Crypto Compliance in 2026: KYC, AML, Travel Rule and the Vendors That Do It

If you run an exchange, a custodial wallet, an on-ramp or a fintech adding crypto, compliance questions arrive early: which rules apply where you operate, which threshold triggers the Travel Rule, and which tools you have to buy. Most pages ranking for “crypto compliance” are either vendor brochures or articles written before the EU and UK rules took effect. This guide sets out the obligations first, by jurisdiction and dated, then the four vendor categories and what each one actually does, using the vendors’ own documentation. Vendors are not ranked, and none paid to be included.

What is crypto compliance?

Crypto compliance means meeting the anti-money-laundering, counter-terrorist-financing and sanctions rules that apply to businesses handling crypto for customers. In practice it has four parts: knowing who your customers are (KYC), watching what they do (AML transaction monitoring), sending and receiving sender and recipient data with transfers (the Travel Rule), and refusing business with sanctioned people, places and wallet addresses.

It applies to businesses, not to the coins. A person sending bitcoin from their own wallet is not a regulated firm. An exchange, broker, custodian or payment service moving crypto for customers usually is. Regulators use different names for the same thing: virtual asset service provider (VASP) at FATF and in Dubai, crypto-asset service provider (CASP) in the EU, money services business (MSB) in the US, virtual digital asset service provider (VDA SP) in India.

What does KYC stand for in crypto?

KYC stands for Know Your Customer. For a crypto platform it means collecting and verifying a customer’s identity (name, date of birth, address, a government ID and usually a selfie or liveness check) before the customer can trade, deposit or withdraw, then keeping that information current. For business customers the same process is called KYB (Know Your Business) and adds company documents and the people who own or control the company.

KYC is one piece of customer due diligence. India’s rules show what that looks like in law: VDA service providers must verify the identity of clients and beneficial owners at account opening and for transactions of INR 50,000 or more, or any international transaction (Ministry of Finance notification of 7 March 2023, as summarised by Mondaq).

What is AML in crypto?

AML (anti-money laundering) in crypto is the wider programme KYC sits inside: a written risk assessment, a compliance officer, ongoing transaction monitoring, suspicious activity reporting to the national financial intelligence unit, record keeping, staff training and independent testing. Blockchain analytics is the crypto-specific part of monitoring. It checks where incoming funds came from and where outgoing funds are going on-chain.

Who has to comply?

If you hold or move crypto for other people, or exchange it for money or other crypto as a business, assume the rules apply to you until a lawyer in that jurisdiction says otherwise. Two points catch teams out:

• Location does not protect you. India’s FIU-IND says its obligations “are activity-based and are not contingent on physical presence of the entity in India” (press release, 9 September 2026). US guidance from FinCEN (FIN-2019-G001, 9 May 2019) says that persons accepting and transmitting convertible virtual currency must register with FinCEN as an MSB, “like any money transmitter”.
• Self-custody users are treated differently. FinCEN’s 2019 guidance notes that unhosted wallets “do not require an additional third party to conduct transactions”, and a user paying for goods from their own wallet is not a money transmitter. The firm on the other side of that user’s transfer still has duties, as the EU and Singapore rules below show.

Crypto compliance rules by jurisdiction (as of 14 October 2026)

Checked 14 October 2026 against regulator pages and the legal texts named in each section below. This is a summary, not legal advice for your specific licence.

FATF: Recommendations 15 and 16, and the June 2025 revision

FATF does not make law. It sets the standard that national laws copy and then grades countries against it. Its virtual assets page lists the core VASP duties under Recommendation 15: licensing or registration, supervision, customer due diligence, record keeping, suspicious transaction reporting, and the Travel Rule, which requires VASPs to “obtain, hold, and securely transmit originator and beneficiary information” with transfers.

Recommendation 16 is the Travel Rule itself. FATF members approved changes to R.16 and its interpretive note at the June 2025 plenary, announced 18 June 2025. The revision sets out which institution in a payment chain is responsible for the data, standardises the information that must travel with cross-border payments, and adds fraud and error checks. In FATF’s words, “The changes will come into effect by the end of 2030.” The assessment methodology for the revised standard followed on 28 October 2025 (FATF, R.16 update). FATF’s page names R.16 as the Travel Rule for virtual assets but does not detail VASP-specific changes, so watch for its follow-up guidance.

