Step 2: Handling Business Verified Customer Statuses #

The basics #

You have successfully created a business verified Customer; however, there are cases where Dwolla will need more information to fully verify the identity of the Controller and/or Business. Read on to learn more.

Verification statuses and corresponding events #

As a developer, you will want to handle the various Customer statuses that can be returned.

Understanding Verification Directives #

When further action is required for a Business Verified Customer to become verified, the Dwolla API includes Verification Directives in the _embedded.errors array of the Retrieve a Customer response. These directives explain the outstanding requirements for verification, provide actionable instructions, and include hypermedia links (_links) to enable resolution. By parsing and utilizing these directives, you can build a dynamic and user-friendly interface that guides your end-users through the necessary steps, minimizing onboarding friction and reducing support overhead.

See how to simulate these verification directives in the Sandbox testing guide.

Structure of a Verification Directive

Each object within the _embedded.errors array represents a single Verification Directive and follows this structure:

{
  "code": "ErrorCode",
  "message": "Human-readable explanation and instructions for resolution.",
  "_links": {
    "action-link": {
      // e.g., "update-customer", "upload-ein-document"
      "href": "URL to perform the required action",
      "type": "application/vnd.dwolla.v1.hal+json"
    }
  }
}

• code: A specific, machine-readable string identifying the type of verification issue. Use this code in your application logic to handle different error scenarios.
• message: A human-readable string explaining the issue and providing guidance on how to resolve it. This message is intended to help you inform your end-users about the required actions.
• _links: A HATEOAS object containing relevant links. This typically includes a link to the API resource needed to address the directive, such as updating the Customer resource or uploading a specific document type. The key of the link (e.g., "update-customer", "upload-ein-document") often indicates the required action. An empty _links object may be returned if no direct API action corresponds to the directive (e.g., for AdditionalReviewRequired).

Verification Directives

The following table lists common verification directives you may encounter for Business Verified Customers, along with their meaning and typical required actions:

Example Retrieve Customer response

Here's an example of how the _embedded.errors array might look in a GET /customers/{id} response when multiple issues require attention:

// Example GET /customers/41432759-6d65-42e5-a6be-400ddd103b78
{
  "_links": {
    // ... other customer links
  },
  "_embedded": {
    "errors": [
      {
        "code": "POBoxNotAllowed",
        "message": "Business addresses must be physical street addresses. PO Boxes are not allowed. Please update to a physical address.",
        "_links": {
          "retry-verification": {
            "href": "https://api-sandbox.dwolla.com/customers/41432759-6d65-42e5-a6be-400ddd103b78"
            // type property omitted for brevity
          }
        }
      },
      {
        "code": "Required",
        "message": "Full SSN required",
        "path": "",
        "_links": {
          "retry-with-full-ssn": {
            "href": "https://api-sandbox.dwolla.com/customers/41432759-6d65-42e5-a6be-400ddd103b78",
            "type": "application/vnd.dwolla.v1.hal+json",
            "resource-type": "customer"
          }
        }
      }
    ]
  },
  "status": "retry"
  // ... other customer properties
}

Handling Multiple Directives

As demonstrated in the example response above, the _embedded.errors array can contain multiple Verification Directive objects simultaneously if several issues require attention. Your application should iterate through the entire errors array, presenting the guidance from each message to the end-user and providing access to all corresponding actions via the _links. Addressing all listed directives is necessary for the user to successfully complete the verification process.

Handling retry status #

A retry status occurs when a Customer's identity scores are too low during a verification attempt. Typically, a retry status occurs after the initial creation of a business-verified customer, however, a customer can also be placed into a retry status via the Dwolla Dashboard if the customer is in a document status. When the customer is in the retry status, your application needs to re-initiate the verification process by prompting the user via a form to resubmit their identifying information.

Determining information needed to retry verification #

When a business verified Customer is placed in the retry verification status, Dwolla will return a link in the API response after retrieving a Customer. The retry link contained within the _links object of the response helps your application determine if a retry is needed and what type of retry is required. What data you need to request from the customer depends on the retry scenario:

• Business-only retry: A retry-verification link is returned. Include all fields required during initial customer but omit Controller information. For business verified Customers with Controllers, different links can be returned depending on whether retry is needed for just the business, or both the Controller and business.

