Crypto KYC Requirements: Global Standards for VASPs and CASPs

Japan's crypto Travel Rule does not apply to every outbound transfer. It applies to transfers going to service providers in a specific list of jurisdictions that Japan has assessed as having equivalent rules — 58 of them, plus five more added with effect from 3 August 2026: Anguilla, Botswana, Dominica, Cuba and Oman.

(Source: Japan Financial Services Agency, "Publication of the finalized Partial Amendment to the Designation of a country or region under Articles 17-2 and 17-3 of the Order for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds," 7 July 2026 — https://www.fsa.go.jp/en/news/2026/20260707/20260707.html)

That is a small detail, and it is also the whole problem in miniature. A crypto business cannot build one global compliance workflow, apply it everywhere, and assume it satisfies the law. Even a requirement as internationally standardised as the Travel Rule is scoped differently in different places — by counterparty jurisdiction in Japan, by transfer value in the United States, by no general de minimis at all in the European Union.

Customer verification behaves the same way. In every major market, a regulated crypto business is now expected to know who its customers are before it provides services to them. That much has converged. What has not converged is the detail: which businesses are in scope, what triggers the obligation, what information must be collected, what counts as acceptable verification, and how long records must be kept.

Crypto KYC requirements are not identical worldwide. FATF provides an international AML/CFT baseline, but legally enforceable customer-verification requirements are determined by national and regional frameworks.

The baseline itself is well established and still spreading. In its Seventh Targeted Update, published on 16 July 2026, FATF reported that 91 of 109 surveyed jurisdictions — 83% — had passed legislation implementing the Travel Rule, up from 73% a year earlier, with a further 11 reporting implementation under way. The same report continued to identify gaps between legislation on the books and effective supervision and enforcement behind it.

(Source: FATF, "Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs," 16 July 2026 — https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-updated-virtualassets-vasps-2026.html)

This article covers what KYC actually means inside a crypto AML programme, what the major jurisdictions require as of late 2026, which elements recur everywhere, and where national rules actually diverge. It is a regulatory overview rather than a vendor comparison — if the question is which technology to buy rather than which obligations exist, choosing a KYC provider for a crypto business is a separate exercise.

Note: None of this is legal, tax, or investment advice. Requirements in this area change frequently and several frameworks referenced below are mid-transition. Verify current rules with the applicable regulator before acting.

What Is KYC in Crypto?

KYC is the operational process through which regulated crypto businesses identify and verify customers as part of their AML/CFT customer due diligence obligations.

The exact trigger, the information required and the acceptable verification method depend on the applicable jurisdiction and business model. That framing matters because KYC is often described as a standalone legal requirement, which it generally is not. It is a component of a wider due diligence obligation imposed by national law.

Three terms get used interchangeably and should not be:

1. KYC is identifying and verifying individual customers, establishing who the person is and confirming it with reliable evidence.
2. KYB is the equivalent process for legal entities: verifying the company's existence and registration, identifying beneficial owners, and understanding the ownership and control structure.
3. CDD is the broader framework that contains both. Alongside identity, it covers understanding the purpose and intended nature of the business relationship, assessing customer risk, and monitoring the relationship over time.

KYC and Customer Due Diligence are related but not identical. KYC focuses on identifying and verifying a customer, while CDD also includes understanding the relationship, assessing risk and monitoring it over time. A business that has verified identity documents but has never assessed what a customer's activity should look like has completed part of a CDD obligation, not all of it.

The operational mechanics of the wider process — risk profiling, EDD, review cycles — are covered in depth under customer due diligence for crypto businesses, and this article does not attempt to duplicate that.

One terminology note that recurs throughout. VASP is the terminology commonly used by FATF, while the European Union uses the term Crypto-Asset Service Provider, or CASP, under MiCA. The two overlap heavily but are not legally interchangeable in every context, and using the right one matters when reading a specific rulebook.

Global KYC Regulatory Requirements for Crypto Businesses

FATF Standards for VASPs

FATF sets international AML/CFT standards. It does not make law anywhere. Every obligation below reaches a business through a national or regional framework that implements the standard, which is why the same FATF principle produces materially different rules in different countries.

