Inside Sumsub: Russian Roots and KYC Data Power

Sumsub Russian Roots and the evidence

Sumsub Russian Roots requires careful assessment of records, reported claims and formal findings. This Malta Media editorial analysis separates documented facts from allegations and avoids prejudging individuals or companies. Background is available through the Malta Gaming Authority, the FATF beneficial-ownership guidance, and related Malta Media reporting.

Sumsub, KYC Data and Corporate Transparency

Sumsub’s KYC data systems should be assessed through the company’s documented ownership, the purpose of identity verification and the privacy safeguards applying to customer information. This investigation distinguishes public records from unresolved questions and does not infer wrongdoing from nationality or corporate history alone. The GDPR text, the FATF framework and Malta Media’s related transparency analysis provide context.

Inside Sumsub: Russian roots, forensic ties and the silent power of KYC data!

It began with an abandoned web studio in St Petersburg. By 2025, it became one of the most influential identity verification providers in Europe. But how exactly did Sumsub – officially “Sum & Substance” – get from local web design to processing sensitive biometric data for global crypto exchanges and fintech platforms?

The answer (as with so many compliance tech firms) lies somewhere between opportunism and timing. But in Sumsub’s case, it also includes Russian founders, niche legal status in the UK and links to investors with forensic software interests.

In this article, we take a closer look at the firm’s background, explore its connections with Belkasoft via Flint Capital and raise important questions about how personal data is governed in high-growth RegTech startups.

A separate investigation into Belkasoft is currently underway and will follow in the coming days.

From failed web projects to fraud detection software

The origin story of Sumsub is far from the typical polished founder narrative. The Severyukhin brothers (Andrey, Yakov and Peter) began their careers not in cybersecurity, but in web design. After their employer disappeared without paying salaries, they took over the studio themselves and began servicing small e-commerce clients in the Russian market.

From there, they launched an online shop for mobile phones, which saw some traction until the 2008 financial crisis devastated their margins. After briefly pivoting to B2B equipment sales and launching a 3D map project in St Petersburg (which failed to attract investors), the brothers began focusing on fraud in the insurance sector.

Their early tool, SMTDP, aimed to detect whether damage claim photos had been altered using Photoshop. It showed promise, but found little traction in Russia’s heavily siloed insurance sector, where long procurement cycles and internal politics delayed adoption.

What emerged instead was something more commercially viable: a document verification service that could help crypto firms comply with AML and KYC rules, especially in the UK and EU. This would eventually become “IDensic”, and later Sum & Substance.

The Cryptopay connection and the UK move

Sumsub’s first major customer was Cryptopay, a London-based crypto wallet and exchange founded by two Russian entrepreneurs, Georgy Basiladze and Dmitry Gunyashov.

Like many in the sector, they needed to comply with UK anti-money laundering obligations and identify users remotely.

Sumsub built them a tailored solution, automating checks on document authenticity and photo matching. To comply with UK data protection law, they hired local legal counsel and adapted the product for cross-border use.

What followed was a rapid institutionalisation. By 2016, Sumsub was registered in the UK, marketing itself as a modular KYC and fraud detection service. Its technology soon attracted the attention of both clients and investors.

The role of Flint Capital and Belkasoft

Among the earliest investors in Sumsub was Flint Capital, a venture fund with a diverse portfolio across security, data infrastructure and forensic software. Flint’s previous involvements include Belkasoft – a company known for developing digital forensics tools used by law enforcement and intelligence agencies.

At the time, Belkasoft and Sumsub operated in separate verticals. One focused on forensic data extraction and analysis, the other on real-time identity verification for fintech and crypto. But the investor link raises important questions.

Flint Capital’s dual interest in both forensics and KYC automation is not illegal or uncommon. But when combined with a background in Russian software development and the collection of biometric and personal data, it prompts legitimate scrutiny.

Who holds the data? Where is it processed? And are users (whether in Europe, Asia or US) aware of the data flows underpinning their identity verification?

While there is no evidence that Flint exerts operational control over Sumsub, it is known that early support and funding from Flint Capital was instrumental in scaling the company’s infrastructure. It was during this phase that Sumsub began referring to itself as “Europe’s most secure and fully compliant remote identification platform”.

