Crypto exchange compliance is more than collecting IDs. How to build a tiered KYC onboarding flow that satisfies MiCA, FinCEN and the FCA without losing users.
Table of contents
Key highlights
- Binance paid USD 4.3 billion in November 2023 after pleading guilty to Bank Secrecy Act violations, including failing to maintain an effective AML programme. Coinbase has been through multiple settlements. These are compliance failures, and underneath them sit infrastructure failures: the platform never had the architecture to do what its operating licence required.
- The 2026 crypto KYC stack is tiered, not flat. Tier 1 (email plus phone) for view-only or below-threshold use, Tier 2 (government ID plus liveness) for trading and deposit, Tier 3 (Enhanced Due Diligence plus source of funds verification) for high-volume or high-risk profiles.
- Regulatory composition is now jurisdiction-stack rather than single-regulator. EU exchanges run MiCA plus the Transfer of Funds Regulation plus national AML law, with the AML Regulation (EU) 2024/1624 applying directly from 10 July 2027. US exchanges run FinCEN plus OFAC plus state-level Money Transmitter requirements. UK exchanges run FCA plus MLR 2017.
- Conversion-killing UX and data-collection gaps are two common reasons exchanges struggle with compliant onboarding. A tiered flow with progressive disclosure tends to convert better than a flat all-or-nothing flow, while satisfying the same regulatory bar.
- Transaction monitoring is not optional anymore, even at the early-stage exchange tier. The Travel Rule transmits identity at the moment of transfer; transaction monitoring is what catches the patterns after.
- Zyphe's crypto exchange onboarding stack ships as an API-first integration with NFC chip read, two-step biometric liveness, sanctions screening, document coverage spanning 190+ countries, 240+ company registries for business customers, and the structured-record output the Travel Rule layer consumes downstream.
Crypto KYC compliance is the system of identity verification, Customer Due Diligence, sanctions screening, and ongoing monitoring that crypto exchanges must operate to satisfy their licensing regulator. In 2026 the stack runs across MiCA in the EU, FinCEN and OFAC in the US, FCA and MLR 2017 in the UK, and equivalent regimes elsewhere.
TL;DR
Crypto exchange compliance in 2026 is not about whether you collect IDs. It is about whether your architecture can do what your operating licence requires. The exchanges that have paid billions in settlements over the last three years did not lack a KYC vendor. They lacked the underlying capability to verify identity at the level the regulator required, screen counterparties at the moment of transaction, monitor flows after onboarding, and produce regulator-defensible documentation for every decision. This piece walks through what to verify, by what tier, in which jurisdiction, with what monitoring layer underneath, and what the architectural mistake looks like that produces a settlement instead of a clean audit.
Reading time: ~8 minutes
What does a crypto exchange actually have to verify?
A 2026 crypto exchange operating under any major regulated jurisdiction has to verify three categories of customer information, at three escalating tiers of intensity.
The three escalating tiers map onto the classic verification pillars covered in CIP, CDD, and EDD.
Tier 1 verification (account creation, view-only access). Email address (verified through a confirmation link), phone number (verified through SMS or call-back), and device fingerprint. This tier permits read-only access to public market data and educational content, with no trading, no deposit, no withdrawal. In most jurisdictions the threshold for any actual transfer of value (fiat in, crypto out, crypto-to-crypto trade above a de minimis level) lifts the customer into Tier 2.
Tier 2 verification (full trading access). Verified government-issued identity document (passport, national ID card, or driving licence where the jurisdiction recognises it), with NFC chip read where the document supports it (modern EU passports, eIDAS-compatible national IDs). Two-step biometric liveness with deepfake detection: passive micro-movement detection plus active consistency check. Verified primary residence address (utility bill, bank statement, government correspondence, or eIDAS-recognised electronic-ID source). Sanctions screening against OFAC, EU consolidated, the UK Sanctions List, UN, and government-direct lists. PEP (Politically Exposed Person) screening. Adverse media check.
