Crypto KYC Requirements: What Exchanges and Wallets Must Verify

Crypto exchanges, custodial wallet providers, and other virtual asset service providers (VASPs) are subject to a growing set of KYC and AML obligations that mirror the requirements applied to traditional financial institutions. If your platform handles virtual assets on behalf of customers, you are almost certainly a VASP under the FATF framework, and that classification triggers a full compliance obligation set: licensing or registration, customer due diligence, transaction monitoring, Travel Rule data sharing, sanctions screening, and suspicious activity reporting.

This guide explains what those obligations are, where they come from, how they differ by jurisdiction, and what a compliant verification workflow looks like in practice.

What Makes a Platform a VASP?

Before examining specific requirements, it is important to understand who they apply to.

Once a business is identified as a VASP under local law, it inherits, in practical terms, the same kinds of obligations that apply to a bank, a payment institution, or a money transmitter: licensing or registration, an AML program, designated compliance personnel, customer due diligence, transaction monitoring, sanctions screening, Travel Rule compliance, recordkeeping, and suspicious activity reporting.

An entity is generally considered a VASP if it provides any of the following activities: exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, or participation in, or provision of financial services related to, an issuer's offer or sale of a virtual asset. The activity determines whether a business is subject to VASP compliance obligations.

In the EU, the term used under MiCA is Crypto-Asset Service Provider (CASP). CASP is the term specifically defined in MiCA and refers to entities providing services related to crypto-assets, like exchange, custody, and transfer. VASP is a broader term often used internationally and encompasses similar activities. MiCA essentially formalizes and regulates VASPs by classifying them as CASPs.

The classification question is not academic. It determines whether a business is operating legally and whether its banking partners, exchange counterparties, and institutional clients will engage with it at all.

The FATF Framework: Where Crypto KYC Obligations Come From

The Financial Action Task Force (FATF) is the international standard-setting body for anti-money laundering (AML), countering the financing of terrorism (CFT), and countering the financing of proliferation (CPF).

FATF’s crypto standards are global AML/CFT recommendations that establish how countries should regulate virtual assets and virtual asset service providers (VASPs). They are not laws themselves, but they serve as a foundation for national crypto AML frameworks around the world, influencing areas such as licensing, risk assessment, transaction monitoring, the Travel Rule, and reporting obligations.

Two FATF Recommendations are central to crypto compliance:

Recommendation 15 covers new technologies and VASPs broadly. Together with its Interpretive Note, R.15 covers VA/VASP risk assessment, licensing or registration of VASPs, supervision, customer due diligence, monitoring, Travel Rule obligations, recordkeeping, and suspicious transaction reporting.

Recommendation 16 is the Travel Rule. The Travel Rule refers to the application of FATF Recommendation 16 to virtual asset transfers. While Recommendation 16 also applies to traditional wire transfers, the term "Travel Rule" is used in the context of VA transfers.

In 2019, the FATF extended the Travel Rule to include virtual assets and Virtual Asset Service Providers, recognizing the evolving financial landscape and the increasing use of digital assets.

The guiding principle is straightforward. The FATF's guiding principle is "same activity, same risk, same rules": if a digital asset transfer poses the same risk as a wire, it should meet the same Travel Rule requirements regardless of the technology.

Core KYC and AML Obligations for VASPs

1. Licensing and Registration

 Recommendation 15 sets a clear baseline: VASPs must be licensed or registered at minimum in the jurisdiction where they are created or where a natural person's business is located. Operating without registration is itself a regulatory violation, independent of any other AML failure.

2. Written AML/CFT Program

VASPs must establish appropriate AML/CFT policies, procedures and controls proportionate to their risks. These controls should address areas such as customer due diligence, ongoing monitoring, suspicious transaction reporting, recordkeeping, employee training and compliance oversight.

FATF also requires appropriate compliance management arrangements and an independent audit function to test the AML/CFT system, taking into account the size and nature of the business. Specific requirements concerning board approval, review frequency and governance may vary under national law.

3. Customer Due Diligence (CDD)

VASPs are subject to customer due diligence requirements when establishing business relationships and for occasional transactions above the FATF threshold of USD/EUR 1,000. (⁠

Enhanced due diligence applies where higher risks are identified. Specific additional measures apply to politically exposed persons (PEPs). For foreign PEPs, FATF requires reasonable measures to establish source of wealth and source of funds, obtain senior-management approval for the relationship, and conduct enhanced ongoing monitoring. Domestic and international-organisation PEPs are subject to enhanced measures where the relationship presents higher risk.

KYC refers to the customer identification and verification measures that form part of the broader CDD framework. For VASPs, these obligations derive from FATF standards and are implemented through national and regional AML/CFT laws and regulations.

