Is KYC required for cryptocurrency exchanges?

Yes, regulated cryptocurrency exchanges generally require KYC in 2026, but the exact duties depend on where they operate and which services they provide. In the United States, an exchange operating as a money transmitter must meet applicable Bank Secrecy Act requirements; that does not mean every exchange follows the identical customer identification rules imposed on banks. Verifying identity is only part of the job: applicable obligations also include an AML program, recordkeeping, transaction monitoring and suspicious activity reporting.

Why this matters

If you operate an exchange, the practical question is not whether to add an ID upload. It is which obligations attach to your business, when you must identify customers and what evidence you need to retain.

A completed identity check cannot establish that every later transaction is acceptable. Your onboarding process needs to connect with ongoing AML monitoring for crypto exchanges, rather than end when a customer passes verification.

For customers, the distinction explains why an exchange can request information after account opening. An identity check answers who you are. A later review can address the purpose of a transfer, the source of funds or a change in account activity.

Is KYC required for cryptocurrency exchanges?

KYC is generally required for regulated exchange activity, but cryptocurrency itself does not create one worldwide onboarding rule. Classification comes first. A business that exchanges or transmits convertible virtual currency for customers can fall within financial-services rules even when it never handles traditional currency.

For a 2026 US assessment, the central references are FinCEN's convertible virtual currency guidance and the money services business AML requirements in 31 CFR § 1022.210. Bank customer identification programs are addressed separately in 31 CFR § 1020.220. These are different legal frameworks, not interchangeable onboarding checklists.

Use this table to identify the question your legal assessment must answer. It is not a substitute for classifying the actual service. Two businesses with similar websites can have different obligations because they handle customer assets differently.

What does a US cryptocurrency exchange need to do?

A US exchange that qualifies as a money services business must maintain an applicable risk-based AML program. Under 31 CFR § 1022.210, the program includes internal controls, a designated compliance officer, training and independent review. Registration and additional requirements depend on the business's classification and activities.

The useful distinction is between a regulatory obligation and a particular verification technique. Collecting a government-issued ID is a technique. Establishing and operating an appropriate AML program is an obligation.

For your 2026 operating plan, separate the work into these steps:

1. Classify the business. Document what you exchange, whose assets you hold and whether you transmit value for customers. Assess federal and applicable state requirements separately.
2. Identify customers. Establish the information and verification needed for your activities, applicable rules and assessed customer risk. Address business customers as well as individuals.
3. Apply screening. Establish applicable sanctions controls and procedures for resolving potential matches. An identity match and a sanctions match answer different questions.
4. Review activity. Define how transaction patterns, customer information and unusual behavior lead to further review. Set responsibility for escalation and required reporting.
5. Keep records. Retain the evidence required for your business and the applicable rule. Make decisions retrievable, not just visible on a dashboard.

This sequence turns a legal assessment into an operating process. Each step needs an owner and a decision rule; buying verification software does not supply either automatically.

*Customer verification belongs inside the operating process, not at its endpoint.*

Which thresholds matter, and what do they not mean?

A transaction threshold is not a blanket exemption from KYC. Different thresholds apply to different duties, and an exchange's customer policy can require identification before a particular recordkeeping threshold is reached.

Three regulatory reference points help prevent common mistakes in a 2026 review:

• $3,000 in the United States: Applicable funds-transfer recordkeeping and Travel Rule provisions generally use this threshold. See 31 CFR § 1010.410(e) and (f) and FinCEN's guidance on their application to convertible virtual currency.
• 5 years in the United States: 31 CFR § 1010.430(d) generally requires retention of records that the relevant Bank Secrecy Act rules require. The specific record obligation still needs to be identified.
• €1,000 in the European Union: Under the EU Transfer of Funds Regulation, transfers exceeding this amount involving a self-hosted address trigger specified ownership or control assessment duties for the covered crypto-asset service provider.

The $3,000 US threshold does not mean an exchange can ignore customers below that amount. The €1,000 EU threshold does not mean smaller transfers are outside all information requirements. And 5 years is a regulatory recordkeeping reference, not a reason to retain every piece of personal information without considering other applicable duties.

Read the threshold together with the duty it modifies. A number taken out of its legal context makes a poor onboarding policy.

