As crypto payments become more mainstream, proving who is behind a transaction is becoming just as important as moving the money itself.

Crypto was built around the idea that people could move value without relying on traditional financial intermediaries. But there’s a catch:

Once crypto becomes a serious payment system, someone still needs to answer a very old question, who is actually moving the money?

That is where KYC and AML compliance enter the picture. Far from disappearing in a decentralized financial world, identity checks, transaction monitoring, sanctions screening and the so-called Travel Rule are becoming central to how legitimate crypto businesses operate.

Decentralized rails, centralized responsibilities

A blockchain can record transactions without a bank sitting in the middle. But crypto exchanges, payment providers, custodians and other service providers often do have identifiable customers and regulatory obligations.

In the United States, FinCEN has treated certain businesses exchanging or transmitting convertible virtual currency as money transmitters under the Bank Secrecy Act since its 2013 guidance.

In Europe, the direction is even clearer.

The EU’s Markets in Crypto-Assets Regulation, or MiCA, created a harmonized framework for crypto-asset issuers and crypto-asset service providers.

The European Commission also states that covered crypto service providers are subject to the EU’s AML and counter-terrorist-financing framework.

So while the blockchain itself may be decentralized, the companies building businesses around it increasingly are not operating in a regulatory vacuum.

KYC is becoming the front door

Know Your Customer, or KYC, is often treated as an annoying onboarding step. In reality, it is the foundation of a compliance program.

A crypto platform needs to understand who its customer is, where appropriate, who ultimately owns or controls a business, and whether that customer presents unusual or elevated financial-crime risk.

That does not mean every customer should automatically be treated as suspicious.

Modern AML frameworks are increasingly risk-based. A small, ordinary transaction from a verified customer should not necessarily receive the same scrutiny as a complicated flow involving multiple jurisdictions, high-risk counterparties or unexplained sources of funds.

The goal is not simply to collect passports.

It is to build enough context to understand whether a transaction makes sense.

The blockchain doesn’t eliminate AML risk

One of crypto’s biggest misconceptions is that blockchain transparency makes money laundering impossible.

It doesn’t.

Transactions may be publicly visible, but identifying the real person or organization behind a wallet can still be difficult. Funds can move through multiple wallets, exchanges, bridges and other services before reaching their final destination.

The FATF’s July 2026 update specifically highlighted growing risks involving stablecoins, peer-to-peer transactions through unhosted wallets, offshore virtual-asset providers and certain decentralized-finance arrangements. It also warned that major gaps remain in how countries identify, license and supervise virtual-asset service providers.

The numbers show why regulators remain concerned.

Chainalysis estimated that cryptocurrency addresses linked to illicit activity received at least $154 billion in 2025, although that figure is a lower-bound estimate and represented less than 1% of overall attributed crypto transaction volume.

Stablecoins accounted for 84% of illicit transaction volume in its 2026 report.

That last point matters. Stablecoins are useful for legitimate businesses precisely because they can move quickly across borders with relatively low volatility. The same characteristics can make them attractive to criminals.

The technology isn’t inherently criminal. The same rails can serve very different purposes depending on who is using them.

Then came the Travel Rule

KYC answers, “Who is this customer?”

The Travel Rule asks another question:

“What information should travel with this transaction?”

Under FATF standards, relevant information about the originator and beneficiary of certain virtual-asset transfers needs to accompany the transfer between regulated providers.

Implementation is accelerating.

FATF reported in July 2026 that 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule, compared with 73% in 2025.

Yet FATF also noted that enforcement and practical implementation remain uneven.

In the EU, the Travel Rule has already moved into operational territory. The European Banking Authority’s guidelines explain how payment service providers and crypto-asset service providers should handle missing or incomplete information attached to transfers. The guidelines have applied since December 30, 2024.

For crypto businesses, that means compliance can no longer stop at onboarding.

The transaction itself matters.

Compliance is becoming part of the product

This is probably the biggest shift.

A few years ago, compliance could feel like something happening behind the scenes after a crypto product was built. Today, for serious payment businesses, compliance increasingly has to be designed into the product itself.

That can mean automated KYC checks, sanctions screening, wallet-risk analysis, transaction monitoring, suspicious-activity investigations and documented escalation procedures.

It also means understanding the difference between a customer’s normal behavior and genuinely unusual activity.

That distinction is important because over-compliance can create its own problem. If legitimate customers constantly face unnecessary freezes, requests for documents or unexplained delays, the payment experience suffers.

Good compliance should reduce financial-crime risk without turning every customer into a suspect.

The harder problem: crypto moves globally

Traditional financial systems already struggle with cross-border compliance. Crypto makes the problem more immediate because a transaction can move across jurisdictions almost instantly.

One wallet may belong to a customer in one country. The service provider may operate from another. The counterparty may be somewhere else entirely, while the underlying blockchain network has no geographic border at all.

That is why global standards matter.

But FATF’s latest findings also show the limits of having global standards without consistent implementation. Regulation is moving forward, yet countries remain at different stages of licensing, supervision and enforcement.

For businesses, that creates a practical challenge: being compliant in one market does not automatically mean being prepared for every market.

The future of crypto payments may depend on trust

Crypto doesn’t have to choose between decentralization and compliance.

The more interesting future is probably one where decentralized networks handle the movement of value while regulated businesses build the identity, monitoring and accountability layers around them.

That may sound less revolutionary than the early crypto vision. But it could be what finally makes crypto payments useful at mainstream scale.

Because moving money quickly is only half the equation.

The other half is being able to explain where it came from, where it is going, and why the transaction makes sense.

And as crypto becomes part of everyday financial infrastructure, that ability may become one of its most valuable features, not its biggest compromise.

KYC and AML Compliance in Crypto Payments was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.