Compliance is the part of exchange development that founders defer and regulators inspect first. It is also, unusually, a system-design problem rather than a paperwork problem — almost every requirement below translates into a service you have to build, integrate and staff.
1. The Four-Layer Stack
| Layer | Question it answers | Runs |
|---|---|---|
| Onboarding (KYC/KYB) | Who is this? | At signup, and on tier upgrade |
| Screening | Are they prohibited? | At signup and continuously on list updates |
| Monitoring | Is this behaviour consistent with who they said they are? | Every transaction, always |
| Reporting | What must we tell the regulator? | On trigger, plus periodic returns |
The layer teams underbuild is monitoring. Onboarding is a vendor integration and feels like progress. Monitoring is an always-on system producing alerts that humans must triage — and it is the layer a regulator examines when deciding whether your programme is real.
2. Onboarding and KYC Tiers
Tiering is how you keep conversion without leaking risk.
| Tier | Requirements | Typical limits | Verification time |
|---|---|---|---|
| 0 — Browse | No trading, no deposits | Instant | |
| 1 — Basic | Government ID + liveness selfie | ~$1k–$5k/day | Seconds to minutes |
| 2 — Verified | + Proof of address | ~$50k/day | Minutes to hours |
| 3 — Enhanced (EDD) | + Source of funds/wealth, occupation | Negotiated | Days — manual review |
| Corporate (KYB) | Incorporation docs, UBO chain, directors | Negotiated | Days to weeks |
What good onboarding does
- Liveness detection, not just a document photo. Static document checks are defeated trivially.
- Document authenticity checks — MRZ parsing, chip reading where available, template matching.
- Duplicate identity detection across accounts using biometric hashing.
- Risk scoring at onboarding — jurisdiction, PEP status, expected activity — which then feeds the monitoring thresholds.
- Full artefact retention for 5–7 years, in a system you control, encrypted at rest with access logging.
3. Sanctions and PEP Screening
Screening is not an onboarding event. It is a standing obligation.
- Lists: OFAC SDN and consolidated, UN, EU, UK OFSI, plus any local list in your jurisdictions.
- Also screen: PEPs and their close associates, adverse media, and — crucially — crypto addresses appearing on sanctions lists.
- Re-screen the entire user base on every list update. A user clean at signup can be designated tomorrow. If you only screen at onboarding, you will find out from a regulator.
- Fuzzy matching with tuned thresholds. Too loose and your team drowns in false positives; too tight and you miss transliteration variants. Expect to tune this continuously.
- Log every hit and its disposition with the reviewer's identity and reasoning. This log is inspected.
4. Transaction Monitoring
On-chain
Every deposit address and every withdrawal destination is scored against blockchain analytics for exposure to mixers, sanctioned entities, darknet markets, ransomware and known theft addresses. Set policy by risk band: auto-accept, hold for review, or reject and file.
Off-chain / behavioural
| Pattern | Why it matters |
|---|---|
| Structuring | Deposits deliberately kept below reporting thresholds |
| Rapid in-out | Deposit, minimal trading, immediate withdrawal — classic layering |
| Activity vs declared profile | A stated $2k/month user moving $200k |
| Linked account clusters | Shared devices, IPs or payment instruments across "unrelated" accounts |
| Dormant reactivation | Long-idle account suddenly transacting at volume |
| Round-number wash patterns | Self-trading to fabricate volume or launder |
Alerts need a workflow, not an inbox. Every alert must have an owner, a state, a deadline and a documented resolution. An alert queue nobody works is worse than no monitoring — it demonstrates that you detected something and did nothing.
5. The Travel Rule
FATF Recommendation 16, applied to crypto. For transfers above the local threshold (commonly $1,000 or €1,000) the sending VASP must transmit originator and beneficiary information to the receiving VASP.
What this means in engineering terms:
- Counterparty identification — determine whether a withdrawal address belongs to a VASP, a self-hosted wallet, or an unknown party.
- Data exchange — transmit IVMS 101 formatted data over an interoperability protocol or commercial network.
- Self-hosted wallet handling — several jurisdictions require proof the user controls the destination address (a signed message or satoshi test).