How do cryptocurrency exchange requirements differ outside the US?

Outside the United States, assess the jurisdiction's own rules rather than exporting a US checklist. Licensing, customer due diligence, transfer information and reporting can sit in different legal instruments.

In the European Union, the Transfer of Funds Regulation establishes information requirements for covered crypto-asset transfers involving crypto-asset service providers. MiCA addresses authorization and other requirements for covered services. MiCA authorization and AML compliance are related responsibilities, not the same task.

FATF Recommendation 15 and its interpretive note provide an international framework for virtual assets and virtual asset service providers. FATF standards are implemented through national law; they do not function as a single worldwide exchange license.

For a cross-border business in 2026, record which customers you serve and which services you provide in each market. Then map the applicable obligations. A customer-facing promise of global access should follow that assessment, not determine it.

Why cryptocurrency exchange KYC requirements vary

The differences come from identifiable features of the business, not just the exchange's preference for a longer signup form.

• Jurisdiction. Countries apply their own licensing, AML and customer due diligence requirements. State-level requirements also matter for a US business.
• Business activity. Exchanging assets, transmitting value, providing custody and supplying software are not automatically treated alike.
• Customer type. An individual account and a business account require different evidence. Business onboarding can involve ownership and control information.
• Customer and transaction risk. A risk-based program must account for relevant customer characteristics and activity rather than apply a document checklist without context.
• Transfer structure. Transfers involving another service provider and transfers involving a self-hosted address raise different information and assessment questions.
• Changes after onboarding. New account activity or changed customer information can require additional review even after initial verification succeeds.

Keep these factors in your policy separately. Otherwise, a rule intended for one customer type or transfer route can spread across the whole service without a clear reason.

Is an ID check enough to satisfy exchange KYC requirements?

No. An ID check supports identity verification; it does not replace the exchange's complete compliance program. A successful document check does not establish the source of funds, resolve a sanctions match or explain unusual transaction activity.

Use verification results as evidence for an onboarding decision. Decide what happens when information is incomplete, inconsistent or requires further review. The output should support a documented decision rather than become a pass badge that overrides every other control.

For operators who need a shared-link identity check, Checktiv is best suited to link-based identity verification, not as a substitute for a complete exchange AML program. Checktiv provides link-based identity verification and background/fraud screening, which supports customer review without making a verification result a legal approval.

The strength of Checktiv's shared-link approach is a straightforward way to request verification. Its boundary is equally important: your exchange still needs to determine legal applicability, customer acceptance rules, monitoring and reporting responsibilities. Choose the workflow around those responsibilities, not the other way around.

Can a cryptocurrency exchange legally offer no-KYC accounts?

A no-KYC label does not prove an exchange is exempt from regulation. Whether a service can operate without a particular identity check depends on its activities and the applicable legal requirements.

A software provider that does not perform regulated exchange or transmission activity presents a different question from a business that holds customer funds and executes transfers. Technical design matters, but so do the people and entities operating the service.

If you are evaluating an exchange as a customer, check the operator's identity, its stated jurisdiction and its explanation of account restrictions. Do not treat the absence of an ID request as evidence of either compliance or noncompliance on its own.

Does using a self-hosted wallet remove KYC requirements?

No. A self-hosted wallet does not remove a regulated exchange's obligations. The exchange must assess its side of the transaction under the rules that apply to it.

The wallet holder and the exchange are different actors. A person holding their own assets does not become an exchange solely by using a wallet, but that distinction does not erase the service provider's transfer-information or customer-review duties.

In the EU, the €1,000 ownership or control assessment threshold is one specific example of obligations tied to self-hosted addresses. It should not be converted into a worldwide rule or a general permission to skip verification below that amount.

One last thing

Before changing your 2026 onboarding flow, write down which obligation each requested field serves. Name the rule or risk-based policy, the decision it supports and the evidence you retain.

That exercise separates useful customer checks from unnecessary friction. It also exposes a common gap: collecting more documents while leaving responsibility for the actual approval decision unclear. Have qualified counsel confirm the legal mapping before you deploy the policy.

Related guides

• How sanctions screening works
• Identity verification for fintech companies
• From Plaid to verified bank accounts: a KYC workflow