KYC for crypto exchanges is the process by which a crypto exchange identifies its customers and understands who it is dealing with. For a licensed exchange it is not an option: in the EU it sits behind the Travel Rule that has applied since December 2024, and a new AML (anti-money laundering) Regulation will tighten it further from 2027. KYC covers identity, address, source of funds and beneficial owners, applied by risk. In the EU the Travel Rule applies to every crypto transfer, and from July 2027 anonymous accounts and privacy coins are banned on regulated platforms.
Checked on 21 October 2026. Rules and sources are current as of this date.
What has changed for exchanges
Since 30 December 2024 the EU Transfer of Funds Regulation applies the Travel Rule to all crypto transfers: originator and beneficiary data must travel with the transfer, whatever the amount. The EUR 1,000 threshold applies only to self-hosted wallets, where the exchange must verify ownership or control for larger amounts.
From July 2027 the EU AML Regulation will bar crypto-asset service providers from keeping anonymous accounts and from handling privacy-preserving assets such as Monero and Zcash. Implementing acts are still being finalised, so watch for details.
What KYC for crypto exchanges covers
Know Your Customer means identifying and verifying a client and understanding the nature of their activity. A good KYC file gives the exchange a risk profile it can act on.
Identity
Verify the person with an official document: passport, driving licence or national ID.
Address
Confirm residence, for example with a utility bill or bank statement.
Source of funds
Ask larger customers where the money comes from, especially for big deposits.
Beneficial owners
For companies, identify the individuals who ultimately own or control them.
Not every customer gets the same check. Low-risk retail users may pass a lighter check, while high-risk customers, large volumes or unusual patterns call for enhanced due diligence.
When an exchange must verify a customer
Article 19 of Regulation (EU) 2024/1624 (AMLR) lists the cases in which customer due diligence is mandatory. For a crypto-asset service provider these are opening an account, that is, establishing a business relationship, and an occasional transaction of EUR 1,000 or more, including several linked transactions. The general threshold for obliged entities is EUR 10,000, but the regulation makes a separate exception for crypto providers, and theirs is ten times lower.
If an occasional transaction is below EUR 1,000, the exchange must still at least identify the customer and verify their identity. Due diligence is also required where money laundering or terrorist financing is suspected, whatever the amount, where there are doubts about the accuracy of previously obtained data, and where there are doubts that the person dealing with the exchange is the customer or an authorised representative.
The practical takeaway is simple. Buying without KYC does not work for a licensed European exchange. The regulation applies from 10 July 2027.
What the exchange’s customer checks include
Article 20 AMLR sets nine mandatory measures. The exchange must identify the customer and verify their identity, identify beneficial owners and take reasonable steps to verify who they are so that it understands the ownership and control structure, and understand the purpose and intended nature of the relationship.
Customers and beneficial owners are also screened against targeted financial sanctions. For companies the check is wider: the exchange looks at whether sanctioned persons control the company or hold more than 50% of its rights between them. It also establishes what the customer does for a living or in business, and determines whether the customer or beneficial owner is a politically exposed person (PEP), a family member or a close associate.
Where a transaction is carried out for the benefit of other natural persons, they are identified and verified too. Where a representative acts, their authority and identity are checked. All of this is backed by ongoing monitoring of the relationship and transactions, including the source of funds where necessary.
The extent of the measures depends on an individual risk assessment. Higher risk calls for enhanced due diligence, lower risk may allow simplified measures. The exchange must be able to show its supervisor at any time that the measures taken match the risks identified.
Enhanced checks, PEPs and self-hosted addresses
Under Article 34 AMLR the exchange must examine the origin and destination of funds in transactions that are complex, unusually large, follow an unusual pattern or have no apparent economic or lawful purpose. The regulation expressly lists enhanced measures such as additional information on the customer and beneficial owners, on the source of funds and source of wealth, senior management approval to start or continue the relationship, enhanced monitoring, and requiring the first payment to come from the customer’s account at a bank with equally robust due diligence standards.
With politically exposed persons three steps are needed (Article 42). Obtain senior management approval, take adequate measures to establish the source of wealth and source of funds, and conduct enhanced ongoing monitoring.
For transfers to and from self-hosted addresses (Article 40) the exchange assesses the risk and has internal policies for it. Mitigating measures include one or more of the following: identifying and verifying the originator or beneficiary behind such an address, requesting additional information on the origin and destination of the assets, and enhanced monitoring. AMLA is to specify the criteria for verifying that an address belongs to the customer in guidelines due by 10 July 2027.
Article 79 prohibits crypto-asset service providers from keeping anonymous crypto-asset accounts and any accounts that allow the account holder to be anonymised or transactions to be further obscured, including through anonymity-enhancing coins. More on this in Privacy Coins (Monero, Zcash): Legal Status in the EU, UAE and US.
