Application States

Every application state on the Rain platform: why an application lands in each one, what to do, and what transitions to expect.

Unless otherwise specified, all application states apply to both consumer and corporate programs. For what to submit to start an application, see Verification requirements & screening.

You can receive real-time notifications for all state transitions by subscribing to the user.updated and company.updated webhooks.

When an application is in any non-approved state, the API response includes an applicationCompletionLink object containing a url and params (including userId and signature). You can use this link to redirect users to Rain’s hosted verification flow.

State summary

The following table summarizes every state, whether it’s terminal, and whether you need to act:

State	Terminal?	Action required?	Description
approved	Yes	No	Application approved, cardholder created
pending	No	No	Automated checks are running
manualReview	No	No	Rain analyst is reviewing
denied	Yes	No	Application permanently denied
locked	Yes	No	Locked by Rain’s compliance team
canceled	Yes	No	You canceled this application
needsVerification	No	Yes	User must complete identity verification flow
needsInformation	No	Yes	Documents were rejected; resubmission needed
tosNotAccepted	No	Yes	User passed verification but hasn’t accepted the terms
notStarted	No	Depends	Application created but processing hasn’t begun

approved

What it means: The application has been approved, either automatically or through additional verification. A cardholder is created automatically upon approval, and collateral contracts and gas subsidies are assigned.

What triggered it: Successful completion of all identity verification and compliance checks.

What you should do: No action needed. You can proceed with card issuance and other cardholder operations.

What to expect next: This is a terminal state. No further transitions will occur, and Sumsub webhooks will no longer update this application.

pending

What it means: Documents have been submitted and automated checks, including identity verification, AML screening, and other compliance validations, are actively running.

What triggered it: A user submitted documents through the Sumsub verification flow, or a reapplication was initiated after a needsInformation state.

What you should do: No action is needed or possible. Wait for a webhook notification indicating the next state.

What to expect next: The application will transition to approved, manualReview, needsInformation, or denied once automated processing completes.

manualReview

What it means: Automated processing is complete, but the application was not automatically approved. A Rain analyst is manually reviewing the submitted data.

What triggered it: This maps from Sumsub’s “onHold” status, indicating the application requires human review.

What you should do: No action is needed or possible on your end. The analyst will update the state when a decision is reached.

What to expect next: The application will transition to approved, denied, or needsInformation.

denied

What it means: The application has been permanently denied and cannot be appealed or resubmitted. Applications are typically only denied after resubmissions and additional verification have failed.

What triggered it: This maps from a Sumsub final rejection (Completed + RED + FINAL reject type). See the rejection catalog for the reasons that lead to a permanent denial.

What you should do: No action is possible on your end. This is a terminal state, and Sumsub webhooks will not update it further. In exceptional circumstances, Rain may change this status at its own discretion.

What to expect next: No further transitions.

locked

What it means: The application has been locked due to compliance requirements.

What triggered it: This is set manually by Rain’s compliance team. It is not triggered by Sumsub.

What you should do: Rain will proactively reach out about why this application was locked. You can also contact us at [e-mail] to inquire. You should not expect to encounter this status during standard day-to-day operations.

What to expect next: This is a terminal state.

canceled

What it means: The application has been canceled and no further processing is possible.

What triggered it: You canceled this application via the API.

What you should do: No action is possible.

What to expect next: This is a terminal state. No further transitions will occur.

needsVerification

Consumer program only:

This state applies to Consumer Programs only.

What it means: The applicant exists in the system but has not yet submitted any identity documents. The user needs to complete the interactive Sumsub-hosted verification flow.

What triggered it: This maps to Sumsub reviewStatus = "init". The applicant record was created, but document submission has not occurred.

What you should do: Redirect the user to the Sumsub-hosted verification flow using the applicationCompletionLink. Pass all values from params as query parameters, and include a redirect parameter to bring the user back to your site after completion.

Do not attempt to submit documents via the API in this state. The user must go through the interactive verification flow.

What to expect next: After the user completes the flow, the state will transition to pending automatically.

needsInformation

What it means: Documents were submitted but were rejected with a retryable rejection. Common reasons include blurry photos, expired documents, mismatched personal information, or missing document pages. The applicationReason field in the webhook payload contains specific rejection labels. See the rejection label reference for details.

What triggered it: This maps from a Sumsub retryable rejection (Completed + RED + RETRY reject type).

What you should do: There are two ways to handle resubmission:

1. Redirect approach: Redirect the user to the applicationCompletionLink URL with the provided params as query parameters. Include a redirect parameter to bring the user back to your site. The user will re-upload documents through the Sumsub-hosted flow.

2. API approach: Use the update endpoints for companies, UBOs, or users to resubmit the corrected information and documents programmatically. The system will reset the Sumsub profile and re-initiate the check.

What to expect next: After resubmission by either method, the state transitions back to pending.

tosNotAccepted

Consumer program only:

This state applies to Consumer Programs with terms acceptance enabled.

What it means: The user passed identity verification, and accepting the terms is the only thing between them and approval.

What triggered it: Verification completed successfully, but Rain has no recorded terms acceptance for the user yet.

What you should do: Send the user to the applicationCompletionLink, where the hosted flow presents the terms step, or embed the terms page in your own UI. See Terms acceptance for both approaches.

What to expect next: Once the user accepts, Rain records the acceptance and the state transitions to approved. Processing can take up to a minute.

notStarted

What it means: The user or company record exists, but no compliance processing has begun.

What triggered it: Either (a) you called the initiate endpoint (for example, initiate a consumer application) and processing hasn’t started yet, or (b) the application is waiting for the user to complete the Sumsub verification flow.

What you should do: If you initiated manually, redirect the user to the applicationCompletionLink to begin the verification flow. Otherwise, the application state should update shortly.

What to expect next: The status will transition to pending once the user submits documents or automated processing begins.

What’s next

Identity and compliance webhooks

The payloads that tell you a state changed, and the full transition table.

Rejection reasons

Read the applicationReason labels behind a rejected application.

Onboard a cardholder

What happens once an application reaches approved.