KYC (SEP-12)

Before a regulated trustline is authorized, the issuer must vet the holder. Authentication establishes a session with SEP-10; the compliance check itself is a SEP-12 customer flow.

Authenticate first (SEP-10)

Any compliance-sensitive call is preceded by SEP-10 web auth, which proves control of the account and issues a short-lived session token.

const { token } = await onboarder.auth({ account });
// JWT session token, scoped to this account

Customer status (SEP-12)

The approval server links to the issuer’s KYC provider — it stores the status per account, not a copy of the customer’s data. A trustline is authorized only once the customer is ACCEPTED.

NEEDS_INFO  the issuer requires more KYC fields
PENDING     under review
ACCEPTED    cleared → the trustline may be authorized
REJECTED    not eligible

How it surfaces to the user

When a holder isn’t cleared yet, POST /tx-approve returns action_required with a URL. The activation UI sends the user to complete KYC, then resumes the onboarding automatically.