.
- Compliance needs one provable record of what happened across every vendor.
What to look for in a platform
When you evaluate, test these capabilities against your real onboarding, not a demo happy path.
- Routing depth: genuine cascade, failover, and step-up, configurable per market.
- No-code workflow builder: so risk and product can change flows without an engineering release.
- Cost and latency controls: spend caps and per-country rules so waterfalls stay governed.
- Vendor breadth: the connectors you need today and room to add more without a project.
- One audit trail: a single immutable record across every vendor and decision.
- Honest scope: a platform that coordinates your vendors, and is clear about what it does not do itself.
Where Zenoo fits (honestly)
Zenoo is a KYC, KYB, and AML compliance orchestration platform. It links your verification vendors, with routing, failover, one audit trail, and cost control, rather than performing the biometric or document check itself. The Marketplace exposes 240+ check types on the Enterprise tier and can run checks in parallel, with new-vendor integration in under 1 hour versus a traditional 4 to 6 months. A single immutable record covers 32 event types across 8 categories, which is exactly what fragmented multi-vendor stacks lack and what AMLA-era supervision will expect. Risk data spans 209 countries with 16 indicators each. The framing is your vendors plus Zenoo, never replace your vendors.
Honest scope
Where Zenoo does not solve the problem
Zenoo does not replace your IDV vendors. It does not run the document forensics, the liveness or biometric match, or the deepfake and injection detection itself; those remain the specialist providers' job, and Zenoo routes to and combines them. Orchestration lifts match rate by combining providers, but it cannot exceed the underlying data and detection quality of what you connect, and it cannot make a non-covering vendor good. Zenoo is also not an IAM, SSO, or access-orchestration product. Where a connector is not pre-built, integration status defaults to activate rather than claiming a connector that does not exist.
What the future looks like
Several trends point the same way: toward architectures built to change.
Wallet-first, verify-once onboarding in the EU. From 2027, regulated entities are expected to accept the EUDI Wallet, and reusable credentials cut repeat verification cost and drop-off. Orchestration flows will increasingly branch on "does this user hold an acceptable wallet or credential?" before falling back to document and biometric paths.
Tighter supervision. AMLA direct supervision from 2028, and continued regulator attention to AI-generated fraud, make a single provable audit trail across all vendors a necessity rather than a nice-to-have.
A bigger, more consolidated vendor layer. As check providers consolidate through M&A while buyers keep multi-vendor optionality by choice, the neutral orchestration layer becomes more valuable, not less.
An escalating arms race. With AI-fraud loss trajectories and attack-growth curves both climbing, defence becomes an ongoing swap-and-add exercise. That favours orchestration, whose whole point is making the swap practical.
Where this fits, honestly
From reading about it to running it.
Zenoo orchestrates your verification, fraud, and compliance vendors: cascade for match rate, fail over for uptime, step up only when risk demands, all in one audit trail. Your vendors plus Zenoo, never a replacement.
A live Compliance Hub with fictional data. Nothing you do is saved.