On implementation, FATF’s sixth targeted update (26 June 2025) reported that 99 jurisdictions had passed or were passing Travel Rule laws, and that “most on-chain illicit activity now involves stablecoins”. The seventh update (16 July 2026) found further progress but listed remaining gaps: weak licensing in practice, finding unlicensed VASPs, offshore VASPs outside effective oversight, peer-to-peer transfers through unhosted wallets, and stablecoin misuse.

European Union: TFR now, AMLR and AMLA next

Two layers apply. MiCA decides who may offer crypto services in the EU at all. The AML layer decides how those firms must check customers and transfers.

• Transfer of Funds Regulation (TFR), Regulation (EU) 2023/1113. Article 40: “It shall apply from 30 December 2024.” Article 14 lists what the originator’s CASP must send, including the originator’s name, distributed ledger address and address including country. The regulation has no de minimis threshold for transfers between CASPs, so the rule applies to every transfer. The EUR 1,000 figure applies only to self-hosted wallets: above that amount, a CASP sending to (Article 14(5)) or receiving from (Article 16(2)) a self-hosted address must take adequate measures to assess whether its own customer owns or controls that address (EUR-Lex, Regulation 2023/1113). The EBA’s Travel Rule guidelines (press release 4 July 2024) apply from the same date.
• AML Regulation (AMLR), Regulation (EU) 2024/1624. A single EU rulebook that replaces national transpositions. It applies from 10 July 2027 (EUR-Lex record). Article 79(1) bars CASPs from keeping accounts that allow anonymisation, “including through anonymity-enhancing coins”, and Article 19(3) sets full due diligence for occasional transactions of at least EUR 1,000, with identification still required below that (as summarised by an AMLR explainer dated 3 October 2026; check the article text before relying on it).
• AMLA. The new EU AML authority has existed since 26 June 2024 and started operations in summer 2025. Its own timeline puts the start of direct supervision “during 2028”.

One ranking page reviewed for this article still says EU crypto-to-crypto transfers need no KYC. Since 30 December 2024 that is wrong for CASPs.

United States: is crypto regulated?

Yes for AML purposes, even without a federal crypto market-structure law. As of 14 October 2026 the CLARITY Act is not law (see the CLARITY Act explainer). AML obligations come from the Bank Secrecy Act instead:

• Registration. Exchangers and administrators that accept and transmit crypto are money transmitters and must register with FinCEN as MSBs (FIN-2019-G001). State money transmitter licences sit on top.
• Travel Rule. 31 CFR 1010.410(f) requires the transmittor’s institution to include the sender’s name, address, account number, amount, date and recipient details on transmittals of “$3,000 or more” (eCFR). FinCEN’s 2019 guidance says crypto transactions “may fall within the Funds Travel Rule”.
• Unhosted wallets. Treasury withdrew FinCEN’s 2020 proposed reporting and identity rule for unhosted wallet transactions on 12 April 2024, published in the Federal Register on 16 August 2024 (Unchained, 20 August 2024).
• Sanctions. OFAC says compliance obligations “are the same” for digital currency (FAQ 560). It adds wallet addresses to the SDN List but warns these listings are not exhaustive (FAQ 562), and blocked virtual currency must be reported within 10 business days (FAQ 646).
• Stablecoin issuers. The GENIUS Act brought payment stablecoin issuers under the Bank Secrecy Act. The stablecoin regulation guide covers what is final and what is still proposed.

United Kingdom: Travel Rule since 2023, new regime from October 2027

Crypto businesses register with the FCA under the Money Laundering Regulations 2017. The FCA’s statement of 17 August 2023 confirms that “From 1 September 2023, cryptoasset businesses in the UK will be required to collect, verify and share information” with transfers (FCA statement). When sending to a country without a Travel Rule, the FCA expects firms to take all reasonable steps to check whether the receiver can accept the data, and to collect, verify and store it anyway. When receiving incomplete data, firms make a risk-based decision on releasing the funds.

A full authorisation regime replaces registration next. The FCA’s gateway opened on 30 September 2026 and closes on 28 February 2027, and the regime comes into force on 25 October 2027. Existing registrations do not convert automatically. Firms that apply in the window can keep operating until the FCA decides; firms that miss it can only perform existing contracts (Davis Polk, 1 October 2026).

