Digital Asset Compliance
KYC Verification for Crypto Businesses
Every licensed crypto business runs know-your-customer verification, because regulators require it before they grant the license. This guide covers what a compliant crypto KYC program contains, and how state and federal reviewers test it.
- All 50 states
- Specialist support
- Human review on every filing
Talk to an expert
Tell us about your situation and we will follow up within one business day.
Digital Asset Compliance
What KYC verification is required for a crypto business?
A US crypto business that holds or transmits customer assets is generally required to run a risk-based anti-money-laundering program under FinCEN's money services business rules, and that program is expected to include policies and procedures for verifying customer identification to the extent reasonable and practicable for the business's risk. Unlike banks, MSBs are generally not subject to the formal bank Customer Identification Program rule, but specific obligations still drive identity verification in practice: Bank Secrecy Act recordkeeping rules require verified identity for covered transmittals, OFAC screening requires knowing who the customer is, New York's BitLicense regulations spell out customer identification requirements, and state licensing regulators review the written KYC procedures in every money transmitter application. The result is that licensed platforms verify essentially all customers, with name, date of birth, address, and an identification number as the standard baseline.
- Is KYC Legally Required for Crypto Exchanges?
- Generally yes, for US exchanges. As money services businesses, exchanges are typically required to run risk-based anti-money-laundering programs under FinCEN rules that include reasonable customer identification procedures, and recordkeeping rules, sanctions screening, state licensing reviews, and New York's BitLicense regulations each add verification obligations of their own. MSBs are generally not under the formal bank CIP rule, but as a practical matter licensed custodial exchanges run identity verification. We recommend confirming how these rules apply to your model with a Cornerstone expert or your attorney.
- What Information Does Crypto KYC Collect?
- The standard baseline is name, date of birth, address, and an identification number such as an SSN or passport number, verified against documents or databases at onboarding. The exact scope is set by the business's risk assessment and the regimes it is licensed under; higher-risk customers face enhanced due diligence, including source-of-funds documentation.
Money transmitter licensing by the numbers
- US jurisdictions require a money transmitter license
- 51 of 52 US jurisdictions require a money transmitter license Source: state regulator statutes compiled in our state-law index, verified August 2026. Money transmitter license state laws
- statutory surety bond range across licensing states
- $10,000 to $1,000,000 statutory surety bond range across licensing states Source: state regulator statutes compiled in our state-law index, verified August 2026. Money transmitter license state laws
The Cornerstone Way
A repeatable method, from first filing to every renewal
Faster licenses, less effort on your side, fewer mistakes, and fewer headaches. It is the way we combine experienced specialists, intentional AI, and the Atlas platform across one sequenced process.
-
Discover
We connect you with independent attorneys to pin down which licenses you need.
-
Prepare
Your licensing specialist assembles each application; our software handles the repetitive work.
-
Review
That same specialist reviews every filing before it reaches a regulator.
-
Approve
We submit, track each application, and keep you posted until the license is granted.
-
Renew
We file every renewal ahead of its deadline in Atlas so licenses stay current.
Anyone can list five steps. Here is what makes ours hold up.
The shortcut
The common approach is to scrape the web for an answer and hope it is current. When the rules change, or the page was wrong to begin with, the mistake surfaces as a deficiency after the filing is in, when it costs the most time.
The Cornerstone Way
-
Specialists who know the answer
Decades of licensing specialists, so the answer is right rather than guessed.
-
Trusted relationships with the regulator
Direct, trusted relationships with regulators, so we ask the question instead of assuming the answer.
-
Living internal checklists
Checklists that update the moment we learn something new, so deficiencies are caught before they happen.
KYC as a Licensing Requirement, Not a Feature
Know your customer, KYC, is the identity-verification half of the Bank Secrecy Act program every US money services business must run. For a crypto exchange, wallet, or payment platform, the federal requirement is a risk-based one: FinCEN's MSB rules require an AML program with identity-verification procedures reasonable and practicable for the business's risk, and recordkeeping rules, sanctions screening, state money transmitter reviews, and New York's BitLicense regulations layer verification obligations on top. Every state application and BitLicense review examines the written procedures before approving the license. Cornerstone builds these programs as part of licensing engagements, which is the lens of this guide: what the requirements are, what regulators actually check, and how KYC fits into getting and keeping licenses.