• Controller and business retry: A retry-with-full-ssn link is returned. If the Controller information needs to be retried, all fields that were required in the initial Customer creation attempt will be required in the retry attempt, along with the full 9-digit SSN of the Controller in order to give our identity vendor more information in an attempt to receive a sufficient score to approve the Customer account (see example request below).

Example response

{
  "_links": {
    "self": {
      "href": "https://api-sandbox.dwolla.com/customers/20c2d8e2-8ccf-42fd-bd9e-757c396f342d",
      "type": "application/vnd.dwolla.v1.hal+json",
      "resource-type": "customer"
    },
    "retry-verification": {
      "href": "https://api-sandbox.dwolla.com/customers/20c2d8e2-8ccf-42fd-bd9e-757c396f342d",
      "type": "application/vnd.dwolla.v1.hal+json",
      "resource-type": "customer"
    },
    "retry-with-full-ssn": {
      "href": "https://api-sandbox.dwolla.com/customers/20c2d8e2-8ccf-42fd-bd9e-757c396f342d",
      "type": "application/vnd.dwolla.v1.hal+json",
      "resource-type": "customer"
    }
  },
  "_embedded": {
    "errors": [
      {
        "code": "Required",
        "message": "Full SSN required",
        "path": "",
        "_links": {
          "retry-with-full-ssn": {
            "href": "https://api-sandbox.dwolla.com/customers/20c2d8e2-8ccf-42fd-bd9e-757c396f342d",
            "type": "application/vnd.dwolla.v1.hal+json",
            "resource-type": "customer"
          }
        }
      }
    ]
  },
  "id": "20c2d8e2-8ccf-42fd-bd9e-757c396f342d",
  "firstName": "Account",
  "lastName": "Admin",
  "email": "accountAdmin@email.com",
  "type": "business",
  "status": "retry",
  "created": "2024-02-20T22:53:00.727Z",
  "address1": "9876 Million Dollar St",
  "address2": "Unit 123",
  "city": "Des Moines",
  "state": "IA",
  "postalCode": "50265",
  "phone": "5555555555",
  "businessName": "Jane Corp",
  "doingBusinessAs": "This is the DBA name",
  "website": "https://www.dwolla.com",
  "correlationId": "CID-bc3b6cd8-fca0-471d-b6f2-4b10abb20956",
  "controller": {
    "firstName": "Jane",
    "lastName": "Doe",
    "title": "CEO",
    "address": {
      "address1": "1749 18th st",
      "address2": "apt 12",
      "address3": "Ste 123",
      "city": "Des Moines",
      "stateProvinceRegion": "IA",
      "country": "US",
      "postalCode": "50266"
    }
  },
  "businessType": "llc",
  "businessClassification": "9ed38155-7d6f-11e3-83c3-5404a6144203"
}

Sole Proprietorship (retry-verification) - Request and response #

POST https://api-sandbox.dwolla.com/customers/62c3aa1b-3a1b-46d0-ae90-17304d60c3d5
Content-Type: application/vnd.dwolla.v1.hal+json
Accept: application/vnd.dwolla.v1.hal+json
Authorization: Bearer 0Sn0W6kzNic+oWhDbQcVSKLRUpGjIdl/YyrHqrDDoRnQwE7Q

{
    "firstName": "Business",
    "lastName": "Owner",
    "email": "solePropBusiness@email.com",
    "ipAddress": "143.156.7.8",
    "type": "business",
    "dateOfBirth": "1980-01-31",
    "ssn": "123-45-6789",
    "address1": "99-99 33rd St",
    "city": "Some City",
    "state": "NY",
    "postalCode": "11101",
    "businessClassification": "9ed3f670-7d6f-11e3-b1ce-5404a6144203",
    "businessType": "soleProprietorship",
    "businessName":"Jane Corp",
    "ein":"00-0000000"
}

