This is a really solid breakdown.
What stood out to me is how everything still looks clean at the design level, but in practice the flow itself becomes unpredictable.
Same user, same KYC path on paper, but depending on providers, timing, retries or even small data differences, the actual execution can vary a lot.
Feels like that’s where KYC and security really merge, not just in data, but in how the system behaves under real conditions.