4. Transaction Monitoring

FATF Recommendation 15 emphasizes the importance of robust customer due diligence, transaction monitoring, record-keeping, and reporting obligations within the digital asset sector. Monitoring must be capable of detecting unusual patterns, structuring, and red-flag indicators specific to virtual asset activity.

5. Sanctions and PEP Screening

The FATF recommends that VASPs be licensed and fulfill standard AML/CFT obligations, including CDD, PEP screening, and reporting and record-keeping. Screening must cover sanctions lists, politically exposed persons, and adverse media.

6. Suspicious Activity Reporting

CASPs must implement systems that verify customer identities (KYC), monitor transactions for suspicious activity, and report these to financial intelligence units, just as in traditional finance.

7. Record Retention

Suspicious transaction reporting maps to Recommendation 20, and the 5-year record retention requirement comes from Recommendation 11. Both the originating VASP and the beneficiary VASP must keep records of the complete originator and beneficiary information for each transfer for a minimum of 5 years from the date of the transfer.

The Travel Rule: What Data Must Travel With Every Transfer

The Travel Rule is the most technically demanding element of crypto AML compliance. It requires that identifying information about both the sender and the recipient accompanies qualifying virtual asset transfers.

Under the Travel Rule framework for virtual assets, VASPs must collect and verify information about the originator and beneficiary of a transaction, and share it with counterparties. This information must "travel" with the transfer to increase transparency and traceability.

What Information Must Be Transmitted?

For qualifying transfers, FATF’s core Travel Rule information includes:

• The originator’s name;
• The originator’s account number, where an account is used to process the transaction - in the virtual asset context, this can be the originator’s wallet address;
• The originator’s physical address, national identity number, customer identification number, or date and place of birth;
• The beneficiary’s name; and
• The beneficiary’s account number, where an account is used to process the transaction - in the virtual asset context, this can be the beneficiary’s wallet address.

The originating VASP must verify the accuracy of the required originator information as part of its customer due diligence process. Beneficiary information must also be obtained and transmitted, although the originating VASP does not necessarily have to verify the beneficiary’s information for accuracy. The beneficiary VASP is responsible for obtaining and, where applicable, verifying the beneficiary information relating to its customer.

FATF also expects VASPs to identify and conduct appropriate due diligence on their counterparty VASPs. However, counterparty VASP identification should be distinguished from the core originator and beneficiary data fields required under the Travel Rule.

Countries may adopt a de minimis threshold of USD/EUR 1,000 for VA transfers. Where such a threshold applies, FATF guidance provides for fewer requirements below the threshold, including collection of the originator and beneficiary names and their wallet addresses or a unique transaction reference number. The precise requirements therefore depend on the applicable jurisdiction.

The Relationship Between KYC and the Travel Rule

These two obligations are not separate workstreams. Without reliable customer identification, the information exchanged under the Travel Rule loses its value. Effective KYC provides the verified names, account numbers, and addresses needed for Travel Rule reporting, guaranteeing that shared data is accurate.

Travel Rule Thresholds by Jurisdiction

Thresholds vary significantly. The table below summarizes the key jurisdictions based on verified sources.

EU-Specific Requirements: MiCA and the TFR

For platforms serving EU customers, two instruments apply simultaneously.

The EU regulates crypto-assets through two complementary instruments: MiCA, which harmonizes licensing, conduct, and market rules for CASPs, and the Transfer of Funds Regulation (TFR), which implements FATF Recommendation 16 for transfers of funds and certain crypto-assets.

In July 2024, the EBA issued final Travel Rule Guidelines to clarify how required originator and beneficiary information must accompany crypto-asset transfers; these guidelines apply from December 30, 2024.

MiCA's authorization requirement also has extraterritorial reach. A key aspect of MiCA is its extraterritorial reach. Any VASP wanting to serve EU customers, even if based outside the EU, will need to meet MiCA's requirements. This includes robust KYC and AML processes.

For pre-existing providers, a transitional window applies. Member States have the option of implementing transitional measures that would allow entities already providing crypto-asset services under applicable law in their jurisdictions to continue doing so during the transitional phase of MiCA. These transitional measures include a grandfathering clause allowing entities providing crypto-asset services in accordance with national applicable laws before 30 December 2024 to continue to do so until 1 July 2026 or until they are granted or refused a MiCA authorisation.

After July 1, 2026, providing crypto-asset services to EU clients without MiCA authorisation is a breach of EU law. Operators face cease-and-desist orders, asset freezes, and licence-revocation cascades across other jurisdictions.

