KYC, short for Know your customer, is the set of procedures a regulated business uses to verify the identity of its clients, understand the purpose of the relationship and assess the money laundering and terrorist financing risk each client represents. For crypto & blockchain services, KYC is the gate between anonymous on-chain addresses and the regulated financial system.
Crypto exchanges, custodians, brokers and payment providers that qualify as virtual asset service providers must apply KYC under anti-money laundering law in most major jurisdictions. KYC is one pillar of a wider AML program that also includes transaction monitoring, sanctions screening, the travel rule and suspicious activity reporting.
What a KYC process includes
KYC is not a single document check. It is a lifecycle of controls that starts at onboarding and continues for as long as the client relationship exists. Regulators expect a risk-based approach: the depth of checks must match the risk the client poses.
| Component | Purpose | Typical evidence or tool |
|---|---|---|
| Customer identification | Establish who the client is | Name, date of birth, address, ID document |
| Identity verification | Confirm the data is genuine | Document scan, liveness check, database match |
| Customer due diligence (CDD) | Understand purpose and expected activity | Questionnaire on occupation and funds |
| Enhanced due diligence (EDD) | Deeper review for higher risk | Source of wealth, source of funds documents |
| Screening | Detect sanctions and political exposure | Sanctions lists, PEP and adverse media databases |
| Ongoing monitoring | Detect changes and unusual activity | Periodic reviews and transaction analytics |
For companies, KYC extends to know your business checks: verifying the legal entity, its directors and its ultimate beneficial owners, usually anyone holding more than 25 percent of shares or control, a threshold common in EU and FATF-aligned rules.
Risk tiers and verification levels
Many crypto platforms structure KYC in tiers tied to account limits. Lower tiers require less data but allow only modest activity; higher tiers unlock larger deposits, withdrawals and products such as derivatives. The exact limits are set by each provider within the rules of its jurisdiction.
| Tier | Data required | Typical access |
|---|---|---|
| Basic | Email, phone, name, country | Browsing, very limited or no fiat activity |
| Standard | Government ID and selfie with liveness check | Fiat deposits, trading, normal withdrawals |
| Enhanced | Proof of address, source of funds | High limits, institutional products |
| Corporate | Company documents, beneficial owners | Business accounts and OTC trading |
Identity verification itself relies on several techniques used together. Document authentication checks security features, fonts and the machine-readable zone of a passport or identity card. Biometric liveness detection asks the user to move, blink or follow prompts so that a printed photo or replayed video is rejected, and face matching compares the live image with the document photo. Some providers also read the chip in electronic passports, which gives strong cryptographic assurance that the document is genuine.
Risk scores are recalculated when behavior changes. A client who suddenly deposits funds from a mixing service, a high-risk exchange or a sanctioned region may be moved into enhanced due diligence even after years of normal activity.
Legal basis for KYC in crypto
The global baseline comes from the FATF Recommendations, which since 2019 explicitly require countries to regulate virtual asset service providers and apply customer due diligence to them. National and regional laws then turn these standards into binding obligations with supervisory enforcement.
- European Union: AML directives and the new AML Regulation, together with MiCA licensing for crypto-asset service providers and the transfer of funds rules implementing the travel rule.
- United States: the Bank Secrecy Act, with crypto businesses typically registered as money services businesses and subject to customer identification rules.
- Other financial centers: licensing regimes that make KYC a condition of operating a crypto business.
- Record keeping: KYC data and transaction records must usually be retained for at least five years after the relationship ends.
Supervisors enforce these duties through inspections, license conditions and fines. Enforcement actions against exchanges have repeatedly cited weak onboarding controls, such as accepting clients from restricted countries or failing to collect beneficial ownership data, as the root cause of wider failures. For a crypto business, a credible KYC program is therefore a condition of keeping its license and its banking partners, not an optional extra.
KYC compared with related compliance controls
KYC is often used loosely to mean all compliance work. In precise usage it covers the client’s identity and risk profile, while neighboring controls cover transactions and counterparties.
| Control | Main question | When it applies |
|---|---|---|
| KYC | Who is the client and what risk do they pose | Onboarding and periodic reviews |
| AML | Is the overall program preventing laundering | Across the whole business |
| Travel rule | Who are the sender and recipient of a transfer | Each qualifying crypto transfer |
| Sanctions screening | Is a person or address sanctioned | Onboarding and every transaction |
| Know your transaction | Is this on-chain flow suspicious | Continuous blockchain analytics |
Practical challenges and common mistakes
KYC in crypto faces problems that traditional banks see less often. Users interact with self-hosted wallets that have no identity attached, onboarding is fully remote, and fraudsters increasingly use deepfakes and synthetic identities to pass automated checks.
- One-time checks only: verifying at onboarding but never reviewing, so outdated data hides new risk.
- Overreliance on automation: accepting vendor scores without human review of edge cases.
- Weak data protection: KYC databases are high-value targets, and breaches expose documents permanently.
- Inconsistent rules across jurisdictions: serving clients in many countries with one undifferentiated process.
- Account renting: verified accounts sold or lent to criminals, defeating identity checks.
Good programs combine document verification, liveness detection and behavioral analytics, and they collect only the data the law requires, which balances compliance with privacy and data minimization.
Explained without jargon
KYC means a crypto service must know who it is dealing with. Before opening an account, it asks for an ID, a selfie and sometimes proof of address. Banks have done the same for decades.
The goal is to keep criminals from using the service to hide stolen or illegal money. The key takeaway: KYC trades some privacy for access to regulated services.
A typical use case
A freelance designer wants to convert crypto payments into euros. She signs up with a licensed exchange, enters her personal details, photographs her identity card and records a short liveness video that confirms she is a real person matching the document. The automated check finishes in a few minutes, and she reaches the standard tier with normal deposit and withdrawal limits.
Six months later, a client pays her a much larger sum than usual. The exchange’s monitoring flags the jump and asks for an invoice and a short explanation of the source of funds. She uploads the contract the same day, the review is closed and the withdrawal goes through. The outcome is a short delay instead of a frozen account, because her profile and documents were already on file.