How KYC and AML Work for Crypto and Fiat Payments

A payment either clears or it does not, and the difference often comes down to two acronyms most engineers would rather not think about: KYC and AML. Get them right and they run invisibly inside your product. Get them wrong and they surface as frozen accounts, regulator questions, and the kind of remediation project that stalls a roadmap for a quarter.

This guide explains what KYC and AML actually are, how they differ, and how the process runs step by step for a platform that moves both crypto and fiat. It is written for the team building the product, so it ends with how to embed these controls in an API flow rather than treating them as a manual chore after launch. For the wider picture of standing up a compliant platform, this pairs with our guide on how to build a crypto and fiat payment platform.

What KYC and AML actually mean

KYC (Know Your Customer) is the process of identifying and verifying who your customer is before you let them transact. AML (Anti-Money Laundering) is the wider program of policies, controls and reporting that keeps your platform from being used to launder money or finance crime.

The relationship is simple: KYC is one component inside AML. KYC answers “who is this person or business.” AML answers “is this activity legitimate, and can I prove I checked.” A useful way to hold it: KYC is a gate you pass once (and revisit), while AML is a system that never stops running.

For businesses rather than individuals, the equivalent of KYC is KYB (Know Your Business), which verifies the legal entity, its registration and its beneficial owners. Everything below applies to both, with KYB adding an ownership layer on top.

KYC vs AML: the difference in one table

KYC is a subset of AML, focused on identity at onboarding, while AML covers the full lifecycle from screening to monitoring to reporting. Confusing the two is the most common mistake teams make when they scope compliance, because they build the gate and forget the system behind it.

Dimension	KYC	AML
Scope	Identity of a single customer	Whole program against financial crime
When it runs	Onboarding, plus periodic refresh	Continuously, across the customer lifecycle
Core activities	Document checks, biometrics, KYB ownership	Screening, monitoring, reporting, recordkeeping
Question it answers	Who is this?	Is this activity legitimate?
Relationship	A component of AML	The program that contains KYC

The takeaway: you cannot have a working AML program without KYC, but KYC on its own is not AML. If your plan stops at “verify the user at signup,” you have built roughly a third of what regulated activity requires.

The KYC process, step by step

KYC runs in a defined sequence: collect identity, verify it, assess risk, then keep it current. Skipping or shortcutting any step is what later shows up as a compliance gap.

1. Identification. Collect the data that identifies the customer: full name, date of birth, address, government ID for individuals; legal name, registration number and beneficial owners for businesses.

2. Identity verification. Prove the data is real and belongs to the person presenting it. This typically combines document authentication (checking an ID is genuine) with a biometric or liveness check (confirming the person matches the document).

3. Customer due diligence (CDD). Assess the risk the customer presents based on who they are, where they are, and what they intend to do. Most customers pass standard CDD.

4. Enhanced due diligence (EDD). Apply deeper checks to higher-risk cases: politically exposed persons (PEPs), high-risk jurisdictions, or unusually large expected volumes. EDD means more evidence, source-of-funds questions, and closer ongoing review.

5. Ongoing monitoring. Verification is not a one-time event. Risk profiles change, sanctions lists update, and behaviour drifts, so you re-screen and refresh records on a schedule and when triggers fire.

Here is how standard and enhanced due diligence compare in practice:

Factor	Standard due diligence (CDD)	Enhanced due diligence (EDD)
Applies to	Most customers	PEPs, high-risk regions, large volumes
Identity evidence	Standard ID and verification	Additional documents and corroboration
Source of funds	Not usually required	Documented and reviewed
Review frequency	Periodic	More frequent, closer scrutiny
Approval	Often automated	Typically manual sign-off

How AML monitoring works

AML monitoring is the always-on layer that screens who a customer deals with and watches how they transact, escalating anything that looks like financial crime. Where KYC is a checkpoint, AML monitoring is a continuous feed.

Three controls do most of the work. Sanctions and watchlist screening checks customers and counterparties against government sanctions lists, PEP databases and adverse-media sources, at onboarding and again on each transfer. Transaction monitoring applies rules and models to flag patterns that suggest laundering: structuring below thresholds, rapid in-and-out movement, or flows to high-risk destinations. Suspicious activity reporting escalates confirmed concerns to a human reviewer, who decides whether to file a report with the relevant authority and, where needed, freeze the activity.

The design principle that matters: these checks belong in the transaction flow, not in a nightly batch that discovers problems after the money has moved. A hit needs to be able to stop a transfer, not just annotate it after the fact.

What changes for crypto and fiat

Regulated crypto activity carries the same core KYC and AML obligations as fiat, plus two crypto-specific controls: wallet screening and travel-rule data exchange. The mistake is treating crypto compliance as a separate discipline instead of an extension of the same program.

Wallet screening checks blockchain addresses against risk databases before you interact with them, flagging funds linked to sanctioned entities, known theft, or illicit marketplaces. It is the on-chain equivalent of counterparty screening.

The travel rule requires that originator and beneficiary information travels with qualifying transfers between regulated institutions, including crypto transfers above an applicable threshold. It lets regulated parties trace funds and screen counterparties, and it applies to fiat rails too. We cover the mechanics in the travel rule explained for crypto and fintech.

