KYC non-compliance in crypto and the controls regulators expect
a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}
Why KYC non-compliance matters in crypto
KYC non-compliance in crypto means more than failing to collect a passport image at sign-up. It can include weak customer identification, inadequate beneficial ownership checks, poor risk scoring, missing sanctions screening, incomplete Travel Rule data, ineffective suspicious activity reporting, and failure to register where a business model triggers money transmission or cryptoasset service obligations. For exchanges, custodians, fiat-to-crypto ramps, brokers, and some payment partners, the risk is not limited to a fine. Recent enforcement actions show that regulators can require market exits, monitorships, customer offboarding, management restrictions, and remediation programmes that change the economics of a crypto business.
The regulatory message is broadly consistent across the United States, the European Union, the United Kingdom, and FATF standards: crypto firms are expected to know who their customers are, understand the purpose and risk of those relationships, monitor activity over time, and act when the data no longer matches the risk profile. You can also explore more in Regulation and Compliance.
This article is an industry analysis for readers following crypto financial crime rules. It is not jurisdiction-specific legal advice. For related coverage, visit our Regulation and Compliance section.
What counts as KYC non-compliance
KYC controls sit inside a wider anti-money laundering and counter-terrorist financing framework. A firm can appear to have a KYC process while still being non-compliant if that process is incomplete, applied inconsistently, or disconnected from transaction monitoring.
Common forms of KYC non-compliance include:
- No identity verification before access to services. This is the clearest failure, especially where customers can deposit, trade, withdraw, or transfer value before verification.
- Insufficient beneficial ownership checks. Corporate accounts, market makers, affiliates, brokers, and institutional customers may require the firm to identify the natural persons who own or control the customer.
- Weak customer risk profiles. Regulators expect firms to understand the nature and purpose of the relationship, not simply store documents.
- Poor ongoing monitoring. KYC is not a one-time file. Changes in geography, volume, counterparties, wallet exposure, or product use can require review.
- Inadequate sanctions and high-risk jurisdiction controls. A user can pass identity checks but still present prohibited or heightened risk because of location, beneficial ownership, or transaction exposure.
- Missing or incomplete transfer information. Under Travel Rule frameworks, certain originator and beneficiary information must accompany qualifying transfers.
- Failure to report suspicious activity. If monitoring detects suspicious behaviour but the firm fails to escalate, investigate, and report where required, the KYC programme has not worked in practice.
A useful distinction is that KYC data answers “who is this customer?” while AML controls answer “does this customer’s behaviour make sense, and is it lawful to serve them?” Regulators increasingly assess both questions together.
The regulatory baseline is becoming more operational
The Financial Action Task Force is the main global standard setter for AML/CFT. Its recommendations, last updated in June 2026, include standards that apply to virtual assets and virtual asset service providers. FATF’s July 2026 targeted update said jurisdictions had made progress on virtual asset risk assessments, registration or licensing, Travel Rule implementation, and enforcement. It also identified continuing gaps in turning risk assessments into effective mitigation, identifying unlicensed VASP activity, and supervising the sector on a risk-based basis.
That matters because many crypto firms operate across borders. Even if a company is incorporated in one country, its customers, liquidity providers, on-chain counterparties, and marketing channels may touch several regulatory perimeters. A firm that treats KYC as a local onboarding form can miss the wider exposure created by cross-border access.
| Framework | Practical KYC impact for crypto firms |
|---|---|
| FATF standards | Set international expectations for risk-based AML/CFT controls, virtual asset supervision, and Travel Rule implementation. |
| United States BSA and FinCEN rules | Can require qualifying money services businesses and money transmitters to register, maintain AML programmes, keep records, and report suspicious activity. |
| EU Transfer of Funds Regulation | Applies Travel Rule information requirements to certain crypto-asset transfers from 30 December 2024. |
| EU MiCA transition | Allows some pre-existing providers to continue during transitional periods, but not beyond 1 July 2026 unless authorisation or refusal occurs sooner. |
| EU AML Regulation | Applies from 10 July 2027 for most covered sectors and includes more harmonised due diligence expectations, including for crypto-asset service providers. |
| UK Money Laundering Regulations | Require in-scope cryptoasset exchange providers and custodian wallet providers carrying on UK business to register with the FCA and comply with AML/CTF rules. |
For compliance teams, the practical shift is from broad policy statements to auditable controls. Regulators want to see how a firm identifies customers, rejects or restricts high-risk activity, obtains transfer data, manages partners, and proves that controls continue to work after launch.