Tier 3 verification (Enhanced Due Diligence). Triggered by transaction volume thresholds, jurisdiction risk (high-risk-third-country origin), product risk (privacy coins, mixers, certain DeFi protocols), or pattern risk (structuring, rapid in-and-out, counterparty risk). Adds: source of funds documentation (employment record, business records, sale-of-asset evidence, gift declaration with corroboration), source of wealth documentation for the broader pattern, Politically Exposed Person enhanced screening with PEP-status revalidation, board-resolution-level approval for relationship initiation, ongoing enhanced monitoring with named-officer accountability.
For the line between standard and enhanced review, see enhanced due diligence versus standard CDD.
The error operators make is treating these tiers as a checklist instead of as a risk-rated cascade. A Tier 1 customer who tries to deposit USD 50,000 in their first week should not be Tier 2 verified at deposit time; they should be Tier 3 escalated at the pattern-detection layer, with deposit held until EDD is complete. The KYC layer alone cannot do this; the KYC layer wired to transaction monitoring can.
How do regulatory requirements differ by exchange jurisdiction?
The 2026 enforcement geography is the reason most crypto exchanges run multi-jurisdiction licensing strategies. The requirements compose differently in each major regulated jurisdiction.
European Union (MiCA + TFR + national AML law). A CASP (Crypto-Asset Service Provider) licence under MiCA is now the entry condition for offering services to EU residents. Travel Rule mechanics sit in the Transfer of Funds Regulation. National AML law sets the broader AML programme requirements today, and from 10 July 2027 the AML Regulation (EU) 2024/1624 sets them directly. In 2026, exchanges are supervised by their national competent authorities. AMLA, the pan-EU authority that became operational in 2025, selects about 40 entities for direct supervision in 2027 and starts supervising them in 2028, six months after it publishes the list. Whoever supervises the exchange, every KYC, EDD, and SAR decision should be documented with policy version, evidence reviewed, and the named accountable individual, because supervisors review files on a sampled-case basis.
We break down what these obligations mean for crypto firms in our MiCA KYC requirements guide.
United States (FinCEN + OFAC + State MTL + SEC where applicable). FinCEN's Bank Secrecy Act applies the recordkeeping and Travel Rule layer. OFAC sanctions screening is mandatory on every counterparty, every transaction. State-level Money Transmitter Licences apply with state-specific reporting and capital requirements, and New York adds its own BitLicense for virtual currency business activity on top. SEC oversight applies where any token offered is determined to be a security; the operative test in 2026 is shaped by recent enforcement actions and continues to evolve.
United Kingdom (FCA + MLR 2017). FCA registration is the entry condition. MLR 2017 carries the AML/KYC requirements, including the Travel Rule. The Senior Managers and Certification Regime does not apply to firms that are only registered under MLR 2017, but accountability is still personal: the Regulations require a nominated officer and, where the size and nature of the business call for it, a board member or senior manager responsible for compliance; the FCA must be satisfied that the firm's officers, managers and beneficial owners are fit and proper; and it can fine an officer who was knowingly concerned in a breach, not just the firm.
Singapore (MAS), UAE (VARA), Hong Kong (SFC), Switzerland (FINMA), Japan (FSA). Each operates its own licensing and KYC standard, broadly aligned with FATF but with jurisdiction-specific quirks. Singapore's PSA imposes tight ongoing AML expectations. VARA in the UAE has rapidly become a credible regulated jurisdiction with structured ongoing examinations. Switzerland's FINMA continues to be the leading example of risk-based, principle-driven supervision.
The procurement implication: a crypto exchange operating in two or more major jurisdictions cannot use a KYC platform optimised for only one. The platform has to compose with the jurisdictional requirements of every market the exchange serves.
How do you design a tiered onboarding flow without destroying UX?
The exchanges with the best 2026 conversion data share three design principles. Each principle protects compliance and customer experience simultaneously.
Progressive disclosure is also the lever for reducing KYC onboarding drop-off.
Progressive disclosure. Tier 1 onboarding completes in 60-90 seconds (email plus phone plus device). The customer enters the product. They see the markets, read educational content, configure their dashboard. When they try to fund their account or place a trade, the Tier 2 flow opens contextually. They have already committed mentally to the product; the friction lands on a customer who is already engaged, not on a stranger.
