KYC, short for Know Your Customer, is the set of checks a financial firm runs to confirm who its customer is before and during a business relationship. The firm collects identifying details such as your name, date of birth, address and an identity document, verifies them against reliable independent sources, and keeps watching activity on the account. The purpose is to stop money laundering and terrorist financing. The global standard is the Financial Action Task Force (FATF) Recommendations; each country turns that standard into its own law, such as the Bank Secrecy Act in the United States and the anti-money laundering rules of the European Union.
Rules differ by country. Some apply to every crypto service, some only to certain types of service, and some set thresholds. The sections below say which rule applies where.
KYC, CDD and AML: how the terms fit
- Anti-money laundering (AML) is the whole framework: risk assessment, customer checks, monitoring, record keeping and suspicious activity reporting.
- Customer due diligence (CDD) is the FATF term for the customer checks inside that framework. "KYC" is the everyday name for the same idea.
- Enhanced due diligence (EDD) means deeper checks for higher-risk customers.
- Beneficial owner is the natural person who ultimately owns or controls a customer, which matters when the customer is a company or trust.
- Travel rule is the requirement that information about the sender and recipient travels with a transfer, including transfers of crypto-assets.
What the FATF standard requires
FATF Recommendation 10 sets out the core customer due diligence measures:
- Identify the customer and verify that identity using reliable, independent source documents, data or information.
- Identify the beneficial owner and take reasonable measures to verify who that is. For companies and trusts, understand the ownership and control structure.
- Understand the purpose and intended nature of the business relationship.
- Conduct ongoing due diligence: check that transactions match what the firm knows about the customer, including, where necessary, the source of funds.
Verification normally happens before or while the relationship is set up. If a firm cannot complete these checks, the standard says it should not open the account or carry out the transaction, or should end the relationship, and should consider filing a suspicious transaction report.
How FATF applies this to crypto
FATF amended Recommendation 15 in October 2018 to cover virtual assets and virtual asset service providers (VASPs), and adopted an Interpretive Note in June 2019. Under it:
- VASPs should be licensed or registered and supervised.
- They apply the same preventive measures as other financial institutions, including customer due diligence and record keeping.
- For occasional transactions, the threshold above which CDD is required is USD/EUR 1,000.
- The travel rule (Recommendation 16) applies to virtual asset transfers: the sending VASP obtains and holds originator and beneficiary information.
FATF recommendations are not law on their own. They apply to firms only once a country writes them into national rules, and FATF's yearly reviews of virtual asset rules report that many jurisdictions have not yet done so in full.
United States: Bank Secrecy Act
In the US, KYC duties come from the Bank Secrecy Act (BSA) and its rules issued by the Financial Crimes Enforcement Network (FinCEN).
- Banks must run a Customer Identification Program (CIP), 31 CFR 1020.220. Before opening an account the bank collects, at minimum, name, date of birth (for individuals), a residential or business street address and, for US persons, a taxpayer identification number. It verifies identity with documents (for example an unexpired government-issued photo ID such as a driver's license or passport) or non-documentary methods, checks the customer against government terrorist lists, gives customers notice that it is asking for this information, and keeps the identifying records for five years after the account closes.
- Crypto businesses that accept and transmit convertible virtual currency are generally money transmitters, a type of money services business (MSB), under FinCEN guidance FIN-2019-G001 (9 May 2019). An MSB must register with FinCEN and keep a written AML program whose policies include verifying customer identification (31 CFR 1022.210).
- Travel rule: for transmittals of funds of USD 3,000 or more, the sending institution must pass specified information to the next institution (31 CFR 1010.410(f)).
Which KYC rule touches your crypto transfer?
Answer three short questions to see which identity and transfer-information rule from this article applies to a transfer through a crypto service.
Where is the crypto service you use regulated?
- European Union → next question
- United States → next question
- Another country → Check your national rules
Is the transfer going to or coming from a self-hosted address (a wallet no provider holds for you)?
- Yes, a self-hosted address → next question
- No, it goes between two providers → EU travel rule applies
Is the transfer above EUR 1,000?
- Yes, above EUR 1,000 → EU travel rule plus a self-hosted address check
- No, EUR 1,000 or less → EU travel rule applies
Is the transfer USD 3,000 or more?
- Yes, USD 3,000 or more → US travel rule applies
- No, under USD 3,000 → Below the US travel rule amount, identity checks still apply
Since 30 December 2024, Regulation (EU) 2023/1113 requires the sender's and recipient's details to accompany a transfer between providers regardless of amount. Expect the provider to have verified your identity first.
