Skip to main content
Supercosmos for Platforms supports three KYC/AML models. Choose the one that matches your existing compliance stack. The transaction settlement flow (Pix → stablecoin) is identical across all three; only the KYC step differs. Each platform is responsible for assessing its own regulatory obligations.
All sequence diagrams below show the SDK method calls on the left and the underlying API endpoints on the right. The SDK is a thin wrapper — you can call the REST API directly if you prefer.

​
Model 1 — Direct Onboard

Supercosmos runs the full KYC/AML flow. Your app collects CPF, selfie, and wallet address; Supercosmos handles everything else. Best for platforms launching without an existing KYC vendor. Who runs KYC: Supercosmos
In sandbox, use CPF 000.000.001-91 to force riskTier: "HIGH" and exercise the liveness path.

​
Model 2 — Client via Platform

Your platform already runs KYC using your own vendor (e.g. Idwall, unico check, or Sumsub directly). Supercosmos accepts your KYC token, adds independent sanctions screening and KYT, then issues its own kycToken to proceed. Who runs KYC: Platform (primary) + Supercosmos (independent screen)
A partnerKycToken does not bypass Supercosmos’s independent screening. If Supercosmos detects a sanctions hit that your vendor missed, kyc.submit returns KYC_REJECTED with reason: "SANCTIONS_HIT". See Compliance Notes for details.

​
Model 3 — Shared Onboard

Both layers contribute to KYC. Your app collects CPF and basic data; Supercosmos collects the biometric (via the Sumsub WebSDK embedded in your interface). A cross-check of both data sets produces the joint KYC result. Who runs KYC: Platform (CPF + document) + Supercosmos (biometric + liveness)
In Shared mode, Supercosmos generates a Sumsub applicantId for you when you call kyc.submit. You only need to pass biometricHash — the SDK handles the Sumsub embedding automatically.

​
Transaction states

Regardless of model, every transaction passes through the same state machine after KYC clears: Poll mippo.transactions.status(transactionId) or listen for webhooks — see the Webhooks guide for the event reference.