KYC (Know Your Customer) is the set of checks a regulated financial business must run before and during a customer relationship. The business collects your identifying details and verifies them against documents or independent data. It also screens you against government lists and keeps monitoring your account for suspicious activity. The duty comes from anti-money laundering (AML) and counter-terrorist financing law. Crypto businesses that exchange, transfer or hold assets for customers are covered in most major jurisdictions. Wherever the law covers them, KYC is a legal duty and not optional.
What KYC actually involves
KYC usually has three layers.
1. Customer identification and verification
The business records who you are and then checks it. Under the US Customer Identification Program rule for banks (31 CFR 1020.220), the minimum before opening an account is:
- name
- date of birth (for an individual)
- a residential or business street address
- an identification number (a taxpayer identification number for US persons)
Verification can be documentary, for example "unexpired government-issued identification evidencing nationality or residence". It can also be non-documentary, such as contacting the customer or independently checking the details against other sources. The same rule requires the bank to check whether the customer appears on any federal government list of known or suspected terrorists or terrorist organisations.
2. Customer due diligence (CDD)
Identity is only the start. FinCEN's Customer Due Diligence rule names four core elements. Covered institutions need written procedures reasonably designed to:
- identify and verify the identity of customers
- identify and verify the beneficial owners of companies opening accounts
- understand the nature and purpose of customer relationships so they can build customer risk profiles
- conduct ongoing monitoring to identify and report suspicious transactions
For companies, the rule covers any individual who owns 25 percent or more of the legal entity. It also covers one individual who controls the entity. The EU's new AML Regulation uses the same 25% ownership test for beneficial owners.
3. Enhanced due diligence
Higher-risk customers get closer scrutiny. The EU's 2024 AML package, adopted by the European Parliament on 24 April 2024, includes enhanced due diligence measures. It also adds extra vigilance for individuals with total wealth of at least EUR 50 million, excluding their main residence.
Why KYC exists
KYC is the customer-facing part of AML and counter-terrorist financing rules. The global standard-setter is the Financial Action Task Force (FATF). Its Recommendations are turned into law country by country. The aim is to make it hard to move criminal proceeds through regulated firms anonymously. Where something looks wrong, the firm has a verified identity to put in a suspicious activity report.
Will this crypto transfer trigger an EU check?
Answer three questions about a crypto transfer in the EU to see which rule applies and what the provider may ask you for.
Is a crypto-asset service provider handling the transfer?
- Yes, a provider sends or receives it → next question
- No, it goes person to person with no provider → The EU travel rule does not cover it
Is the other side of the transfer a self-hosted address rather than another provider?
- Yes, a self-hosted address → next question
- No, it goes from one provider to another → Sender and beneficiary details travel with it
Is the transfer above EUR 1,000?
- Yes, above EUR 1,000 → Expect to prove you control the address
- No, EUR 1,000 or less → Sender and beneficiary details still travel with it
Regulation (EU) 2023/1113 does not cover person-to-person transfers made without a provider.
Since 30 December 2024, information on the sender and the beneficiary must accompany crypto-asset transfers handled by providers, for every transfer regardless of value, according to Osborne Clarke's analysis.
For transfers to or from a self-hosted address above EUR 1,000, the provider must assess whether its own customer owns or controls that address, for example through a test transfer of a predefined amount or a message signed with the address's key. The sender and beneficiary details also travel with the transfer.
The extra ownership check applies above EUR 1,000, but the EU travel rule still requires sender and beneficiary information for every transfer handled by a provider, regardless of value.
This covers EU travel rule and self-hosted wallet checks only. It leaves out US and other national rules, sign-up checks and ongoing monitoring, and each provider's own risk-based requests. It is not legal advice.
KYC in crypto
The FATF standard
Since 2019, FATF has applied its standards to virtual asset service providers (VASPs) through Recommendation 15 and its Interpretive Note. Two points matter most for users:
- Lower threshold for one-off transactions. VASPs must carry out CDD on occasional transactions above USD/EUR 1,000. Ordinary financial institutions use USD/EUR 15,000. FATF guidance says this is a threshold, not an exemption for smaller amounts.
- The travel rule. Recommendation 16, the wire-transfer rule, applies to virtual asset transfers in a modified form. Originator and beneficiary information has to travel with the transfer between providers. Countries may set a de minimis threshold of USD/EUR 1,000. Even below it, FATF says the provider should still collect the originator's and beneficiary's names and a wallet address or unique transaction reference.
Countries have been slow to implement this. In a June 2025 paper on travel rule supervision, FATF said implementation of Recommendation 15 had lagged since 2019 and that many jurisdictions had still not acted.
United States
FinCEN guidance FIN-2019-G001 (9 May 2019) says that exchangers and administrators of convertible virtual currency are generally money transmitters under the Bank Secrecy Act. Persons accepting and transmitting such currency must register with FinCEN as money services businesses. They must also meet AML programme, recordkeeping, monitoring and reporting requirements, including suspicious activity reports and currency transaction reports. This applies equally to foreign-located providers doing business in whole or in substantial part within the United States.
European Union
The EU rules run on three timelines:
- Travel rule, in force since 30 December 2024. Regulation (EU) 2023/1113 requires information on the sender and the beneficiary to accompany crypto-asset transfers handled by crypto-asset service providers. The European Banking Authority's travel rule guidelines (EBA/GL/2024/11) took effect the same day. FATF allows a USD/EUR 1,000 threshold, but the EU rule applies to every crypto-asset transfer regardless of value, according to an analysis by law firm Osborne Clarke. It does not cover person-to-person transfers made without a provider.
- Self-hosted wallets. For transfers to or from a self-hosted address above EUR 1,000, the provider must assess whether that address is owned or controlled by its own customer. The EBA guidelines list methods such as a test transfer of a predefined amount, or the customer signing a message with the address's key. The guidelines treat these transfers as inherently higher risk than transfers between two providers.
- MiCA transition ended 1 July 2026. Firms operating under national law before 30 December 2024 could continue under transitional arrangements until 1 July 2026 at the latest. In a June 2026 statement, ESMA, the EU securities markets regulator, said unauthorised providers must stop onboarding new EU clients after that date. They may only let clients sell, transfer or close positions.
Next: the AML Regulation from 10 July 2027. Regulation (EU) 2024/1624 entered into force in July 2024 and applies from 10 July 2027. It replaces national variations with one directly applicable rulebook. The general CDD threshold for occasional transactions is EUR 10,000. Crypto-asset service providers must apply CDD to occasional transactions of at least EUR 1,000. The package also sets an EU-wide limit of EUR 10,000 on cash payments, except between private individuals in a non-professional context.
What to expect when you are asked to verify
- Typical requests: full legal name, date of birth, residential address, a national ID or tax number, and an image of a government-issued ID. Some providers also ask for a live selfie or proof of address. The exact list is set by the provider's own risk assessment, so it differs between firms.
- Further questions later: ongoing monitoring is part of CDD. A provider may ask about the source of funds or the purpose of a large or unusual transfer long after you signed up.
- Withdrawals to your own wallet: in the EU, a transfer above EUR 1,000 to a self-hosted address can trigger a request to prove that you control it.
- Companies: expect to name everyone who owns 25% or more, plus a person who controls the entity.
- Protect your documents: upload ID only through the provider's official site or app. A KYC request that arrives through unsolicited messages or links should be treated as possible phishing.
Limitations: this is a general overview of US federal, EU and FATF rules as of October 2026; national laws and individual providers' requirements vary, and it is not legal advice.