Tier 2 done in a single session, not split. The KYC industry once treated Tier 2 as a multi-day asynchronous process: submit your ID, come back tomorrow when we verify it. That UX is dead. The 2026 standard is sub-90-second Tier 2 completion: NFC chip read, liveness, automated sanctions and PEP screening, all done in the same session the customer started. The customer is funded and trading before the day ends. This requires platform infrastructure that can verify in real time, not a queue-based vendor.
EDD as escalation, not as a separate flow. Tier 3 is rarely initiated by the customer; it is triggered by the platform when the risk score warrants. A customer should not be presented with EDD upfront; they should be presented with EDD only when the platform detects the trigger (high deposit, high-risk jurisdiction, suspicious counterparty pattern). When EDD is triggered, the flow asks for the specific documents the regulator wants, with clear framing of why and what comes next.
The architectural lesson: the onboarding flow is a graph, not a sequence. The customer enters at Tier 1, escalates to Tier 2 when they engage with value transfer, and escalates to Tier 3 only when the risk model flags. Vendors that ship flat all-or-nothing onboarding cannot support this architecture.
Why is transaction monitoring inseparable from KYC?
Crypto exchanges that buy KYC as a one-time event and transaction monitoring as a separate downstream system leave a gap between the two that manual review cannot close. The reason is structural.
KYC at onboarding captures a customer's identity and risk profile at a single point in time. Transaction monitoring observes the customer's behaviour over time and updates the risk profile based on what the customer actually does. Without monitoring, the KYC record decays into a stale snapshot; a customer who passed Tier 2 in January and starts moving USD 200,000 a week in March is still tagged at the January risk level if the systems are not connected.
The 2026 architecture treats KYC and monitoring as one system, not two. Concretely:
The KYC record is the system of identity. Every transaction touches the KYC record through the customer reference. Sanctions hits, adverse media events, PEP-status changes, jurisdictional re-classifications, all flow back into the same customer record. The risk score is dynamic, not static.
The transaction-monitoring layer feeds the AML alert queue. Alerts are triaged with the full KYC record context, not just the transaction. An alert on a customer who is Tier 3 EDD-completed with verified source of funds is a different alert than one on a Tier 2 customer who slipped through with weak Tier 2 verification.
The audit trail covers both layers. Every triage decision, every alert closure, every SAR filing has access to the full KYC plus monitoring context, and the per-decision documentation reflects that. Supervisors (an EU national authority, the FCA, or in the US the IRS, which examines money services businesses on FinCEN's behalf) can sample cases that span both layers; an exchange that cannot produce the joined record is at risk of an adverse examination.
For deeper coverage, our AML transaction monitoring 2026 piece walks through what the regulations require from the monitoring layer specifically.
What does Zyphe's crypto exchange onboarding stack actually cover?
Zyphe's stack is built for the tiered, jurisdiction-composed, KYC-plus-monitoring architecture above. Concretely, the platform ships:
The broader approach sits inside our AML strategy for crypto exchanges.
Identity verification at Tier 2 standard. NFC chip read from passports and ID cards (ICAO 9303 and eIDAS-compatible), two-step biometric liveness with passive micro-movement detection plus active consistency check for deepfake resistance, automatic rejection of submitted images (the system captures 10-15 photos itself during liveness to prevent fraud), one-click re-verification for users already in the Zyphe credential network.
Sanctions, PEP, and adverse media screening. Coverage across World-Check, ComplyAdvantage-equivalent feeds, OFAC, EU consolidated, the UK Sanctions List, UN, and government-direct lists. PEP screening with jurisdiction-specific PEP-status taxonomies. Adverse media with internal-agent triage so only true-positive matches surface to compliance officers.
KYB and corporate-customer flows. Direct integration with 240+ corporate-registry databases plus US state Secretary of State APIs, ACRA Singapore, DIFC, and equivalent registries in other jurisdictions. Recursive UBO trace to low ownership thresholds. Specialist-agent handling for opaque jurisdictions (BVI, Cayman, Marshall Islands).