Where the Crypto KYC Requirement Comes From
The obligation stacks from several sources, and it is worth being precise about which rule does what. Federally, FinCEN treats exchangers and transmitters of convertible virtual currency as money services businesses, and the MSB anti-money-laundering rule (31 CFR 1022.210) requires a written, risk-based program that includes policies and procedures for verifying customer identification to the extent reasonable and practicable. That is a different instrument from the formal Customer Identification Program rule that applies to banks; MSBs are generally not covered by the bank CIP rule, and the federal baseline is risk-based rather than prescriptive.
Other rules then make verification unavoidable in practice. The Bank Secrecy Act recordkeeping and Travel Rules require verified identity information for covered transmittals, OFAC sanctions screening presupposes knowing who the customer is, and suspicious activity monitoring cannot work against anonymous accounts. State money transmitter statutes require applicants to document their AML and KYC procedures as a condition of licensure, and examiners test them after approval. New York goes furthest: BitLicense regulations at 23 NYCRR Part 200 expressly require customer identification, enhanced due diligence, and controls against servicing anonymous accounts.
The practical consequence: a crypto business cannot sequence KYC after launch. The written program must exist at application time and be running in production by the time examiners visit, which in a licensing project means building it in parallel with the applications. How far verification must go for your specific model is a risk and counsel question we work through as part of the program build.
What a Compliant Crypto KYC Program Contains
Programs vary with risk profile, but regulators expect the same core elements everywhere.
Identity Verification Procedures
Written, risk-based procedures for verifying customer identity, in practice collecting name, date of birth, address, and an identification number at onboarding, verified through documentary means (government ID) or non-documentary means (database checks, document liveness). The industry borrows the CIP label from banking, but for an MSB the federal requirement is the risk-based program, with prescriptive detail coming from state and NYDFS review.
Sanctions and PEP Screening
Screen every customer against OFAC sanctions lists at onboarding and on an ongoing basis, plus politically-exposed-person screening where risk warrants. Blocked matches must be blocked or rejected and reported.
Risk-Based Customer Due Diligence
Risk-rate customers and apply enhanced due diligence, source-of-funds and source-of-wealth checks, at documented thresholds. High-risk jurisdictions, high volumes, and institutional accounts all trigger deeper review.
Wallet Screening and Blockchain Analytics
The crypto-specific layer: screen deposit and withdrawal addresses against known illicit clusters, mixers, and sanctioned protocols using blockchain analytics tooling. Examiners increasingly ask to see the live integration, not the vendor contract.
Ongoing Monitoring and Refresh
KYC is not one-time. Programs re-verify on risk triggers, keep records for five years, and feed unusual activity into the suspicious activity reporting workflow covered by the AML program.
How Licensing Reviews Test Your KYC
State reviewers read the written program at application time and probe it in deficiency letters: who verifies, with what tools, at what thresholds, and who owns exceptions. New York's BitLicense review goes deeper, examining the program against Part 200's specific requirements and the department's transaction monitoring guidance.
After licensure, examinations sample real files. The findings that recur are predictable: onboarding flows that skip verification for referred customers, screening lists that are not refreshed, thresholds in the policy that the platform does not actually enforce, and no documented exception handling. A program that matches its own paper is most of the battle.
The importance of KYC and AML for crypto exchanges is ultimately commercial as well as legal: banking partners run their own diligence on your program, and a weak one costs you accounts even where regulators have not caught up.
KYC in Context: The Rest of the Compliance Stack
KYC verification is the front door of a larger Bank Secrecy Act program. Behind it sit transaction monitoring, suspicious activity reporting, Travel Rule compliance, independent testing, and a designated compliance officer, the components covered in our crypto AML and BSA compliance guide. And the whole program exists in service of licensing: it is what lets a state grant a money transmitter license and what a BitLicense examination tests.
Cornerstone's role is the integration: we build the KYC and AML program as part of the licensing project, so the written program, the production tooling, and the applications tell one consistent story. That is materially faster than retrofitting compliance after a regulator or bank flags the gap.
FAQ
Frequently Asked Questions
Ready for licensing the Cornerstone way?
Anyone can file paperwork and hand you a license. Licensing the Cornerstone way is the same outcome done right: fewer deficiencies, a faster path to approval, less work on your plate, and renewals that stay managed long after you go live.