Privacy, transparency and risk jurisdiction

Sumsub’s official headquarters are in London, but like many UK-based RegTech startups, the scope of its data processing activities goes far beyond British borders.

The firm claims GDPR compliance and routinely engages with customers in Europe, Southeast Asia and Latin America. Its user verification modules are embedded via API into fintech platforms, crypto exchanges and gambling services.

Yet users rarely interact directly with Sumsub. Instead, their data is passed to sit silently in the background. Documents are scanned, facial images captured, liveness checks performed. Behind it all is a company with Russian founders, funding ties to a forensic software investor, and very little independent oversight.

The legality of this model is not necessarily in question. But the opacity of its implementation is.

In jurisdictions like Germany, France and the Netherlands, regulators are becoming increasingly sensitive to where personal data is processed and who retains long-term access. The European Data Protection Board (EDPB) has already cautioned against the use of biometric processing without clear data minimisation principles.

If regulators begin to shift focus toward third-party KYC processors, Sumsub and others may be asked to disclose more details about data residency, retention periods and encryption practices.

What makes this structure fragile?

Sumsub’s clients rarely question the service itself. By all indications, the technology works. But the governance structure behind it may not be sufficiently tested in the courts.

As the company continues to onboard high-risk clients in crypto, gambling and gaming, it steps into grey areas where data leaks or breaches could carry significant legal and reputational risk. In the event of litigation or regulatory scrutiny, clients may discover that they have limited visibility over how user data was stored, handled or shared.

Moreover, with international pressure on Russia-linked firms continuing, any new sanctions or regulatory tightening could disrupt Sumsub’s operating model, especially if its infrastructure or key technical personnel remain dependent on individuals or entities with Russian nationality or exposure.

What to expect next

Sumsub remains one of the most important players in the compliance tech landscape. Its tools are effective, widely used and deeply integrated into financial platforms. But effective technology is not always transparent technology. In sectors dealing with personal data, even small lapses in disclosure or governance can lead to disproportionate fallout.

As for Flint Capital and its relationship with other software firms in the compliance and forensic sector, that remains an area requiring closer public and journalistic attention. Our next article will explore Belkasoft in detail, including its market presence, partnerships and data handling practices.

Until then, the key question remains: Who really owns and controls the infrastructure we trust to protect our identities?

FAQs

What is Sumsub and what does it do?
Sumsub, short for “Sum & Substance,” is a UK-based identity verification provider offering KYC and AML compliance tools for fintech, crypto, and gaming firms.

How did Sumsub start its operations?
Sumsub began as a small web studio in St Petersburg, Russia, before pivoting to fraud detection and ultimately focusing on digital identity verification.

Who founded Sumsub?
The company was founded by the Severyukhin brothers—Andrey, Yakov, and Peter—who initially worked in web design and later moved into RegTech.

What is the connection between Sumsub and Flint Capital?
Flint Capital is an early investor in Sumsub and also has interests in Belkasoft, a digital forensics firm. This dual investment has raised concerns about data governance.

Why are there concerns about Sumsub’s data processing?
Given its Russian founding team and forensic software investor links, regulators and observers are questioning how and where Sumsub stores and handles sensitive user data.

Is Sumsub GDPR compliant?
Sumsub claims to be GDPR compliant and maintains its headquarters in the UK, though concerns persist about the opacity of its data handling practices across borders.

How does Sumsub’s technology work?
Its tools perform document verification, facial recognition, and liveness detection, typically via API integrations with client platforms in crypto and fintech sectors.

Does Sumsub have direct user interaction?
Usually not. Users submit data to client platforms, which then pass it to Sumsub for verification, often without the user knowing who is processing their information.

Are regulators investigating Sumsub?
While no formal investigations have been disclosed, European regulators are increasing scrutiny of biometric processors like Sumsub, especially in high-risk sectors.

What risks do Sumsub’s clients face?
Clients may face reputational and legal risks if data breaches or regulatory issues arise due to lack of transparency in Sumsub’s governance or data infrastructure.