> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.vlenseg.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.vlenseg.com/_mcp/server.

# October 13, 2026

## New features

### SMS provider option on the PII consent OTP

`POST /api/FRAServices/RequestOtpForPii` now accepts an optional `smsProviders` field, matching the rest of the API. Omit it — or send `0` — and the tenant's default provider is used, so existing callers are unaffected.

```bash
POST /api/FRAServices/RequestOtpForPii
{
  "phoneNumber": "+201234567890",
  "smsProviders": 2
}
```

See [PII inquiry with OTP](/fra-services/pii-inquiry-otp) for the full flow.

### Users with AML matches

A new portal page (**Users With AML**) lists users whose ID front scan matched an AML record, showing user ID, name, phone number, transaction ID and scan date. Results are paged, searchable by name, surname, phone, email, ID number or transaction ID, and filterable by date range. Available to tenants and to the host while impersonating a tenant.

Access is controlled by the new **Pages.AmlUsers** permission — grant it to the roles that should see the page.

### Custom confirmation content on business request types

Request types can now carry their own confirmation text, set on the request type screen and saved with each request. It is rendered in the KYC confirmation section of the generated contract, after the standard declaration and before the request fields, for both standard and promissory-note types, in English and Arabic.

It is not shown when the type is single-section or when KYC confirmation is hidden.

## Enhancements

### Scan step retries are driven by one setting

Scan step retries are now controlled solely by the **Scan Step Max Tries Count** feature. The default remains `6`; setting it to `0` means unlimited tries, with every request counted as a new request. The old **Enable Scan Step Retry** checkbox has been removed from the Create/Edit Tenant screens.

> **Note**
>
> Tenants that relied on the old **Enable Scan Step Retry** flag fall back to the 6-try limit after this release. Set **Scan Step Max Tries Count** to `0` for those tenants to keep unlimited retries.

### Hide KYC Confirmation requires Custom Contract Template

**Hide KYC Confirmation** now takes effect only when the **Custom Contract Template** feature is enabled. Without it, the KYC confirmation is always shown in contracts.

### Explicit error codes on the FRA PII inquiry

Both PII inquiry endpoints — `POST /api/FRAServices/PersonallyIdentifiableInformation` and `POST /api/FRAServices/CheckIdAndFRAByTransaction` — now return **HTTP 400** with a specific `error_code` instead of a generic failure:

**OTP not verified**

* `6106` — wrong OTP code. Re-enter it and retry with the same `otpRequestId` (up to 5 tries per OTP)
* `6105` — OTP expired. Request a new OTP and retry
* `6101` — OTP request not valid (unknown, already used, or no tries left). Request a new OTP and retry

**ID image validation failed** (`PersonallyIdentifiableInformation` and `CheckIdAndFRAByTransaction`), with the failing fields in `data.validation_errors`:

* `6125` — ID front image failed validation
* `6126` — ID back image failed validation

See [PII inquiry with OTP](/fra-services/pii-inquiry-otp#errors) and [Error codes](/errors#identity--contract-errors-6xxx).

## Bug fixes

* Deleting a portal user who has signed contracts now returns a clear message instead of an HTTP 500 error. Self-deletion through the Gateway is unchanged
* The **Unlock** action now appears for business request users in the Users list, and unlocking them is allowed by the backend
* After login, users are returned to the link they originally opened — including `/account/...` links such as email verification — instead of the home page