KYC in Crypto: Requirements for Exchanges and VASPs
Crypto was built to work without intermediaries. The businesses that connect it to the financial system — exchanges, brokers, custodians — are now regulated like financial institutions, and that starts with knowing their customers. This guide explains what KYC means in crypto, the rules in the main markets, and how crypto KYC works in practice.
For years, many crypto platforms let users trade with nothing more than an email address. That model has largely disappeared from regulated markets. Regulators treat exchanges and custodians as gatekeepers between crypto and the banking system, and enforcement has been heavy: in November 2023, Binance agreed to pay more than US$4.3 billion to US authorities over anti-money laundering and sanctions failures.
This guide is written for compliance teams at exchanges, brokers, custodians and payment firms adding crypto. For the general KYC process, see What Is KYC?; for the travel rule in depth, see our travel rule guide for VASPs.
What KYC Means in Crypto
The term is used in two ways:
- For users, "KYC verification" is the identity check an exchange asks for before you can trade, deposit fiat or withdraw — typically a government ID, a live selfie and sometimes proof of address.
- For crypto businesses, KYC is the full customer due diligence obligation: identifying and verifying customers, screening them, understanding their activity, applying enhanced checks to higher-risk users, and monitoring on an ongoing basis.
The global baseline comes from the FATF. In 2019 it amended Recommendation 15 so that virtual asset service providers — exchanges, transfer services, custodians and firms providing financial services related to token issuance — must be licensed or registered, supervised for AML/CFT, and apply the same preventive measures as other financial institutions, including customer due diligence and the travel rule.
Why Crypto Exchanges Require KYC
- It is the law. In every major market, crypto exchanges and custodians are obliged entities under AML legislation and must perform customer due diligence before or when the relationship starts.
- Sanctions. Crypto transfers cross borders instantly. Without knowing the customer and screening wallets, an exchange cannot avoid processing transactions for sanctioned persons.
- Banking access. Banks and payment partners will not serve exchanges whose customers are unverified.
- Fraud and account takeover. Verified identities make it harder to open accounts with stolen or synthetic identities and easier to recover compromised accounts.
Crypto KYC Requirements by Jurisdiction
| Jurisdiction | Regime | Key KYC points |
|---|---|---|
| Global | FATF Recommendations 15 and 16 | VASPs licensed or registered; customer due diligence as for banks; travel rule for transfers, with a USD/EUR 1,000 threshold in the FATF standard |
| European Union | MiCA; Transfer of Funds Regulation (EU) 2023/1113; AML Regulation from July 2027 | Crypto-asset service providers (CASPs) need MiCA authorisation (applying since 30 December 2024; national transitional periods ended by 1 July 2026 at the latest). The travel rule applies from 30 December 2024 with no minimum threshold between CASPs, and transfers over €1,000 involving a self-hosted wallet require verification that the customer owns or controls it |
| United States | Bank Secrecy Act; FinCEN | Exchangers and administrators of convertible virtual currency are money services businesses: FinCEN registration, a written AML programme, customer verification, suspicious activity reports and the funds-transfer travel rule |
| United Kingdom | Money Laundering Regulations 2017; FCA | Cryptoasset exchange and custodian businesses must register with the FCA for AML purposes; the UK travel rule has applied since 1 September 2023 |
| Singapore | Payment Services Act 2019; MAS Notice PSN02 | Digital payment token service providers need an SPI or MPI licence; PSN02 sets customer due diligence, monitoring and travel rule duties (fuller data above S$1,500). See our MAS DPT licensing guide |
| Hong Kong | AMLO; SFC | Virtual asset trading platforms serving Hong Kong must be licensed by the SFC (regime in force since 1 June 2023), with AML/CFT obligations including customer due diligence and the travel rule |
The common thread is that crypto businesses are held to bank-equivalent customer due diligence, plus crypto-specific obligations around transfers and wallets. For the EU framework in more detail, see our MiCA guide.
How Crypto KYC Works
Sign-up and identification
The user provides full name, date of birth, nationality and address. Many platforms also capture phone and email for fraud checks.
Identity verification
The user uploads a government ID and takes a live selfie. The platform authenticates the document, matches the selfie to it and runs liveness detection to stop spoofing and deepfakes.
