Most teams build KYC as a gate. The user passes, you flip a boolean, and you move on.
That boolean is the bug.
Verification is not a fact about a person. It is a claim made by a provider, at a specific moment, based on documents that were valid then. Documents expire. Sanctions lists change. Risk scores get revised. A user who cleared verification in March may not be clearable today, and nothing in your system will tell you that, because you stored an answer instead of a decision.
When I build compliance tooling now, I store the whole decision: which provider responded, what they returned, which ruleset version was applied, and when. Approval becomes a dated record, not a permanent property. Re-checks are scheduled, not triggered by someone noticing.
The practical payoff shows up on the moderation side. Your compliance team stops asking "is this user verified?" and starts asking "what did we know, and when did we know it?" — which is the only question that survives an audit.
The part that always causes an argument: what happens to an in-flight transaction when a user's status goes stale mid-flow. Block it, let it settle, or hold and escalate?
How do you handle that one?