Crypto Payment KYC: What Developers and Businesses Must Verify

KYC for crypto payments means identifying and verifying your customer before, or while, you move value for them. Whether you have to do it depends less on the technology than on what your business does: holding customer funds, exchanging crypto for fiat, or only providing software. This guide explains where the obligation starts, which checks are standard, how rules differ by jurisdiction, and what to decide before you wire a payment flow into your app.

TL;DR

• KYC is one layer of crypto payments compliance, next to risk assessment, sanctions screening, transaction monitoring, recordkeeping and, where it applies, Travel Rule data.
• Custodial services, exchanges and fiat on-ramps are the usual points where identity checks happen. Neutral software providers may fall outside the perimeter, depending on their activities and jurisdiction.
• Standard checks cover name, date of birth, address and a government ID, with a selfie and extra information for higher-risk customers.
• The right intensity of checks is risk-based, not one identical check for every payment.
• Settle your regulatory status with counsel first, then build verification and monitoring into the payment flow itself.

Table of Contents

• What KYC means in a crypto payment flow
• Who actually has to verify customers
• The checks that are commonly required
• Risk-based, not one-size-fits-all
• The Travel Rule and self-hosted wallets
• Rules change by jurisdiction
• What to check before you integrate a payment flow
• Our perspective
• Build the technical side with Chaingateway
• FAQ
• Sources

What KYC means in a crypto payment flow

KYC stands for “know your customer.” In practice it covers identifying and verifying the customer, understanding the purpose and intended nature of the relationship or transaction, and taking reasonable steps to verify beneficial owners. That is how the UK’s JMLSG guidance for cryptoasset exchange providers and custodian wallet providers frames it.

KYC is not the whole of compliance. Around it sit AML and counter-terrorist-financing risk assessment, sanctions and other screening, transaction monitoring, suspicious-activity reporting, recordkeeping and, where applicable, travel-rule information. When people search for “crypto payments compliance,” they usually mean this full stack, and KYC is the front door of it.

The global baseline comes from the Financial Action Task Force. Its updated guidance on virtual assets and virtual asset service providers says VASPs must apply AML/CFT preventive measures, including customer due diligence, recordkeeping, suspicious-transaction reporting and the travel rule. National laws then implement that baseline, each in its own way.

Who actually has to verify customers

The first question is not “which KYC vendor should we pick?” It is “are we the kind of business that has to verify anyone?”

Custodial services and exchanges

If you hold customer funds, exchange crypto for other assets or fiat, or safeguard and administer cryptoassets, you are likely in scope. The JMLSG guidance says exchange providers and custodian wallet providers generally fall within customer-due-diligence requirements. Safeguarding and transferring customers’ keys can also bring a business within scope.

Neutral software providers

The same guidance notes that software developers and other providers connected to decentralized systems may fall outside the perimeter. It depends on their activities and on whether they benefit from transactions. “May” is the operative word. Your own design choices, such as whether you ever control keys or take a cut of flows, can move you across the line.

Fiat on-ramps and off-ramps

Permissionless blockchains have no single accountable intermediary. The Bank for International Settlements explains in its bulletin on anti-money laundering compliance for cryptoassets that customer verification is typically performed where crypto meets the conventional financial system, such as exchanges and off-ramps. It adds that blockchain transaction history can complement KYC and AML controls.

That is why a merchant who only receives crypto often never runs ID checks directly, while the exchange where the payer bought the coins did. It is also why the answer changes the moment you add a conversion to fiat or a custodial balance.

Flow	Who typically verifies the customer	What to confirm
Custodial wallet or balance held for users	You, as the service provider	Licensing or registration, full CDD, monitoring
Fiat on-ramp or off-ramp	The regulated exchange or processor	Who is the regulated party, and what data they require from you
Self-custody payments, software only	Often nobody at your layer	Whether your activities and benefit from transactions put you in scope
Transfers to or from self-hosted wallets	The regulated provider on the other side	Local wallet-ownership and travel-rule rules

The checks that are commonly required

For an individual, the standard set is simple. Providers collect and verify a full name, date of birth and residential address, and check a valid government-issued ID such as a passport or driver’s license. Veriff’s guide to crypto KYC adds that enhanced checks may request a selfie and additional information, and that requirements vary by exchange. Plaid’s overview of KYC for crypto describes the same data set and says suspicious customers may be asked for more.

