API reference

Webhook event: kyc.referred

The kyc.referred webhook fires when verification is referred for manual checks. Its data.object is a kyc. A typical handler will show a "checks in progress" state after verifying the signature. Delivery is <a href="/reference/webhook-delivery-and-retries/">at-least-once and unordered</a>, so handle it <a href="/glossary/idempotency-explained/">idempotently</a>.

2 min read

kycdata.object type
unorderedDelivery
evt_…Dedup on id

When it fires

kyc.referred is emitted when verification is referred for manual checks. A redelivery of the same occurrence carries the same event id.

If your endpoint does not return a 2xx within the timeout, delivery is retried on an exponential backoff schedule — see Webhook delivery and retries. Design your handler to be idempotent so a redelivered event is safe to process twice.

Example delivery

{
  "id": "evt_KYCR9Z",
  "type": "kyc.referred",
  "created": "2026-07-05T12:00:00Z",
  "livemode": true,
  "api_version": "2026-07-01",
  "data": {
    "object": {
      "id": "kyc_9D2F6",
      "subject": "acct_4B8N2",
      "outcome": "referred",
      "reason": "document_review"
    }
  }
}

Handling it

A common handler will show a "checks in progress" state. Verify the signature, acknowledge with 200 within 10 seconds, then work asynchronously. Guard against out-of-order delivery using the created timestamp, and re-fetch the resource from the API if you need its live state.

Frequently asked questions

Can kyc.referred arrive out of order?

Yes. Webhook delivery is unordered — a retried event can arrive after a newer one. Reconcile with the created timestamp. See Handle out-of-order webhooks.

Should I act on kyc.referred alone?

Treat it as a nudge. For anything that changes money or state on your side, re-read the kyc from the API to confirm current state before acting.

Funding for UK limited companies

Credicorp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.