Crypto KYC Requirements: What Exchanges and Wallets Need to Know

Key Takeaways

• Crypto KYC requirements now apply to centralized exchanges, custodial wallets, and increasingly to DeFi protocols with identifiable governance entities across most major jurisdictions.
• The FATF Travel Rule requires VASPs to collect and transmit verified originator and beneficiary data on every qualifying transfer above USD/EUR 1,000, and the EU Transfer of Funds Regulation extends this to zero threshold for all crypto-asset transfers regardless of value.
• The minimum KYC requirements include government-issued identity document verification, biometric liveness checks, sanctions and PEP screening, and ongoing transaction monitoring.
• In the first half of 2025, regulators issued 139 fines totalling $1.23 billion for AML, KYC, and sanctions violations, a 417% increase in value compared to the same period in 2024.
• Blockchain KYC and crypto AML compliance are not separate programs. They run in parallel, and a gap in either creates liability across both.

Total crypto market cap reached $2.4 trillion in Q1 2026.  Crypto hackers stole $3.4 billion in 2025, a 55% rise from the year before. It’s a fair assumption that as fraud organizes and industrializes these numbers are going to grow exponentially. With so much money at stake, KYC in the crypto sector is critical for both security and compliance. At the same time, according to industry analysis, KYC demands are driving away 70% of potential crypto users before they even make a deposit. 

The rules around crypto KYC requirements have changed dramatically. What was once a patchwork of voluntary best practices and loosely enforced regional guidelines is now a global compliance framework with real teeth. Exchanges that got KYC wrong paid billions. Regulators that once watched from the sidelines are now issuing enforcement actions, revoking licenses, and opening criminal cases.

If you operate a crypto exchange, custodial wallet, or any platform that qualifies as a Virtual Asset Service Provider (VASP), this guide is for you. It covers what the current requirements are, how they differ by platform type, where global regulation is heading in 2026, and what the cost of non-compliance looks like in practice.

Why Crypto Platforms Face Stricter KYC Scrutiny Than Most Industries

Cryptocurrency presents a specific combination of risk factors that traditional financial services do not. Transactions settle in minutes across borders, often without the correspondent banking relationships that traditionally enabled compliance checks. Wallet addresses offer pseudonymity by default. And the market has grown fast enough to attract significant illicit activity: the FATF’s June 2025 update noted approximately $51 billion in illicit on-chain activity related to fraud and scams in 2024 alone, alongside the largest single virtual asset theft in history, the $1.46 billion ByBit hack attributed to North Korea.

That combination of speed, pseudonymity, and scale is exactly why regulators have moved aggressively to bring crypto-asset service providers under the same KYC framework as traditional financial institutions. The FATF, which sets the global floor for AML and counter-terrorist financing standards, made its position clear: if you are moving value on behalf of another person, you must know who is behind the transaction.

The result is a compliance environment where KYC cryptocurrency obligations are no longer a checkbox at onboarding. They are an ongoing operational requirement that covers identity verification, transaction monitoring, sanctions screening, and cross-border data sharing. Platforms that built their user base on minimal friction at signup are now being asked to retrofit controls that many were never designed to support.

What KYC Requirements Apply to Crypto Exchanges vs. Wallets

Crypto KYC obligations aren’t uniform across platform types. The key distinction is whether your platform takes custody of user assets.

Centralized exchanges (CEXs) are the most clearly regulated entity type. They hold user funds, execute trades, and facilitate fiat on-ramps and off-ramps. Under FATF guidance and the implementing legislation of most major jurisdictions, centralized exchanges are unambiguously VASPs and must implement full KYC and AML compliance programs. This includes identity verification at onboarding, ongoing due diligence, transaction monitoring, and Travel Rule compliance for qualifying transfers.

Custodial wallet providers hold private keys on behalf of users, which makes them VASPs under FATF’s definition. The same full KYC obligations apply. If you control the keys, you control the compliance obligation.

Decentralized exchanges (DEXs) and non-custodial wallets sit in more complex territory. Non-custodial wallets, where users hold their own private keys, are generally not subject to KYC requirements because no intermediary holds funds on the user’s behalf. However, the regulatory perimeter is actively expanding. In 2026, regulators have begun imposing AML and KYC obligations on DeFi protocols that have identifiable governance entities, effectively treating them equivalently to traditional financial institutions. If your DEX has a legal entity, a governance token with voting rights, or a development team that can implement changes, regulators may classify you as a VASP regardless of your technical architecture.

The practical guidance: if there is an entity that can be held accountable, regulators will hold it accountable.