For verifying business customers at scale, see our KYB software guide.
Decentralised storage with regulator-defensible audit trail. Source documents sharded across thousands of decentralised storage nodes using a 29-of-100 threshold scheme, per-region data residency, the end user holds the encryption key, no central honeypot. Every verification, every credential issuance, every revocation, every triage decision lands in an immutable case file that EU national supervisors and the FCA can review case by case, and that supports the FinCEN reasonably-designed standard.
Travel Rule-compatible output. Verified records exposed through a structured API in the exact shape TRISA, VerifyVASP, and TRP (the OpenVASP Association's protocol) transmit. The KYC output becomes the Travel Rule input with no manual transcription.
MCP support. Compliance and product teams can build, change, and operate the platform by talking to Claude, Cursor, or ChatGPT through the Zyphe MCP integration.
Integration timeline: 15 minutes to a working sandbox, 1-2 weeks to a production deployment on a Tier 2 jurisdiction, 4-8 weeks for a fully Tier 3 EDD configuration tuned to the exchange's specific risk taxonomy.
The create call, the sandbox flag and the webhook signature behind that timeline are documented on the KYC and KYB API page.
What does the compliance tier matrix look like across jurisdictions?
The tier matrix below shows what verification each tier requires under each major regulated jurisdiction in 2026. Use this as the procurement specification when evaluating a KYC platform.
| Tier | Capability | EU (MiCA + TFR) | US (FinCEN + OFAC) | UK (FCA + MLR 2017) | SG (MAS) | UAE (VARA) |
|---|---|---|---|---|---|---|
| Tier 1 | Email + phone + device fingerprint | Required | Required | Required | Required | Required |
| Tier 1 | Geolocation and jurisdictional gating | Required | Required | Required | Required | Required |
| Tier 2 | Verified government ID, NFC where supported | Required | Required | Required | Required | Required |
| Tier 2 | Two-step biometric liveness | Required | Required | Required | Required | Required |
| Tier 2 | Verified primary address | Required | Required | Required | Required | Required |
| Tier 2 | Sanctions screening (OFAC, EU consolidated, UK Sanctions List, UN) | Required | Required | Required | Required | Required |
| Tier 2 | PEP screening with revalidation | Required | Required | Required | Required | Required |
| Tier 2 | Adverse media | Required | Required | Required | Required | Required |
| Tier 3 | Source of funds documentation | EDD trigger | EDD trigger | EDD trigger | EDD trigger | EDD trigger |
| Tier 3 | Source of wealth documentation | EDD trigger | EDD trigger | EDD trigger | EDD trigger | EDD trigger |
| Tier 3 | Enhanced PEP screening | Required (PEP-tagged) | Required (PEP-tagged) | Required (PEP-tagged) | Required (PEP-tagged) | Required (PEP-tagged) |
| Tier 3 | Named-officer relationship approval | Required | Best practice | Required | Required | Required |
| Cross-tier | Per-decision audit trail | Supervisor-reviewable | FinCEN reasonably-designed | FCA-reviewable | MAS audit-ready | VARA-defensible |
| Cross-tier | Travel Rule transmission (threshold varies by jurisdiction) | TFR (every transfer, no threshold) | 31 CFR 1010.410 (USD 3,000 and above) | MLR 2017 Part 7A (full data from £800 cross-border) | PSA | VARA Travel Rule |
The matrix is not exhaustive but it captures the cross-jurisdictional minimums. Exchanges operating in three or more of these jurisdictions need a KYC platform that can compose the requirements per customer, per market, per tier, without re-architecting per jurisdiction.
What are the operator mistakes that produce a $4 billion settlement?
Five architectural mistakes are worth designing out from the start. They are not compliance-officer mistakes. They are infrastructure decisions made long before any compliance officer joined.
Treating KYC as a one-time event. The customer onboarded once at Tier 2. The exchange never re-verified, never re-screened, never re-tiered. When the customer's pattern shifted into high-risk territory, the system still treated them at the original risk level. Keeping customer due diligence current is an ongoing obligation, not an onboarding step.
