KYC Verification for Crypto Businesses

The obligation stacks from several sources, and it is worth being precise about which rule does what. Federally, FinCEN treats exchangers and transmitters of convertible virtual currency as money services businesses, and the MSB anti-money-laundering rule (31 CFR 1022.210) requires a written, risk-based program that includes policies and procedures for verifying customer identification to the extent reasonable and practicable. That is a different instrument from the formal Customer Identification Program rule that applies to banks; MSBs are not covered by the bank CIP rule, and the federal baseline is risk-based rather than prescriptive.

Other rules then make verification unavoidable in practice. The Bank Secrecy Act recordkeeping and Travel Rules require verified identity information for covered transmittals, OFAC sanctions screening presupposes knowing who the customer is, and suspicious activity monitoring cannot work against anonymous accounts. State money transmitter statutes require applicants to document their AML and KYC procedures as a condition of licensure, and examiners test them after approval. New York goes furthest: BitLicense regulations at 23 NYCRR Part 200 expressly require customer identification, enhanced due diligence, and controls against servicing anonymous accounts.

The practical consequence: a crypto business cannot sequence KYC after launch. The written program must exist at application time and be running in production by the time examiners visit, which in a licensing project means building it in parallel with the applications. How far verification must go for your specific model is a risk and counsel question we work through as part of the program build.

Programs vary with risk profile, but regulators expect the same core elements everywhere.

State reviewers read the written program at application time and probe it in deficiency letters: who verifies, with what tools, at what thresholds, and who owns exceptions. New York's BitLicense review goes deeper, examining the program against Part 200's specific requirements and the department's transaction monitoring guidance.

After licensure, examinations sample real files. The findings that recur are predictable: onboarding flows that skip verification for referred customers, screening lists that are not refreshed, thresholds in the policy that the platform does not actually enforce, and no documented exception handling. A program that matches its own paper is most of the battle.

The importance of KYC and AML for crypto exchanges is ultimately commercial as well as legal: banking partners run their own diligence on your program, and a weak one costs you accounts even where regulators have not caught up.

KYC verification is the front door of a larger Bank Secrecy Act program. Behind it sit transaction monitoring, suspicious activity reporting, Travel Rule compliance, independent testing, and a designated compliance officer, the components covered in our crypto AML and BSA compliance guide. And the whole program exists in service of licensing: it is what lets a state grant a money transmitter license and what a BitLicense examination tests.

Cornerstone's role is the integration: we build the KYC and AML program as part of the licensing project, so the written program, the production tooling, and the applications tell one consistent story. That is materially faster than retrofitting compliance after a regulator or bank flags the gap.