Cryptoasset KYC and Due Diligence
Crypto exchange KYC controls should reflect what the business does, who it serves and how it handles virtual assets. An initial discussion can examine whether customer and counterparty due diligence fits the business model and the jurisdictions involved.
Start with the business model and relationships
Due diligence needs to reflect the services offered and the parties involved. Depending on the model, this may mean understanding retail or institutional customers, legal entities and their beneficial owners, authorised users, counterparties and the role of intermediaries. The custody arrangement also matters: clarify whether the business holds assets or controls wallets or keys, facilitates transfers, or provides another service, and what records support that understanding.
Review whether procedures distinguish identity from authority to act, ownership from control, and a customer's stated business from observed activity. Evidence should have a clear source and purpose, with gaps, contradictions and changes handled through defined escalation. Complex ownership structures call for closer analysis of the evidence chain and control rights.
Risk ratings, enhanced checks and ongoing review
Customer and counterparty risk ratings should connect to the activity the business enables. An initial discussion can consider how customer type, products, delivery model, jurisdictions, expected transaction patterns and custody or wallet arrangements inform the rating. The rating should guide proportionate due diligence, approvals, enhanced due diligence where risk warrants it, and review frequency.
Periodic review is only one trigger. Material changes to ownership, control, business purpose, counterparties or transaction behaviour may call for an earlier refresh. Useful inputs might include the KYC policy, risk-rating methodology, review triggers, evidence standards, process maps and appropriately protected sample cases. The discussion can identify unclear criteria and priorities for accountable teams; any written output and depth are agreed in advance.
Scope travel-rule duties by jurisdiction
FATF standards set an international framework that countries implement in national law. FATF describes the travel rule as requiring virtual asset service providers to obtain, hold and securely transmit originator and beneficiary information for covered transfers. Whether a particular firm, service or transfer is in scope depends on the applicable jurisdiction and its current implementation. FATF's July 2026 update reports continuing gaps in implementation, so firms need to check current local law and guidance rather than assume a universal rule.
Advice can address due diligence frameworks and controls, but does not operate customer onboarding, provide legal opinions or recommend a verification vendor. Blockchain forensics, wallet tracing and transaction investigations are separate specialist activities. Applicable jurisdictions and the question to address shape any engagement.
Common questions
Does the travel rule apply to every cryptoasset transfer?
Do not assume that it does. FATF sets an international standard, while local laws define which businesses, services, transfers and any thresholds are covered. Check current requirements in each relevant jurisdiction.
Does the advice include blockchain tracing or forensics?
No. It focuses on customer and counterparty due diligence frameworks and controls. Wallet tracing, blockchain forensics and transaction investigations are separate specialist activities.