KYC Soft-Launch Checklist: 14 Things to Validate Before Going Live

We run this checklist on every new integration before opening the funnel. It catches the issues that only surface under real production traffic.

The 14 items

• Webhook signature verification deployed
• Idempotency keys end-to-end
• Retry policy with exponential backoff
• Verdict state machine handles re-opens
• Sandbox-to-prod credential separation
• PII minimisation audit completed
• Audit log retention configured
• Country routing rules tested for top-10 markets
• Analyst review SLA agreed
• Mobile capture tested on iOS 18, Android 15
• Low-bandwidth flow validated
• Accessibility audit (WCAG 2.2 AA)
• Incident runbook published
• MLRO sign-off recorded

How we help

We provide a sandbox that mirrors production, a webhook test harness, and a launch-readiness review with our solutions team.