Build the orchestration; buy the checks. Identity verification, document authentication and sanctions screening are commodities with several credible vendors, and there is nothing to gain from reimplementing them. The orchestration layer, meaning which checks run in which order, what each result means, when a case escalates to a human, and how the whole decision is evidenced, is your risk policy expressed as software, and it changes far too often to sit inside someone else's product.
The practical reason is vendor churn. Verification providers are replaced regularly: coverage gaps in a new market, pricing changes, quality regressions, an acquisition. If your onboarding flow is built inside one vendor's orchestration tool, every replacement is a rebuild, and you will delay a replacement you should make because the switching cost is artificially high.
The regulatory reason is stronger. A supervisor asking why a specific customer was onboarded wants the decision, the inputs, the policy version in force at the time, and who approved any override. That is an audit trail over your own decision logic, and it is materially harder to produce when the logic lives in a third-party console whose change history you do not control.
Orchestration you own also lets you run vendors in parallel, which is the only reliable way to evaluate a replacement. Send a sample through both, compare outcomes on real traffic, and switch on evidence rather than on a sales demo.
The scope worth owning is narrow: a policy engine, a case model, an event log and adapters per vendor. That is a small, stable component. The temptation to expand it into a full case-management product is where this decision goes wrong.