Two Recommendations matter most here, and they are frequently merged into one when they should not be.

Recommendation 15 extends the risk-based AML/CFT framework to virtual assets and virtual asset service providers. Within that framework sit customer due diligence, recordkeeping, suspicious transaction reporting, sanctions obligations and risk-based supervision. This is where crypto KYC obligations originate conceptually.

Recommendation 16 covers information accompanying transfers — the Travel Rule. It is a data-transmission requirement between institutions, not a customer-identification requirement in itself.

The connection between them is the point that gets lost. The FATF Travel Rule and KYC are separate requirements. Reliable KYC data helps VASPs provide accurate originator and beneficiary information when Travel Rule obligations apply. A business with weak customer verification will produce weak Travel Rule data, because the fields being transmitted are drawn from the customer record. But satisfying the Travel Rule does not satisfy KYC, and vice versa.

There is no single global Travel Rule threshold. FATF provides a de minimis reference point in its standards, but the figure, the scope and the treatment of transfers below it differ by jurisdiction — as Japan's counterparty-equivalence approach at the top of this article illustrates. Mapping Travel Rule implementation across jurisdictions shows how widely those choices diverge in practice.

For the underlying standard itself — how Recommendation 15 defines virtual assets and VASPs, and what the risk-based framework requires — the FATF standards for virtual assets and VASPs are worth reading in full rather than summarized here.

KYC Requirements in the EU

The EU position in late 2026 requires separating what applies now from what applies later, because both are frequently described as current.

What applies in 2026. The MiCA transitional period across the EU ended on 1 July 2026. CASPs continuing to provide relevant crypto-asset services need appropriate MiCA authorization rather than relying on a national transitional arrangement. On the AML side, customer due diligence obligations in 2026 still sit in the existing pre-AMLR framework — the directive-based regime as transposed into national law, alongside the Transfer of Funds Regulation for crypto transfer traceability.

What changes next. The EU AMLR has entered into force as legislation but generally applies from 10 July 2027. Regulation (EU) 2024/1624 will replace national transpositions with a directly applicable, harmonised set of customer due diligence requirements across the bloc. Until that date, a CASP's enforceable CDD obligations come from its national framework, not from AMLR.

Underneath the regulation, technical standards are still being written. AMLA ran a consultation on draft regulatory technical standards on customer due diligence from 9 February to 8 May 2026, and a consultation on draft guidelines covering the ongoing monitoring of business relationships from 3 June to 3 September 2026. Both had closed by late September 2026, with finalisation pending — which means they indicate supervisory direction but should not be implemented as settled requirements.

What specifically changes for EU customer verification when AMLR applies is a subject in its own right, set out in the analysis of how AMLR changes EU KYC requirements from July 2027. The separate question of whether a business may operate at all is governed by MiCA authorization requirements for CASPs, which determines permission rather than KYC procedure.

KYC Requirements in the United States

The US section is where published crypto compliance content most often goes wrong, including the earlier version of this article, so it is worth being precise. Under FinCEN's framework, many businesses dealing in convertible virtual currency can qualify as money transmitters and therefore as Money Services Businesses, depending on the activity performed. FinCEN's consolidated CVC guidance applies the existing MSB and money-transmitter framework to crypto business models rather than creating a separate crypto rulebook.

(Source: FinCEN, "Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies," FIN-2019-G001, 9 May 2019 — https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models)

Where a business is a covered MSB, its Bank Secrecy Act obligations can include FinCEN registration, a risk-based AML programme, recordkeeping, applicable transaction reporting, suspicious activity reporting, and the relevant funds-transfer and Travel Rule requirements.

Here is the correction that matters. FinCEN's formal Customer Due Diligence Rule applies to defined covered financial institutions — banks, mutual funds, broker-dealers in securities, futures commission merchants and introducing brokers in commodities. It does not apply to all MSBs as a category. Nor does the bank Customer Identification Program rule, with its four prescribed data fields, transplant automatically onto every crypto MSB as a universal checklist.

