KYC and AML for a crypto exchanger are not bureaucratic formalities — they are the baseline procedures without which operating legally in 2026 is nearly impossible. Payment partners, banks, and regulators are increasingly strict about whether an exchanger has a working client verification and transaction monitoring system in place.
How KYC Differs from AML — and Why You Need Both
KYC (Know Your Customer) is identity verification: who the client is and where their funds come from. AML (Anti-Money Laundering) monitors transactions to catch suspicious activity. One without the other does not work: you can verify a client and still let a questionable transfer go through. An exchanger needs both layers running together.
When to Request Documents: Verification Thresholds
In most jurisdictions the identification threshold is the equivalent of €1,000–€3,000 per session or €15,000 per year. That is the legal minimum. Many exchangers voluntarily lower the threshold to $500–$1,000 to reduce risk and simplify conversations with banks. The exact figure depends on your license and country of registration.
- Below threshold: collect email, IP, browser fingerprint — minimal tracking.
- At threshold: full name, passport photo, selfie with document.
- For large amounts: proof of funds (bank statement, invoice).
KYC Checklist: What the Procedure Must Cover
A proper KYC process is more than "upload your passport." A complete checklist looks like this:
- Government-issued identity document (passport, national ID, or travel document).
- Proof of address (utility bill or bank statement, no older than 3 months).
- Selfie with document or liveness check.
- Screening against sanctions lists: OFAC, EU sanctions, UN.
- PEP (Politically Exposed Person) status check.
- Secure storage of all data for a minimum of 5 years (FATF requirement).
AML Filters: What to Watch in Transactions
AML is about patterns, not just amounts. A single €900 transfer can be cleaner than a series of €150 transfers from the same address. Typical triggers for manual review:
- Structuring: many small transfers that together add up to a large amount.
- Transactions involving mixers (Tornado Cash and similar) — a red flag in most jurisdictions.
- Addresses flagged by Chainalysis or Elliptic as linked to dark markets.
- Sudden changes in client behavior: new region, different currency, anomalous volume.
Common Implementation Mistakes
Three mistakes that come up most often.
"We'll add KYC later." A payment partner disconnects the exchanger without warning — precisely because KYC was not set up from day one. Retroactive verification of existing clients costs more and creates friction.
Storing documents without encryption. This is a direct violation of GDPR and similar laws. Client documents must be kept in an encrypted store with restricted access.
Not updating sanctions lists. OFAC and EU lists are updated regularly. A one-time check at registration is not enough — re-screening is needed at every transaction.
KYC as a Competitive Advantage
It sounds counterintuitive, but a well-built KYC system is a genuine argument in negotiations with banks and payment gateways. An exchanger with a transparent compliance policy gets better rates and faster onboarding. Large B2B clients — companies that need to exchange regularly — are far more willing to work with a verified platform.
Conclusion
KYC and AML are not a cost center — they are the infrastructure of a legal business. An exchanger without these procedures operates on borrowed time: sooner or later a partner disconnects, a regulator fines, or a bank freezes an account. Better to build the system right once than to deal with the fallout later.
If you are launching your own exchanger and want to build compliance in from the start, iEXExchanger offers a ready-made engine that accounts for verification requirements and transaction monitoring from day one.
