Crypto compliance software is the set of tools an exchange or custodial wallet uses to check who its users are, where their coins came from, and where they are going. It runs KYC at sign up, screens wallets at deposit and withdrawal, sends Travel Rule data to other exchanges, and turns red flags into reports for the regulator. No single product does all of it well, so most platforms run a stack of three to five tools.
This guide is for founders who are building or relaunching an exchange or wallet. You get the full stack layer by layer, the rules each layer must meet as of 1 November 2026, how the tools plug into your platform, and what to build versus buy.
In this guide:
- The six layers of a crypto compliance stack and what each one checks
- The EU and US rules your software must cover in 2026, with dates
- Where each check sits in the deposit and withdrawal flow
- A build or buy test for every layer, plus real published prices
- A checklist for choosing vendors without overpaying
What Is Crypto Compliance Software?
Crypto compliance software helps a virtual asset service provider (VASP) meet anti-money laundering (AML), sanctions and data-sharing rules. In the EU these firms are called crypto-asset service providers (CASPs). In the US most are money services businesses under the Bank Secrecy Act.
The term covers two kinds of tools:
- Classic AML tools: identity checks, sanctions lists, case files and reports. Banks have used these for decades.
- Blockchain compliance tools: software that reads public blockchains, labels wallets, and scores funds by where they came from. This part is unique to crypto.
You need both. A bank only knows its own customer. An exchange also has to judge the wallet on the other side of every transfer, because funds can arrive from a hack, a darknet market or a sanctioned group.
The risk is real. Illicit crypto addresses received at least $154 billion in 2025, according to Chainalysis’s 2026 Crypto Crime Report. That is still less than 1% of all crypto activity. But stablecoins carried 84% of the illicit volume, so any platform that lists USDT or USDC is exposed.
What Does a Crypto Compliance Stack Include?
A full stack has six layers. Some vendors sell three or four of them in one suite, but each layer does a different job.
| Layer | What it checks | When it runs | Typical tool type |
| KYC and KYB | Is this person or company real, and who owns it? | Sign up, then on a review cycle | Identity check API |
| Sanctions and PEP screening | Is the user on a sanctions or politically exposed list? | Sign up, then daily against list updates | Screening API |
| Wallet screening and KYT | Did these funds touch risky sources? | Every deposit and withdrawal | Blockchain analytics API |
| Transaction monitoring | Does this user’s behavior look like laundering? | Ongoing, on every trade and transfer | Rules engine |
| Travel Rule | Did sender and receiver data travel with the transfer? | Every qualifying transfer | Travel Rule network |
| Case management and reporting | What did the team decide, and was it reported? | After every alert | Case tool plus report export |
KYC and KYB
KYC (know your customer) checks a user’s ID document, matches a selfie to it, and runs a liveness test so a photo or deepfake cannot pass. KYB (know your business) does the same for firms: it checks the company record, the directors and the real owners.
The result is a risk rating. Low risk users get standard limits. High risk users, such as those from high risk countries, get enhanced due diligence: proof of address, source of funds, and sometimes a call.
Sanctions and PEP Screening
Screening checks names against sanctions lists such as the US OFAC list, the EU consolidated list and UN lists. It also flags politically exposed persons (PEPs) and adverse media. The check must rerun when lists change, not just at sign up, because a user who was clean in March can be listed in June.
OFAC also publishes crypto wallet addresses tied to sanctioned people. That is why sanctions screening and wallet screening overlap.
Wallet Screening and Blockchain Analytics (KYT)
KYT means “know your transaction.” A blockchain analytics tool looks at the wallet sending or receiving funds and traces its history. It returns a risk score and the reason: direct exposure to a mixer, indirect exposure to a hack, a link to a sanctioned exchange, and so on.
Well-known names here include Chainalysis, TRM Labs and Elliptic, with smaller vendors covering niche chains. What you pay for is the label database: millions of wallets tagged to real services and bad actors. You cannot build that yourself.
Transaction Monitoring
KYT looks at the funds. Transaction monitoring looks at the user. Rules watch for patterns such as many deposits just under a reporting limit, fast in and out flows with no trading, wash trades between linked accounts, or a sudden jump in volume. Each hit creates an alert.
Good rules depend on your product. A spot exchange, a futures desk and a payment app need different rules, so this layer needs tuning by your own team.
