My onramp passed every test I had, because the verification provider's sandbox answered instantly, and it answered yes almost every time.
In code I had two paths: approved and rejected. Both covered. Both worked.
Then real users showed up, and the compliance queue filled with people who were neither.
Manual review was the state I had barely modelled. A document that needs a human. A callback that lands hours later instead of seconds. A re-request for a clearer photo of the document the user already uploaded. Sometimes a verdict that flips after a moderator takes a second look.
Nothing crashed, and that was the problem. The fiat leg sat waiting on a decision that was not coming, the interface had no honest way to say "we're still looking at this", and support had nothing to tell anyone.
What I do differently now: I map the provider's full state machine before I write the happy path, and pending becomes the default branch instead of the exception. I store every raw callback, so I can replay real payloads against new code rather than trust a sandbox's optimism. Moderation tooling ships in the same sprint as the integration, because a compliance team with no view into the intermediate states is an outage with a human face on it.
Sandboxes don't simulate judgement. They simulate throughput.
I write up more of these integration realities on my blog, if you find that useful: https://polycratia.com/c/3877661a
If you're running KYC in production, you probably already know the incident that made you take the pending state seriously.