A US crypto business still has to identify its customers — a risk-based AML programme that does not know who it is dealing with cannot function, and identity data underpins recordkeeping, SAR narratives and Travel Rule fields alike. But the specific legal source of that obligation, and its exact content, is not the bank CIP rule. Describing it as such produces a compliance programme built against the wrong regulation.

KYC Requirements in the UK

In-scope UK crypto businesses currently operate under the Money Laundering Regulations, with FCA registration for AML and CTF supervision. Customer due diligence obligations — identification, verification, risk assessment, ongoing monitoring, recordkeeping — flow from that framework and continue to apply.

A broader change is in progress alongside it. The FCA's authorisation gateway for the new FSMA cryptoasset regime opened on 30 September 2026, the application window runs to 28 February 2027, and the regime itself is expected to commence on 25 October 2027. An existing MLR registration does not convert automatically into FSMA authorization.

For KYC purposes, the practical reading is simple: current customer verification requirements remain tied to the UK AML and MLR framework, while the broader authorization change runs on its own track. The full picture of that transition is set out under UK crypto regulation and FCA authorization.

KYC Requirements in Asia-Pacific

Three major markets, three different regulatory architectures, and a common core of customer identification, beneficial ownership and ongoing monitoring.

Singapore

• Main regulator and framework: MAS, under the applicable payment services AML/CFT framework.
• KYC focus: customer identification and verification, beneficial ownership, risk-based CDD, ongoing monitoring, and transfer-information requirements under the applicable notice.

Hong Kong

• Main regulator and framework: SFC, under the VATP licensing regime and the AMLO.
• KYC focus: customer due diligence, beneficial ownership, ongoing monitoring, and transaction-level controls including unhosted-wallet ownership assessment.

Japan

• Main regulator and framework: FSA, under the cryptoasset exchange service provider framework.
• KYC focus: customer verification, AML controls, ongoing monitoring, and Travel Rule obligations scoped by the FSA's designated list of equivalent jurisdictions.

The specific thresholds, the exact data fields and the transfer-information rules differ by jurisdiction and change more often than most compliance documentation is updated.

Japan's designated-jurisdiction list was amended with effect from 3 August 2026; a workflow configured against an earlier version was out of date within a month. Any hard number used in an onboarding rule should be checked against the current regulator source rather than inherited from a summary.

KYC Requirements in the UAE

The UAE is not one regulatory regime, and treating it as one is a common planning error. KYC obligations depend on the regulator and the jurisdiction in which the business actually operates. Dubai's Virtual Assets Regulatory Authority, the Abu Dhabi Global Market and the Dubai International Financial Centre each administer their own frameworks, alongside the federal AML/CFT regime.

For a business licensed by VARA in Dubai, the current rulebook applies risk-based customer due diligence and requires client and beneficial-owner verification in the relevant circumstances, with enhanced measures where risk indicators are present. Businesses in ADGM or the DIFC answer to their own regulators with their own rulebooks.

What should not be assumed across the whole country is a single retention period, a single identical KYC workflow, or a single licensing authority. The applicable framework follows the licence.

Core Elements of Crypto KYC

The elements below recur across jurisdictions. What differs is how each is specified in law.

Customer Identification and Verification

At its core, the process has three steps: collect the identity information required by the applicable rules; verify it using reliable, independent information or data as those rules require; and determine whether additional evidence is needed given the jurisdiction and the customer's risk profile.

The important correction concerns method. Document checks, biometric or liveness verification, and proof of address are all commonly used, and the earlier version of this article presented them close to a universal mandatory set. They are not. Biometric verification is a common KYC technology, but it is not a universal legal requirement for every crypto business in every jurisdiction. The same applies to proof of address, which is required in some frameworks and for some risk profiles, and not in others.

The governing principle is that required data and permitted verification methods depend on applicable regulation and risk. A business operating in four markets may legitimately run four slightly different verification flows — and a business that applies the strictest of the four everywhere should do so as a deliberate commercial choice, not in the belief that it is legally required.

Customer Risk Assessment and Enhanced Due Diligence

Identity verification produces a record. Risk assessment turns that record into a decision about how much due diligence the relationship warrants.

