KYC and AML in Crypto: What Businesses Need to Know

Crypto moves fast and settles globally, which is exactly why regulators treat it as a money laundering risk. If your business touches crypto, the question is which anti-money laundering rules apply to you, and how far you have to go to know who your customers are.

The answer depends on what you do. An exchange that swaps dollars for bitcoin carries heavy duties. A coffee shop that accepts bitcoin through a payment processor carries almost none. This guide explains where the line falls in the US, what “KYC” and “AML” mean in practice and how to build a program that holds up.

This is not legal advice. Crypto rules are changing quickly, so confirm your obligations with a qualified attorney.

KYC vs AML: what the terms mean

AML (anti-money laundering) is the full set of controls a business uses to stop criminals from moving illicit money through it. In the US, the main law is the Bank Secrecy Act (BSA), enforced by the Treasury Department’s Financial Crimes Enforcement Network (FinCEN).

KYC (know your customer) is one part of AML: collecting and verifying identity information and understanding what normal activity looks like for each customer.

Sanctions compliance sits alongside AML. The Treasury’s Office of Foreign Assets Control (OFAC) prohibits dealings with sanctioned people, entities, countries and specific crypto addresses.

Who has to comply in the US

FinCEN’s 2019 guidance on convertible virtual currency (FIN-2019-G001) sets the basic map. It builds on 2013 guidance that defines 3 roles:

• Exchangers, which exchange crypto for dollars, other currency or other crypto as a business. These are generally money transmitters.
• Administrators, which issue a virtual currency and can redeem it. Also generally money transmitters.
• Users, defined as a person that obtains virtual currency “to purchase goods or services” on their own behalf. Users are not money transmitters.

In practice, these businesses are usually money services businesses (MSBs) with full BSA duties:

• Centralized exchanges and crypto brokers
• Hosted (custodial) wallet providers that control customers’ funds
• Crypto ATM operators
• Peer-to-peer exchangers who trade crypto as a business
• Payment processors that receive crypto from buyers and transmit value to merchants, in most cases. FinCEN’s guidance explains that crypto processors typically can’t use the standard payment processor exemption because crypto doesn’t settle through systems limited to BSA-regulated institutions

Businesses that are usually outside MSB status include merchants accepting crypto for their own products, providers of unhosted (self-custody) wallet software and developers of decentralized apps that don’t transmit customer funds. Facts matter, though. A business that starts holding or forwarding customers’ crypto can become a money transmitter.

Key takeaway: Your duties depend on your activity, not your label. If you hold, exchange or forward crypto on behalf of others, assume you are a money services business and need a full AML program. If you only accept crypto for what you sell, your main obligations are sanctions, tax and choosing a compliant processor.

What a crypto AML program must include

FinCEN’s guidance says MSBs must maintain an effective written AML program, which at a minimum includes:

1. Policies, procedures and internal controls covering customer identity verification, reporting, recordkeeping and responses to law enforcement requests
2. A designated compliance officer responsible for day-to-day compliance
3. Training for relevant staff, including spotting suspicious transactions
4. Independent review to test that the program works

On top of the program, MSBs carry specific duties:

• FinCEN registration within 180 days of starting to operate as an MSB, under 31 CFR 1022.380
• Suspicious activity reports (SARs) for suspicious transactions involving at least $2,000, filed no later than 30 calendar days after initial detection, under 31 CFR 1022.320
• Currency transaction reports (CTRs) for cash transactions over $10,000
• Recordkeeping, including identity and transfer records
• The Travel Rule, covered below

FinCEN also expects a risk assessment. Its guidance says an MSB should know enough about its customers to determine the risk level they represent.

How KYC works in practice

For a crypto platform, KYC usually runs in tiers.

At onboarding, collect name, date of birth, address and a government ID number, then verify them using document checks, database checks or both. For business accounts, identify who owns and controls the company. Screen every customer against OFAC’s sanctions lists.

Risk scoring sorts customers into low, medium or high risk based on factors such as location, expected volume, source of funds and product use.

Enhanced due diligence applies to high-risk customers: more documentation on source of funds, closer monitoring and senior sign-off.

Ongoing monitoring watches for red flags, such as rapid movement through many wallets, transfers to mixers or darknet markets, structuring just under reporting thresholds or activity that doesn’t match the customer’s profile. Many firms use blockchain analytics tools that score wallet addresses by their exposure to risky activity.

Scam victims are a growing concern too. Platforms see customers being coached by criminals in pig butchering scams and crypto ATM scams, and good monitoring can catch these before the money leaves.

