OpenCasp-KYC

import { determineCddLevel, validateCustomer, retentionUntil, KycLedger, MemoryStore, auditSummary } from "opencasp-kyc";

// 1. Decide the CDD level from risk facts (AML/CFT Law Art. 18).
const { level } = determineCddLevel({ pep: false, nonCompliantCountry: false });

// 2. Validate what you collected (Art. 16(4)(1) for a natural person).
const result = validateCustomer(
  {
    customer_type: "natural_person",
    customer_id: "C-000123",
    first_name: "Anna",
    last_name: "Petrosyan",
    citizenship: "AM",
    date_of_birth: "1990-02-03",
    place_of_birth: "Yerevan",
    residence_address: "12 Abovyan St, Yerevan",
    residency_status: "resident",
    id_document_type: "passport",
    id_document_number: "AB1234567",
    id_document_issue_date: "2020-05-01",
    id_document_copy: "vault://docs/C-000123/passport.jpg",
    pep_status: "not_pep",
    business_profile: "Software engineer, ~500,000 AMD/month",
    purpose_and_nature: "Buying and holding BTC",
    verification_method: "non_face_to_face",
    identity_verified_at: "2026-09-20",
  },
  { level },
);
if (!result.ok) console.log(result.issues); // each issue lists the rule ids behind it

// 3. Record decisions in a tamper-evident chain; log only the safe summary.
const ledger = new KycLedger(new MemoryStore());
const ev = await ledger.append({
  type: "applicant.status_changed",
  actor: "compliance@yourcasp.am",
  actor_role: "compliance",
  customer_ref: "C-000123",
  applicant_ref: null,
  payload: { kyc_status: "approved", id_document_number: "AB1234567" },
});
console.log(auditSummary(ev)); // { …, fields: { kyc_status: "approved" }, redacted: ["id_document_number"] }

// 4. Know when you may erase (Art. 22(2): 5 years after the relationship ends).
retentionUntil("customer_identification", { relationshipEndedAt: "2026-03-31" }).keepUntil; // 2031-03-31

import { SumsubClient, verifyWebhookDigest, parseWebhook, toDictionary } from "opencasp-kyc/sumsub";

const sumsub = new SumsubClient({ appToken: process.env.SUMSUB_APP_TOKEN!, appSecret: process.env.SUMSUB_APP_SECRET! });

// Create (or reuse) the applicant and a hosted link for the customer.
await sumsub.ensureApplicant("am-individual-standard", { externalUserId: "C-000123", email: "anna@example.am" });
const { url } = await sumsub.createLink("am-individual-standard", { externalUserId: "C-000123" });

// In your webhook handler — pass the raw body, not re-serialised JSON.
if (!verifyWebhookDigest(rawBody, req.headers, process.env.SUMSUB_WEBHOOK_SECRET!)) return reply(401);
const hook = parseWebhook(rawBody);
const applicant = await sumsub.getApplicant(hook.applicantId); // the applicant, not the webhook, is your record
const { values, gaps } = toDictionary(applicant, { level: "standard" });
// gaps lists Armenian-required fields Sumsub did not provide, with how to fill each.