Reusable KYC: Verify Once, Reuse Everywhere
Every KYC flow asks the same person for the same passport, over and over. Once for the exchange, once for the marketplace, once for the lender — the same document photographed again, the same selfie taken again, the same checks run again.
That repetition is expensive on both sides. It costs the user two minutes and a little goodwill; it costs the business a slice of its funnel, because a meaningful share of drop-off happens at exactly the moment a returning customer realises they have to start from scratch. Reusable KYC removes the repetition without removing the verification.
What reusable KYC actually is
A user completes one full verification: document, liveness, face match, and proof of address if the first service requires it. At the end of that flow they are asked a single question — would you like to keep this verification in your personal Identity Vault?
If they agree, the verified result is stored encrypted. The next time they arrive at a service that supports reuse, they are recognised, they confirm they are still the same person, and the verification is handed over. No new document scan, no new upload, no second wait.
The important word is asked. The vault is opt-in: nothing is stored unless the user actively ticks the box, and the box is never pre-ticked.
How the reuse flow works
Verify — the user goes through the standard KYC flow at whichever service they reach first: document, selfie, optionally proof of address.
Store — at the end they are offered the vault. Opt-in, no default, no pressure. Decline and the flow behaves like an ordinary verification.
Reuse — at the next service they are recognised by their email address, pass a short identity challenge, and are through.
For the returning user this is the difference between a two-minute detour and a three-second confirmation: measured re-verification takes about 3.1 seconds, and returning users convert roughly 38% better than users pushed through a full repeat check.
Two ways to prove it is you
Handing over a verified identity is only safe if the person requesting it proves they are the person it belongs to. Flonk offers two challenge methods, and the integrating service chooses which one its users see.
Email OTP
A six-digit code is sent to the address the vault entry is bound to. Fast, works on any device, needs no camera. This is the default and the right choice for most integrations — signup flows, marketplaces, SaaS onboarding.
Selfie and face match
A live capture, matched biometrically against the portrait already held in the vault. A few seconds slower, but it establishes that a live human is present rather than merely that someone controls an inbox. This is the setting for regulated contexts, where a supervisor will eventually ask how presence was established.
The choice is made per project in the dashboard, next to the toggle that enables reuse in the first place. You can run email OTP in sandbox and face match in production, or OTP for a consumer product and face match for a regulated one, from the same account.
What is stored — and what deliberately is not
Held in the vault:
the document images, front and back
the selfie or portrait
proof of address, if the first service required one
the verification result itself: status, document type, date
Not held: the user's email address in readable form. It is kept only as a cryptographic hash, which is enough to recognise a returning user while the vault never stores a legible address. Everything else is encrypted at rest with AES-256-GCM under rotating KMS keys. Revocation deletes rather than flags — when consent is withdrawn the stored files are removed, not hidden behind a status column.
Consent and control
Reusable KYC is a consent product before it is a convenience product, and it is built in that order:
Nothing is stored without an explicit tick — the default is off, with no pre-selection.
No silent handover: every reuse requires a fresh challenge, so a service cannot pull an identity in the background.
No expiry clock: consent holds until the user withdraws it, with no quiet timer that keeps re-asking.
Withdrawal is a deletion, which is how GDPR Articles 7, 12, 15 and 17 are handled as operations rather than promises.
An identity belongs to the person it describes — not to every signup form that asks for it again.
When reuse will not be offered
Not every service accepts a reused verification. Some regulated operators are obliged to run their own full check regardless of what another provider has already established. In that case the user simply sees the normal KYC flow — no error, no dead end, nothing to explain. Reuse appears where the service has enabled it; everywhere else, behaviour is unchanged.
What it means for your integration
Reuse is configured per project rather than globally:
one toggle enables reuse for the project
a second setting picks the challenge method: email OTP or selfie with face match
the verification result carries a reuse flag, so your backend can tell a fresh check from a reused one and apply its own policy — for example routing reused approvals into a lighter review queue
the whole path is covered by the same audit trail as a standard verification
Nothing else about your integration changes: the same session endpoint, the same webhook, the same result object. Setup details are in the developer documentation, and you can try the whole flow in sandbox from your first API key.
Ready to try it? Start free with 50 verifications — no credit card required.
Frequently Asked Questions
Can I use verification without storing anything?
Yes. The vault checkbox at the end of the flow is optional. Decline it and the verification behaves exactly like an ordinary one-off KYC check.
Can another service access my identity without my confirmation?
No. Every new service triggers a challenge — either an email OTP or a live selfie with face match. Without that confirmation there is no transfer.
How do I delete a stored verification?
Contact support@flonk.id. Vault data is removed within 30 days and usually immediately, and the underlying files are deleted rather than flagged as inactive.
What happens if I change my email address?
The stored verification is bound to the original address. With a new address you start a fresh verification, which you can then store as well.
Does reusable KYC work with every provider?
Only where the service has switched it on. Regulated operators may still require a complete check, in which case the standard verification flow is shown instead.