-
Right the First Time
We prepare and file it correctly the first time, so most applications are accepted on the first submission instead of bouncing back with correction notices.
-
25 to 30x
faster than doing it yourself
Faster to Licensed
Start applications for 12 to 15 states on your own and it crawls. Hand those same states to a Cornerstone Licensing Specialist and they get you licensed 25 to 30 times faster, pursuing every state at once and knowing what each examiner expects.
-
97-98.5%
of the work handled for you
Less Work for You
You answer questions once, then Cornerstone generates and files the license. Your part is the few minutes it takes to confirm the details.
-
99.995%
on-time submissions in 2025
Renewals That Stay Managed
Every license, bond, and renewal date lives in Atlas and is tracked for you, so nothing lapses once you are approved.
Ready to Apply?
Start Your Application Now
Save and resume from any step. An expert reviews every submission within one business day.
Money transmitter regulations by state
Money transmitter regulations by state
We are refreshing our state-by-state summaries for money transmitter. Browse the states we have published below.
- AlabamaRegulator: Alabama Securities CommissionLicense: yesBond: Not less than $100,000, or the average daily outstanding money-received-for-transmission obligations in Alabama plus 50% of average daily outstanding payment-instrument and stored-value obligations in Alabama, whichever is greater; commission may raise to a maximum of $5,000,000
- AlaskaRegulator: Alaska Department of Commerce, Community, and Economic Development, Division of Banking and SecuritiesLicense: yesBond: $25,000 plus $5,000 for each location, not exceeding a total addition of $125,000 (base + additions); department may raise to a maximum of $500,000 based on financial condition
- ArizonaRegulator: Arizona Department of Insurance and Financial InstitutionsLicense: yesBond: Greater of $25,000 or 100% of the licensee's average daily money transmission liability in Arizona (most recent three-month period), up to a maximum of $500,000; $25,000 if tangible net worth exceeds 10% of total assets
- ArkansasRegulator: Arkansas Securities DepartmentLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in Arkansas (most recent three-month period), up to a maximum of $500,000; $100,000 if tangible net worth exceeds 10% of total assets
- CaliforniaRegulator: California Department of Financial Protection and Innovation (DFPI)License: yesBond: $250,000 to $7,000,000 for receiving money for transmission; selling or issuing payment instruments or stored value carries a separate $500,000 to $2,000,000 bond, and the two are cumulative
- ColoradoRegulator: Colorado Department of Regulatory Agencies, Division of BankingLicense: yesBond: Greater of $250,000 or 100% of the licensee's average daily money transmission liability in Colorado (most recent three-month period), up to a maximum of $1,000,000
- ConnecticutRegulator: Connecticut Department of BankingLicense: yesBond: Non-virtual-currency transmitters: not less than $300,000 (avg weekly transmissions < $300,000), $500,000 ($300,000-$500,000), or $1,000,000 (> $500,000); virtual-currency transmitters: amount set by the commissioner
- DelawareRegulator: Delaware Office of the State Bank CommissionerLicense: yesBond: $25,000, plus $5,000 for each location in excess of one, not to exceed $250,000 total
- District of ColumbiaRegulator: District of Columbia Department of Insurance, Securities and BankingLicense: yesBond: $50,000, increased by $10,000 per additional location, not to exceed $250,000 total
- FloridaRegulator: Florida Office of Financial RegulationLicense: yesBond: Amount specified by rule, but not less than $50,000 and not exceeding $2,000,000 (rule allows for financial condition, number of locations, and anticipated volume)
- GeorgiaRegulator: Georgia Department of Banking and FinanceLicense: yesBond: $250,000 minimum; the Department may require additional coverage, capped at $2,000,000
- HawaiiRegulator: Department of Commerce and Consumer Affairs, Division of Financial InstitutionsLicense: yesBond: $100,000 for the initial 12 months of licensure; commissioner may increase up to a maximum of $500,000 based on impaired financial condition
- IdahoRegulator: Idaho Department of FinanceLicense: yesBond: $10,000, increased by $5,000 per additional location/authorized representative, up to a maximum of $500,000
- IllinoisRegulator: Illinois Department of Financial and Professional Regulation, Division of Financial InstitutionsLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Illinois for the most recently completed quarter, capped at $2,000,000
- IndianaRegulator: Indiana Department of Financial InstitutionsLicense: yesBond: Greater of $300,000 or the licensee's average daily money transmission liability in Indiana for the most recent calendar quarter, capped at $500,000