A platform that moves both crypto and fiat should run one compliance layer across both. Two disconnected systems (one for cards and bank transfers, one for on-chain movement) create blind spots exactly where laundering tries to cross between rails. This is also why your custody model matters: a non-custodial architecture changes what you have to safeguard, though it does not remove your KYC and AML obligations.

Embedding KYC and AML in your payment flow

The cleanest way to run KYC and AML is inside your onboarding and transaction flow through an API, so verification and screening happen as part of the movement rather than as a separate manual step. Concretely, that means a customer record you create once, verification and screening events delivered by webhook, and a monitoring layer that can hold a transfer when a rule fires.

The pattern looks like this. You create the customer, kick off verification, and receive the result asynchronously. An idempotency key makes the call safe to retry without creating duplicates, which matters because compliance events must never be double-counted.

curl https://api.tokelia.com/v1/customers \
  -H "Authorization: Bearer $API_KEY" \
  -H "Idempotency-Key: cus_onb_9f3a21" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "individual",
    "profile": {
      "first_name": "Ana",
      "last_name": "Reyes",
      "country": "MX",
      "date_of_birth": "1991-04-12"
    },
    "kyc": { "level": "standard" },
    "screening": { "sanctions": true, "pep": true, "adverse_media": true },
    "webhook_url": "https://yourapp.com/webhooks/compliance"
  }'

The response comes back with the customer in a pending verification state. When the checks finish, a webhook delivers the outcome, and only a verified customer can hold a balance or transact:

{
  "id": "cus_7Qa1",
  "type": "individual",
  "kyc_status": "pending",
  "screening_status": "pending",
  "risk_tier": null,
  "created_at": "2026-06-27T14:03:00Z"
}

From there, transaction monitoring runs on every movement. When a rule fires, the transfer can be held in a review state and surfaced to your operations team rather than settling silently. The point is not the exact field names but the shape: verification and screening are events in your flow, delivered over webhooks, retryable with idempotency, and able to block money movement when they need to.

Regulatory frameworks vary by market

The core obligations (verify identity, screen, monitor, report) are broadly consistent worldwide, but the specific laws, thresholds and supervisors differ by country, so you scope compliance market by market. Treating one country’s rules as universal is a reliable way to get a market entry wrong.

To make this concrete without overreaching: in Mexico, the anchor law is the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI, commonly the “Ley Antilavado”). The CNBV supervises financial institutions, the UIF (Financial Intelligence Unit) is the authority that receives reports, and certain “vulnerable activities” carry their own identification and reporting duties. Fintech activity also intersects with the Fintech Law. In the US, the Bank Secrecy Act framework and FinCEN sit at the center; in the EU, AML directives and, for crypto, dedicated regimes apply.

Because thresholds and obligations change over time and by activity, treat the above as orientation, not legal advice, and confirm the current requirements with local counsel. Which registrations and licences you actually need is a related question we cover in licenses to move crypto and fiat: MSB, EMI and MiCA.

Choosing your compliance tooling

Most teams should integrate KYC and AML through specialised providers rather than build them, because the components are undifferentiated, hard to get right and costly to maintain. What you own is the policy and the review decisions; what you integrate is the plumbing.

There are roughly four categories of tooling to cover:

Capability	What it does	Runs at
Identity verification	Document checks, biometrics, liveness, KYB ownership	Onboarding and refresh
Sanctions and PEP screening	Matches customers and counterparties to watchlists	Onboarding and each transfer
Transaction monitoring	Rules and models that flag suspicious patterns	Every movement
Wallet screening	Checks on-chain addresses against risk databases	Every crypto interaction

You can stitch these together yourself from separate vendors, each with its own contract, data model and failure modes, or you can adopt infrastructure where they arrive as one integrated layer. The integrated route removes the reconciliation headaches that appear when four systems disagree about the same customer.

What it costs to get wrong

AML failures are not a paperwork risk, they are an existential one: penalties, forced remediation, loss of banking and card-network access, and reputational damage that outlasts the fine. The downside is asymmetric, which is why compliance belongs in the architecture from day one.

The failure modes are predictable. Onboarding without proper verification lets bad actors in. Screening that runs once and never again misses a customer who later lands on a sanctions list. Monitoring that only runs in batch discovers laundering after settlement. Records that are not auditable turn a routine review into a crisis. None of these are exotic; they are the direct result of treating compliance as a feature to add later rather than a foundation to build on. It is the same lesson as choosing your on-ramp and off-ramp design early: the parts that are hard to change should be right on the first pass.

Where Tokelia fits

Tokelia is the infrastructure for programmable money, with compliance built into the base stack rather than sold as an add-on. KYC and KYB verification, sanctions and PEP screening, transaction monitoring, wallet screening and travel-rule data run across unified crypto and fiat rails behind one API, on a non-custodial architecture where users keep control of their own funds. Money services are provided by Tokelia LLC, registered as a Money Services Business with FinCEN, with regulated banking delivered by licensed institutions, so you can launch under your own brand while the hard, undifferentiated compliance plumbing is already solved.

If you are scoping the compliance layer for a crypto-fiat product, the fastest way to see how this maps to your flows is to walk a real onboarding and transfer with our team. Talk to us and get a sandbox key.