- Inbound handling — receive, validate and store counterparty data, and reconcile it against the arriving transaction.
- Sunrise-period policy — decide what you do when the counterparty VASP is in a jurisdiction that has not implemented the rule.
6. Licensing by Jurisdiction
| Jurisdiction | Regime | Timeline | Practical note |
|---|---|---|---|
| European Union | MiCA CASP authorisation | 6–12 months | Passports across all 27 member states — the best value licence available |
| United Kingdom | FCA cryptoasset registration | 9–18 months | Historically low approval rate; over-prepare the AML programme |
| United States | FinCEN MSB + state MTLs | 12–24 months | State-by-state; surety bonds dominate the cost |
| UAE (Dubai) | VARA | 6–12 months | Clear categories, strong banking access |
| Singapore | MAS DPT under the PSA | 9–18 months | High governance bar, selective approval |
| Hong Kong | SFC VATP licence | 9–18 months | Strict custody and insurance requirements |
| Switzerland | FINMA / SRO membership | 6–12 months | Mature regime, high credibility |
7. What You Actually Have to Build
Vendors provide the data. You build the systems around it.
- Case management — queues, assignment, SLAs, evidence attachment, decision logging, audit trail. This is the single most important internal tool you will build for compliance.
- Risk engine — combines onboarding risk, jurisdiction, behaviour and on-chain exposure into a live per-user score that drives limits and thresholds.
- Policy configuration — rules and thresholds must be changeable by the compliance team without a code deploy. If a threshold change requires engineering, it will not happen when it needs to.
- Regulatory reporting export — produce SAR/STR packages and periodic returns in the required format on demand.
- Immutable audit log — every admin action, outside the reach of admin users.
- Data retention and deletion — retention obligations and privacy law obligations conflict. Model this explicitly rather than discovering it during an audit.
8. Common Compliance Failures
- Screening once at signup. Lists change daily; your obligation is continuous.
- Alerts with no workflow. Detection without disposition is worse than no detection.
- Thresholds hardcoded in application code. Compliance cannot tune what only engineering can change.
- KYC data held only in the vendor's system. When you switch vendors or the regulator asks, the record must be yours.
- No documented risk assessment. It is the first document requested in an inspection and the one nobody has written.
- Treating compliance as launch-blocking rather than continuous. Programmes decay; independent testing is what catches the decay.
For how this layer sits alongside custody and the trading core, see the complete cryptocurrency exchange development guide and the cost breakdown.
Frequently Asked Questions
What KYC level does a crypto exchange actually need?
Tiered. A basic tier with email, phone and government ID covers most retail users at modest limits. Enhanced due diligence — source of funds, proof of address, employment — applies above a volume threshold and to any PEP or high-risk-jurisdiction user. One-size-fits-all KYC either leaks risk or destroys conversion.
What is the Travel Rule and does it apply to me?
It requires the sending VASP to transmit originator and beneficiary information alongside transfers above a threshold — typically $/€1,000. It applies to essentially every licensed exchange. Implementation means joining an interoperability network such as TRP, IVMS-based protocols or a commercial provider, and handling counterparty VASP identification.
How much does exchange compliance tooling cost?
Realistically $50k–$200k per year for a mid-size exchange: blockchain analytics ($25k–$150k), sanctions and PEP screening ($12k–$50k), plus $0.80–$3.50 per KYC verification. Headcount is separate and usually larger.
Can I launch first and get licensed later?
It is how many exchanges have operated, and it is increasingly how they get shut down. More practically: without a licence you will not keep a banking relationship, and without banking you have no fiat rails. Start the licence track before the build.
What does a regulator actually inspect?
Evidence that your controls operate, not that they exist. Expect requests for: a sample of onboarding files, your screening hit-and-disposition log, transaction monitoring alert volumes with resolution reasoning, SAR filings, your risk assessment document, and proof of independent testing. Build the case management system that can produce these on demand.
Building the Compliance Layer?
We integrate KYC, screening, monitoring and Travel Rule into exchange platforms — and build the case management your regulator will ask to see.
Talk to Our Blockchain Team