KYC in crypto: what exchanges and wallets must check

A crypto wallet app that only stores keys asks its user for no ID. It holds no customer money. Trust Wallet's glossary entry on KYC says that creating a non custodial wallet does not require KYC, and that KYC may still apply when the user buys crypto through a third party provider inside the app, because that provider is a regulated business.

The duty therefore follows the business that holds, exchanges or transfers crypto for others, whatever software the customer happens to use. Know your customer (KYC) and AML obligations sit with the exchange, the broker, the custodian, the on ramp and the crypto ATM operator. For those firms KYC opens the six AML checks a crypto business runs, and its file decides the tier, the wallet proof and the travel rule data.

What is KYC in crypto? A short guide to know your customer, due diligence and EDD

KYC in crypto means identifying and verifying each customer of a crypto business, then learning enough about them to judge how much money laundering or terrorist financing risk each one carries. It is the front part of customer due diligence (CDD). The key components of CDD are the four measures of Recommendation 10 of the Financial Action Task Force (FATF): verify who the customer is, find any beneficial owner, learn what the relationship is for, and keep watching it through ongoing due diligence. Enhanced due diligence (EDD) asks for more of each when the risk is higher, such as the source of wealth and closer monitoring.

The FATF Recommendations hold every virtual asset service provider (VASP), the business that exchanges or transfers virtual assets for others, to the same measures. The interpretive note to Recommendation 15 sets the CDD line for occasional transactions at USD/EUR 1,000 (para 7(a)). Recommendation 10 prohibits anonymous accounts, and from 10 July 2027 the EU's AML Regulation (AMLR) bars anonymous crypto asset accounts, including through anonymity enhancing coins (art. 79(1)).

The benefits of KYC reach past regulators. Banks and payment firms that carry an exchange's fiat check its KYC controls first. A verified identity makes stolen identities and account takeover harder to use, and monitoring needs a profile to compare each transfer against.

Picture a customer (illustrative) who opens an account to buy 200 euros of bitcoin a month from a salary. Standard CDD covers that file. Later the same customer deposits 40,000 euros in stablecoins received from a mixer. The exchange moves the file to EDD and asks where the coins came from.

Who has to run KYC: exchanges, custodial and non custodial wallets, DEXs or crypto ATMs?

The business that holds or moves the customer's crypto runs KYC, at the point where the customer's money meets that business.

Table 1. Who runs KYC where a customer meets crypto (as of November 2026)

A custodial exchange or broker carries the full file because it holds the coins and sees every deposit and withdrawal. It is also where an identity first meets a wallet address. complead, formerly Sanction Scanner, screens that name and that wallet together for crypto firms: sanctions, wallet and name screening run on one engine.

KYC affects a non custodial wallet user only at the edges, since the app never touches the funds. Decentralized platforms such as a DEX run as code, which moves KYC to the exchange where funds enter or leave; the FATF's July 2026 report makes recommendations to VASPs that deal with DeFi. UK crypto ATM operators have applied CDD to every exchange made on their machines since 10 January 2020, at any amount. Between two self hosted wallets nobody runs KYC until one side touches an obliged firm.

How do crypto KYC rules differ around the world?

Global KYC compliance follows one FATF standard, and the detail is national: the regulator and license differ in each of 24 markets, and so do the duties by article in six rulebooks.

In the US, an exchanger of virtual currency generally qualifies as a money transmitter, so it registers with FinCEN within 180 days of being established and runs an AML compliance program that includes verifying customer identification (31 CFR 1022.210).

The 2016 CDD rule covers banks, broker dealers, futures firms and mutual funds, not money transmitters.

What did the 2026 calendar change for crypto KYC?

• 2 February. Brazil's central bank rules for virtual asset providers apply (Resolução BCB nº 520, art. 92).
• 31 March. Australian digital currency exchanges become registered VASPs (AML/CTF Amendment Act 2024, Schedule 6; Transitional Rules 2026, s 6).
• 30 June. The UK sets CDD on crypto transfers at £800 or more (S.I. 2026/621).
• 1 July. MiCA's transition for providers already active ends at the latest (art. 143(3)); newly covered Australian services take on duties (Transitional Rules 2026, s 12).
• 7 July. The EDPB adopts its final guidelines on personal data in blockchains.
• 6 October. FinCEN withdraws its December 2020 proposal for unhosted wallet transactions.
• 7 October. Türkiye doubles the crypto asset transfer line of its Regulation on Measures to 30,000 TL (Official Gazette 33393).