Business with Controller (retry-verification) - Request and response #

POST https://api-sandbox.dwolla.com/customers/62c3aa1b-3a1b-46d0-ae90-17304d60c3d5
Content-Type: application/vnd.dwolla.v1.hal+json
Accept: application/vnd.dwolla.v1.hal+json
Authorization: Bearer 0Sn0W6kzNic+oWhDbQcVSKLRUpGjIdl/YyrHqrDDoRnQwE7Q

{
    "firstName": "Jane",
    "lastName": "Merchant",
    "email": "accountAdmin@email.com",
    "ipAddress": "143.156.7.8",
    "type": "business",
    "address1": "123 Corrected Address St",
    "city": "Some City",
    "state": "NY",
    "postalCode": "11101",
    "businessClassification": "9ed3f670-7d6f-11e3-b1ce-5404a6144203",
    "businessType": "llc",
    "businessName":"Jane Corp",
    "ein":"00-0000000"
}

Business with Controller (retry-with-full-ssn) - Request and response #

POST https://api-sandbox.dwolla.com/customers/62c3aa1b-3a1b-46d0-ae90-17304d60c3d5
Content-Type: application/vnd.dwolla.v1.hal+json
Accept: application/vnd.dwolla.v1.hal+json
Authorization: Bearer 0Sn0W6kzNic+oWhDbQcVSKLRUpGjIdl/YyrHqrDDoRnQwE7Q

{
    "firstName": "Jane",
    "lastName": "Merchant",
    "email": "accountAdmin@email.com",
    "ipAddress": "143.156.7.8",
    "type": "business",
    "address1": "123 Corrected Address St",
    "city": "Some City",
    "state": "NY",
    "postalCode": "11101",
    "controller": {
        "firstName": "John",
        "lastName": "Controller",
        "title": "CEO",
        "dateOfBirth": "1980-01-01",
        "ssn": "123-45-6789",
        "address": {
            "address1": "1749 18th st",
            "address2": "apt 12",
            "city": "Des Moines",
            "stateProvinceRegion": "IA",
            "postalCode": "50266",
            "country": "US"
        }
    },
    "businessClassification": "9ed3f670-7d6f-11e3-b1ce-5404a6144203",
    "businessType": "llc",
    "businessName":"Jane Corp",
    "ein":"00-0000000"
}

Handling document status #

If the Customer has a status of document, the Customer will need to upload additional pieces of information in order to verify the account. Use the create a document endpoint when uploading a colored camera captured image of the identifying document. The document(s) will then be reviewed by Dwolla; this review may take up to 1-2 business days to approve or reject.

You can provide the following best practices to the Customer in order to reduce the chances of a document being rejected:

• Only images of the front of an ID
• All 4 edges of the document should be visible
• A dark/high contrast background should be used
• At least 90% of the image should be the document
• Should be at least 300dpi
• Capture image from directly above the document
• Make sure that the image is properly aligned, not rotated, tilted or skewed
• No flash to reduce glare
• No black and white documents
• No expired IDs

Determining verification documents needed #

When a business verified Customer is placed in the document verification status, Dwolla will return a link in the API response after retrieving a Customer, which will be used by an application to determine if documentation is needed. For business verified Customers, different links can be returned depending on whether or not documents are needed for a Controller, the business, both the Controller and business, or for the DBA (Doing Business As). Additionally, embedded errors are included in the Customer resource which include information about the next steps required to get the Customer verified (see example response below). Refer to the table below for the list of possible links and their description.