The Full Breakdown of Crypto KYC Requirements

The minimum requirements for blockchain KYC compliance across most major jurisdictions include the following:

Identity document verification

• Government-issued photo identification: passport, national ID card, or driving license
• Proof of residential address: utility bill, bank statement, or government correspondence dated within three to six months
• For higher-risk users or higher transaction limits: source of funds statements, employment verification, or tax identification numbers

Biometric verification and liveness detection

• A selfie or live photo matched against the submitted identity document
• Active liveness detection to prevent injection attacks and deepfake spoofing
• FATF’s June 2025 update to Recommendation 16 strengthened the requirement for originator identity assurance in virtual asset transfers, making biometric verification a practical necessity rather than a compliance option

Sanctions and PEP screening

• Every user must be screened against global sanctions lists and Politically Exposed Persons registers at onboarding
• Screening must continue on an ongoing basis throughout the customer lifecycle, not only at registration

Transaction monitoring

• Ongoing monitoring of transactions for patterns consistent with money laundering, terrorist financing, or sanctions evasion
• Suspicious activity must be reported to the relevant financial intelligence unit

Travel Rule compliance

• For transfers above USD/EUR 1,000, originating VASPs must transmit the originator’s verified name, account or wallet identifier, and physical address or an alternative identifier such as national ID or date of birth
• The receiving VASP must verify this data and apply risk-based controls when information is incomplete
• The EU Transfer of Funds Regulation, which became fully enforceable in December 2024, removes the threshold entirely: CASPs must collect, verify, transmit, and retain originator and beneficiary information for every crypto-asset transfer, regardless of value

Tiered verification

• Most compliant platforms implement tiered KYC that scales verification requirements with transaction volume and risk level
• Lower-tier accounts may access limited functionality with basic identity verification; higher limits require enhanced due diligence

How Global Regulations Are Tightening KYC Rules for Crypto in 2026

Three regulatory frameworks now determine whether most exchanges can legally operate in their target markets.

MiCA (Markets in Crypto-Assets Regulation) is the EU’s comprehensive framework for crypto-asset service providers. CASPs operating in EU member states must obtain national authorization, with grandfathering periods that expired between mid-2025 and July 2026 depending on the member state. MiCA itself governs market conduct and prudential requirements; the KYC and AML obligations flow from the EU’s AMLD framework and the Transfer of Funds Regulation, which operate alongside it. Failure to meet MiCA authorization requirements can result in license revocation across all 27 member states simultaneously.

The US Bank Secrecy Act and FinCEN bring crypto exchanges under the same AML obligations as traditional money services businesses. Starting in 2026, all US cryptocurrency exchanges are required to issue Form 1099-DA to report capital gains and losses to the IRS, making KYC collection a tax reporting requirement on top of an AML one. FinCEN can impose civil penalties up to $1 million per day for willful Bank Secrecy Act violations.

The UK FCA registration regime requires crypto-asset businesses operating in the UK to register with the Financial Conduct Authority and demonstrate robust AML and KYC frameworks as part of the registration process.

The FATF Travel Rule, formally Recommendation 16 as extended to virtual assets, operates beneath all three frameworks as the global standard. As of 2026, over 50 jurisdictions have enacted Travel Rule legislation, and FATF has signaled that monitoring and public pressure on non-implementing jurisdictions will remain a priority.

The direction of travel is consistent across every major market: broader scope, lower thresholds, and more active enforcement.

What Happens When Crypto Platforms Get KYC Wrong

The enforcement record from 2023 to 2025 makes the cost of non-compliance concrete.

Binance agreed to a $4.3 billion resolution with US authorities in November 2023 after pleading guilty to AML and sanctions violations, including absent KYC controls that allowed prohibited activity to continue for years. It remains the largest corporate criminal penalty in crypto history. OKX paid more than $504 million to the US Department of Justice in February 2025 after pleading guilty to unlicensed money transmission and failing to maintain an effective AML program. BitMEX was fined $100 million in January 2025 and placed on two years of probation for enabling customers to trade with only an email address, in violation of AML and KYC laws. The Central Bank of Ireland issued its first-ever crypto enforcement action in November 2025, fining Coinbase Europe Limited 21.5 million euros for AML and CFT monitoring failures between 2021 and 2025.

Across all these cases, the pattern is the same: inadequate KYC at onboarding, weak transaction monitoring, and sanctions screening gaps that allowed prohibited activity to continue for years.

The financial penalties are only part of the cost. Platforms that face enforcement actions also deal with operational disruption, mandatory compliance overhauls, reputational damage, and in some cases criminal prosecution of individual executives. Dubai’s VARA issued 55 regulatory sanctions in 2024, including 14 license revocations, its strictest enforcement year on record.

The math is straightforward. In the first half of 2025, regulators issued 139 fines totaling $1.23 billion for AML, KYC, and sanctions violations. The cost of building a compliant KYC program is a fraction of what non-compliance costs when enforcement arrives.

For more on how AU10TIX supports crypto platforms with identity verification and fraud prevention, visit our crypto hub or explore our guide to the best KYC providers for crypto.

FAQ