- IowaRegulator: Iowa Division of BankingLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in Iowa for the most recent 3-month period, capped at $500,000
- KansasRegulator: Office of the State Bank CommissionerLicense: yesBond: Greater of $200,000 or 100% of the licensee's average daily money transmission liability in Kansas for the most recent 3-month period, capped at $1,000,000 (or $200,000 if tangible net worth exceeds 10% of total assets)
- KentuckyRegulator: Kentucky Department of Financial InstitutionsLicense: yesBond: At least $500,000; commissioner may increase up to a maximum of $5,000,000 based on financial condition, net worth, or transaction volume
- LouisianaRegulator: Louisiana Office of Financial InstitutionsLicense: yesBond: Minimum $100,000, up to a maximum of $500,000, or a higher amount deemed appropriate by the Commissioner up to a maximum of $1,000,000
- MaineRegulator: Bureau of Consumer Credit ProtectionLicense: yesBond: $100,000
- MarylandRegulator: Office of the Commissioner of Financial RegulationLicense: yesBond: Greater of $150,000 or 100% of the applicant's average daily money transmission liability in the State for the most recent quarter, capped at $2,000,000
- MassachusettsRegulator: Massachusetts Division of BanksLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Massachusetts over the most recently completed three months, capped at $500,000
- MichiganRegulator: Department of Insurance and Financial Services (DIFS)License: yesBond: $500,000 for the first location, plus $10,000 for each additional location and authorized delegate, up to a maximum of $1,500,000
- MinnesotaRegulator: Minnesota Department of CommerceLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in Minnesota (most recent 3-month period), capped at $500,000
- MississippiRegulator: Mississippi Department of Banking and Consumer FinanceLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in Mississippi (most recent 3-month period), capped at $500,000 (commissioner may raise up to $1,000,000)
- MissouriRegulator: Missouri Division of FinanceLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in Missouri (most recent 3-month period), capped at $500,000
- MontanaRegulator: Montana Division of BankingLicense: noBond: Not required (no state license needed)
- NebraskaRegulator: Nebraska Department of Banking and FinanceLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in Nebraska (most recent 3-month period), capped at $500,000
- NevadaRegulator: State of Nevada Department of Business and Industry, Financial Institutions DivisionLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Nevada (most recently completed quarter), capped at $500,000
- New HampshireRegulator: New Hampshire Banking DepartmentLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in New Hampshire (most recent 3-month period), capped at $500,000
- New JerseyRegulator: New Jersey Department of Banking and InsuranceLicense: yesBond: Amount set by the Commissioner by regulation, not less than $100,000 and not more than $1,000,000 (money transmitter). Foreign money transmitters use a volume-based schedule starting at $25,000.
- New MexicoRegulator: New Mexico Regulation and Licensing Department, Financial Institutions DivisionLicense: yesBond: Greater of $300,000 or 1% of the licensee's total yearly dollar volume of money transmission business in New Mexico (or projected first-year volume), up to a maximum of $2,000,000
- New YorkRegulator: New York State Department of Financial ServicesLicense: yesBond: Set by the Superintendent of Financial Services for each licensee; New York Banking Law Article 13-B fixes no dollar amount, so confirm the required bond with DFS before relying on a figure
- North CarolinaRegulator: North Carolina Office of the Commissioner of BanksLicense: yesBond: $150,000 base (transmission volume in NC up to $1,000,000); increases with NC transmission volume (e.g., $175,000, $200,000, and higher tiers)
- North DakotaRegulator: North Dakota Department of Financial InstitutionsLicense: yesBond: Greater of $100,000 or 100% of the licensee's average daily money transmission liability in North Dakota (most recent 3-month period), capped at $500,000
- OhioRegulator: Ohio Department of Commerce, Division of Financial InstitutionsLicense: yesBond: Security device (surety bond or permitted alternative) of not less than $300,000, up to a maximum of $2,000,000 as the Superintendent finds appropriate
- OklahomaRegulator: Oklahoma State Banking DepartmentLicense: yesBond: $50,000 plus $10,000 per authorized-delegate location, not exceeding a total of $500,000