Example response

{
  "_links": {
    "self": {
      "href": "https://api-sandbox.dwolla.com/customers/41432759-6d65-42e5-a6be-400ddd103b78",
      "type": "application/vnd.dwolla.v1.hal+json",
      "resource-type": "customer"
    },
    "document-form": {
      "href": "https://api-sandbox.dwolla.com/customers/41432759-6d65-42e5-a6be-400ddd103b78/documents",
      "type": "application/vnd.dwolla.v1.hal+json; profile=\"https://github.com/dwolla/hal-forms\"",
      "resource-type": "document"
    },
    "upload-dba-document": {
      "href": "https://api-sandbox.dwolla.com/customers/41432759-6d65-42e5-a6be-400ddd103b78/documents",
      "type": "application/vnd.dwolla.v1.hal+json",
      "resource-type": "document"
    }
  },
  "_embedded": {
    "errors": [
      {
        "code": "Required",
        "message": "DBA (Doing Business As) document upload required",
        "_links": {
          "upload-dba-document": {
            "href": "https://api-sandbox.dwolla.com/customers/41432759-6d65-42e5-a6be-400ddd103b78/documents"
          }
        }
      }
    ]
  },
  "id": "41432759-6d65-42e5-a6be-400ddd103b78",
  "firstName": "Account",
  "lastName": "Admin",
  "email": "accountAdmin@email.com",
  "type": "business",
  "status": "document",
  "created": "2018-05-10T19:59:22.643Z",
  "address1": "66 Walnut St",
  "city": "Des Moines",
  "state": "IA",
  "postalCode": "50309",
  "businessName": "Jane Corp",
  "controller": {
    "firstName": "document",
    "lastName": "Controller",
    "title": "CEO",
    "address": {
      "address1": "1749 18th st",
      "address2": "apt 12",
      "city": "Des Moines",
      "stateProvinceRegion": "IA",
      "country": "US",
      "postalCode": "50266"
    }
  },
  "businessClassification": "9ed3f670-7d6f-11e3-b1ce-5404a6144203",
  "businessType": "llc"
}

Document Types #

Controllers

US persons: A colored camera captured image of the Controller's identifying document can be specified as documentType: license (state issued driver's license), or idCard (U.S. government-issued photo id card).

Supported Document Examples:

• Non-expired State Issued Driver's License/Identification Card
• Non-expired US Passport
• Federal Employment Authorization Card
• US Visa

Unsupported Document Examples:

• Military IDs
• Expired government-issued IDs

Non-US persons: A colored camera captured image of the Controller's identifying document can be specified as documentType: passport. Examples include:

• Non-expired Foreign Passport Note: Foreign Passports are only accepted when the individual does not have an ITIN or SSN and the user must alternatively enter the Passport number.

Businesses

Documents that are used to help identify a business are specified as documentType other. Note: A DBA document should be issued by the government and should include the DBA name along with the state registered business name. Business Identifying documents we recommend uploading can include the following:

• Partnership, General Partnership: EIN Letter (IRS-issued SS4 confirmation letter).

• Limited Liability Corporation (LLC), Corporation: EIN Letter (IRS-issued SS4 confirmation letter).

• Sole Proprietorship: Sole Proprietorships can be verified by uploading Business documents as well as Personal IDs. Personal IDs need to be specified as documentType idCard, license or passport depending on the type of the ID. Business documents need to be specified as documentType other. Acceptable documents include one or more of the following, as applicable to your sole proprietorship:

  • Business documents (documentType other):
    • Fictitious Business Name Statement,
    • Certificate of Assumed Name; Business License,
    • Sales/Use Tax License,
    • Registration of Trade Name,
    • EIN documentation (IRS-issued SS4 confirmation letter)
  • Personal documents (documentType license, passport or idCard):
    • Color copy of a valid government-issued photo ID (e.g., a driver's license, passport, or state ID card).

Note: Trusts should be created as Sole Proprietor accounts and will require signed trust documents that include the trust and username that are on file.

Other business documents may be acceptable on a case by case basis with Dwolla approval. These include any US government entity (federal, state, local) issued business formation or licensing exhibiting the name of the business enrolling with Dwolla, or; Any business formation documents exhibiting the name of the business entity in addition to being filed and stamped by a US government entity. Examples include:

• Filed and stamped Articles of Organization or Incorporation
• Sales/Use Tax License
• Business License
• Certificate of Good Standing

Proof of address

If Dwolla's Compliance team is unable to find an external connection to confirm the user does in fact conduct business at their provided business address, a "proof of address" will be required. Proof of address are any of the following, current documents that show the address in question:

• Utility Bill
• Financial Statement
• Tax Statement (Please note - Form W-9 is a tax form, and is not an acceptable Tax Statement)
• Fully Executed Lease Agreement - must be valid for a minimum of the next 30 days.

