Table of Contents
KYC and AML are also frequently used in the same sentence and some people start to believe they mean the same thing. They're not. KYC (Know Your Customer) is a process that involves determining who you are and verifying your identity.
AML (Anti-Money Laundering) is the big picture. AML is the entire framework a provider adopts to evaluate, track and act on money-laundering and terrorist-financing (AML/TF) risks.
There is one more term that you should know. In EU law, the majority of what "KYC" is commonly referred to is actually customer due diligence (CDD). It's the same concept, just a bit more specific.
What Is the Difference Between AML and KYC?
Based on the meanings of these, we can infer that KYC is a precursor to AML. A provider cannot determine whether or not a customer's activity is legitimate without knowing who that customer is. Once your identity is confirmed, the larger AML process kicks in.
It may be a risk assessment, continuous transaction surveillance, further investigation and, if required by law, a suspicious activity report to the National Financial Intelligence Unit (FIU). The following is an explanation of how the two are used in practice.
The KYC process is not a box to be ticked on sign up. It's a base that continues to be utilised for as long as you are a customer. It may also remind you to update the information at any time.
Which AML/KYC Rules Apply to Crypto Services in the EU?
A crypto-asset service provider (CASP) that has been authorised by MiCA is part of the EU's AML/CFT framework. They are obliged to request AML/KYC information, just like banks.
The main duties of AML come from the EU Anti-Money Laundering Directive (2015/849). This directive is written into the national law of each EU member state, but how they are executed can differ from country to country.
Crypto transfers have their own layer. Regulation (EU) 2023/1113, the recast Transfer of Funds Regulation, has applied to relevant crypto-asset transfers since 30 December 2024. That's where the EU's crypto Travel Rule comes from.
And there's a change on the horizon. The Anti-Money Laundering Regulation, (EU) 2024/1624, will generally apply from 10 July 2027. It replaces the national patchwork with one directly applicable rulebook.
Why Is Identity Verification Needed If Blockchains Are Transparent?
Blockchains are public ledgers, where everyone has access to transaction details. They don't know who is behind these addresses. An address is a string of characters. It's not a name, passport or company registration. Control hundreds of addresses using one person.
You will see the transaction when you view the transaction history. KYC associates it with a flesh-and-blood person or company. AML needs both. This is also how CASPs operate on a risk-based approach. Not all customers are subjected to the same level of investigation.
Providers weigh four kinds of factors, including who the customer is, their location, transaction size/frequency, and product. Low risk = normal checks. The more you have the more you are at risk.
What Information Can a Crypto Platform Ask For?
There's no universal checklist. It depends on the provider, the country and your risk profile. Most requests fall into these categories:
- Identity details: full name, date of birth, nationality
- An identity document: passport or national ID, often with a selfie
- Address information: sometimes with proof of address
- Purpose of the relationship: how you plan to use the account
- Occupation or business activity
- Beneficial ownership: for companies, who ultimately owns or controls them
- Source of funds: usually when risk is higher
The first three are standard for almost everyone. The rest depend on context.
Does KYC End After an Account Is Opened?
EU guidelines require that providers maintain customer data and track transactions during the course of the business. The purpose is to find out if your activity is still in keeping with what they know about you.
Imagine that you registered to make a €200 monthly investment. A year later there is an influx of €80,000 from several new sources. Nothing's necessarily wrong. However, the profile is no longer relevant and the provider might ask.
Why Can a Platform Ask About the Source of Funds?
Where the particular money or crypto was obtained is known as source of funds. It is not the same as source of wealth, which is the way in which you have created your total assets.
Only a few platforms will require source of funds information during large deposits, changes in usage or if you are from a higher risk area. A provider might want to know where you got specific cryptos or euros, and provide proof of:
- Pay slips or bank statements
- Use any type of trade history or account statements from another exchange
- This document will provide evidence of a property or business sale.
- Cryptocurrency details that include record of where the crypto has been sourced from.
If you have had crypto for a long time, store the previous crypto exports and tax statements from the exchange. They are there to help you get your stressful process from a five-minute upload.
What Does the Travel Rule Change for Crypto Transfers?
The Transfer of Funds Regulation requires CASPs to obtain and provide certain information on the originator (sender) and the beneficiary (recipient) of a covered transfer. Names, wallet address/account number; additional originator information like address or ID number.
This is true between two CASPs, regardless of quantity. Unlike some payment rules, there is no minimum limit for using crypto. This data that they gather isn't recorded on the blockchain.
It flows from provider to provider via distinct compliance routes. Your on-chain transaction is identical to yours. Self-hosted wallets are not handled the same way.
No provider is available on the other side with whom to exchange information, so CASPs collect the information. If the amount is transferred over €1,000 it will also verify whether the address you are using is owned or controlled by you.
What Happens If a Transaction Is Flagged for Additional Review?
Being flagged doesn't necessarily indicate an illegal action. Most platforms have a monitoring system that alerts for patterns or risk factors, such as a large volume, links with risky addresses and money moving in and out very quickly.
An alert is simply a call for someone to investigate. Depending on the circumstances, the provider may ask for further information, check transactions, could postpone payments or reverse transactions. All of this doesn't happen without work.
But if there is still a suspicion, the provider might be obliged to report to the FIU. If so, it is usually not allowed to tell you, and this is why some responses may be ambiguous. When flagged, respond promptly and succinctly, using documents. Most reviews are done once the context is present.
Practical Example: Sending Crypto From a Self-Hosted Wallet to an Exchange
Let's assume there's a fictional user called Martin. This is Martin's first full KYC with an EU regulated CASP last year. Martin would like to send Bitcoin from his own self-hosted hardware wallet to his exchange account today.
The exchange already has a clear idea of who Martin is. However, the AML tests don't end there. The provider must evaluate the relationship since the money is being sent from an outside wallet that is self-hosted. They have to determine if it is a real wallet belonging to Martin or not.
They may temporarily suspend the deposit if there are any risk factors or if the amount of the transfer is less than expected. This is because they want to hear more before they accept his story.
What Do AML and KYC Not Guarantee for Users?
AML and KYC are rules, and like every rule, they have their limitations. Passing KYC doesn't make a platform risk-free. They cover financial-crime controls, not market swings or how a provider runs its business.
AML can't catch everything. Fraud, stolen funds or laundered money can still slip through a regulated service. Also, there's no single EU-wide process yet. Until AMLR applies, national rules and provider risk policies differ, leading to the differences we see.
While AML and KYC are great protection tools, they won't stop a scam you authorise yourself. If someone talks you into sending crypto, KYC doesn't undo it. In the end, you still have a role to play in protecting your coins.
Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.