Unhosted Wallets: A Specific Compliance Challenge

Transfers to and from self-hosted (unhosted) wallets require special handling because there is no counterparty VASP/CASP on the self-hosted side to receive Travel Rule information.

Under FATF standards and applicable national or regional requirements, VASPs/CASPs may still be required to collect relevant information and apply risk-based controls when processing transfers involving self-hosted addresses.

The EU’s Transfer of Funds Regulation (TFR) is explicit on this point. For transfers above €1,000 involving a self-hosted address, the relevant CASP must take adequate measures to assess whether the self-hosted address is owned or controlled by its customer. This applies both to transfers to a self-hosted address, where the originator’s CASP performs the assessment, and transfers from a self-hosted address, where the beneficiary’s CASP performs it.

The Sunrise Issue: Cross-Border Compliance Gaps

A persistent challenge is uneven global adoption. When a VASP in a compliant jurisdiction transacts with a counterparty in a jurisdiction without Travel Rule requirements, full compliance becomes difficult.

This is commonly called the "sunrise issue": a VASP in a regulated jurisdiction must comply with the Travel Rule, but its counterparty in a less-regulated jurisdiction may have no equivalent obligation and no technical infrastructure to receive or transmit the required data.

Failed transmissions, missing data fields, or insecure channels can risk regulatory exposure and delay transaction processing. VASPs operating cross-border should document their compliance efforts even when counterparty limitations prevent full data exchange, and apply risk-based policies to handle incomplete information.

Common Compliance Gaps in Crypto KYC Programs

Based on the regulatory framework above, the following gaps are frequently observed in VASP compliance programs:

1. Incomplete CDD at onboarding. Collecting a name and email address is not sufficient. Full CDD requires government-issued document verification, liveness detection to confirm the person presenting the document is physically present, and address verification where required by local law.

2. No enhanced due diligence for high-risk customers. PEPs, customers from FATF grey-listed or black-listed jurisdictions, and customers with unusual transaction patterns require enhanced scrutiny, including source of funds and source of wealth documentation.

3. Travel Rule data not collected at transaction initiation. Meeting Travel Rule requirements requires both operational processes and technical infrastructure. VASPs need systems to collect required information at the point of transaction initiation, validate completeness before processing, and transmit data securely to counterparty VASPs.

4. Unhosted wallet transfers processed without ownership verification. Many platforms apply Travel Rule logic only to VASP-to-VASP transfers and overlook the separate obligations that apply when customers send to or receive from self-hosted wallets.

5. Counterparty VASP due diligence missing. VASPs are required to assess ML and TF risks posed by counterparty VASPs. This requires VASPs to conduct due diligence and risk assessments in relation to counterparty VASPs.

6. Record retention not meeting the 5-year minimum. Transaction records, CDD documentation, and Travel Rule data must be retained for a minimum of five years and be retrievable without undue delay.

7. No process for handling missing or incomplete Travel Rule data. If required information is incomplete, the beneficiary VASP must either reject the transfer or request the missing details. Beneficiary VASPs must implement risk-based policies to handle transfers with incomplete information.

How Identomat Supports VASP Compliance

Building a compliant verification workflow is one of the most operationally demanding parts of launching or scaling a crypto platform. The verification steps described above, including document verification, liveness detection, sanctions and PEP screening, and ongoing monitoring, need to work together without creating friction that drives users away before they complete onboarding.

Identomat provides identity verification, document verification, liveness detection, KYB, KYT, and AML screening designed for regulated industries, including crypto exchanges and wallet providers. Identomat’s platform is built to handle the layered requirements VASPs face: verifying identities during onboarding, screening against sanctions and PEP lists, and supporting the CDD documentation that Travel Rule compliance relies on.

For compliance teams building or auditing their onboarding workflows, Identomat's toolset can help close the gaps between regulatory obligation and operational reality, without sacrificing the user experience that drives conversion.

Conclusion

Crypto KYC requirements are no longer a future concern. The FATF framework, the EU's MiCA and TFR, the US Bank Secrecy Act, and equivalent regimes in Singapore, the UK, and dozens of other jurisdictions have created a compliance environment where operating without a structured verification program carries real legal and operational risk.

The core obligations are consistent across jurisdictions: register or obtain a licence, verify your customers, monitor transactions, screen for sanctions and PEPs, apply the Travel Rule to qualifying transfers, and retain records for at least five years. The details, particularly thresholds, unhosted wallet rules, and data field requirements, vary by jurisdiction and require careful mapping against every market you serve.

The compliance checklist above is a starting point. If you’re ready to supercharge your crypto business with user-friendly KYC solutions, book a meeting with Identomat.