KYC Error Codes: What They Mean and How to Fix Them

When verification fails you often get a code rather than an explanation. This page collects the codes that are publicly documented, explains what each one actually tests, and gives you a method for decoding the ones nobody has written up.

Last reviewed 30 July 2026 · by the KYC Rejected team

Why there is no universal code list

People reasonably expect that a code like E4301 or IAV.8 means one specific thing everywhere, in the way that HTTP 404 means one thing everywhere. It does not work that way. Identity verification has no shared error taxonomy. Each vendor defines its own codes, each platform layers its own on top, and most publish nothing at all.

There is also a deliberate reason for the vagueness. Regulated firms are frequently restricted by rules against tipping off. If a submission was flagged by a fraud model or a sanctions screen, telling the applicant precisely which signal fired would tell a genuine bad actor exactly what to change next time. So the code you receive is often intentionally uninformative.

What follows is therefore in two halves. First, codes that the issuing organisation has actually documented publicly, with what they say. Second, a method for working out the family of any code, including ones with no documentation, which is the situation most people are in.

Publicly documented codes

These come from the issuing organisation's own help documentation. Where a platform has not published a definition, we say so rather than guess.

A note on C9182

This code appears in searches attached to the message "id number does not match the name on the account, please verify". We looked for an authoritative definition and could not find one published by any platform, so we are not going to invent a meaning for it.

What we can say is that the accompanying message places it squarely in the data mismatch family: an identifier you supplied does not agree with the name attached to the account. The remedies in the mismatch section below apply. If you know which platform issues this code, we would genuinely like to hear from you so we can document it properly.

The five families, and what each one responds to

1. Image quality

Codes and messages mentioning blur, glare, brightness, resolution, cropping, edges or readability. The system measured a property of your photograph and it fell below a threshold.

Responds to recapture: yes. This is the only family where retaking the photograph is the correct first move. Shoot in daylight beside a window with the flash off, brace the phone, fill the frame with roughly a centimetre of margin on every side, and upload the original file rather than one sent through a chat app. The measurable targets are set out in our photo standard guide.

2. Data mismatch

Codes mentioning name, date of birth, address, identifier or "does not match". The image was fine. The text extracted from it disagrees with what your profile, or an external record, holds.

Responds to recapture: no. Fix the profile so it matches the document character for character, never the reverse. Middle names, accented characters and transliterations cause most of these, and each is covered in detail on our name mismatch page.

3. Biometric

Codes mentioning face, selfie, liveness, match score or presence. Either your face could not be compared reliably against the document portrait, or the system was not satisfied a live person was present.

Responds to recapture: yes, with technique. Use even front lighting with nothing bright behind you, remove glasses and hats, keep only your own face in frame, and move slowly through any prompted motion. Switching from a laptop webcam to a phone resolves a large share of these. See liveness check failed.

4. Document validity

Codes mentioning expiry, unsupported document type, unrecognised issuer, or unaccepted country of issue.

Responds to recapture: no. An expired document is refused outright, and many platforms also decline anything within about three months of expiry. A student card or workplace badge will never be accepted. You need a different, currently valid, government issued document. See document expired and accepted documents.

5. Screening and risk

Often no code at all, or a deliberately generic one. Your name was checked against sanctions lists, politically exposed persons databases and adverse media, and your session was assessed for device and behavioural signals.

Responds to recapture: absolutely not. This is where people waste the most attempts, because the rejection looks identical to an image failure. See sanctions and PEP false matches.

Stop guessing what went wrong A human specialist corrects the document for you and sends it back ready to submit, usually in under 10 minutes. $1.99, money back if it is not approved. Get my fix

Decoding a code nobody has documented

Most codes have no public definition. You can still classify one reliably, because the behaviour around the rejection carries more information than the code string.

Use the timing

• Seconds after upload, before any selfie step. Almost certainly image quality or document classification. Something measurable failed.
• Immediately after the selfie or liveness step. Biometric.
• After the images were accepted, minutes to days later. Screening, manual review or a records check. The photographs were fine.
• A request for more documents rather than a refusal. Enhanced due diligence. This is an escalation, not a rejection, and it is satisfied with paperwork.
• Stuck on pending with no outcome. A human queue. Resubmitting can reset your place in it.

Read the words, not the code

The message accompanying a code is usually more diagnostic than the code itself, because it has to be human readable. Words like blurry, glare, unclear, dark and cropped put you in family one. Match, mismatch, does not match, verify and confirm put you in family two. Face, selfie, liveness and photo of yourself put you in three. Expired, not supported and not accepted put you in four. Anything vague, especially arriving late, points at five.

Search the code properly

If you want to find the official definition, search the code together with the platform name and the word support or help, in quotes. Codes are frequently documented in a vendor help centre rather than on the platform you were using, because the code came from the vendor. Identifying which vendor is assessing you is covered in our guide to who actually checks your ID.

What to do before you spend another attempt

Attempts are limited, commonly three to five, and every platform treats running out differently. Some route you to a human. Some restrict the account. Before resubmitting, do this in order.

1. Classify the failure into one of the five families using the timing and the wording.
2. If it is family two or four, do not touch the camera. Fix the data or change the document.
3. If it is family five, do not resubmit at all. Contact support and ask for human review.
4. If it is family one or three, fix the specific measurable problem, then check the new capture before uploading.
5. Confirm your document has more than three months of validity left.
6. Confirm your profile name matches the document character for character, including middle names and accents.

Where the code actually came from

One of the reasons codes are so hard to research is that people search them alongside the wrong company. You were on an exchange when it failed, so you search the exchange name plus the code and find nothing, because the exchange never issued it.

Almost no platform builds identity verification in house. They license it, and the code frequently originates with the vendor rather than the brand you were looking at. Coinbase, for instance, publicly names Onfido, Au10tix, Jumio, Refinitiv, Shufti, Persona, Prove and Sardine among its third party verification vendors. A single platform can route different users to different vendors depending on country, product and risk score, which means two people can receive different codes for the same underlying failure on the same service.

If you want the authoritative definition, work out which vendor assessed you first. Watch whether the address bar changes to an unfamiliar domain when the capture step begins. Look for a small attribution or a privacy link inside the capture screen pointing somewhere other than the platform. Open your browser network tab with F12 before starting the flow and see which third party hosts receive requests. Then search the code against that company's help centre.

This also explains why support staff often genuinely cannot tell you more. The decision was not made in their building, and the detail behind it may not be exposed to them at all. Our guide to who actually checks your ID covers the identification methods in full.

What a code never tells you

It is worth being explicit about the limits, because people over read these strings and draw conclusions that are not there.

A code does not tell you whether a human has seen your case. Most rejections at the automated stage are never viewed by a person, which is precisely why asking for manual review is often the productive next step rather than resubmitting into the same machine.

A code does not tell you how many attempts you have left. Platforms rarely publish the limit, and it can differ by country and product. Assume between three and five, and assume that exhausting them has consequences ranging from a slower human queue to a restricted account.

A code does not tell you that you did anything wrong. Documented cases exist where checks fail purely because reference data held by credit bureaus and similar databases has not caught up with a recent change of name, address or phone number. Every document you hold can be correct and current, and the check still fails because the record it compares against is stale.

And a code very often does not tell you the real reason at all. Where a fraud model or a sanctions screen fired, the message you receive is deliberately generic, because naming the trigger would tell someone attempting evasion exactly what to change. The absence of detail is sometimes the most informative thing about a rejection.

Frequently asked questions