Enhanced due diligence triggers can include PEP exposure, connections to higher-risk jurisdictions, complex or opaque ownership structures, unusual activity, source-of-funds concerns, and other indicators defined under the applicable framework. The response is deeper information gathering: source of funds and wealth, ownership chains, business rationale, counterparty detail.

What does not follow is that any connection to a higher-risk jurisdiction automatically requires EDD everywhere. The required response varies by framework and by the category of exposure involved — a jurisdiction under increased monitoring, a call for action, and a sanctions designation are three different situations with three different obligations, as the analysis of jurisdiction risk in crypto AML works through in detail.

Ongoing KYC and Customer Information Updates

KYC does not necessarily end once identity is verified. Risk-based CDD frameworks commonly require keeping customer information current, reviewing changes in risk, monitoring activity, and reassessing customers when triggers occur.

The scope of that obligation varies. It is not accurate to say every regulator explicitly mandates real-time transaction monitoring for every business; what is required depends on the framework, the business model and the risk profile. What is broadly consistent is the expectation that a customer file should not simply be archived after onboarding.

The relationship between the two halves is worth stating plainly: KYC gives customer context; transaction monitoring tests actual activity against that context. A verified identity with no behavioural baseline tells you little about whether today's transfer makes sense, and an alert with no customer context gives a reviewer nothing to work with. The mechanics of the monitoring side are covered under continuous crypto transaction monitoring.

Sanctions and PEP Screening

Screening runs alongside identity verification rather than inside it, and it answers a different question: not who is this customer, but does this customer appear on a list that creates a legal obligation?

In practice this covers applicable sanctions screening against the lists that bind the business, PEP identification, risk-based additional measures where a match or a status is confirmed, and periodic or ongoing rescreening where appropriate — because list content changes even when the customer does not.

Adverse media screening may form part of risk-based due diligence and EDD, and many mature programmes use it. It is not universally required by every regulator, and presenting it as a baseline legal obligation overstates the position.

Why Crypto KYC Requirements Differ Across Jurisdictions

Different Jurisdictions, Different Rules

FATF creates a common international baseline. National implementation then diverges across almost every practical dimension: which businesses fall inside the legal scope, what customer information must be collected, what thresholds apply, which verification methods are acceptable, how the Travel Rule is implemented, how long records must be kept, and when simplified or enhanced measures are permitted.

In practical terms, this means a single VASP or CASP operating across borders cannot run one onboarding workflow and call it compliant. It needs a common core plus jurisdiction-specific configuration — and it needs to know which parts are which, so that a change in one market does not silently propagate into another where it does not belong.

Balancing Onboarding Friction and Verification Quality

Users want fast access. Verification takes time. Every additional step in an onboarding flow costs conversion, and compliance teams are routinely asked to justify why a given check exists.

The resolution is not to minimise verification but to allocate it. Risk-based frameworks exist precisely so that effort concentrates where risk sits rather than being spread evenly across every customer. Automating document checks and data validation, designing clear interfaces, and explaining to users what is being asked for and why all reduce friction without reducing verification quality. What does not work is skipping required steps and hoping the risk profile stays low.

False Positives and Manual Reviews

Two different systems produce two different kinds of false alarm, and conflating them leads to the wrong fix.

1. Identity and name screening false positives come from fuzzy matching against sanctions and PEP lists, a common name, a transliteration variant, an incomplete list entry. The remedy is better data: secondary identifiers such as date of birth, nationality and full address to refine matching, and list hygiene.
2. Transaction monitoring alerts come from behavioural rules applied to on-chain and account activity. A customer moving funds between their own wallets can resemble structuring; a legitimate high-volume trader can resemble layering. The remedy here is calibration against customer context and risk profile, not name-matching precision.
3. Both consume analyst time, and both extend the customer journey when they surface during onboarding. But a team tuning its name-screening algorithm will not reduce transaction alert volume, and the reverse is equally true.