Enforcement shows the cost of weak KYC
Large enforcement actions have made KYC non-compliance a board-level issue for crypto firms. On 21 November 2023, FinCEN announced a $3.4 billion civil money penalty against Binance, together with a five-year monitorship and major compliance undertakings, including steps connected to Binance’s exit from the U.S. market. The U.S. Department of Justice announced a related resolution exceeding $4 billion for Bank Secrecy Act, registration, and sanctions-related violations.
On 27 January 2025, the U.S. Attorney’s Office for the Southern District of New York announced that the entity operating KuCoin pleaded guilty to operating an unlicensed money transmitting business and agreed to penalties totaling more than $297 million. The announcement said KuCoin failed to implement effective AML and KYC programmes, failed to register with FinCEN, failed to file required suspicious activity reports, and served about 1.5 million registered U.S. users between about September 2017 and March 2024.
The United Kingdom has also shown that weak financial crime controls can affect firms connected to crypto activity even when they are not the main exchange. On 25 July 2024, the FCA fined CB Payments Limited £3,503,546 for repeatedly breaching a requirement that prevented it from offering services to high-risk customers. The FCA said the firm onboarded or provided e-money services to 13,416 high-risk customers despite restrictions, and that some funds were used for cryptoasset transactions through other Coinbase Group entities.
These cases differ in legal theory and facts, but they point to the same compliance lesson: regulators do not only review whether a firm has written policies. They look at whether controls stopped prohibited or high-risk activity when the firm had real customers, transaction volume, and commercial incentives to keep accounts open.
Where crypto firms often misjudge KYC risk
They treat registration as a substitute for controls
Registration or authorisation is not a regulator’s endorsement of every customer, product, or partner. The FCA has explicitly warned that UK cryptoasset registration under the Money Laundering Regulations is a legal requirement, not a recommendation or endorsement. A registered firm can still fail if its controls are poorly designed or if it enables non-compliant partners.
They separate onboarding from transaction behaviour
A customer may provide valid identity documents and still create risk through transaction patterns. Examples include rapid movement through multiple wallets, interaction with high-risk services, inconsistent source-of-funds information, activity tied to sanctions exposure, or behaviour inconsistent with the stated purpose of the account. KYC files that are not connected to monitoring alerts provide limited protection.
They rely too heavily on geofencing
Geofencing can be part of a control framework, but it is rarely enough on its own. Regulators have criticized firms where location controls, IP checks, affiliate channels, or onboarding paths failed to prevent restricted customers from accessing services. A credible programme usually combines location controls with identity verification, device intelligence, sanctions screening, payment data, blockchain analytics, and manual escalation. See also: Blockchain Technology.
They ignore partner and on-ramp exposure
Fiat-to-crypto ramps, widgets, API integrations, white-label products, and payment partners can create indirect exposure. The FCA’s 2026 guidance on cryptoasset financial promotions and on/off ramp services emphasized that regulated or registered firms should consider the risks of supporting unregistered cryptoasset firms that may be illegally promoting to UK consumers. Partner due diligence is therefore part of KYC risk, not a separate commercial checklist.
Controls regulators expect to see in practice
A defensible KYC programme should be proportionate to the firm’s products, jurisdictions, customer types, and transaction flows. For a low-risk, limited-use product, controls may be simpler. For an exchange, custodian, derivatives venue, high-volume broker, or cross-border on-ramp, regulators are likely to expect a deeper framework.
- Clear customer acceptance rules. Define who the firm will serve, who it will not serve, and which customers require enhanced due diligence.