Buying transaction monitoring separately from KYC. Vendor A handled onboarding. Vendor B handled monitoring. They did not share a customer record. Alerts were triaged without KYC context. EDD triggers were not routed to the onboarding stack. The seams between the two systems is where the failures lived.
Skipping the Travel Rule layer because it felt optional. It was not optional. A missing Travel Rule layer is a breach in its own right, on top of any broader AML programme failure.
Allowing self-attested data into the verified record. A customer self-attested address that the platform never verified is not a verified address, and presenting it as one overstates CDD quality to the regulator.
Centralised PII storage. Exposures like the unsecured database Cybernews reported in February 2026 and linked to IDmerit (a claim IDmerit disputes) show why centralised KYC stores are honeypots. The architectural alternative (decentralised storage with no central honeypot) is now both available and increasingly the standard procurement teams ask for. We covered the breach surface specifically in Why Your KYC Vendor Is Your Biggest Data Breach Risk.
The math behind why centralised stores keep getting breached is in Is KYC safe in 2026.
Exchanges that fix all five of these architectural mistakes do not produce settlement-level outcomes. Exchanges that fix none of them produce them by structural inevitability.
When is full crypto KYC investment the wrong move right now?
Three scenarios where the right move is to scope down rather than scope up on the KYC stack.
The exchange is pre-launch and operating in a single light-touch jurisdiction. A pre-launch exchange testing product hypothesis with a small group of approved beta users can run manual KYC against a documented CDD policy. Adopting a multi-jurisdiction stack at this stage is over-investment. The trigger to upgrade is the move from beta to general availability, or the first jurisdictional expansion.
The exchange operates under a single regulator that has not yet enforced multi-jurisdiction composition. Some regulated exchanges with a single national licence (and no plans to expand for 12-18 months) can run a single-jurisdiction KYC stack rather than the multi-regulator composition the broader market increasingly adopts. The right move is to document the scope explicitly and plan the upgrade when expansion lands.
The exchange cannot dedicate a named MLRO or AML officer. Tiered KYC plus transaction monitoring plus Travel Rule produces alerts that require human review. Without a named accountable individual, the audit-trail surface is incomplete regardless of how good the platform is. Hire or contract the MLRO before the full stack deployment.
Founders who skip this step learn the cost the hard way, as we document in the founder decisions that killed crypto startups.
Outside these scenarios, full crypto KYC stack investment is the right call. The remaining question is which platform composes across the firm's actual jurisdictional footprint.
What is the bottom line on building a compliant crypto exchange onboarding flow?
The crypto exchanges that survive the 2026-2028 enforcement cycle will be the ones whose architecture matches their operating licence. A tiered KYC stack, jurisdiction-composed, wired to transaction monitoring, with Travel Rule-compatible output and per-decision audit-trail documentation. The exchanges that produce settlement-level outcomes are the ones whose architecture was built for a different era. Procurement teams that get this right ship in 4-8 weeks; those that buy KYC and monitoring from different vendors spend the next 18 months in remediation.
Get a custom compliance stack assessment, book a call, and our team will evaluate your exchange's KYC, monitoring, and Travel Rule stack against the 2026 standard.
Related resources
- FATF Travel Rule for VASPs 2026, Practical compliance guide
- AML transaction monitoring 2026, What the regulations require
- Why your KYC vendor is your biggest data breach risk, Centralised storage exposure
- KYC API integration, 15-minute integration guide
- Decentralised KYC primer, What it is, how it works
- Zyphe MCP launch, Talk to your compliance stack
Cited sources
- European Union, Markets in Crypto-Assets Regulation (EU) 2023/1114
- European Union, Transfer of Funds Regulation (EU) 2023/1113
- FinCEN, Bank Secrecy Act requirements for VASPs
- FCA, Cryptoasset firms registration and supervision
- FATF, Virtual Assets and VASPs guidance
- European Union, Regulation (EU) 2024/1624, the AML Regulation
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.