Compliance Cost and Scalability

The cost of running KYC scales with things that are easy to overlook at launch: verification volume, the complexity of KYB and beneficial-ownership work for corporate clients, the proportion of cases requiring manual review, compliance headcount, integration and engineering effort, ongoing monitoring and rescreening, staff training, and periodic independent audits. For a small or mid-sized business, the manual review line tends to dominate, because it scales with customers rather than with revenue. That is the practical argument for automating the repetitive parts early — not to reduce compliance, but to keep the cost of compliance from growing linearly with the customer base.

Best Practices for Crypto KYC Compliance

Use a Risk-Based Approach

A risk-based approach calibrates the depth of due diligence to the risk a customer or relationship presents. Lower-risk cases may receive simplified measures; higher-risk cases receive enhanced ones.

One precision point here, because the earlier version of this article got it wrong: a business cannot relax statutory thresholds for customers it considers low risk. Simplified measures apply to lower-risk cases only where the applicable framework permits them, and in the form that framework specifies. The discretion is in how you allocate effort within the rules, not in whether the rules apply.

Build a Global Baseline With Local Rules

For a business operating in several markets, the workable architecture is a core framework aligned with FATF principles, with jurisdiction-specific overlays layered on top: local thresholds, local data requirements, local verification rules, separate regulatory configurations, and version-controlled policies so that changes are traceable.

The goal is not identical KYC everywhere. That is neither achievable nor desirable — it either under-complies in the strictest market or over-collects in the most permissive. The goal is a common spine that makes local variation manageable and auditable.

Automate Repetitive Verification, Not Compliance Decisions

Automation earns its place on document checks, data validation, liveness where it is used, sanctions and PEP screening, workflow routing, and periodic rescreening. These are high-volume, rule-bound tasks where machines outperform people on both speed and consistency.

What automation does not do is take responsibility. Final compliance responsibility remains with the business, regardless of which vendor runs the verification step. No platform guarantees compliance in every jurisdiction, and any provider claiming otherwise is describing something that does not exist. The decisions that matter — whether to onboard, whether to escalate, whether to file a report — stay with the compliance function.

Train Teams and Review the Program

Rules change, and a programme designed against a 2024 framework will drift out of alignment without anyone deciding to let it. Periodic review of policies, documented training for the people applying them, and independent testing of whether controls work as described are what keep the gap from opening.

How AMLBot Supports KYC and KYB Workflows

Most of what is described above is process rather than software, but the repetitive parts of it need tooling that fits the business model.

Automated KYC and KYB verification covers the front of the funnel: identity document verification for individual customers, and the corporate side for business clients — entity verification, ownership structure, and identification of beneficial owners and relevant controllers. Sanctions and PEP screening runs as part of the same flow rather than as a separate manual step, and verification can be embedded directly in an onboarding journey or called through an API where the product needs to control the user experience. The part that tends to matter more than any individual check is what happens to the output. Verification results, risk ratings and screening outcomes are only useful when they reach the systems making decisions later, which is why the onboarding layer should write into the same record that crypto transaction monitoring reads from. A customer file that never sees on-chain behaviour produces blind spots; an alert with no customer context produces noise.

Two honest limits. No verification platform determines which requirements apply to your business — that follows from your activities, your markets and your licence, and it is a question for legal analysis rather than configuration. And no provider assumes your regulatory responsibility. What good tooling does is make the required work faster, more consistent, and evidenced well enough to show a supervisor. If you are scoping KYC and KYB for a new market, or re-testing an onboarding flow that was configured before the 2026 and 2027 changes described above, that is a reasonable point to walk through the requirements against your actual customer base rather than against a generic checklist.

What Converges, and What Does Not

Crypto KYC requirements are converging around common FATF principles. Identify the customer. Verify the identity with reliable evidence. Understand who ultimately owns and controls a corporate client. Assess risk, and let that assessment drive how much diligence follows. Keep the picture current. Screen against the lists that bind you. That shape now repeats across the EU, the US, the UK, Asia-Pacific and the Gulf.

What has not converged is everything underneath it — legal scope, triggers, data fields, verification methods, thresholds, retention periods, and how the Travel Rule interacts with all of it. Two businesses can both be fully compliant with the same FATF principle and run visibly different onboarding flows, because they answer to different regulators.

