Passports of Belarusians Voting in the CC Elections Will Be Processed by a Company Whose Last Data Leak Was Discovered in 2026, and Whose Founders Are Russians

When voting in the Coordination Council elections, organizers need to verify whether the voter is indeed a citizen of Belarus and if they are voting only once.

To identify voters, the organizers hired a contractor, Sumsub. Belarusians who wish to vote will need to photograph their document and themselves. This data will be sent to Sumsub.

The election organizers assert that the choice of contractor is correct.

"They are covered with the most diverse trust certificates. Neither we, the developers of the voting system, nor the election commission have access there. No one can go there and view these photos. Can they themselves transfer data to someone? I doubt it. They already use encryption internally. They work with fairly large companies. For them, any leak history would be fatal. We chose the largest, most famous company. So that it would be impossible to put pressure on them," Pavel Liber explained the choice of contractor for data processing in an interview with "Svaboda."

But what is the reality?

As "Nasha Niva" found out, Sumsub is not only not among the "largest and most well-known" companies in the market for similar services, but it is an organization with a set of red flags when its corporate history is evaluated through the prism of Belarusian emigrant organizations.

Sumsub was founded as a startup in 2015 by the three Severyukhin brothers. The initial business model was a KYC tool for crypto exchanges and fintech startups.

KYC (Know Your Customer) is a term from the financial sector. It's a technology to combat money laundering that allows banks and exchanges to accurately know who their client is, especially during online registrations. KYC verifies who the person is and if they are who they claim to be. Technically, this is done by taking a picture of a document and comparing it with the person's identity via photo or video.

Sumsub's main development offices were located in Russia. The Severyukhins – who today call themselves Severs and claim to have Israeli citizenship – studied in Russia.

Павялічыць

In 2017, Sumsub announced the integration of document recognition technology from Smart Engines LLC into its product. This is a Russian company founded by scientists from the Russian Academy of Sciences, whose document recognition technologies are used in Russian airports. Concurrently, Smart Engines developed (and likely continues to develop) AI technologies for the military, for example, recognizing tanks of a hypothetical enemy.

With this technology, Sumsub became a recognizable player in the KYC market, but primarily as a contractor for crypto exchanges. Most of the clients listed on Sumsub's website are crypto startups and exchanges that do not have the necessary licenses to operate in the Eurozone.

Sumsub used Russian development for document analysis at least until 2021.

After the start of the war, the company stated that it had ceased operations in Russia and Belarus, and also that it had switched from Smart Engines technology to another. Which other technology the company switched to was not specified. The statement was made after journalists became interested in the topic and following accusations from Ukrainian cybersecurity companies.

Today the company positions itself as British, but in reality, the British legal entity Sum and Substance Ltd belongs to the Cypriot Raritex Trade Ltd.

After the publication of this article, a company representative contacted us and stated that since Sumsub's founding in 2015, its sole ultimate beneficial owners are its three founders – namely Andrei, Yakov, and Petr Severy. "Differences in the spelling of the brothers' names and surnames are explained by historical changes made to some of their documents, as well as their personal preferences." "Raritex Trade Ltd also has four minority shareholders. These shareholders are not related to each other; they do not hold seats on our board of directors and do not exercise control over our operations; among their ultimate beneficiaries, there are no politically exposed persons (PEPs) or sanctioned individuals; they themselves are also not sanctioned; they are in no way connected with the Russian state apparatus. None of their ultimate beneficiaries (whose identities we are not permitted to disclose without the written consent of the parties) are simultaneously beneficiaries of Sumsub. We hope that this information is sufficient to address any legitimate concerns regarding the composition of Sumsub's shareholders," states the letter received by "Nasha Niva."

In early 2026, the company admitted that in 2024, third parties were present in its system, which resulted in the compromise of user data, specifically their names. "Unauthorized activity was retrospectively detected during a security review conducted in January 2026," the company reported.

Considering these and a host of other, smaller factors, "Nasha Niva" approached Pavel Liber with questions regarding the selection of Sumsub as a partner.

Pavel Liber reported that an extraordinary meeting of the Coordination Council's election commission would be convened on this matter:

"Our technical team (in this case, I am responsible for this decision) selected a market leader that has the necessary security certificates + conducted tests for recognition quality.

Sumsub is an international company with its main office in London, recognized by Gartner as a leader in KYC, plus it is GDPR Compliant (meaning the company adheres to EU rules for collecting and storing personal data. — NN), has joint projects with Interpol (in reality, the "joint project with Interpol" is a presentation at a conference attended by Interpol employees. — NN), the UN, and successfully passed all document recognition tests.

I worked with this company, including on commercial projects, and it raised no questions regarding the quality of its service. In 2022, the company refused to work with Russia and Belarus.

Regarding data storage, we asked them this question separately — for European companies, Sumsub uses an AWS data center in Germany (with encrypted storage for sensitive data) to ensure GDPR compliance.

Regarding the question of beneficiaries, we need to clarify this data ourselves and discuss this information with the election commission, as it directly affects the security and ethics of using Sumsub — we will conduct an audit.

Additionally, we will hold an unscheduled meeting with the CEC today to discuss this situation; the meeting will be open.

At the same time, we re-verified Sumsub's claims about ceasing operations with Russia and Belarus since 2022 and ceasing work with Smart Engines in the same year in favor of its own technology.

We are checking the remaining data."

* * *

Clarifications and Additions

1) The initial version of the article stated: "Today the company positions itself as British, but in reality, the British legal entity Sum and Substance Ltd belongs to the Cypriot Raritex Trade Ltd. Who actually controls the company, we do not know." In the updated version, we added an explanation of its beneficiaries, received from the company itself.

The Cypriot registry is not public; we could not obtain this information ourselves.

2) The initial version of the article stated that "in early 2026, the company was forced to admit after publications on hacker forums."

In its letter, the company explained that the incident was discovered and investigated by Sumsub itself and was not forced by publications on hacker forums.

3) The publication from Incrypted Media, cited in the earlier version of the article, was based on a publication by Rekt, which was later removed from that publication's page by court order for interim measures until a final judicial decision.

• 7
• 0
• 16
• 49
• 1
• 2
• 3
• 0