- OregonRegulator: Oregon Department of Consumer and Business Services, Division of Financial RegulationLicense: yesBond: $25,000, increased by $5,000 per additional location/authorized delegate (amount otherwise set by rule/Director)
- PennsylvaniaRegulator: Pennsylvania Department of Banking and SecuritiesLicense: yesBond: Bond in the penal sum of $1,000,000 (department may require additional bond based on average daily outstanding transmission balance)
- Puerto RicoRegulator: Puerto Rico Office of the Commissioner of Financial Institutions (OCIF)License: yesBond: $500,000 for a single office, increased by $10,000 per additional office or authorized agent (Commissioner may require a higher bond based on business volume/financial condition)
- Rhode IslandRegulator: Rhode Island Department of Business Regulation, Division of BankingLicense: yesBond: $50,000 (currency transmission licensees); department may accept an alternative security form if a surety bond is not commercially available at reasonable cost
- South CarolinaRegulator: South Carolina Attorney General (Commissioner under the South Carolina Uniform Money Services Act)License: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in South Carolina (most recent 3 months), capped at $500,000; alternatively $100,000 if tangible net worth exceeds 10% of total assets
- South DakotaRegulator: South Dakota Division of BankingLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in South Dakota (most recent 3 months), capped at $500,000; alternatively $100,000 if tangible net worth exceeds 10% of total assets
- TennesseeRegulator: Tennessee Department of Financial InstitutionsLicense: yesBond: Greater of $50,000 or 100% of average daily money transmission liability in Tennessee (most recent calendar quarter), capped at $800,000
- TexasRegulator: Texas Department of BankingLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Texas (most recent 3 months), capped at $500,000; alternatively $100,000 if tangible net worth exceeds 10% of total assets
- UtahRegulator: Utah Department of Financial InstitutionsLicense: yesBond: Flat minimum surety bond of $50,000
- VermontRegulator: Vermont Department of Financial RegulationLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Vermont (most recent 3 months), capped at $2,000,000
- VirginiaRegulator: Virginia State Corporation Commission, Bureau of Financial InstitutionsLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Virginia for the most recent quarter, capped at $1,000,000; a flat $100,000 where tangible net worth exceeds 10% of total assets
- WashingtonRegulator: Washington State Department of Financial InstitutionsLicense: yesBond: Surety bond based on prior year's money transmission and payment instrument dollar volume; minimum $10,000, not to exceed $550,000
- West VirginiaRegulator: West Virginia Division of Financial InstitutionsLicense: yesBond: $300,000 for money transmission; $100,000 for check or money-order sale or currency exchange; increased by 1% of annual West Virginia volume over $10 million, capped at $1,000,000
- WisconsinRegulator: Wisconsin Department of Financial InstitutionsLicense: yesBond: Greater of $100,000 or 100% of average daily money transmission liability in Wisconsin (most recent 3 months), capped at $500,000
- WyomingRegulator: Wyoming Division of BankingLicense: yesBond: $10,000 or 2.5 times outstanding payment instruments, whichever is greater, not to exceed $500,000
Explore More From Our Team
Tools and references our customers use most.
Stay Ahead of the Rules
Recent rule changes, deadline announcements, and state agency updates we are tracking for you.
- Action Multistate Settlement Aug 19, 2026
August 2026 Monthly Settlement with NewRez LLC
State financial regulators announced a nearly $15. 5 million settlement with NewRez LLC related to improperly charged insurance.
- Watch New York DFS NY Aug 19, 2026
DFS Pre-Proposed Amendment to 23 NYCRR 400
The DFS posted a pre-proposed second amendment to 23 NYCRR 400 on August 13, 2026; comments are due by August 24, 2026.
- Action NMLS Aug 19, 2026
New NMLS Information Requests and Notification Changes
August 2026 updates include new Information Requests and notification options for individuals within the NMLS system.
- Watch FinCEN Aug 19, 2026
FinCEN Proposed Rule for AML/CFT Reforms
On April 7, 2026, FinCEN proposed reforms to AML/CFT program requirements affecting MSBs and financial institutions.
- Action California DFPI CA Aug 18, 2026
California Debt Collection Licensing Act Updates
California continues to enforce its Debt Collection Licensing Act, maintaining rigorous licensing and examination protocols for debt collectors and debt buyers. The DFPI supervises compliance closely.
Build a KYC Program Regulators Approve
Your KYC program is reviewed in every license application you file. We build it alongside the applications so both pass the first time. Talk with our team.