What are the KYC requirements for crypto exchanges at sign up?

At sign up an exchange's KYC process collects seven things, each answering a question the rules or the monitoring will ask later.

1. Identity. Full name, date of birth, nationality and an ID number, checked against one of the KYC documents that prove identity and address. Why: CDD starts with identify and verify.
2. Address. Residential address, with proof where policy asks for it. Why: it places the customer in a country, and countries carry risk.
3. Face and liveness. A selfie or short video matched to the document, a biometric check run through the firm's identity verification (IDV) provider. Why: on a remote sign up, it shows the document holder is present.
4. Sanctions and PEP screening. The name against sanctions lists and politically exposed person data. Why: a match decides whether, and on what terms, the account opens.
5. Purpose and expected activity. Why the account exists, the expected monthly value and the countries money will come from. Why: monitoring compares each transfer to this baseline.
6. Source of funds. Salary, business income, trading profits or mining, with source of funds and source of wealth evidence for the higher tiers. Why: unexplained money behind the crypto is the risk the file exists to catch.
7. Wallets and crypto history. The addresses the customer will use, whether each sits at an exchange or in a self hosted wallet, and where the coins came from. Why: it ties the person to the chain.

A company customer adds KYB: owners, directors and licenses, as in the questions a crypto exchange asks a company customer.

KYC vs eKYC in crypto: what is the difference?

KYC is what the exchange has to know. Electronic KYC (eKYC) is one way to collect it remotely: an electronic check of the ID document, a face match and a liveness test inside the sign up flow. Almost every crypto customer signs up online, so eKYC is the usual channel, and the firm still owns the result. A failed or doubtful check goes to a manual review.

How long does KYC take on a crypto exchange?

It depends on the tier. A clean electronic check can finish inside the sign up session. A file that needs a source of funds document waits for the customer, and an EDD review waits for an analyst. No rule sets the minutes; a quoted time describes one provider's flow.

How do KYC tiers and risk ratings work in crypto?

A KYC tier sets how much the exchange asks and how often it looks again, and a trigger moves the file up.

Table 2. Crypto KYC tiers by trigger (the tiers are the firm's policy; the legal lines are the floor)

The tiers come from the firm's own KYC risk rating, its risk based approach to assessing and profiling each customer. Crypto adds factors of its own to the usual ones: wallet exposure to mixers or sanctioned addresses, privacy coins, heavy peer to peer or OTC volume, and countries on the FATF lists. Under a policy like Table 2, one such factor moves a file to the enhanced tier kept for high risk customers.

A tier works only if every route into the account passes through it. On 30 October 2020, on the firm's own application, the FCA barred CB Payments Ltd (CBPL), the Coinbase group's UK e money firm, from onboarding high risk customers while it fixed its financial crime controls. Between 31 October 2020 and 1 October 2023, CBPL onboarded about 3.9 million customers and onboarded or served 13,416 high risk customers the restriction covered. About 31 percent of those made 12,912 deposits worth about $24.9 million, which then funded about $226 million of crypto transactions through other group firms. The FCA's final notice of 23 July 2024 found the onboarding flag was built without the latest version of the restriction, tested too little and blind to customers moving over from other group companies. The penalty was £3,503,546 after a 30 percent settlement discount.

How does an exchange tie a self hosted wallet to its customer?

Picture a customer of an exchange in Madrid (illustrative) who asks to withdraw 1,800 euros in USDC to a hardware wallet the exchange has never seen. The amount is above 1,000 euros and the address is self hosted, so the exchange must take adequate measures to assess whether its customer owns or controls the address (TFR art. 14(5)). For incoming transfers above the same amount, art. 16(2) puts the question to the receiving firm.

The EBA's travel rule guidelines name the methods (paras 83 to 86). A firm uses at least one of these:

• a predefined amount, set by the firm and preferably the smallest unit of the coin, sent between the address and the firm's own account;
• a specific message signed with the key that controls the address;
• a remote verification, attended or unattended, in which the customer shows the address;
• another technical means that gives a reliable, secure assessment and leaves the firm fully satisfied about who owns or controls it.

Which method works best depends on what the wallet can do, how reliable each method is and the risk. Firms combine methods where one falls short. Once satisfied, the firm records the address and may skip the test on later transfers (whitelisting), and it takes the address off the list when the risk or the owner changes. Ownership is one question and exposure another: to see where the coins have been, the address also goes through a crypto wallet AML check.

What does the travel rule add after onboarding?

