KYC and AML in Crypto Explained

KYC (Know Your Customer) and AML (Anti-Money Laundering) are the rules that require regulated crypto businesses, such as exchanges and custodians, to verify who their customers are and to monitor transactions for signs of money laundering, fraud, terrorist financing or sanctions evasion. In practice, KYC is why an exchange asks for your ID, and AML is why it may question or hold some transactions.

These rules are not unique to crypto — banks and payment companies follow similar ones. But because crypto moves quickly and across borders, regulators have extended them to crypto service providers in most major jurisdictions. Knowing how they work helps you open accounts smoothly, understand delays and spot fake "verification" requests.

What KYC Involves

KYC is the identity-checking part. A typical exchange onboarding asks for:

1. 1Personal details: full name, date of birth, address and nationality.
2. 2Identity document: passport, national ID card or driver's license.
3. 3Liveness check: a selfie or short video to confirm you are a real person matching the document.
4. 4Proof of address: sometimes a recent utility bill or bank statement.
5. 5Source of funds or wealth: for larger accounts, questions about where your money comes from.

Many platforms use tiered verification: basic checks allow small amounts, and higher tiers unlock larger deposits and withdrawals. Businesses face additional checks on their owners and directors, often called KYB (Know Your Business). Related reading: Consumer Protections When Using Crypto Platforms.

What AML Involves

AML is the ongoing part. A regulated crypto business typically must:

• Assess risk for each customer and apply enhanced checks for higher-risk profiles.
• Screen customers and addresses against sanctions lists.
• Monitor transactions for unusual patterns, often using blockchain analytics tools that trace funds to known hacks, darknet markets or mixers.
• Report suspicious activity to the national financial intelligence unit.
• Keep records for a set number of years.
• Apply the Travel Rule, which in many jurisdictions requires sending basic sender and recipient information with transfers between providers. Our guide to the Travel Rule in crypto explains it.

Where the Rules Come From

The FATF, an intergovernmental body, sets international standards. In 2019 it clarified that its standards apply to "virtual asset service providers," and countries have since written them into national law. Examples include registration or licensing regimes for crypto businesses and, in the European Union, the Markets in Crypto-Assets Regulation together with updated anti-money-laundering rules. Our explainer on MiCA covers the EU framework. Our article Is Crypto Legal? How Rules Differ Around the World expands on this point. Our article What Is a VASP? Virtual Asset Service Providers Explained expands on this point.

Because each country implements the standards differently, thresholds, documents and reporting rules vary. Rules also change over time, so check your national regulator's website for current requirements. The FATF website publishes the underlying standards.

Who Must Do KYC and Who Doesn't

This is a general pattern, not a legal rule for every country. Some jurisdictions impose obligations on transfers to and from self-custody wallets. If you are unsure, our article on choosing between self-custody and exchange custody explains the trade-offs. If you want to go further, read Self-Hosted Wallets and Regulation.

Privacy Trade-Offs

KYC means a company stores sensitive personal data, and data breaches do happen. Linking your identity to an exchange account also means that, through blockchain analysis, your deposits and withdrawals can often be connected to addresses you use elsewhere. See also: Sanctions and Crypto.

Reasonable steps to limit exposure:

• Use as few platforms as you need, and close accounts you no longer use.
• Prefer platforms that explain how long they keep data and how they protect it.
• Be cautious about publicly linking your name to wallet addresses.

These steps reduce risk without breaking any rules. Deliberately hiding the source of funds from a regulated platform is a different matter and can have legal consequences.

Common Frustrations and How to Handle Them

• Delayed verification. Use clear, uncropped photos, matching names and a current address document.
• Withdrawal holds. Funds linked to flagged addresses or unusual activity may be reviewed. Answer questions honestly and keep records of where your crypto came from.
• Account restrictions. Platforms may limit service by country. Using a VPN to get around this usually breaks terms of service and can lead to frozen funds.

Keeping a simple log of deposits, withdrawals and addresses makes reviews faster, and it helps with taxes too.

KYC Scams to Watch For

Criminals exploit the fact that people expect to be asked for documents:

• Fake exchanges that collect passports and selfies, then disappear or sell the data.
• "Verify your wallet" messages that ask for your seed phrase. No legitimate KYC process ever needs your seed phrase or private key.
• Unlock fees. Fake support agents claim you must pay a "compliance fee" or "AML deposit" to release funds. This is a common feature of fake crypto exchanges.
• Phishing links to look-alike verification pages.

Before uploading anything, confirm the platform is licensed or registered with your regulator and that you reached it through its official domain.

Bottom line

KYC and AML are the price of connecting crypto to the regulated financial system: identity checks at the door and transaction monitoring afterward. Expect them from any legitimate exchange, keep records to make reviews painless, and treat any request for your seed phrase or an "unlock fee" as a scam. Rules differ by country and change often, so check official sources or a qualified professional for your situation.