KYC, AML and the Travel Rule: what a crypto exchange has to build
Exchange compliance is software: identity checks that unlock limits, sanctions and wallet screening, monitoring with cases and reports, Travel Rule data on every transfer and an audit log.
Most of a crypto exchange's compliance is software. It needs onboarding that verifies identity and sets limits, screening of customers and wallet addresses, monitoring that turns unusual activity into alerts and cases, Travel Rule data on every transfer, and records of who decided what. Built into the same accounts, ledger and audit trail as trading, these controls can stop a transfer at the right moment instead of reporting on it afterwards.
The licence is covered in the MiCA checklist; this guide is the plumbing behind it, mostly under EU rules. It is general information, not legal advice.
Onboarding: identity, liveness and verification levels
Under the EU's anti-money laundering directive, customer due diligence starts with "identifying the customer and verifying the customer's identity on the basis of documents, data or information obtained from a reliable and independent source" (Directive (EU) 2015/849, Article 13). The Transfer of Funds Regulation added crypto-asset service providers to the directive's obliged entities (Regulation (EU) 2023/1113, Article 38). From 10 July 2027, the new AML Regulation, (EU) 2024/1624, applies to them too.
For onboarding done entirely online, the EBA's remote onboarding guidelines (EBA/GL/2022/15, guideline 41) set out what an unattended flow should do. Photographs or video are taken at the time of verification, liveness detection checks the person is present, and reliable algorithms match the face to the picture on the document.
In software, onboarding is a short state machine on the account:
Personal details: name, date of birth, address.
The identity document, photographed, read and checked.
A selfie with liveness detection, matched to the document.
A decision: passed automatically, referred to staff, or rejected.
A verification level written on the account.
That level is the hinge: limits read it, so a higher level unlocks higher limits without anyone exporting a list. A change of name or address sends the account back through the relevant steps.
Screening: people and addresses
Crypto-asset service providers need "internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures" (Regulation (EU) 2023/1113, Article 23). The EBA's guidelines on restrictive measures for payment and crypto-asset service providers (EBA/GL/2024/15), applying from 30 December 2025, describe what that means:
Screening the whole customer base regularly, and always at onboarding, on a new designation and on a significant change in a customer's details.
Screening at least the name and date of birth of a person, and wallet addresses where the sanctions lists carry them.
Screening every transfer of crypto-assets before the crypto-assets are made available to the beneficiary, including the Travel Rule information and the wallet addresses.
Alerts analysed by trained staff, with no service to a party to a transfer before an informed decision.
Wallet screening is the address half: before a deposit is credited or a withdrawal sent, the counterparty address is checked against official lists and, usually, a blockchain analytics provider's view of its funds.
In the build, screening runs on events: an account opened or changed, a sanctions list updated (re-screening everyone), a deposit detected, a withdrawal requested. A possible match is a held state, not an email: nothing is credited or sent until someone decides.
Transaction monitoring: alerts, cases and reports
Due diligence includes "ongoing monitoring of the business relationship", so that transactions are "consistent with the obliged entity's knowledge of the customer, the business and risk profile" (Article 13(1)(d)). Suspicions go to the financial intelligence unit (FIU), and "all suspicious transactions, including attempted transactions, shall be reported" (Article 33). Staff may not tell the customer that a report or an analysis is under way (Article 39).
Transaction monitoring software has three layers:
Rules over the exchange's own records: a deposit withdrawn at once, volumes far above the declared profile, funds touching a flagged counterparty.
Alerts, which a rule raises, grouped into a case per customer with the evidence, notes and a decision.
Reports, drafted from the case and filed to the FIU, with the filing kept on the case.
The tipping-off rule shapes the screens. A support agent sees that an account is under review, not why, and the customer's messages say nothing about a report.
The Travel Rule in the EU
The Transfer of Funds Regulation has applied since 30 December 2024, and its Article 14 sets no minimum amount. Under Article 14, the originator's provider sends:
On the originator: the name; the distributed ledger address and the crypto-asset account number, where one exists and is used; the address, including the country, the official personal document number and customer identification number, or alternatively the date and place of birth; and the LEI or an equivalent identifier, where the message format has a field for it and the originator provided it.
On the beneficiary: the name; the distributed ledger address and account number, where one exists and is used; and the LEI or equivalent on the same terms.
The information travels "in advance of, or simultaneously or concurrently with" the transfer, securely and under the GDPR, and need not be on chain. The originator's provider verifies it first, and "shall not allow for the initiation, or execute any transfer" until the article is met.