The customer file becomes the data that travels. Under the FATF travel rule, the sending VASP passes originator and beneficiary data to the receiving VASP straight away and over a secure channel, and hands it to authorities when they ask (INR.15 para 7(b)). The EU applies this to transfers of any amount, and the UK asks for CDD on transfers of £800 or more. Its impact on the file is that the data must stay current. From 10 July 2027, AMLR art. 26(2) allows at most one year between updates for a higher risk customer and five years otherwise, and a change in circumstances calls for an earlier review. Ongoing monitoring between those dates is what spots the change.

Why is KYC hard to put into practice in crypto, and what does failure cost?

On 11 May 2025, Coinbase received an email demanding money in exchange for not publishing customer data. In its filing with the US Securities and Exchange Commission (SEC), the company said the attacker appears to have paid contractors or employees in support roles outside the United States to collect data from internal systems: names, addresses, masked Social Security numbers, masked bank account numbers, government ID images such as driver's licenses and passports, balances and transaction history. No passwords or private keys were compromised. Coinbase did not pay. It preliminarily put the cost of remediation and voluntary reimbursement at about $180 million to $400 million.

The first difficulty of KYC implementation in crypto is that the file is itself a target. A firm that must keep ID images for years holds what fraudsters and other criminals want, so control over who can open the KYC store belongs to the KYC program. The other challenges are familiar. Friction: each extra document loses some sign ups, while a weak check lets stolen or forged documents through. Cross border rules mean one customer base answers to many thresholds and data sets. Decentralization leaves nobody to ask at a DEX or a self hosted wallet. And every check, review and refresh takes analyst time.

Failure brings penalties as well. Four crypto exchanges are among the top 49 cases in a ranking of the biggest AML fines on record, all since 2021, and the CBPL penalty above came from a tier control that let barred customers through.

Can blockchain be a solution for KYC?

Blockchain technology is a shared ledger that many computers copy, so no single party can edit a past entry. The old promise was one tamper proof KYC record for every exchange. The 2026 answer is narrower: a blockchain can carry proofs while personal data stays elsewhere, and the obliged firm keeps the duty. Five steps, each with its rule:

1. Keep personal data off chain. The EDPB's final guidelines say data written to a blockchain will in most cases stay "with no practical possibility of deletion or modification" (para 50) and recommend storing additional personal data off chain (para 109).
2. Reuse a verified identity through the EU wallet. By 24 December 2026 each member state of the European Union owes its residents a European Digital Identity Wallet (eIDAS art. 5a(1): 24 months after the implementing acts took effect on 24 December 2024), which carries verified identity data the way blockchain based self sovereign identity projects promised.
3. Rely on another firm's KYC only under reliance rules. FATF Recommendation 17 leaves "the ultimate responsibility for CDD measures" with the relying firm, so an exchange that accepts shared credentials from industry collaboration still answers for the result.
4. Square record keeping with erasure. AML records stay for at least five years (FATF R.11), while the GDPR gives people a right to erasure, and an immutable ledger serves neither cleanly.
5. Automate with smart contracts, decide with people. A smart contract can release a transfer only when a valid credential is shown, and sharing a credential instead of a passport scan helps data security and user experience. An analyst still decides a doubtful file.

How does a firm in the cryptocurrency industry put KYC into practice with complead?

Implementing CDD procedures at cryptocurrency exchanges comes down to one test: do the identity file, the wallet checks and the monitoring agree on who the customer is? Document and liveness checks stay with the firm's own IDV provider. complead takes the verified identity as an input to its risk model and does not generate it. Names and wallets are screened against sanctions on one engine. The model's factors, weights and thresholds are entered exactly as the firm's policy states them, and any change rescores the customer.

Through API triggers the exchange starts ongoing monitoring of a name at onboarding and stops it when the account closes, so screening stays continuous for live customers and former customers drop out. Every screening search leaves a record of who ran it, which name, when and with what outcome. Empty results count.

One exchange had worked wallet exposure and name screening in two tools. The unified setup on complead went live in 4 weeks; its analysts now open 1 system per case instead of 2, and 100 percent of cases carry both the wallet trail and the name trail.

So the wallet question has the same answer for the firm. The wallet app asks for nothing because it holds nothing. The exchange, the on ramp and the ATM operator hold the money, so they hold the file: who the customer is, which tier the file sits in, and which self hosted addresses are proven to be the customer's. When a bank partner, a supervisor or a receiving VASP asks who sent a transfer, that file is the one place the answer exists.