Uploading a document #

To upload a color photo of the document, you'll initiate a multipart form-data POST request from your backend server to https://api.dwolla.com/customers/{id}/documents. The file must be either a .jpg, .jpeg, or .png. Files must be no larger than 10MB in size. Additionally, Business Documents can also be uploaded in a .pdf format.

You'll also get a webhook with a customer_verification_document_uploaded event to let you know the document was successfully uploaded.

Request and response

curl -X POST
\ -H "Authorization: Bearer tJlyMNW6e3QVbzHjeJ9JvAPsRglFjwnba4NdfCzsYJm7XbckcR"
\ -H "Accept: application/vnd.dwolla.v1.hal+json"
\ -H "Cache-Control: no-cache"
\ -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW"
\ -F "documentType=passport"
\ -F "file=@foo.png"
\ 'https://api-sandbox.dwolla.com/customers/132681fa-1b4d-4181-8ff2-619ca46235b1/documents

If the document was successfully uploaded, the response will be a HTTP 201 Created with the URL of the new document resource contained in the Location header.

HTTP/1.1 201 Created
Location: https://api-sandbox.dwolla.com/documents/11fe0bab-39bd-42ee-bb39-275afcc050d0

Document review process #

Once created, the document will be reviewed by Dwolla. When our team has made a decision to approve or reject, which may take up to 1-2 business days, we'll create either a customer_verification_document_approved or customer_verification_document_failed event.

If the document was sufficient, the Customer may be verified in this process. If not, we may need additional documentation. Note: Reference the determining verification documents needed section for more information on determining if additional documents are needed after an approved or failed event is triggered.

If the document was found to be fraudulent or doesn't match the identity of the Customer, the Customer will be suspended.

Document failure #

A document can fail if, for example, the Customer uploaded the wrong type of document or the .jpg or .png file supplied was not readable (i.e. blurry, not well lit, not in color, or cuts off a portion of the identifying image). If you receive a customer_verification_document_failed webhook, you'll need to upload another document. To retrieve the failure reason for the document upload, you'll retrieve the document by its ID. Contained in the response will be a failureReason field which corresponds to one or more of the following values. In case of a failure due to multiple reasons, an additional allFailureReasons of reasons and descriptions is also returned:

Request and response

GET https://api-sandbox.dwolla.com/documents/11fe0bab-39bd-42ee-bb39-275afcc050d0
Accept: application/vnd.dwolla.v1.hal+json
Authorization: Bearer tJlyMNW6e3QVbzHjeJ9JvAPsRglFjwnba4NdfCzsYJm7XbckcR

...

{
  "_links": {
    "self": {
      "href": "https://api-sandbox.dwolla.com/documents/11fe0bab-39bd-42ee-bb39-275afcc050d0"
    }
  },
  "id": "11fe0bab-39bd-42ee-bb39-275afcc050d0",
  "status": "reviewed",
  "type": "license",
  "created": "2016-01-29T21:22:22.000Z",
  "failureReason": "ScanNotReadable",
  "allFailureReasons": [
      {
          "reason": "ScanDobMismatch",
          "description": "Date of Birth mismatch"
      },
      {
          "reason": "ScanIdExpired",
          "description": "ID is expired"
      }
  ]
}

Handling status: suspended #

If the Customer is suspended, there's no further action you can take to correct this using the API. You'll need to contact support@dwolla.com or your account manager for assistance.

Next steps: Beneficial Owners #

The successful creation of a business verified Customer and Controller doesn't necessarily mean the Customer is fully verified and eligible to transfer. After successfully creating your business verified Customer, you will need to check to see if the beneficial ownership requirements apply to you. To learn how to add beneficial owner(s) to your Customer, read on in the next step.