Business Crypto Compliance 101: KYC/KYB, AML, Travel Rule, and Tax Basics (Business Crypto Compliance Guide)

You don’t need a law degree to run compliant crypto operations. You do need a plan that ties identity checks, anti–money laundering controls, Travel Rule data, and taxes into one workflow. This business crypto compliance guide shows what to implement, when to trigger it, and how to connect it to daily operations without slowing your team.

Quick answer, in 120 seconds: If your company accepts or sends crypto on behalf of others, you may be a money transmitter (a type of Money Services Business) under U.S. rules and must run an AML program, monitor transactions, file suspicious activity reports, and comply with the Travel Rule at $3,000 or more per transfer. IRS treats crypto as property, and new Form 1099‑DA reporting for brokers applies to sales effective January 1, 2025, with penalty relief for good‑faith efforts during 2025. The EU applies a no‑threshold Travel Rule to crypto‑asset service providers, while the U.K. and Singapore require originator/beneficiary data with jurisdiction‑specific triggers. Sources: FinCEN CVC guidance; FinCEN Travel Rule FAQ; IRS virtual/digital asset guidance and 1099‑DA updates; EU Regulation 2023/1113; FCA and MAS notices. (fincen.gov)

Note: This page is educational. Regulations change by jurisdiction. For decisions that carry legal or tax consequences, work with qualified counsel or a licensed advisor once you’ve sketched your compliance program.

What belongs in a business crypto compliance program?

Think of compliance as a set of habits that run every time value moves. A durable program covers six layers:

1. Risk assessment and governance. Document what assets you touch, who your customers are, where they’re located, and how you control wallets. In practice, this controls what you must verify, screen, and report.

2. KYC (know your customer) and KYB (know your business). For individuals, capture legal name, address, date of birth, and an ID. For companies, verify legal existence, business address, directors, and beneficial owners (the real people who control 25% or more, or otherwise exercise control). In the U.S., banks must run a formal Customer Identification Program under 31 CFR 1020.220; MSBs must have AML programs under 31 CFR 1022.210 that include risk‑based customer identification. (law.cornell.edu)

3. Sanctions screening. Check customers and counterparties against OFAC lists before and during the relationship and flag activity tied to sanctioned wallets or geographies. OFAC has issued crypto‑specific guidance on program expectations. (ofac.treasury.gov)

4. Travel Rule data exchange. When the Travel Rule applies, send/receive required originator and beneficiary information with transfers, and reconcile exceptions. In the U.S., this triggers at $3,000; in the EU, there’s no de minimis threshold for covered transfers. (fincen.gov)

5. Monitoring and reporting. Detect suspicious activity and file SARs. For U.S. money services businesses, the SAR threshold is generally $2,000. Screen for typologies like ransomware cash‑outs, darknet markets, and sanctioned mixers. (fincen.gov)

6. Tax and records. Track basis, holding periods, cost, proceeds, and income characterization. Crypto is property for U.S. federal income tax; broker gross‑proceeds reporting (Form 1099‑DA) begins for sales on or after January 1, 2025, with good‑faith penalty relief during 2025 and basis reporting stepping in by 2026 per final regs. (irs.gov)

A useful data point: the share of illicit crypto transaction volume was estimated at 0.34% for 2023, down from 0.42% in 2022, but absolute illicit volumes and ransomware remained material. Monitoring and sanctions controls still matter. (chainalysis.com)

Who needs to comply? Are you a money services business or just a user?

Whether your company is a regulated “financial institution” in the U.S. often turns on activities. FinCEN’s 2019 guidance says administrators or exchangers that accept and transmit convertible virtual currency (CVC), or buy/sell CVC for others, are money transmitters and must comply with BSA rules. Pure users that only buy goods/services for themselves aren’t money transmitters. (fincen.gov)

Here’s a compact comparison to orient your next steps.

This framework comes straight from FinCEN’s CVC interpretations and related administrative rulings that tie MSB status to activities, not technology labels. When in doubt, map your product flows to “accepts and transmits value for others.” (fincen.gov)

How do KYC and KYB fit into business crypto compliance?