For an international VASP or CASP, the practical sequence is to identify which jurisdictions actually apply given where services are provided and customers are served; establish a defensible baseline aligned to FATF principles; apply local legal requirements as overlays rather than exceptions; connect the KYC record to customer risk assessment and ongoing activity monitoring; and keep the regulatory configurations under version control, because several of the frameworks described in this article change again between now and late 2027.

The businesses that struggle with this are rarely the ones that failed to verify identity. They are the ones that verified identity once, in one configuration, and assumed it held everywhere.

FAQ

What Are the Main KYC Requirements for Crypto Businesses?

Typically: customer identification, identity verification, beneficial ownership identification where a legal entity is involved, customer risk assessment, enhanced due diligence for higher-risk relationships, ongoing review and monitoring, and recordkeeping and reporting under applicable law. The exact requirements differ by jurisdiction, business model and the regulator supervising the firm.

Are KYC Requirements the Same in Every Country?

No. FATF creates international standards, but national and regional regulators determine the legally enforceable requirements. Scope, thresholds, required data fields, acceptable verification methods, recordkeeping periods and reporting obligations all vary. A workflow built for one market should not be assumed compliant in another without checking the local framework.

What Is the Difference Between KYC and CDD in Crypto?

KYC focuses on identifying and verifying the customer. CDD is broader: it includes identity, but also understanding the purpose and nature of the business relationship, assessing customer risk, and monitoring that relationship over time. They are not separate processes — KYC is a component of CDD rather than an alternative to it.

What Is the Difference Between a VASP and a CASP?

VASP — virtual asset service provider — is the terminology FATF uses in its international standards. CASP — crypto-asset service provider — is the term used under the EU's MiCA regulation. They describe overlapping populations but are defined by different instruments, and they are not legally interchangeable in every context.

Does Every Crypto Transaction Require KYC?

Not universally. Whether customer verification is required depends on the business relationship, the service provided, the transaction type and value, the applicable local regulation and the risk presented. There is no single global threshold below which KYC never applies or above which it always does.

Does the FATF Travel Rule Require KYC?

They are different but connected requirements. The Travel Rule concerns originator and beneficiary information accompanying a transfer under the applicable national implementation. A business needs reliable customer data to populate those fields accurately, so weak KYC undermines Travel Rule compliance — but satisfying one does not satisfy the other.

Is Biometric Verification Mandatory for Crypto KYC?

Not universally. Biometric and liveness checks are widely used identity-verification and fraud-prevention methods, and some frameworks treat them as acceptable or expected for remote onboarding. Whether they are required, permitted or sufficient depends on the jurisdiction and the verification framework that applies to the business.

What Are EU Crypto KYC Requirements in 2026?

CASPs operate in the post-transition MiCA environment, with the EU-wide transitional period having ended on 1 July 2026. Customer due diligence obligations still come from the existing pre-AMLR framework as transposed nationally, alongside the Transfer of Funds Regulation. AMLR is in force as legislation but generally applies from 10 July 2027.

Do US Crypto Exchanges Have to Follow FinCEN's Bank CIP Rule?

Not as a blanket rule. Many crypto businesses can qualify as money transmitters and MSBs with Bank Secrecy Act obligations including registration, an AML programme, recordkeeping and suspicious activity reporting. But FinCEN's formal CDD Rule applies to defined covered financial institutions, and the bank CIP rule should not be described as applying identically to every crypto MSB.

Is KYC a One-Time Onboarding Check?

No, not necessarily. Risk-based AML frameworks commonly require customer information and risk assessments to remain current through the relationship, with additional review where activity, ownership or risk changes. The depth and frequency of that review follow the customer's risk profile and the applicable regulatory framework.

What Is KYB, and When Does It Apply?

KYB is the verification of a legal entity rather than an individual: confirming the company exists and is registered, identifying beneficial owners and relevant controllers, and understanding the ownership and control structure. It applies when the customer is a business rather than a person, and it is generally more involved than individual KYC because ownership chains can span jurisdictions.