KYC Widget
Turning KYC into a modular, embeddable verification system that partners configure, theme and ship
- Year
- 2026
- Company
- Uphold
- Role
- Lead Product Designer (IC)Why hands-onWith the Widget API growing fast and partners asking to embed KYC in their own products, the company needed this delivered quickly. During a hiring freeze, the C-level team decided I would take it on as IC while leading design across Uphold's Enterprise products.
- Team
- 2 product managers, 5 engineers and Uphold's compliance team
Challenge
Partners building on Uphold had two options for KYC: build it themselves or integrate a third-party vendor. Both slow time-to-market and add conversion risk, and neither gives partners compliance logic designed for crypto. KYC is also not one step. Depending on jurisdiction and risk profile, it can include personal details and address, identity and proof of address, a financial profile, tax residency and, in the UK, a regulatory investor classification and a crypto risk assessment.
The challenge was to package all of this into a single widget any partner could configure to their needs, carry over what years of onboarding in Uphold Consumer had taught us about where verification breaks down, and do it in a way that never competes with the partner's own product voice.
Solution
I designed the KYC Widget as a modular system rather than a fixed flow. Partners choose which processes run when they initialize the widget, and the widget renders exactly those steps, in a consistent order, behind a single hub that shows the user everything they need to complete upfront.
Every process follows the same principles: set expectations before effort, guide before failure, make every error specific and recoverable, and add friction only where the user has something to lose. Jurisdiction is treated as a structural difference, not a setting. The visual layer adapts to the partner through tokens, and the language was written to carry no voice at all, so the widget feels native inside any product.
Outcome
Users whose ID carries their address verify identity and address in a single step instead of two. Partners embed verification without rewriting a line of copy, because the widget's language carries no voice to clash with theirs. Every rejection reason has its own message and recovery action instead of a generic failure. All of it runs across five flows and two jurisdictions (profile and address, identity and proof of address, financial profile, tax details, and UK investor protection), built from one shared set of patterns, with the consumer funnel as the baseline to measure against.
The five flows
Collects the user's legal name, date of birth, citizenship and residential address exactly as they appear on the ID, with inline validation before anything is submitted.
Verifies the person behind the account with a government-issued ID (plus selfie and liveness in the UK), and confirms where they live: automatically from the ID when possible, otherwise through an electronic check or a document upload.
Customer due diligence on source of funds, intended use of the account, employment, income and net worth, with enhanced due diligence for users assessed as high risk.
Country of tax residence and Tax Identification Number for each jurisdiction where the user has tax obligations, with a W-9 certification for US persons.
The investor self-categorisation and crypto risk assessment that UK regulation requires before users can access crypto promotions.
01 Profile and address
Collects the user's legal name, date of birth, citizenship and residential address exactly as they appear on the ID, with inline validation before anything is submitted.
02 Identity and proof of address
Verifies the person behind the account with a government-issued ID (plus selfie and liveness in the UK), and confirms where they live: automatically from the ID when possible, otherwise through an electronic check or a document upload.
03 Financial profile
Customer due diligence on source of funds, intended use of the account, employment, income and net worth, with enhanced due diligence for users assessed as high risk.
04 Tax details
Country of tax residence and Tax Identification Number for each jurisdiction where the user has tax obligations, with a W-9 certification for US persons.
05 UK investor protection
The investor self-categorisation and crypto risk assessment that UK regulation requires before users can access crypto promotions.
The process
Discovery
I started from inherited knowledge, reviewing the Uphold Consumer onboarding funnels to extract the patterns of where and why verification breaks down.
Define
I turned those patterns into five structural causes, each with a design response, and two principles that shaped every later decision.
Design
Three decisions (the user hub, one document for identity and address, and a white-label language) and one system across five flows that makes them hold.
Key learnings
Transferred knowledge is a starting point, jurisdiction is structure, and modularity only works when the system underneath is consistent.
The full case is private
Enter the password, or request access and I'll get back to you.
Request accessWhether you're looking to collaborate, talk more about my work or just have a conversation:
Let's talk