KYC & Identity Verification — WhatsApp Profile Signal

Where it fits in a KYC flow

• Pre-flight signal: before spending on full-KYC checks, verify the number is real.
• Step-up authentication: if a user claims to represent a business, verifying the number matches a WhatsApp Business account is a supporting signal.
• Identity continuity: re-check periodically to detect number recycling / churn.
• Dual-channel verification: confirm the same number is present on WhatsApp before sending an OTP — reduces OTP fraud.

Composable KYC architecture

1. User provides phone + ID document.
2. WhatsApp Profile API → number active & profile present?
3. Document KYC provider → ID verification + liveness.
4. Sanctions / PEP screening provider (Refinitiv, ComplyAdvantage, etc.).
5. Fraud signal provider (IP, device, velocity).
6. Risk-engine decision based on combined signals.

Compliance notes

• The API only returns publicly visible fields the target user has chosen to expose. Private profile data is not accessible.
• You remain the data controller for GDPR / CCPA purposes. Establish your own lawful basis for processing looked-up profile data.
• Do not store profile pictures of users who have not consented to your processing purpose — the URL returned is a reference, not a licence.
• Log the lastChecked timestamp and the source of the signal for audit.

Related