The Travel Rule and sanctions screening

The Travel Rule. Under 31 CFR 1010.410(f), a transmittal of funds of $3,000 or more requires the sending institution to pass certain information about the sender and recipient to the next institution. FinCEN’s 2019 guidance states that crypto transfers qualify as transmittals of funds, so the rule applies to them, and the information must be sent before or at the time of the transfer. Internationally, the Financial Action Task Force extended the same idea to virtual asset service providers in 2019, which is why many exchanges worldwide now exchange customer data with each other.

Sanctions. OFAC published sanctions compliance guidance for the virtual currency industry on October 15, 2021. It expects crypto businesses to build risk-based programs that screen customers and transactions, use geolocation tools such as IP address checks to block sanctioned regions, and screen wallet addresses that OFAC has added to its sanctions list. Sanctions rules apply to every US person, including merchants, not just MSBs.

State licenses, stablecoin rules and enforcement

Federal registration is only part of the picture. Most states require a money transmitter license to exchange or transmit crypto for customers, each with its own bonding, capital and examination requirements. New York goes further with its BitLicense, a virtual currency license under 23 NYCRR Part 200 that the New York Department of Financial Services adopted in 2015.

Stablecoin issuers face a newer regime. The GENIUS Act, signed July 18, 2025, treats permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act and requires AML and sanctions compliance programs. FinCEN and OFAC proposed implementing rules in 2026, so check the Federal Register for their current status. Our GENIUS Act guide and overview of who regulates crypto in the US cover the wider framework.

The cost of getting it wrong

Enforcement can be severe. In November 2023, Binance and its founder pleaded guilty to US charges, including Bank Secrecy Act violations, as part of a resolution of about $4.3 billion with the Justice Department, FinCEN, OFAC and the CFTC. Smaller firms face the same rules at a smaller scale: civil penalties, loss of banking relationships and denial of state licenses.

Regulators also hold individuals accountable. FinCEN guidance repeatedly stresses a “culture of compliance,” meaning management can’t treat AML as a box-ticking exercise.

What merchants accepting crypto need to do

If you only accept crypto as payment for your own goods or services, you are a “user” under FinCEN’s guidance, not a money transmitter. You still have practical obligations:

• Use a compliant processor. Most merchants accept crypto through a payment processor that handles customer verification and converts crypto to dollars. Ask how it complies with BSA and state licensing rules. Our guide to accepting crypto payments covers the setup.
• Follow sanctions rules. Don’t sell to sanctioned persons or regions. Processors usually screen, but responsibility doesn’t disappear.
• Handle taxes. The IRS treats crypto as property, so payments received are income at fair market value. See how crypto is taxed in the US.
• Watch Form 8300. Congress added digital assets to the $10,000 cash reporting rule in 2021, but IRS Announcement 2024-4 says businesses don’t need to count digital assets until Treasury issues regulations. Check IRS.gov for the current status.
• Secure your wallets. If you hold crypto, decide between hot and cold wallets and limit who can move funds.

Where to start: a 6-step compliance check

1. Map your activity. Write down exactly how crypto moves through your business. Do you ever hold, exchange or forward value for others?
2. Get a legal opinion on whether you’re an MSB federally and a money transmitter in each state where you have customers.
3. If you’re an MSB, register with FinCEN and start state licensing work, which takes much longer.
4. Write your AML program: risk assessment, KYC tiers, monitoring rules, SAR process, Travel Rule process, recordkeeping, training and independent review.
5. Choose tools for identity verification, sanctions screening and blockchain analytics, and document why each one fits your risk.
6. Test and review at least once a year, and whenever you add a new product, coin or country.

Conclusion

KYC and AML duties in crypto follow what you do, not the technology you use. Exchanges, custodial wallets, brokers and most processors carry full Bank Secrecy Act obligations, from FinCEN registration and customer verification to SARs and the Travel Rule. Merchants that only accept crypto carry far lighter duties but still need to respect sanctions and tax rules. Map your activity first, get professional advice and build a program sized to your real risk. Unfamiliar terms? See our glossary.

Sources

• FinCEN: Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001) — money transmitter status, user definition, AML program elements, Travel Rule application to crypto
• 31 CFR § 1022.320 (Cornell LII) — MSB suspicious activity report threshold of $2,000 and 30-day filing deadline
• Federal Register: Permitted Payment Stablecoin Issuer AML/CFT and Sanctions Compliance Program Requirements (April 10, 2026) — proposed GENIUS Act AML and sanctions rules for stablecoin issuers
• IRS Announcement 2024-4 — digital assets not yet counted toward Form 8300 cash reporting
• New York DFS: Virtual Currency Businesses — BitLicense requirements under 23 NYCRR Part 200