KYC and AML explained

What do KYC and AML mean?

Money laundering is processing criminal proceeds to disguise where they came from. The Financial Action Task Force (FATF), the intergovernmental body set up by the G-7 in 1989 to set global standards against it, describes three stages.

AML is the umbrella term for the laws and controls designed to break that chain. KYC is one piece of AML: confirming that customers are who they say they are, so that every account traces back to a real person or company.

What does a platform check when you sign up?

In the US, FinCEN's customer due diligence (CDD) rule, in force since 11 May 2018, asks covered firms — banks, broker-dealers, mutual funds and futures brokers — to have written procedures for four core tasks:

1. Identify and verify the customer. Collect your identifying details and check them against documents or reliable records.

2. Identify the owners behind a company. Any person owning 25% or more of a business account holder, plus one person who controls it.

3. Understand the relationship. Why the account exists and what activity to expect, which sets a risk profile.

4. Monitor on an ongoing basis. Watch transactions and report suspicious activity.

That is why a platform may ask about your job, the source of your funds or the purpose of a large transfer months after you opened the account. The questions are part of step three and four, not a sign you are under suspicion.

Why do crypto exchanges have to do KYC?

Since 2013, FinCEN — the US Treasury bureau responsible for Bank Secrecy Act rules — has treated businesses that exchange or administer convertible virtual currency as money transmitters. Its 2019 guidance confirms that such businesses must register with FinCEN as money services businesses, keep a written AML programme, keep records and file reports. By contrast, a person who uses an unhosted wallet they fully control to buy things for themselves is not a money transmitter.

Internationally, FATF Recommendation 15 says countries should regulate virtual asset service providers for AML purposes and license or register them. The EU went further: under its 2024 rules crypto-asset service providers are full obliged entities, and the EBA tells customers to expect questions both at account opening and when they transact. See MiCA explained for the licensing side.

What reports do financial firms file about customers?

Two reports matter most in the US. A currency transaction report (CTR) is filed for cash transactions over $10,000 by or for one person in a single business day, including several smaller ones that add up. FinCEN stresses that a CTR is routine: there is no general ban on handling large amounts of cash. A suspicious activity report (SAR) is filed when a firm suspects possible illegal activity. US banking agencies and FinCEN reminded firms in September 2026 that the Bank Secrecy Act bars revealing a SAR's existence, including to the customer it concerns.

Crypto platforms registered as money services businesses carry the same reporting duties. Moving coins between exchanges can also trigger the travel rule, which passes your details to the receiving provider.

Is KYC a privacy risk?

It can be, which is why it matters who you hand documents to. FinCEN says CTR information is collected in a manner consistent with a customer's right to financial privacy. For most people the bigger risk is handing ID to the wrong party: scammers imitate "verification" requests to steal identities, as described in common crypto scams.

What mistakes do people make with KYC checks?

• Letting someone else use your verified account. The account is tied to your identity; activity in it is attributed to you.
• Giving inaccurate answers to speed things up. False information can lead to frozen accounts and, in some cases, legal trouble.
• Splitting cash deposits to avoid a report. That is structuring, which FinCEN describes as a federal crime in its own right.
• Choosing a platform because it skips KYC. An unregistered firm leaves you with fewer protections and less recourse if something goes wrong.
• Uploading ID from a link in a message. Scammers imitate verification requests to steal identities.