UAE (Dubai VARA): AED 3,500 threshold

VARA’s Compliance and Risk Management Rulebook (Rule III.G.2) requires the sending VASP to obtain and hold originator and beneficiary information before initiating a transfer above AED 3,500, and the receiving VASP has the matching duty. For unhosted wallets, VASPs must decide how they handle the risk but VARA does not prescribe a method. The rulebook PDF on VARA’s site is versioned 19 May 2025. Abu Dhabi (ADGM) has its own FSRA rules and is not covered here.

Singapore (MAS): PSN02 and the 2025 offshore cut-off

MAS Notice PSN02 has applied the Travel Rule to digital payment token service providers since 28 January 2020. According to Notabene’s Singapore summary, ordering VASPs send originator and beneficiary information regardless of amount, with wider personal data for transfers above S$1,500, and MAS expects firms to verify ownership of self-hosted wallets. This could not be confirmed on the MAS notice page itself when checked, so read PSN02 directly before you rely on the threshold. Separately, Singapore-based firms serving only overseas customers had to hold a digital token services licence or cease by 30 June 2025, and MAS said it would issue such licences only in “extremely limited circumstances” (CMS, 26 June 2025).

India (FIU-IND): register or be blocked

A Ministry of Finance notification of 7 March 2023 made VDA service providers reporting entities under the Prevention of Money Laundering Act for five activities: VDA-to-fiat exchange, VDA-to-VDA exchange, transfers, safekeeping or administration, and services around token offerings. Offshore platforms are covered too. FIU-IND issued non-compliance notices to 25 offshore VDA SPs on 1 October 2025, when 50 VDA SPs were registered, and to 15 more on 9 September 2026, with takedown notices for their apps and URLs in both rounds (PIB release, 9 September 2026). The Binance in India guide walks through one platform’s route from penalty to registration.

Travel Rule thresholds compared

Checked 14 October 2026. A different threshold on each side of a transfer is common. Your Travel Rule tool has to apply the stricter rule of the two jurisdictions involved, and handle counterparties that cannot receive data yet.

Can the FBI and police track crypto?

Often, yes, on public blockchains. Every transfer on networks such as Bitcoin and Ethereum is permanently visible. Blockchain analytics firms group addresses into entities (an exchange, a mixer, a sanctioned group) and trace funds between them. Law enforcement uses the same tools that exchanges buy for compliance, and they become far more effective when a trail reaches a regulated exchange that holds KYC data. That is the point of the system: analytics shows where funds went, KYC and Travel Rule data show who was behind the account.

The limits matter too. Address labels are probabilistic and vendor-specific, privacy coins and mixers reduce visibility, and FATF’s July 2026 update still lists peer-to-peer transfers through unhosted wallets and offshore VASPs as weak points.

The four vendor categories, and what each does not do

Vendors below are described from their own websites and documentation, checked 14 October 2026. Customer counts, coverage figures and testimonials are company claims, not independent measurements. Vendors are listed alphabetically within each category and are not ranked. The site’s methodology explains how providers are assessed.

1. KYC and identity verification (IDV)

These tools check a government ID, match it to a selfie with liveness detection, and screen the person against watchlists. They answer “is this person real and who they say they are”. They do not monitor on-chain activity.

2. Blockchain analytics and transaction monitoring (KYT)

KYT (Know Your Transaction) tools score deposits and withdrawals by their on-chain exposure to risky entities and raise alerts. They do not verify identity, and an alert is not a suspicious activity report: your team still has to investigate and decide.

Coverage claims are the thing to test in a trial. Ask for the list of chains and tokens supported at full attribution depth, not just address parsing, and run your own historical deposits through it.

3. Travel Rule messaging

These tools find out whether the other side of a transfer is a VASP, exchange the required sender and recipient data with it before or alongside the transfer, and handle self-hosted wallet checks. They do not tell you whether the funds themselves are risky.

The practical problem is interoperability. Your provider must reach the counterparties your customers actually send to, which may use a different messaging network. Ask each vendor which other networks and protocols it can exchange data with, and what happens to a transfer when no connection exists.

