diff --git a/.envrc b/.envrc
index e7733e4..3e52939 100644
--- a/.envrc
+++ b/.envrc
@@ -62,4 +62,5 @@ export STATS_EXCLUDE_MEMBER_UIDS=
 export COOKIE_DOMAIN=localhost
 export USE_PRIVATE_KEY=true
 
+
 source_env_if_exists .envrc.local
diff --git a/.gitmodules b/.gitmodules
index 739b1af..fb487fe 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -13,3 +13,6 @@
 [submodule "liza"]
 	path = liza
 	url = git@github.com:bitzlato/liza.git
+[submodule "kyc-service"]
+	path = kyc-service
+	url = git@github.com:bitzlato/kyc-service
diff --git a/Makefile b/Makefile
index c3dfe6b..06dfbc5 100644
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ nvm:
 .envrc:
 	direnv allow
 
-configure_apps: app_baseapp app_barong app_peatio app_liza
+configure_apps: app_baseapp app_barong app_peatio app_liza app_kyc_service
 
 GeoLite2-Country.mmdb:
 ifeq ($(UNAME), Darwin)
@@ -94,6 +94,9 @@ start_rango:
 start_liza:
 	cd liza; bundle exec foreman start
 
+start_kyc_service:
+	cd kyc-service; bundle exec foreman start
+
 app_baseapp:
 	cd baseapp; yarn rebuild
 	rm -f baseapp/web/public/config/env.js; ln -s env.localdev.js baseapp/web/public/config/env.js
@@ -111,6 +114,10 @@ app_peatio:
 			bin/rake tmp:clear tmp:create; \
 			bin/rake db:reset
 
+app_kyc_service:
+	cd kyc-service; rbenv install -s; bundle; \
+	bundle exec rails db:setup; \
+
 app_liza:
 	cd liza; git submodule init; git submodule update; \
 		rbenv install -s; bundle; \
@@ -119,3 +126,11 @@ app_liza:
 
 secrets:
 	bundle exec peatio security keygen --path=secrets
+
+checkout_all_master:
+	cd kyc-service; git checkout main; git pull; bundle install; bundle exec rake db:setup; cd ..; \
+		cd barong; git checkout master;  git pull; bundle install; bundle exec rake db:setup;  cd ..; \
+		cd liza; git checkout master;  git pull; bundle install; bundle exec rake db:setup; cd ..; \
+		cd peatio; git checkout master;  git pull; bundle install; bundle exec rake db:migrate;  cd ..; \
+		cd rango; git checkout master;  git pull; cd ..; \
+		cd baseapp; git checkout master; git pull; yarn install; cd web; yarn install; cd ..\..;
diff --git a/README.md b/README.md
index aef4d89..ea0938e 100644
--- a/README.md
+++ b/README.md
@@ -58,6 +58,13 @@ make start_rango
 make start_liza
 ```
 
+**6th terminal session (kyc-service)**
+
+```bash
+make start_kyc_service
+```
+
+
 Open page http://localhost:8080/ in browser.
 
 ## Run main apps in light mode (only web, no daemons)
diff --git a/barong b/barong
index 30ff69f..bf96841 160000
--- a/barong
+++ b/barong
@@ -1 +1 @@
-Subproject commit 30ff69f36ff56c845848d80746c00f9854cf50c0
+Subproject commit bf968417a2813d693f0dd8fdb1634541f89ba68b
diff --git a/docker-compose.yml b/docker-compose.yml
index 10ecb1d..9ab1df9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,6 +51,7 @@ services:
       BASEAPP_PORT: 3002
       RANGO_PORT: 8090
       LIZA_PORT: 3003
+      KYC_PORT: 3008
 
     # Good idea. But it does not work on macos because of https://docs.docker.com/docker-for-mac/networking/#there-is-no-docker0-bridge-on-macos
     # The better way it to set peatio.local and ws.local in /etc/hosts manualy
@@ -77,7 +78,7 @@ services:
     environment:
       SKIP_SETCAP: 1
       VAULT_TOKEN: ${VAULT_TOKEN}
-      VAULT_DEV_ROOT_TOKEN_ID: changeme
+      VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_TOKEN}
       VAULT_ADDR: http://vault:8200
 
   tower:
diff --git a/kyc-service b/kyc-service
new file mode 160000
index 0000000..6e3f429
--- /dev/null
+++ b/kyc-service
@@ -0,0 +1 @@
+Subproject commit 6e3f429b69f67c6a885b76d5534e742b8265f8f4
diff --git a/liza b/liza
index dba6e13..6a307ce 160000
--- a/liza
+++ b/liza
@@ -1 +1 @@
-Subproject commit dba6e1347aefc16230b5a213445ace99d4b64cb3
+Subproject commit 6a307ce2bcecefcc2434791dff977760e3ecb94f
diff --git a/peatio b/peatio
index b946ca6..c4a8ac0 160000
--- a/peatio
+++ b/peatio
@@ -1 +1 @@
-Subproject commit b946ca6d539673fa7faecf24116555d61612f603
+Subproject commit c4a8ac0e696970366f3462d5de4f28ee8cd2041b
diff --git a/rango b/rango
index 1fde354..43c1855 160000
--- a/rango
+++ b/rango
@@ -1 +1 @@
-Subproject commit 1fde3543564fc3a42325de6c787ca8cb0bbdd1a4
+Subproject commit 43c1855293954e5bac8f122ec072fbef9d0f7876
diff --git a/templates/default.conf.template b/templates/default.conf.template
index dbefe2f..d4d3edb 100644
--- a/templates/default.conf.template
+++ b/templates/default.conf.template
@@ -35,6 +35,30 @@ server {
       proxy_pass http://${DOCKER_HOST_IP}:8091;
     }
 
+    location /api/v1/kyc/webhook/sumsub {
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      error_page 401 =401 /error/401;
+      proxy_pass http://${DOCKER_HOST_IP}:${KYC_PORT}/api/webhook/sumsub;
+    }
+
+    location /api/v1/kyc {
+      proxy_set_header Host $http_host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      auth_request     /api/v2/auth/;
+      proxy_http_version 1.1;
+      auth_request_set $auth_header $upstream_http_authorization;
+      proxy_set_header Authorization $auth_header;
+      error_page 401 =401 /error/401;
+      proxy_set_header        X-Original-URI $request_uri;
+      proxy_pass http://${DOCKER_HOST_IP}:${KYC_PORT}/api/kyc;
+      proxy_cookie_path / "/; Secure";
+    }
+
     location /api/v2/barong {
       proxy_set_header Host $http_host;
       proxy_set_header X-Real-IP $remote_addr;