KYC and AML in Crypto Explained

Know Your Customer (KYC) and Anti-Money Laundering (AML) are regulatory requirements mandating that cryptocurrency exchanges and financial service providers verify the identity of their customers and monitor transactions for suspicious activity. KYC involves identity verification; AML involves ongoing transaction monitoring and reporting obligations to prevent illicit use of crypto assets.

KYC, know your customer, and AML, anti-money laundering, rules require regulated crypto businesses to verify customer identities and monitor transactions for suspicious activity. Most centralized exchanges collect ID, and many check deposits and withdrawals against blacklists. The rules vary by country, and their reach into DeFi and self-custody is still contested. Expect more questions, not fewer, when moving large amounts on regulated platforms.

What happens when you sign up

A regulated exchange will usually ask for a passport or ID card, often a selfie to match it, and sometimes proof of address. Larger accounts can be asked where the money came from. That's the know your customer part. The anti money laundering part keeps running after you're in. Deposits and withdrawals get screened, and many firms use blockchain analytics companies such as Chainalysis and Elliptic, which trace coins across addresses and flag funds linked to hacks, sanctioned addresses or mixers.

What it means for privacy

Once an exchange knows who owns an account, every address that account sends to or receives from can be tied back to a real name. Someone with exchange records, IP logs and clustering tools can often rebuild the whole history of a wallet. For most people that link starts at the on ramp, the moment they buy with a bank card.

Where the lines get blurry

The rules are clear for exchanges and custodians and much less clear for software. In 2022 the US Treasury sanctioned the Tornado Cash mixer contracts. A federal appeals court ruled in November 2024 that the Treasury had overstepped, and the sanctions were lifted in March 2025. That back and forth shows how unsettled the reach of these rules into code and DeFi still is.

Practical points

Keep records of where your coins came from, especially if they passed through DeFi or another exchange. A withdrawal that touches a flagged address can be held for review, so a clean history saves time.