The beneficiary's provider detects missing information (Article 16) and, on a risk-sensitive basis, rejects or returns the transfer or asks for the information before making the crypto-assets available (Article 17). A provider that repeatedly sends incomplete information is warned, then restricted or cut off, and reported to the AML authority. The EBA's Travel Rule guidelines (EBA/GL/2024/11) cap the deadline for missing information at three working days inside the EU and five from outside it.
In the build, every withdrawal and every deposit carries a Travel Rule record linked to its on-chain transaction. A withdrawal moves from "counterparty identified" to "information sent" to "broadcast"; a deposit from "detected" to "information matched" to "credited", "held" or "returned". The hard part is finding which provider holds an address and reaching it: the EBA notes that not all messaging protocols are interoperable.
Self-hosted wallets
A self-hosted address is one "not linked to" a crypto-asset service provider or a similar firm outside the EU (Article 3). For a transfer to one, the provider obtains and holds the originator and beneficiary information, and keeps the transfer individually identifiable. For "an amount exceeding EUR 1 000", it takes "adequate measures to assess whether that address is owned or controlled by the originator" (Article 14(5)); deposits from one work the same way (Article 16(2)).
The Travel Rule guidelines (section 4.8) list ways to assess it: a verification in which the customer shows the address, sending a small amount set by the provider to and from it, signing a message with the address's key, or other reliable means, combined where one is not enough. Value is converted to euros at the exchange rate at the time of the transfer, regardless of fees. An address proven once can be whitelisted, and comes off the list when its risk changes.
In software, that is an address book: each address with its type (another provider or self-hosted), the proof method, the date and the evidence. A withdrawal above the threshold to an unproven self-hosted address waits for the proof.
Records and the audit log
Travel Rule information is kept for five years (Article 26). Due diligence documents and transaction records are kept for five years after the business relationship ends (Directive (EU) 2015/849, Article 40), and personal data is then deleted unless national law says otherwise.
The software side is an append-only audit log of who approved a withdrawal, changed a limit, cleared a match or closed a case, and when, beside a retention schedule per record type that deletes on time.
Staff review queues
Every check above ends where a person decides: referred verifications, screening matches, monitoring alerts, withdrawal approvals, Travel Rule exceptions. Roles decide who sees and who approves each queue. For higher-exposure screening alerts, the EBA's restrictive measures guidelines expect review by at least two people.
Why compliance belongs in the data
With compliance in a separate tool fed by exports, a withdrawal can leave before the alert arrives. With each check a state on the same records, the ledger holds the funds until it clears.
Event | Checks it triggers | What waits for them |
|---|---|---|
Account opened or details changed | Identity verification, sanctions screening | Trading and withdrawals above the level's limits |
Deposit detected | Wallet screening, Travel Rule matching, monitoring | Crediting the balance |
Withdrawal requested | Daily limit by level, wallet screening, self-hosted proof, Travel Rule message, approval rules | The broadcast |
Trade filled | Monitoring | Nothing; it may raise an alert |
Sanctions list updated | Re-screening every customer | Accounts with a possible match |
Any staff decision | Audit log entry | Nothing |
Every check reads the same account, verification level and ledger entries, and every decision lands in one audit trail, so a regulator's question about one transfer is answered from one place.
Outside the EU
In the UK, the Travel Rule is Part 7A of the Money Laundering Regulations, in force since 1 September 2023 (regulation 64C). Between UK firms, names and account numbers travel, with more on request within three working days; from £800 with a firm outside the UK, an identifier such as an address travels too. See the FCA registration guide, and for the UAE's regulators the UAE guide.
How Paynoramic's exchange handles it
Paynoramic's white-label exchange already has the base of this plumbing, and Marengo, the exchange we built on it, is where to see it working. A new account verifies through Paynoramic KYC, our own verification: a hosted page with personal details, an identity document and a selfie, by camera or upload. Staff review it in the backoffice.
Limits by level: daily limits follow the account's verification level.
Withdrawals: each passes approval rules and the daily limit for its level before it leaves, connected to the client's custodian.
The backoffice: accounts and roles, KYC review, balances and ledger, withdrawal approvals, markets with their fees and limits, and the audit log.
The records: a full audit log, and a double-entry ledger whose reconciliation checks every account.
Each service writes its change and its event in one transaction, and every outside provider sits behind an adapter: identity checks on Sumsub, Onfido or Veriff are added for a launch that way. For the client's licence, we add the rest of the controls regulators look for: sanctions and wallet screening, transaction monitoring with suspicious activity reports, Travel Rule messaging, MiCA, DAC8 and CRS reports, proof of reserves reporting and market surveillance, through the KYC/AML and compliance reporting modules.
To see verification and limits on a working exchange, open Marengo at marengo.paynoramic.com, on a phone or a computer. What the exchange includes, and what is added for a launch, is on the crypto exchange page.
