KYC stands for Know Your Customer. It is the process of confirming that a person opening an account is genuinely who they say they are — and that they are not someone your business is legally barred from serving. For a crypto exchange, wallet or fintech, KYC is usually the first compliance control you are required to implement, and the one regulators ask about first. This guide explains what a KYC check actually involves, which documents matter, how KYC relates to AML and KYT, what it costs per verification, and how to plug it into your platform without building an identity stack yourself.
What KYC actually means
KYC is identity assurance. When a user signs up, you collect evidence of who they are, verify that the evidence is genuine, and confirm the person presenting it is the person it describes. Everything else in a compliance programme builds on that foundation — you cannot apply sanctions rules, transaction limits or reporting obligations to a customer whose identity you never established.
A modern crypto KYC check has three parts. Document verification confirms that a passport, national ID or driving licence is authentic, unexpired and unaltered. Biometric matching compares a selfie against the photo on that document. Liveness detection confirms the selfie comes from a live person rather than a printed photo, a screen or a deepfake.
On top of those, the customer's name and date of birth are screened against sanctions lists, politically exposed person (PEP) registers and adverse-media databases. That last step is where KYC begins to overlap with AML obligations, which is why the two terms are so often confused.
KYC, AML and KYT: how they fit together
These three acronyms describe different layers of the same programme, and mixing them up leads to real gaps.
- AML (Anti-Money Laundering) is the umbrella — the entire legal framework you operate under, including policies, record-keeping, staff training and reporting.
- KYC is one control inside AML. It answers: who is this person? It happens at onboarding and is periodically refreshed.
- KYT (Know Your Transaction) answers a different question: what is this money doing? It runs continuously, monitoring the wallets and transactions attached to the account.
The practical consequence is that KYC alone is not enough. A verified customer with a genuine passport can still receive stolen funds next month. Conversely, clean transaction history tells you nothing about whether the account holder is a real person or a rented identity. You need both, and for corporate customers you also need KYB to verify the company and its beneficial owners.
What happens during a verification
From the user's side the flow takes two or three minutes. You create a verification request through the dashboard or API and receive a verification link. The user opens it on a phone, photographs their ID document, takes a selfie, and submits.
Behind that simple flow, the system checks document security features, validates the machine-readable zone, extracts the data fields, compares the face biometrically, runs liveness analysis, and screens the extracted name against watchlists. The result comes back as approved, rejected or requires-review, together with the extracted data and the reason for the decision.
Results are delivered to your webhook, so nothing needs polling. Each completed verification produces a signed record you can export as PDF — which matters, because the verification you cannot evidence is, to an auditor, a verification that never happened.
What KYC costs, and why
KYC is priced per verification request, not per user seat. On Arya Crypto every paid action draws from one token balance shared across screening, KYT monitoring, KYC and KYB, so you are not managing separate subscriptions.
A personal KYC verification costs more per request than an address screening, and that difference is structural rather than arbitrary. An address check is a lookup against indexed data. A KYC verification runs document forensics, biometric comparison and liveness analysis on uploaded media, then screens the result — considerably more work per request.
Two details worth knowing. Tokens are consumed on the final decision, not at the moment you create the request, so an abandoned verification does not bill. And new accounts receive gift tokens, so you can run real verifications end-to-end before committing budget. Current per-action rates are always shown on the pricing page and are readable programmatically.
Integrating KYC into your platform
You do not need to build identity infrastructure. In the dashboard you create a business, set a callback URL, and receive an eight-digit business code. From there a single API call issues a verification link for a given user, and the signed result arrives on your webhook when the check completes.
The usual integration point is registration: create the verification when the user signs up, hold account features that require verified status until the callback confirms approval, and route the small share of requires-review cases to a human queue. Because the callback is signed with HMAC-SHA256, you can verify it genuinely came from us before acting on it.
For exchange operators, this is the same identity layer that plugs into a full exchange platform, and the same one used for trader onboarding on a prop trading platform — so the compliance stack stays consistent no matter which product you run.
Common KYC mistakes
Verifying once and never again. Documents expire and circumstances change. Most frameworks expect periodic re-verification, with the interval driven by customer risk rather than a fixed calendar.
Treating rejection as final without review. Genuine customers fail automated checks for mundane reasons: poor lighting, a worn document, a name written differently across systems. A manual review path recovers real users that pure automation would lose.
Collecting more data than you need. Every extra field is a liability under data-protection law and a target in a breach. Collect what the obligation requires, and no more.
Assuming KYC covers your sanctions duty. Name screening at onboarding catches a listed individual on the day they register. It does nothing about the wallet they use six months later — that is what continuous transaction monitoring is for.
Where to start
If you are building compliance from scratch, the sensible order is: verify identity at onboarding with KYC, screen the wallet addresses those customers actually use, then put your recurring counterparties under continuous monitoring. Add KYB when you begin onboarding companies rather than individuals.
Start with a handful of real verifications using the gift tokens on a new account. Run them end to end — including a deliberately imperfect document — so you learn what your approval, rejection and review rates actually look like before those numbers matter commercially.
Run your first KYC verification free — Pricing · Services · KYT · KYC · KYB · Exchange · Prop