Screening
The customer is screened against sanctions lists, politically exposed person databases and adverse media.
Risk rating
Country, expected activity, source of funds and product use feed a risk rating that sets limits, monitoring intensity and whether enhanced due diligence is needed.
Source of funds for larger activity
Higher deposits or higher-risk profiles trigger source-of-funds and source-of-wealth evidence — see our source of funds vs source of wealth guide.
Wallet screening
Deposit and withdrawal addresses are checked with blockchain analytics for exposure to sanctioned addresses, darknet markets, mixers, scams and stolen funds.
Travel rule data exchange
For transfers to and from other VASPs, originator and beneficiary information is exchanged; for self-hosted wallets, ownership is verified where the rules require it.
Ongoing monitoring
Activity is monitored both off-chain (account behaviour) and on-chain (where funds come from and go to), with periodic and event-driven KYC refresh.
KYC Levels and Verification Tiers
Many exchanges organise verification into tiers — for example a basic tier with ID and selfie, and a higher tier adding proof of address and source of funds for larger limits or additional products.
In most regulated markets, customer due diligence is required before a business relationship begins, so tiers now determine limits and product access, not whether KYC happens at all. Tier design should follow the firm's risk assessment, with the triggers for moving a customer up a tier written down and applied consistently.
Self-Hosted Wallets and the Travel Rule
Transfers between two regulated VASPs can carry travel rule data from one to the other. Transfers to or from a self-hosted wallet — one the user controls with their own keys — have no counterparty institution to receive or send that data.
The EU deals with this directly: for transfers over €1,000 involving a self-hosted address, the CASP must verify that the address is owned or controlled by its own customer — for example by having the customer sign a message with the wallet's key or make a small test transfer. Other jurisdictions take a risk-based approach to self-hosted wallets. Either way, the firm needs to know whether each counterparty address is hosted or self-hosted, which is a job for blockchain analytics rather than manual review.
Crypto KYC Challenges
- Speed and scale — users expect onboarding in minutes, often in large surges around market events.
- Document fraud and deepfakes — crypto platforms are a prime target for synthetic identities and injected deepfake video.
- Cross-border users — a global customer base means many document types and several regulators' rules at once.
- Travel rule interoperability — jurisdictions implemented at different times and VASPs use different messaging protocols, so counterparty data does not always arrive.
- On-chain risk — mixers, privacy-enhancing tools and cross-chain bridges make tracing fund flows harder and require specialist analytics.
The firms that handle this well treat crypto KYC as one connected flow — identity, screening, wallet risk and transaction monitoring — rather than separate tools that each see part of the customer.
Frequently Asked Questions
What is KYC in crypto?
KYC in crypto is the identity verification and customer due diligence that crypto exchanges and other virtual asset service providers carry out on their users, as required by anti-money laundering law in most jurisdictions.
Why do crypto exchanges require KYC?
Because they are legally required to. FATF standards and national laws treat crypto exchanges and custodians as obliged entities that must verify customers, screen them against sanctions lists and monitor transactions — the same core duties as banks.
What documents are needed for crypto KYC?
Usually a government-issued photo ID such as a passport or national ID card and a live selfie. Higher limits or higher-risk profiles may also require proof of address and evidence of the source of funds.
What is the crypto travel rule?
The travel rule requires VASPs to send and receive identifying information about the sender and recipient of crypto transfers. FATF sets a USD/EUR 1,000 threshold; the EU applies it to all transfers between crypto-asset service providers with no minimum.
Does MiCA require KYC?
MiCA sets the authorisation and conduct regime for crypto-asset service providers. The KYC obligations themselves come from EU anti-money laundering law and the Transfer of Funds Regulation, which apply to CASPs alongside MiCA.
Sources
- FATF — Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs
- EUR-Lex — Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA)
- EUR-Lex — Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets
- FinCEN — Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies (2019)
- MAS — Licensing for Payment Service Providers
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
KYC, Screening and Monitoring Built for VASPs
One Constellation brings crypto-specific KYC, sanctions and entity screening, travel rule compliance and on-chain analytics integration into one compliance platform.