For transfers above EUR 1,000 to or from a self-hosted address, the provider must assess whether that address is owned or controlled by its own customer, so it may ask you to show the wallet is yours.
For transmittals of funds of USD 3,000 or more, the sending institution must pass specified information to the next institution (31 CFR 1010.410(f)). Your identity checks still apply as well.
A crypto business that transmits convertible virtual currency is generally a money services business: it registers with FinCEN and keeps a written AML program that includes verifying customer identification (31 CFR 1022.210).
The FATF standard sets USD/EUR 1,000 as the threshold for CDD on occasional transactions and applies the travel rule to virtual asset transfers, but it binds firms only once a country writes it into national law, and many have not done so in full.
This sorts transfers by the US, EU and FATF rules named in the article only. It is not legal advice, does not cover other countries' laws or a firm's own extra checks, and cannot tell you whether a specific firm will approve you.
European Union: AMLD, the transfer regulation and the new AMLR
- 2018: Directive (EU) 2018/843, the fifth anti-money laundering directive, brought two kinds of crypto business into the AML rules: providers exchanging virtual and fiat currencies, and custodian wallet providers.
- 30 December 2024: Regulation (EU) 2023/1113 extended the AML rules to crypto-asset service providers (CASPs) more broadly by amending Directive (EU) 2015/849, and introduced the travel rule for crypto-asset transfers. The sender's and recipient's details must accompany a transfer between providers regardless of amount. For transfers above EUR 1,000 to or from a self-hosted address, the provider must assess whether that address is owned or controlled by its own customer. In parallel, MiCA (Regulation (EU) 2023/1114) requires CASPs to be authorised.
- 10 July 2027: the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies. It sets a EUR 1,000 threshold for CDD on occasional transactions by CASPs and bans anonymous crypto-asset accounts.
What the checks look like for you
Firms design their own flows within these rules, so the exact order varies. A typical crypto onboarding runs like this:
1. Basic details
Name, date of birth, address and, depending on the country, a tax or national ID number.
2. Identity document
A valid government-issued photo ID: passport, national ID card or driving licence. Many apps ask for a live selfie or short video so the face can be matched to the document. Selfie and liveness checks are common practice, not a requirement named in the FATF text.
3. Proof of address
Where a firm asks for it, this is usually a recent utility bill, bank statement or official letter showing your name and address. Accepted documents and how recent they must be are set by each firm.
4. Source of funds or source of wealth
Higher limits, large deposits or higher-risk profiles can trigger questions about where the money comes from: payslips, tax returns, sale contracts or bank statements. FATF requires firms to establish source of wealth and source of funds for foreign politically exposed persons (Recommendation 12) and to scrutinise source of funds where necessary under ongoing due diligence (Recommendation 10).
5. Ongoing checks
KYC does not end at sign-up. Firms monitor activity and may ask you to update documents or explain a transaction later.
Privacy, timelines and rejections
- Privacy: firms must keep KYC records. In the US, banks keep CIP records for five years after an account closes; the EU transfer regulation also sets a five-year record-keeping period. Check the firm's privacy notice for who processes your data and where.
- Timelines: no FATF, US or EU rule sets a fixed approval time for customers. Automated checks can be quick; manual review or source-of-funds requests take longer.
- Rejections: if a firm cannot verify you, the rules point it towards declining the account or closing it. US banks must have written procedures for when to refuse an account, when to allow use while verification is pending, and when to close it. A rejection is not always explained in detail, because firms may also be under suspicious activity reporting duties.
Common mistakes that slow verification
- Expired or cropped documents. Upload the whole document, all four corners visible, with no glare.
- Name mismatches. The name on your account, your ID and your proof of address should match, including middle names and transliteration.
- Old proof of address. Use a recent document; firms usually set a maximum age.
- Address you no longer live at. Enter the address that appears on the document you upload.
- Screenshots or edited files. Upload the original photo or PDF.
- Using someone else's account or documents. Accounts are checked against the person using them; this can lead to closure.
- Treating a VPN location as your residence. The firm checks where you actually live, and some services are not available in every country.
- Ignoring follow-up requests. Unanswered requests for more information can lead to restrictions.
This article explains general rules and is not legal advice. Requirements differ by country and change over time; check the current rules where you live and the firm's own terms.
