Crypto AML and KYC Rules Explained: What Exchanges Must Check

Last reviewed: 2 October 2026

Crypto exchanges must know who their customers are, monitor what they do and report suspicious activity to a financial intelligence unit. Sanctions laws also bar them from serving listed people and places. These anti-money-laundering (AML) and know-your-customer (KYC) duties come from national law built on the FATF standards, and explain most of what an exchange asks you.

The data that travels with each transfer is a separate rule, covered in our guide to the crypto Travel Rule.

Which laws make exchanges check their customers?

The global baseline is the FATF Recommendations. Recommendation 15 applies the customer due diligence rule in Recommendation 10 to virtual asset service providers, and sets USD/EUR 1,000 as the level above which even a one-off transaction needs checks.

• United States. FinCEN says crypto exchangers generally count as money transmitters under the Bank Secrecy Act (guidance FIN-2019-G001). Under 31 CFR 1022.210 each must run a written, risk-based AML programme with controls for verifying customers, filing reports and keeping records, plus a named compliance officer, staff training and an independent review.
• European Union. The fifth AML directive, adopted in 2018 and then written into national laws, brought crypto-to-fiat exchanges and custodian wallet providers into scope. The AML Regulation (EU) 2024/1624 harmonises many of these rules from 10 July 2027, and the new EU authority, AMLA, is due to start supervising up to 40 high-risk financial firms directly in 2028.
• United Kingdom. The Money Laundering Regulations 2017 cover cryptoasset exchange providers and custodian wallet providers (regulation 14A), supervised by the FCA. Our guide to the UK FCA crypto regime covers the registration side.

Licensing rules sit on top, as our crypto regulation explainer shows.

What does an exchange have to check when you sign up?

Standard customer due diligence has the same core everywhere: identify you, verify that identity, and understand what the account is for. From 10 July 2027 the EU regulation sets the minimum data for a person: all names, place and full date of birth, nationality and national ID number where one exists, and usual address. For a company, the exchange must also find and verify the people who own or control it.

The same rule makes two items explicit: checking whether you or a company’s owners are under targeted financial sanctions, and asking about your occupation or business. If the checks cannot be completed, the exchange must refuse the account or end it, and consider a suspicious transaction report (Article 21).

Thresholds decide when one-off transactions without an account need full checks. The EU rule will set EUR 1,000 for crypto firms, with identification still required below that. In the UK, a one-off cryptoasset transfer worth £800 or more, counting linked transfers, triggers checks; SI 2026/621 replaced the old 1,000 euro level on 30 June 2026.

Checks continue after sign-up: exchanges monitor whether your transactions fit what they know about you, so you may be asked to update details years later.

When does an exchange ask for more?

Enhanced due diligence applies when risk is higher. The UK rules (regulation 33) list cases such as customers linked to a FATF “call for action” country, politically exposed persons and their families, and anyone who has given false documents. From 2027, EU Article 34 adds transactions that are unusually large, complex or follow an odd pattern.

The extra steps cause most friction: questions on the purpose of a transfer, proof of source of funds and wealth, senior management sign-off and closer monitoring. Typical evidence is a payslip, a sale contract or statements from another platform.

How does sanctions screening work?

Exchanges screen names and wallet addresses against sanctions lists such as OFAC’s SDN list in the US. OFAC’s guidance for the virtual currency industry says civil penalties are “generally based on a strict liability legal standard”, so a firm can be liable without knowing it broke the rules. It recommends IP geolocation and blocking for sanctioned regions. A login that appears to come from a sanctioned place may trigger a review or restriction, even if a VPN caused it.

Why might an exchange not explain a frozen account?

In the US, an exchange must file a suspicious activity report for transactions of at least $2,000 it suspects, within 30 calendar days of spotting the facts, and may not reveal that a report exists. From 2027, EU Article 69 requires reports “regardless of the amount involved”. In the UK, disclosing a report in a way likely to prejudice an investigation can be the offence of tipping off (Proceeds of Crime Act 2002, section 333A). So an exchange may be unable to say whether it filed a report, though a freeze can have other causes too.

Records last. US rules keep most records five years. UK rules keep identity and transaction records five years after the relationship ends or a one-off transaction completes, and the EU rule will do the same from 2027.

What happens when exchanges get these checks wrong?

On 2 October 2026 we reviewed a selection of enforcement releases from US, UK, Irish and Canadian agencies: 19 actions since 2021 involving 16 crypto businesses (three of them Coinbase entities). It is not a complete tally. The failure named most often was a weak or missing AML programme (11 businesses), then suspicious activity reports not filed or filed late (8). Eight cases:

US agencies often credit each other’s payments, so totals should not be added. The NYDFS and DOJ sites blocked us, so we used archived copies; the Dutch central bank’s site was unreachable.

What should you expect to be asked?

1. Identity. Full name, date of birth, address and a photo ID, often with a selfie or video check.
2. Purpose. Why you are opening the account and roughly how much you expect to move.
3. Occupation. Your job or business, a named item in the EU rule from July 2027.
4. Source of funds. Proof of where a larger deposit came from, if your activity looks higher risk.
5. Location. Your country of residence and, through your IP address, where you log in from.

An exchange that asks for no identifying information at all can be a warning sign. Check its registration with our guide on how to check if a crypto company is licensed.

Sources

• eCFR, 31 CFR Part 1022 (money services businesses) and Part 1010, read 2 October 2026
• EUR-Lex, Regulation (EU) 2024/1624 (AMLR) and Regulation (EU) 2024/1620 (AMLA)
• legislation.gov.uk, Money Laundering Regulations 2017 (as amended by SI 2026/621)
• FATF, The FATF Recommendations (updated October 2025)
• Enforcement releases linked in the table (FinCEN, US Treasury, NYDFS, FCA, DOJ, FINTRAC, Central Bank of Ireland, OFAC), read 2 October 2026