We will review your situation and propose a solution for your project.
Beneficial owners of a corporate customer
For companies, a beneficial owner by ownership interest is a person who directly or indirectly holds 25% or more of the shares, voting rights or other ownership interest (Article 52). Indirect holdings are calculated by multiplying the interests along each chain and adding the results of the different chains. So the exchange traces a corporate customer’s structure down to natural persons.
Refusing a customer and keeping records
If the exchange cannot complete due diligence, it must not carry out the transaction or establish the relationship, must terminate any existing relationship, and must consider reporting a suspicious transaction to the financial intelligence unit (Article 21).
Due diligence documents and data are kept for five years from the end of the relationship or the date of the occasional transaction (Article 77). The exchange must keep copies of documents, records of its suspicion assessments and supporting transaction records, without redaction. Instead of copies it may keep references to the information, provided the information can be provided immediately to authorities and cannot be altered.
Benefits and costs
Regulator practice
The most telling example for crypto exchanges came from the US Treasury on 21 November 2023. These are US rules, but they show how supervisors assess weak customer checks.
Binance, 21 November 2023
FinCEN assessed a civil money penalty of $3.4 billion and OFAC (US Treasury’s Office of Foreign Assets Control) a further $968 million. According to the Treasury, the company admitted that it ran an unregistered money services business and did not maintain an effective AML programme, and that it failed to perform adequate customer identification on many users. It never filed a suspicious activity report, with more than 100,000 suspicious transactions unreported, and between August 2017 and October 2022 it executed more than 1.67 million trades between US persons and users in sanctioned jurisdictions or blocked persons. An independent monitor is in place for five years, and the company must exit the US market.
Weak KYC and the lack of transaction monitoring are assessed together with sanctions risk. A formal check at onboarding does not help if, after registration, there is no control of transactions and geolocation and suspicious activity is not reported.
A crypto exchange grows quickly, allows small transactions without full verification, and some users connect through a VPN (virtual private network) from restricted countries. A sensible order of action is to introduce geolocation and IP checks, review the thresholds for transactions without full verification, carry out a look-back review of suspicious activity, report to supervisors as the applicable law requires, and document the changes to procedures.
Setting up KYC step by step
Define your risk appetite
Decide which customers and countries you accept and which checks apply to each risk level.
Start hereChoose a KYC provider
Identity verification, sanctions and wallet screening, with reliable data.
Set levels and limits
Tie withdrawal and deposit limits to the level of verification.
Add Travel Rule and wallet checks
Exchange data with other providers and verify ownership of self-hosted wallets above the threshold.
ImportantMonitor and keep records
Ongoing monitoring, suspicious activity reports and retention of KYC records for the period the law requires.
Frequently asked questions
From what amount is KYC required at an EU exchange?
In practice from the first transaction. Due diligence is mandatory when an account is opened and for an occasional transaction of EUR 1,000 or more, and below that amount the exchange must still identify the customer and verify their identity (Article 19 AMLR).
Is KYC mandatory for a crypto exchange?
In the EU, authorised crypto-asset service providers must run customer due diligence and apply the Travel Rule. Most other major jurisdictions also require it for licensed or registered exchanges.
Is there a threshold for the Travel Rule in the EU?
No. Since 30 December 2024 data must accompany all crypto transfers between providers, whatever the amount. The EUR 1,000 threshold concerns self-hosted wallets only.
What about transfers to self-hosted wallets?
Up to EUR 1,000 the exchange collects and cross-checks the parties’ information. Above that, it must verify that the wallet belongs to or is controlled by its customer, using at least two methods.
Will anonymous accounts still be allowed?
Not on regulated EU platforms from July 2027. The AML Regulation prohibits anonymous accounts and handling privacy-preserving assets by crypto-asset service providers.
See also: Legal Support for Token Sales Procedure; Legal Aspects Checklist for an NFT Marketplace; Privacy Coins (Monero, Zcash): Legal Status in the EU, UAE and US; EMI and Payment Institution Licence in the EU, UK and Canada. Services: licensing, compliance and AML/KYC.
- EUR-Lex: Regulation (EU) 2023/1113 (TFR)
- EUR-Lex: Regulation (EU) 2024/1624 (AMLR), Articles 19, 20, 21, 34, 40, 42, 52, 77, 79, 90
- EBA: Travel Rule Guidelines
- U.S. Department of the Treasury: Press release, Largest settlements in history with Binance (21 November 2023)
- FinCEN: Consent Order Number 2023-04, Binance Holdings Limited
This is what we do
How we help projects with this topic:
