An early-stage crypto founder raising a seed round, onboarding the first exchange users, or integrating a payment rail faces a compliance question that cannot wait for Series A: does the business have a KYC and onboarding framework (the documented policies, controls and processes that verify customer identity and detect financial crime risk) that satisfies the regulator on day one? With enforcement activity rising across every major hub, the answer to that question determines whether you keep your banking, your licence application, and your operating runway.
A well-designed AML compliance program is not a bureaucratic formality. Under the FATF Recommendations (the Financial Action Task Force's global standards for anti-money laundering and counter-financing of terrorism), every VASP (virtual asset service provider) must implement risk-based customer due diligence, transaction monitoring and suspicious activity reporting before it accepts the first user. Regulators from the Bank of Lithuania to VARA (Dubai's Virtual Assets Regulatory Authority) to the FCA in the United Kingdom apply those standards directly. Getting the architecture right early avoids the expensive retrofit later.
This page maps the regulated basis, the practical build process, the cross-border complications, and the decision logic that founders most often miss. Every section draws on the frameworks that apply globally and on the experience of our practice in advising businesses through this process.
Why a KYC Framework Cannot Wait Until You Scale
Regulators do not grade compliance programs on a startup curve. The obligation to verify customers, assess financial crime risk and monitor transactions arises the moment a business conducts a regulated virtual-asset activity – not when it passes a revenue threshold or closes a funding round. Founders who delay the compliance build invariably face one of two outcomes: a licensing refusal that delays go-to-market by many months, or a banking termination that stops the business operating at all.
AUDIENCE_PAIN is the correct frame here. Operating without an adequate KYC program means frozen payment rails, rejected licence applications, and personal exposure for the individual serving as the business's money-laundering reporting officer. We have seen early-stage businesses spend more to remediate a deficient framework than it would have cost to build it correctly. The remediation clock starts at the worst possible moment – when you are under regulatory scrutiny and cannot afford to pause onboarding.
The cross-border dimension makes this sharper. A token issuer incorporated in the Cayman Islands, running a web interface accessible from the EU and processing payments through a Singapore account, is simultaneously subject to the CIMA VASP regime, the MiCA (Markets in Crypto-Assets Regulation) perimeter, and the MAS Payment Services Act requirements. Each of those regimes has its own customer due diligence standard. A single-jurisdiction compliance template does not travel.
In our practice, we regularly advise founders who discover this exposure only when their first banking partner requests an AML policy pack. The faster that pack is ready – and correctly structured – the faster the account opens.
What Legal Regime Governs Your AML Obligations?
The AML compliance obligation for a crypto business rests on three interlocking layers: the FATF Recommendations at the international standard-setting level, the national VASP or CASP regime at the licensing level, and the specific rulebook of the regulator that supervises the licence.
At the FATF level, Recommendation 15 extends the full suite of anti-money laundering controls to virtual asset service providers. That means risk-based customer due diligence, ongoing monitoring, record-keeping, and – critically – the Travel Rule (the obligation to collect and transmit originator and beneficiary information alongside virtual-asset transfers). FATF-aligned jurisdictions implement these standards in domestic legislation; the level of detail and the specific thresholds vary by jurisdiction and all figures should be confirmed against current local rules.
In the EU, MiCA and the related Transfer of Funds Regulation bring CASPs (crypto-asset service providers) within the standard financial-institution AML perimeter supervised by ESMA and the relevant national competent authority. In Dubai, the VARA rulebooks require exchanges and custodians to maintain documented KYC procedures as a precondition of authorisation. In Singapore, the MAS applies its Notice on Prevention of Money Laundering and Countering the Financing of Terrorism directly to DPT (digital payment token) service providers. In the UK, the FCA requires cryptoasset businesses to register under the Money Laundering Regulations and demonstrate adequate AML systems at registration.
For early-stage founders, the practical consequence is that you need a compliance framework calibrated to the most demanding regime in your operational footprint – not the most permissive one.
What Must a KYC Onboarding Framework Actually Contain?
A compliant KYC onboarding framework for a digital-asset business has six core components, each of which maps to a regulatory expectation across the major hubs.
First, a risk appetite statement – a documented decision by the board or senior management on which customer types, geographies and product uses the business will and will not accept. This document is the anchor for every downstream control. Without it, a compliance officer cannot make consistent onboarding decisions, and an auditor cannot assess whether those decisions were reasonable.
Second, customer identification and verification procedures – the specific checks applied to each customer category (individual, corporate, institution, high-net-worth, politically exposed person). These procedures must specify the identity documents accepted, the verification method (manual, electronic, biometric), the reliance standard for third-party verification providers, and the treatment of customers from higher-risk jurisdictions.
Third, customer due diligence tiers: simplified due diligence for lower-risk profiles, standard CDD for the general customer base, and enhanced due diligence for politically exposed persons, customers from FATF grey-list or black-listed jurisdictions, and high-value or complex relationships. The trigger thresholds between tiers vary by jurisdiction and should be confirmed against current local rules.
Fourth, a transaction monitoring system calibrated to the business's risk profile. This can be rule-based (alert on transactions above a threshold, on unusual patterns, on interactions with flagged wallet addresses) or machine-learning-enhanced for higher-volume platforms. The key regulatory expectation is that the system is documented, tested, and produces alerts that are actually reviewed.
Fifth, a Travel Rule compliance mechanism. For transfers above the applicable threshold – which varies by jurisdiction – the business must collect originator and beneficiary information and transmit it to the receiving VASP. This requires either integration with a Travel Rule messaging solution or a documented manual procedure for smaller volumes. We address the Travel Rule in more detail below.
Sixth, a suspicious activity reporting procedure and a named MLRO (money-laundering reporting officer) who receives internal reports, makes the filing decision, and is the regulator's point of contact on AML matters.
Regulators in the leading hubs – including VARA and ESMA's national competent authorities – increasingly expect these six elements to be evidenced in writing before a licence is granted, not assembled after the fact.
How Does the Cross-Border Reality Complicate KYC?
The cross-border reality of a digital-asset business – entity in one place, users in another, banking in a third – is the single most common source of KYC framework failure at early-stage companies.
The fundamental problem is jurisdictional multiplication. A business that passports its MiCA CASP authorisation across EU member states faces national-level AML laws that can impose stricter due diligence obligations than the EU baseline. A business operating from the AIFC (Astana International Financial Centre) in Kazakhstan under AFSA supervision may onboard users across Central Asia, the Middle East and Europe – each region with different regulatory expectations for the same customer type.
Banking is where the cross-border tension surfaces most acutely. Correspondent banks apply their own AML standards when reviewing the compliance programs of their crypto clients. A framework that satisfies a national regulator may still fail a correspondent's due diligence questionnaire if it does not address the geographic risk of the user base or the specific screening obligations for sanctioned jurisdictions.
In our cross-border practice, we regularly see two failure modes. The first is the geographic mismatch: the compliance program was written for the jurisdiction of incorporation but the user base is predominantly in a higher-risk geography that the framework does not address. The second is the Travel Rule gap: the framework documents a Travel Rule procedure but does not specify which solution is used, what happens when the counterparty VASP is unhosted, and how unresolved transfers are treated.
Operators we advise routinely address this by building a framework with a modular jurisdiction annex – a core policy that meets the highest standard in the footprint, plus jurisdiction-specific annexes that document the local variation where rules diverge.
For a scoped assessment of your KYC framework across your operational footprint, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What Does the Travel Rule Mean for an Early-Stage VASP?
The Travel Rule is the requirement – derived from FATF Recommendation 16 and implemented across the major VASP regimes – to collect, hold and transmit originator and beneficiary information alongside virtual-asset transfers above a specified threshold. For an early-stage VASP, the Travel Rule is frequently the most technically complex compliance obligation to implement.
The practical challenge is that the Travel Rule requires the transmitting VASP to communicate structured data to the receiving VASP before or simultaneously with the transfer. That presupposes that the receiving VASP is identified, reachable through a shared messaging protocol, and willing to receive and process the data. None of those conditions is guaranteed in the current environment, where Travel Rule adoption and protocol coverage vary significantly by jurisdiction.
For founders, the immediate obligations are: first, determine which Travel Rule threshold applies in each jurisdiction where you operate; second, select a messaging solution that covers the counterparty VASPs in your expected transfer volume; third, document your procedure for transfers where the counterparty VASP cannot be identified or does not respond; and fourth, maintain records of originator and beneficiary data for the period required by local law.
The risk of getting this wrong is not theoretical. Regulators including the FCA, MAS and the national competent authorities under MiCA have each signalled that Travel Rule compliance is a supervisory priority. A compliance program that is silent on the Travel Rule will draw a finding on first examination.
What Are the Most Expensive KYC Mistakes at Early Stage?