Travel Rule
The Travel Rule requires an exchange to send the sender’s and receiver’s details along with a crypto transfer, much like a bank wire. The data uses a shared format called IVMS101 and moves over networks such as TRP, TRUST or vendor networks.
The hard part is reach. Your tool must find the receiving exchange and talk to it, even if it uses another provider. For a deeper look, see our guide to building crypto Travel Rule compliance.
Case Management and Reporting
Alerts are useless without a place to work them. A case tool gives your team a queue, the user’s full record, notes and a log of each decision. When a case looks bad, the tool helps you file a report with the national unit that tracks dirty money. In the US this is a suspicious activity report (SAR). Many other countries call it an STR.
Keep every record. US rules for money services businesses require most records to be kept for five years, and regulators will ask to see why each alert was cleared.
Where Does Compliance Software Sit Inside an Exchange?
Each layer plugs into a specific point in the user journey. The diagram shows the six points.
In practice, the tools connect through APIs and webhooks:
- Sign up: your onboarding screen loads the KYC vendor’s SDK. The vendor posts the result back to your server, and your platform sets the user’s tier and limits.
- Deposit: your wallet service sees a new transfer and calls the analytics API with the address and hash. Funds stay pending until the score comes back.
- Trading: the matching engine streams trades and transfers to your rules engine, which raises alerts in near real time.
- Withdrawal: before signing, your platform screens the destination address and, above the threshold, sends Travel Rule data. A high risk score or a failed Travel Rule check holds the withdrawal.
- Alert: alerts from every layer land in one case queue in your admin panel.
- Report: your compliance officer files reports and exports records for audits.
The key design rule: checks at deposit and withdrawal must run before funds are credited or released. A check that runs after the coins move only records the problem. It does not stop it.
Do Non-Custodial Wallets Need Compliance Software?
It depends on control. FATF’s 2021 guidance says a firm that only writes software for self-hosted wallets, and never holds or moves users’ funds, is generally not a VASP. A custodial wallet that holds keys for users is a VASP and needs the full stack.
Even non-custodial apps often screen addresses. If your app offers swaps, on-ramps or cards through partners, those partners will expect sanctions screening at the front end.
What Rules Must Crypto Compliance Software Cover in 2026?
Your software has to meet the rules in every market you serve. The table lists the dates that matter most as of 1 November 2026.
| Rule | Market | Status (as of 1 Nov 2026) | What it means for your software |
| Transfer of Funds Regulation | EU | In force since 30 Dec 2024 | Travel Rule on every CASP transfer, no minimum |
| MiCA | EU | Transition ended 1 Jul 2026 | Only authorized CASPs may serve EU users |
| AML Regulation (AMLR) | EU | Applies from 10 Jul 2027 | No anonymous accounts or privacy coins at CASPs |
| Bank Secrecy Act | US | In force | AML program, SARs from $2,000, Travel Rule from $3,000 |
| GENIUS Act | US | Signed 18 Jul 2025; AML rules proposed Apr 2026 | Stablecoin issuers treated as BSA financial institutions |
| CLARITY Act | US | Not law; Senate vote failed 15 Sep 2026 | Market structure still unsettled |
FATF Standards
FATF sets the global baseline. Recommendation 15 covers VASPs and Recommendation 16 is the Travel Rule. In its July 2026 targeted update, FATF reported that 91 of 109 responding jurisdictions (83%) had passed Travel Rule laws, up from 73% a year earlier. But 60% of those had not yet taken any supervisory action on it. Expect enforcement to catch up.
European Union: MiCA, TFR and AMLR
Three EU laws shape your stack. The Transfer of Funds Regulation has applied since 30 December 2024. It requires Travel Rule data on every transfer between CASPs, with no minimum. For transfers above EUR 1,000 to or from a self-hosted wallet, you must also check that your customer controls that wallet.
MiCA is the license regime. Its transition period ended on 1 July 2026, so only authorized CASPs can now serve EU users. Minimum capital runs from EUR 50,000 to EUR 150,000, depending on the services. Our guide to launching a MiCA-compliant exchange in the EU covers the steps.
Next is the AML Regulation, which applies from 10 July 2027. It bars CASPs from keeping anonymous accounts and from handling anonymity-enhancing coins. If you list privacy coins, plan the delisting now.
United States: BSA, FinCEN, OFAC and the GENIUS Act
Most US exchanges and custodial wallets are money services businesses. They register with FinCEN, run a written AML program, and follow FinCEN’s 2019 guidance on convertible virtual currency. Key numbers:
- SAR threshold: suspicious transfers of $2,000 or more must be reported.
- Travel Rule: applies to transfers of $3,000 or more under 31 CFR 1010.410.
- Cash reports: cash deals above $10,000 need a currency transaction report.
- Sanctions: OFAC rules apply to every US person with no minimum amount.
Stablecoins now have their own law. The GENIUS Act was signed on 18 July 2025. On 8 April 2026, FinCEN and OFAC proposed rules that would treat permitted stablecoin issuers as financial institutions under the BSA. As of 1 November 2026 we found no final rule.
The CLARITY Act, which would split oversight between the SEC and CFTC, passed the House in July 2025. A Senate motion to start debate failed 49 to 50 on 15 September 2026, so it is not law yet. Licensing is still state by state, so check our crypto license guide before you pick a market.
Travel Rule Thresholds in Other Markets
If you serve users outside the EU and US, your Travel Rule tool needs a rule per country. Figures below were checked in late September 2026.
| Market | Travel Rule applies to |
| EU, Switzerland, India | Every transfer |
| Dubai (VARA) | Transfers above AED 3,500 |
| Hong Kong (SFC) | Transfers of HK$8,000 or more |
| Singapore (MAS) | Full data above S$1,500, lighter data below |
| FATF standard | USD or EUR 1,000 |
| United States | $3,000 |
The simple design choice: build for zero and relax the rule by country. That way a new market is a settings change, not a code change.
What Happens When Crypto Compliance Fails?
Weak AML programs have cost exchanges far more than any software bill. The four US cases below all cited poor KYC or AML controls.
Binance agreed to pay $4.3 billion in November 2023. In early 2025, OKX agreed to pay more than $504 million, KuCoin more than $297 million, and BitMEX a $100 million fine. Fines are only part of the cost. Plea deals can bring outside monitors, forced exits from markets and lost banking partners.
Should You Build or Buy Crypto Compliance Software?
You should do both, layer by layer. Buy what depends on outside data. Build what depends on your own product.
| Layer | Build or buy | Why |
| KYC and KYB | Buy | Document databases, liveness models and registry access are licensed data |
| Sanctions and PEP lists | Buy | Lists change daily and need trusted feeds |
| Wallet screening and KYT | Buy | The value is the label database, which takes years to build |
| Travel Rule | Buy or join a network | It only works if other exchanges are on the same network |
| Transaction monitoring rules | Build or configure | Rules must fit your products, fees and user base |
| Case management, limits, reports | Build into your platform | You own the data, the audit trail and the speed |
The build side matters more than most founders expect. If your case queue, limits and audit logs live inside your own admin panel, you can swap a KYC or analytics vendor in weeks. If they live inside one vendor’s portal, switching means rebuilding your workflow and losing history.
How Much Does Crypto Compliance Software Cost?
Costs come in three forms: per check fees, yearly contracts and your own team.
Per check fees (KYC and screening): some vendors publish prices. As of 2 November 2026, Sumsub’s pricing page lists a Basic plan at $1.35 per check with a $149 monthly minimum. Its Compliance plan costs $1.85 per check with a $299 minimum. Transaction monitoring sits in a custom plan.
Yearly contracts (blockchain analytics): the big analytics vendors do not publish prices. Comparison sites such as CostBench estimate annual contracts for the largest names at roughly $50,000 to $200,000 or more. Treat these as estimates and get quotes.
Your own team: you need a named compliance officer (often called an MLRO in Europe) and analysts to work alerts. Every false positive costs analyst time, so tuning matters as much as the license.
Here is a worked example for KYC alone. Say your exchange verifies 5,000 new users a month:
- On a $1.35 plan: 5,000 x $1.35 = $6,750 a month, or $81,000 a year.
- On a $1.85 plan with AML screening: 5,000 x $1.85 = $9,250 a month, or $111,000 a year.
Add analytics, Travel Rule and staff on top. The main cost drivers are:
- Volume: checks, screened transfers and Travel Rule messages per month
- Chains and tokens: more chains means more data to cover
- Markets: each country adds lists, thresholds and report formats
- Risk level: derivatives, high limits and high risk regions need deeper checks
- Contract terms: minimums, seat counts and multi-year lock-ins
Then there is the platform itself. Published 2026 agency cost guides put a white label exchange at $15,000 to $60,000, a custom MVP at $100,000 to $200,000, and a full custom exchange at $250,000 to $500,000 or more. See our white label crypto exchange cost breakdown for what each tier includes.
How Do You Choose Crypto Compliance Software?
Run every vendor through the same test before you sign.
- Map your obligations first. List your markets, licenses and products. This tells you which thresholds, lists and reports you need.
- Check coverage. Does the analytics tool support every chain and token you plan to list? Ask for the list, not a headline number.
- Test the API under load. Deposit and withdrawal checks sit in the money path. Ask for response times at your peak volume and the fallback when the API is down.
- Measure false positives. Run a proof of concept on a sample of your own past transfers. Count how many alerts a human would need to clear.
- Check Travel Rule reach. Ask which exchanges the network can reach, and how it handles counterparties on other networks.
- Ask where data lives. EU users’ data may need to stay in the EU. Check hosting regions and retention settings.
- Read the contract. Look for monthly minimums, overage fees, multi-year terms and exit help.
A rule of thumb: pick vendors that your regulator and your banking partners already know. It shortens audits and bank due diligence.
Launch an Exchange With Compliance Built In
Compliant crypto exchange development, done right.
- KYC and KYB onboarding: Vendor SDKs wired into sign up, with user tiers and limits set automatically
- Wallet screening: Deposit and withdrawal checks that hold risky funds before they move
- Travel Rule module: IVMS101 data exchange with per-country thresholds you can change in settings
- Compliance admin panel: Alert queue, case notes, audit logs and report exports in one place
See a live demo of our exchange software with the compliance stack in action.
Book a Free Demo to plan the KYC, AML and Travel Rule setup for your exchange or wallet.
How Coinsclone Helps With Crypto Compliance
Coinsclone builds exchanges and wallets with the compliance layer wired in from day one. We connect your chosen KYC, wallet screening and Travel Rule vendors through APIs, and build the rules engine, limits, case queue and audit logs into your own admin panel, so you can switch vendors without a rebuild. Coinsclone has built crypto products since 2018 and delivered 350+ platforms for 200+ clients across 20 industries. A white label exchange takes 4 to 6 weeks, or 7 to 10 weeks with fiat rails. Talk to our cryptocurrency exchange development company team to plan your stack, or read our guide on how to start a cryptocurrency exchange.
Frequently Asked Questions
What is blockchain compliance?
Blockchain compliance is the use of on-chain data to meet AML and sanctions rules. Tools trace where funds came from, label wallets tied to known services or criminals, and score the risk of each transfer. Exchanges use it alongside KYC because a user’s identity says nothing about the source of the coins they deposit.
What is AML in crypto?
AML in crypto means anti-money laundering controls for crypto businesses. It includes KYC, sanctions screening, wallet screening, transaction monitoring, Travel Rule data sharing and suspicious activity reports. Most countries apply these rules to exchanges and custodial wallets under FATF standards.
What does KYT mean in crypto?
KYT stands for “know your transaction.” It means screening each deposit and withdrawal against blockchain data to see if the funds touched risky sources such as mixers, hacks or sanctioned wallets. KYT checks the money, while KYC checks the person.
Do crypto companies need both blockchain analytics and traditional AML software?
Yes, in most cases. Traditional AML tools handle identity checks, sanctions lists, case work and reports. Blockchain analytics covers what those tools cannot see: the history of the wallets on each transfer. Some vendors bundle both, but the two jobs are different.
How much does crypto compliance software cost?
It depends on volume, chains and markets. Published KYC prices start around $1.35 to $1.85 per check, plus a monthly minimum. Blockchain analytics is most often sold as a yearly contract, quoted in private. Add Travel Rule fees and the cost of the team that reviews alerts.
Can one platform handle all crypto compliance requirements?
Rarely. A few suites cover KYC, screening and monitoring together, but most exchanges still add a separate blockchain analytics tool and a Travel Rule network. The safer setup keeps case management and audit logs in your own platform, so vendors can change without losing your records.
What are the KYC requirements for crypto exchanges?
Most regulators want exchanges to check each user’s ID with a document and a live selfie, screen them against sanctions and PEP lists, and rate their risk before they can trade. Higher risk users need enhanced checks such as proof of address and source of funds. Firms need KYB, which also checks who really owns them.
What is the difference between KYC and transaction monitoring?
KYC happens at onboarding and confirms who the user is. Monitoring runs for the life of the account and watches what the user does, such as odd deposit patterns or fast in and out flows. Both are required, and alerts from monitoring often lead to a fresh KYC review.