Current model: Provider supports custody (Phase 1) and lead-gen (Phase 2). Connection methods: self_api, we_pull, and widget. KYC via self_api/we_pull is forwarded to the VASP with kyc_share_token; widget KYC is Sumsub-ready on Twin Bridge and gated by SUMSUB_APP_TOKEN. Phase 2 is implemented.