The same Veriff guide notes that exchanges commonly restrict purchases, withdrawals or deposits until verification is complete, and that risk-based KYC can include sanctions, politically exposed person and adverse-media screening, plus ongoing monitoring.

Some markets verify differently. A provider’s help center describes how, in Indonesia, South Africa and Nigeria, non-document verification usually checks an official number automatically: the NIK, the national ID card number or the NIN. If you serve users in several countries, expect the verification method to change by region, not just the rules.

What slows verification down

The sources we reviewed do not give reliable timing figures, so we will not invent any. The practical causes are predictable from the checks themselves: a document that does not match the typed name or address, an image the system cannot read, a customer who triggers a screening hit, or a request for extra information on a higher-risk profile. Design your onboarding so a customer can resubmit without starting over, and so your support team can see why a case is pending.

Risk-based, not one-size-fits-all

FATF’s approach is risk-based. The intensity of customer due diligence and monitoring should reflect the customer, the product, the transaction and the geography. A small, repeat payment from a verified customer does not carry the same risk as a large first-time transfer from an unclear source.

Enhanced due diligence is where this shows up. Malta’s financial intelligence unit, in its implementing procedures for the crypto-assets sector, points to higher-risk scenarios that call for it, such as transactions involving high-risk jurisdictions, unusual patterns, or a source of wealth or funds that cannot be reconciled with known transaction volumes.

Typical EDD triggers you can encode as rules:

1. A customer or counterparty connected to a high-risk jurisdiction.
2. Payment amounts or frequency that depart from the customer’s established pattern.
3. Funds that do not match the declared source of wealth.
4. Missing or incomplete originator or beneficiary information on an incoming transfer.

Teams in other high-risk payment categories already run this kind of risk-based customer monitoring, with underwriting, fraud screening and ongoing review. Crypto teams can borrow the same discipline: define the trigger, route the case, record the decision.

The Travel Rule and self-hosted wallets

The Travel Rule requires identifying information about the sender and recipient to travel with a transfer. The European Union’s crypto-asset transfer rules, in force from 30 December 2024, require providers to include originator and beneficiary details. For transfers over €1,000 involving a self-hosted address, the provider must verify whether the relevant person owns or controls that address.

The European Banking Authority’s final guidelines require one verification method for self-hosted wallets by default, according to Notabene’s analysis of the guidelines. The same analysis says providers with technical limitations could use additional technical steps until July 31, 2025, though full compliance remains mandatory.

The Travel Rule is not applied evenly across the world. According to FATF 2024 figures cited in the Bermuda Monetary Authority’s Travel Rule guidance, about 30% of jurisdictions had not implemented Travel Rule legislation. The same guidance says payment service providers should maintain Travel Rule messages and obtain, verify, transmit or record payer and payee information as applicable. Missing or incomplete information can inform enhanced measures and suspicion assessments.

Rules change by jurisdiction

The rule that applies to you is the rule of the places where you operate and where your users live. A few examples from official and regulator pages show how much the details differ:

• European Union: the transfer rules above, with a €1,000 threshold for self-hosted wallet verification.
• Bermuda: Regulation 22(1) covers all fund transfers, in any currency, sent or received by a payment service provider, including digital-asset transfers. The regulator expects a current counterparty registry and retained Travel Rule messages, per the BMA guidance above.
• Switzerland and Liechtenstein: for self-hosted wallets, Switzerland requires identity verification and proof of ownership, while Liechtenstein requires enhanced due diligence, as Notabene’s overview of unhosted wallet rules reports.
• United Kingdom: the JMLSG guidance on who is inside the perimeter, discussed above.