- Risk-based identity verification. Verify individuals and legal entities before meaningful access to regulated services, with stronger checks for higher-risk customers.
- Beneficial ownership and control mapping. For legal entities, identify ownership and control, and refresh information when risk changes.
- Sanctions and adverse media screening. Screen customers, beneficial owners, and relevant counterparties at onboarding and on an ongoing basis.
- Transaction monitoring tied to customer profiles. Alerts should use customer risk, expected behaviour, wallet exposure, geography, product type, and velocity.
- Travel Rule procedures. Capture, verify, transmit, and review required originator and beneficiary information where applicable.
- Suspicious activity escalation. Document investigation steps, filing decisions, and reasons for no filing where alerts are closed.
- Partner due diligence. Review on-ramp partners, liquidity providers, introducers, affiliates, and embedded widget arrangements for perimeter and financial crime risk.
- Independent testing. Test whether controls work in production, not only whether policy documents exist.
- Board reporting and remediation tracking. Senior management should receive meaningful metrics on KYC failures, overdue reviews, rejected customers, sanctions hits, SARs, partner issues, and control defects.
Strong programmes also avoid false precision. Blockchain analytics can help identify wallet exposure, but attribution is not perfect. Digital identity tools can reduce friction, but they do not remove the need for risk judgment. A credible control environment explains how the firm handles uncertainty.
What investors and counterparties should watch
KYC non-compliance is not only a regulator-to-firm issue. Investors, market makers, banks, payment processors, and retail users can be affected when a platform is forced to suspend services, exit a jurisdiction, or restrict withdrawals during remediation.
Warning signs include a platform advertising “no KYC” access for services that look like money transmission or exchange activity, inconsistent country restrictions, vague ownership information, no clear AML disclosures, repeated complaints about sudden verification demands, or heavy reliance on offshore entities without explaining which regulated entity serves which customer. None of these signals proves illegality on its own, but each should prompt deeper due diligence.
For counterparties, the key question is whether the crypto firm can provide credible evidence of controls. That evidence may include registration or licence status, AML policy summaries, independent audit results, transaction monitoring procedures, Travel Rule arrangements, sanctions screening processes, and documented offboarding rules.
Frequently asked questions
Is no-KYC crypto always illegal?
No. The answer depends on the activity, jurisdiction, and role of the provider. A non-custodial software tool may raise different issues than an exchange, custodian, or money transmitter. However, services that accept and transmit value, exchange crypto for fiat, custody assets, or serve regulated markets may trigger AML/KYC obligations.
Can a crypto firm rely on blockchain transparency instead of KYC?
No. Blockchain data can support monitoring, but it does not by itself identify the customer, beneficial owner, or purpose of the relationship. Regulators generally expect on-chain analytics to be combined with off-chain customer due diligence where obligations apply.
Does KYC compliance end after onboarding?
No. Ongoing monitoring is a core part of due diligence. A customer’s risk can change because of new transaction patterns, new jurisdictions, new beneficial owners, sanctions updates, adverse media, or use of higher-risk products.
Why do Travel Rule requirements matter for KYC?
The Travel Rule connects transfer information with customer due diligence. For covered transfers, firms may need to collect, verify, transmit, and review originator and beneficiary information. Missing transfer data can create AML risk even when the customer initially passed onboarding.
The bottom line
KYC non-compliance in crypto is best understood as a control failure across the customer lifecycle. Regulators are looking at onboarding, beneficial ownership, sanctions exposure, transaction monitoring, Travel Rule data, partner relationships, and suspicious activity reporting as one connected system. The firms most exposed are those that scale customer acquisition faster than compliance operations, treat registration as reputational cover, or allow commercial partners to create risks the core platform would not accept directly.
For crypto businesses, the practical response is not to collect more documents for every user. It is to build a risk-based programme that can explain who is being served, why the relationship is acceptable, what behaviour is expected, which activity triggers review, and how the firm proves that its controls work under real transaction pressure.