4. Sanctions screening

Sanctions screening has two halves in crypto. Customers are screened against sanctions and PEP lists at onboarding and on an ongoing basis (identity vendors such as Jumio sell this). Wallet addresses are screened against OFAC’s SDN List and vendor intelligence (analytics vendors such as Chainalysis Address Screening, Elliptic Lens and TRM Wallet Screening sell this). OFAC itself says its address listings are not exhaustive, so screening only the published addresses is not enough. Location data matters as much: the Bittrex case below turned on users whose IP and physical addresses showed sanctioned regions.

Is KYC verification safe?

For you as the business, KYC data is a liability you must protect, because you hold identity documents and selfies for every customer. The safety question is really a vendor due diligence question. Before you sign, ask each identity vendor:

• Where customer data and biometric templates are stored, and in which country
• How long the vendor keeps images and templates, and whether you can set deletion schedules that match your own record-keeping duties
• Whether the vendor uses your customers’ data to train its own models, and whether you can opt out
• Which sub-processors handle the data, and what security certifications and audit reports the vendor can share

For your customers, the honest answer is that a regulated platform must collect this data by law, and its protection depends on the platform’s and its vendors’ controls.

What is the verification process for using cryptocurrency?

On a regulated platform, the customer-facing flow usually runs like this:

1. Account creation: email or phone, then the platform checks the customer’s country against where it is licensed.
2. Identity check: government ID upload, selfie with liveness detection, and proof of address where required.
3. Screening: sanctions, PEP and adverse media checks on the person.
4. Risk rating: the platform assigns a risk level. Higher-risk customers face enhanced due diligence, such as source-of-funds questions.
5. Ongoing monitoring: every deposit and withdrawal is scored by blockchain analytics, transfers to and from other platforms carry Travel Rule data, and transfers to self-hosted wallets may need proof of ownership (for example above EUR 1,000 in the EU).

Red flags: what enforcement cases show

The cases below are useful because they show which control failed, not just the size of the fine.

Checked 14 October 2026. The OKX plea date is February 2025. One 2026 ranking-page summary dates it to late 2025.

What these mean when you buy tools:

• Buying a monitoring tool is not the same as monitoring. The Coinbase Europe failure came from how the system was configured. Test rules and data feeds after every change, and reconcile alert volumes against transaction volumes.
• Screen location as well as names and addresses. Bittrex had the IP data and did not use it.
• Treat vendor numbers as marketing until tested. Some vendor pages checked for this article give two different figures for the same metric. Ask for the methodology behind any coverage or accuracy number.
• Licensing comes first. No vendor stack fixes serving a market where you are not registered, as the OKX and FIU-IND cases show.

How to choose a crypto compliance vendor

Start from your obligations, not from feature lists. Map each market you serve to its Travel Rule threshold, self-hosted wallet rule and licensing status, then score vendors on the site’s five criteria plus three that are specific to compliance tools:

• Track record: named regulated customers still using the product, and any public enforcement involving the vendor’s controls
• Transparency: documented methodology for risk scores and address attribution
• Security practices: data residency, retention controls and audit reports (see the KYC questions above)
• Pricing clarity: per-check, per-transaction or platform pricing in writing. None of the vendor pages checked listed prices.
• Jurisdiction coverage: ID documents, languages and Travel Rule counterparties in the countries you actually serve
• Chain and token coverage at full attribution depth for the assets you list
• Integration: APIs, case management, and export to your regulator’s reporting format
• Interoperability: whether the Travel Rule tool can reach counterparties on other networks

Most firms end up with one identity vendor, one analytics vendor and one Travel Rule vendor, sometimes with overlap (Sumsub, for example, sells all three). Fewer vendors means fewer integrations, but check each module separately rather than assuming a suite is equally strong everywhere.

What this means for you

As of 14 October 2026, crypto compliance is no longer a future project in the main markets. The EU Travel Rule has applied to every CASP transfer since 30 December 2024, the UK’s since 1 September 2023, and the US rule at $3,000 since well before that. The next deadlines to plan for are the UK authorisation gateway (closing 28 February 2027), the EU AML Regulation (10 July 2027), the new UK regime (25 October 2027) and FATF’s revised R.16 (by the end of 2030). Write down your obligations by market first, then buy tools that cover each one, and test that they work as configured.

For providers in this space, see the KYC/AML & Compliance section. For the rules that change month to month, the regulation roundup tracks new deadlines and enforcement, and the payment gateway guide covers the compliance questions to ask an on-ramp partner.