If you serve US customers, the US framework is its own question. The general point from the research stands: KYC is a legal requirement enforced by financial supervisory authorities, and which one applies to you depends on your activity and location. Get a written view from a lawyer who handles money transmission and AML in your target markets before you launch.

What to check before you integrate a payment flow

Use this list in the planning stage, not after launch.

1. Map your activity. Do you ever hold keys or balances for users? Do you convert to fiat? Do you take a share of transactions? Each “yes” pushes you toward regulated status.
2. Name the regulated party. In every flow, write down who performs customer due diligence. If it is a partner, get their data requirements in writing.
3. List your jurisdictions. Where are you incorporated, and where do your users and counterparties sit? Check the Travel Rule status of each.
4. Decide your thresholds. Set amounts and risk triggers that escalate a payment to enhanced checks.
5. Plan data protection. Identity documents are sensitive. Limit who can read them, define retention periods with counsel, and keep verification data apart from payment data where you can.
6. Assign responsibility. Someone owns the compliance program, sanctions alerts and suspicious-activity decisions. “The engineering team” is not an owner.
7. Keep records. Store the decision, the data used and the timestamp for each check, so you can show your work.

Put the rules in code

One practitioner view in the research is that compliance works best embedded in fund flows as deterministic rules rather than as a separate manual process. We agree with the engineering idea behind it. A payment that cannot reach a “released” state until the required checks pass is easier to audit than a spreadsheet of exceptions.

Our perspective

We build the plumbing, not the legal opinion. Chaingateway is a unified API for creating wallets, sending token transfers, receiving webhook notifications and reading decoded transaction data across chains such as Ethereum, Bitcoin, Tron, Solana, Polygon, BNB Chain and Arbitrum. Compliance is a layer you add on top of that, and the best place to add it is where payments change state.

That is why we think of webhooks as a compliance tool as much as a convenience. When an incoming payment event arrives already decoded, with sender, recipient, token and amount in one payload, you can screen it against your rules before you credit anything. Your own rule engine decides whether to release, hold or escalate. Your KYC provider decides who the customer is. The blockchain API tells you what actually happened on-chain.

We would also warn against two habits. One is treating KYC as a one-time form at sign-up, when risk-based monitoring is continuous. The other is assuming that “we are only software” settles your status. The regulator looks at what you do, not at what you call yourself.

— Bitblade

Build the technical side with Chaingateway

Once your compliance model is clear, the engineering work is wallet creation, transfers and event handling. Our Blockchain API gives you one REST interface across seven chains, with automatic gas estimation and HMAC-signed requests, and no nodes to run. Webhooks and event notifications push real-time payment events to your backend, which is the natural hook for screening and monitoring logic. If you are starting from scratch, our guide on creating a crypto wallet with an API walks through the first steps.

Plans start at €49 per month for Plus, €99 for Pro, €249 for Premium and €499 for Enterprise, or €490, €990, €2,490 and €4,990 per year. Details and plan limits are on the pricing page, and you can try the API before you subscribe.

Sources

• JMLSG Guidance Part II, Sector 22: cryptoasset exchange providers and custodian wallet providers
• FATF: Updated Guidance for a Risk-Based Approach for Virtual Assets and VASPs
• BIS Bulletin: An approach to anti-money laundering compliance for cryptoassets
• Veriff: What is KYC in crypto?
• Plaid: KYC for crypto
• Doto Help Center: KYC compliance
• FIAU Malta: Implementing Procedures Part II, Crypto-Assets Sector
• EUR-Lex: Information accompanying transfers of funds and certain crypto-assets
• Notabene: The EBA’s final Travel Rule guidelines
• Bermuda Monetary Authority: Travel Rule compliance and implications
• Notabene: Travel Rule compliance with unhosted wallets
• DavinciPay: payment processing for high-risk businesses

Recommended

• RPC API Beta Release — Level Up Your Crypto Journey
• Blockchain APIs for E-Commerce: A Revolution
• Developer: Ship Recurring Crypto Payments in 90 Days, EIP & 2026
• How to Create a Crypto Wallet with an API: 2026 Guide