Early-stage founders make a predictable set of KYC and AML mistakes. The cost of each is higher than it appears at the time, because each one compounds the difficulty of the next step – the licence application, the banking relationship, or the investor due diligence.
The first mistake is treating the KYC policy as a template download exercise. A policy that was not written for the specific business, its risk profile, its user geography, and its product structure will fail a regulator's review. Regulators ask: "How does this policy apply to your business?" If the answer requires significant improvisation, the policy is inadequate.
The second mistake is failing to appoint an MLRO before the business onboards its first user. The MLRO is a regulated role in most jurisdictions. In the UK under the FCA regime and in Malta under MFSA supervision, the individual must satisfy a fit-and-proper assessment. Appointing a founder as a placeholder MLRO without the relevant experience creates both a regulatory risk and a personal liability risk for that individual.
The third mistake is separating the compliance build from the technology build. A transaction monitoring system that was integrated after the onboarding flow was coded is almost always incomplete. Risk flags that should generate alerts are invisible because the data architecture was not designed to surface them. We have seen this pattern repeatedly in exchange builds that used modular third-party stacks assembled quickly.
The fourth mistake is the most common: believing that a single offshore licence is enough to serve a global user base. It is not. A BVI FSC-registered VASP serving EU residents remains subject to MiCA's geographic reach. A Cayman-licensed entity with a US-accessible interface faces FinCEN and state money-transmitter licensing obligations. A compliance program that does not address the jurisdiction of the user is a compliance program built on a false assumption.
A micro-matter illustrates the cost. In a recent onboarding remediation matter, an exchange at Series A had built its KYC flow around a single jurisdiction's CDD requirements. When a new institutional investor ran AML due diligence, it identified that the framework did not address enhanced due diligence for its own home jurisdiction's PEP screening standard. We conducted a gap analysis against the applicable regimes, rewrote the jurisdiction annex, and the investment closed on the revised timeline. The cost of the remediation was a fraction of the investor's revised position – but it was entirely avoidable.
Which KYC Build Approach Fits Your Founder Profile?
The right KYC and onboarding architecture depends on three variables: the licence stage, the user base geography, and the product risk profile. A decision matrix helps founders identify the appropriate scope of work.
Profile A is the pre-licence founder building toward a first regulatory application in a single jurisdiction. The appropriate build is a core policy suite (risk appetite, CDD procedures, transaction monitoring framework, MLRO mandate, SAR procedure) calibrated to the target regulator's published expectations. The timeline from instruction to a reviewable draft is typically measured in weeks. The key risk at this profile is underbuilding – producing a framework that is structurally complete but too thin in the jurisdiction-specific detail to pass a licensing review.
Profile B is the licensed operator expanding geographically – adding EU users under MiCA passporting, or adding a Singapore DPT licence to an existing BVI VASP registration. The appropriate build is a modular framework: the core policy remains in place, and a jurisdiction-specific annex is added for each new regulatory perimeter. The key risk at this profile is the gap between the core framework standard and the more demanding standard in the new jurisdiction – specifically in Travel Rule coverage and enhanced due diligence triggers.
Profile C is the institutional product builder – a custodian launching for family offices, or a lending platform onboarding accredited investors. The appropriate build requires a full institutional KYC module: legal entity verification, beneficial ownership mapping, source-of-funds documentation for large transfers, and an ongoing monitoring cadence. The key risk at this profile is that the institutional onboarding standard diverges from the retail standard already in the framework, creating two de facto policies that are not reconciled.
Profile D is the DeFi protocol or token issuer that is not certain whether it falls within the VASP perimeter. The first task is a perimeter analysis under the applicable regimes – MiCA, VARA, MAS – before any compliance architecture is designed. Building KYC infrastructure for a protocol that turns out not to be a regulated VASP is wasteful. Failing to build it for a protocol that is regulated creates enforcement exposure.
If a prior application stalled or a banking relationship was terminated, a second read of your compliance architecture can identify the structural reason and the route forward. Reach out at info@oboluslaw.com. Map your options
Addressing the Common Assumption: One Offshore Licence Covers Global Operations
A common assumption among early-stage founders is that a single offshore VASP registration – in the BVI, Cayman Islands, or a similarly efficient jurisdiction – is sufficient to serve users worldwide without additional compliance obligations. That assumption is incorrect, and regulators increasingly act on it.
The legal principle that dismantles this assumption is jurisdictional reach. Under MiCA, a CASP serving EU residents from a third-country entity requires separate authorisation or a reverse-solicitation analysis. Under the MAS Payment Services Act, a business that actively markets DPT services to Singapore residents from outside Singapore may still fall within the licensing perimeter. Under FinCEN's MSB rules in the United States, providing money transmission services to US persons can trigger registration obligations regardless of where the business is incorporated.
The offshore registration solves the home-jurisdiction compliance question. It does not solve the user-jurisdiction compliance question. Those are different problems, and conflating them is one of the most durable misconceptions in the early-stage crypto-business environment.
The correct approach is a jurisdictional footprint analysis: map the entity structure, the user access points, the payment flows, and the marketing channels against the licensing and AML perimeters in each relevant jurisdiction. The output is a gap map – a list of jurisdictions where compliance obligations exist and are not yet met. That gap map drives the compliance build sequence.
We map the licence and compliance stack across operating, custody and payment layers before a business commits to a go-live geography. That analysis consistently surfaces obligations that were not visible at the founding stage.
A Self-Assessment Checklist Before Your First Regulatory Engagement
Before a founder approaches a regulator, a bank, or an institutional investor, five compliance questions should have documented answers.
First: does the business have a written AML policy signed by a director or senior manager that is specific to its product, user base and risk profile? A generic template is not adequate. The policy must reflect actual decisions made about the business.
Second: is there a named MLRO who meets the fit-and-proper standard required in the target jurisdiction, with documented authority to make suspicious activity reports and to escalate compliance concerns to senior management?
Third: does the onboarding flow implement CDD in a manner that is consistent with the policy – meaning that the system flags what the policy says it will flag, and the operations team knows what to do with those flags?
Fourth: is the Travel Rule addressed? If the business transmits virtual assets between VASPs above the applicable threshold, there must be a documented procedure for the collection, transmission and record-keeping of originator and beneficiary data.
Fifth: has the compliance framework been reviewed against the regulatory perimeters in every jurisdiction where the business has users or payment flows – not only the jurisdiction of incorporation?
If any of these questions cannot be answered with a "yes, here is the document," the framework has a gap. The time to close that gap is before the regulator, the bank, or the investor asks the same question.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – the full practice overview covering AML, Travel Rule and compliance program design across all entity types and stages.
- AML/CFT policy drafting in the Cayman Islands – jurisdiction-specific guidance on CIMA-compliant AML policy drafting for Cayman-registered VASPs and funds.
- KYC and onboarding framework for regulated entities – the counterpart service page for businesses that already hold a licence and are scaling their compliance infrastructure.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule, derived from FATF Recommendation 16 and implemented across the major VASP licensing regimes, requires a transmitting VASP to collect and pass originator and beneficiary identifying information to the receiving VASP alongside a virtual-asset transfer above a specified threshold. The specific data fields required and the applicable threshold vary by jurisdiction and should be confirmed against current local legislation. Record-keeping obligations attach to every transfer, including those below the threshold in most regimes.
Who must act as MLRO for a crypto firm?
An MLRO (money-laundering reporting officer) is an individually designated senior person responsible for receiving internal suspicious-activity reports, making disclosure decisions, and liaising with the regulator on AML matters. Most licensing regimes – including those administered by the FCA, MFSA, MAS and VARA – require the MLRO to satisfy a fitness-and-propriety assessment. At early stage, the MLRO can be a founder or a senior compliance hire, provided that individual meets the regulator's standard and has documented authority and independence to act on compliance concerns.
How do regulators audit crypto AML programs?
Regulators typically audit AML programs through a combination of document review, transaction sampling, and operational interviews. They request the written AML policy, the risk appetite statement, CDD procedure documentation, transaction monitoring alert logs, and records of suspicious activity reports filed. They test whether the documented controls match the operational reality – for example, whether a transaction monitoring system flagged what the policy says it should flag. VARA, MAS and the FCA have each signalled that AML supervisory reviews of VASPs are a continuing priority, and businesses with poorly documented programs draw disproportionate scrutiny.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the compliance, AML and Travel Rule architecture that sits beneath every licensed operation. We map the licence and compliance stack – across operating, custody and payment layers – before clients commit to a go-live geography. Digital assets are the whole of our practice. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. To discuss your compliance build, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in AML program design, KYC framework architecture and Travel Rule implementation for early-stage and scaling digital-asset businesses across multi-jurisdiction footprints.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.