KYC (individual identity verification) and KYB (business verification) are how you know who’s behind a wallet or account. For KYC, capture name, address, date of birth, and a government ID, then verify the person matches the document and any selfie or liveness test. For KYB, confirm the entity’s legal name, registration number, formation documents, business address, and executives. Identify beneficial owners and a control person, then verify them as individuals.

In the U.S., formal Customer Identification Program rules sit squarely on banks and certain securities firms. MSBs must implement AML programs that are “risk‑based,” and in practice that means customer identification and screening appropriate to the products and risks you carry. If you bank your crypto operations, your bank will apply CIP and customer due diligence standards when you open accounts or lines. Citations: 31 CFR 1020.220 (banks CIP), 31 CFR 1023.220 (broker‑dealers CIP), and 31 CFR 1022.210 (MSB AML program). (law.cornell.edu)

A parallel requirement many companies miss: beneficial ownership information reporting under the Corporate Transparency Act. FinCEN began accepting BOI reports on January 1, 2024. Most small U.S. entities must report their beneficial owners and company applicants, and keep filings up to date when information changes. (fincen.gov)

Pro tip: tie KYC/KYB outcomes to wallet permissions. For example, don’t let a new account request high‑risk jurisdictions or large outbound transfers until both entity documents and ultimate owners have been verified and screened. For operational guidance on access controls and incident response, see our primer on wallet security for teams.

What AML monitoring and reporting should U.S. businesses plan for?

Two anchors shape day‑to‑day work:

• Suspicious Activity Reports. If you operate as a money services business, you must file a SAR when you suspect illicit activity and the transaction involves or aggregates at least $2,000. That includes crypto flows that suggest sanctions evasion, ransomware, or stolen funds. Build playbooks that translate blockchain signals (mixer exposure, OFAC‑listed wallets) into SAR narratives. (fincen.gov)

• Sanctions screening. OFAC’s crypto briefing points to the same expectation: know your exposure, block prohibited transactions, and maintain an audit‑friendly sanctions program across customers and transactions. Don’t just screen names; add wallet screening and geofencing where relevant. (ofac.treasury.gov)

One more operational reality: it’s common to receive deposits from self‑hosted wallets. The BSA doesn’t ban interacting with them, but your risk assessment should navigate those transfers with higher scrutiny.

Travel Rule explained for businesses: when it triggers, what data to send, and how it differs by region

In plain English, the Travel Rule requires certain financial institutions to send verified originator and beneficiary information “along with” a covered transfer. In the U.S., it applies to transmittals of funds at $3,000 or more, including those denominated in convertible virtual currency. Data usually includes the originator’s name, address, and account number (or wallet reference), plus the amount and date. The European Union’s Transfer of Funds Regulation (EU 2023/1113) extends a no‑threshold Travel Rule for crypto‑asset service providers, and the U.K. requires crypto businesses to comply since September 1, 2023. Singapore’s MAS PSN02 sets a threshold around SGD 1,500 for value transfers. Build logic that recognizes counterparties and jurisdiction, then routes the right data. Sources: FinCEN FAQ; EU 2023/1113; FCA statements; MAS PSN02 references. (fincen.gov)

Build reconciliation flows for “sunrise issues” (when your counterparty’s country has not yet implemented compatible rules); FATF has repeatedly called out gaps and urged faster alignment. (fatf-gafi.org)

Digital asset tax basics for teams and freelancers

This is where many businesses trip: taxes are not optional just because you’re using crypto.

• Classification. The IRS treats virtual currency as property, which means general property tax rules apply to gains and losses. Buying and selling crypto, paying contractors in crypto, and using crypto to buy goods or services can all trigger taxable events. (irs.gov)

• Information reporting. The IRS finalized Form 1099‑DA for broker reporting of digital asset sales occurring on or after January 1, 2025, with penalty relief for brokers that make a good‑faith effort to file correctly for 2025 transactions. Adjusted basis reporting aligns with 2026 applicability. Expect more accurate pre‑filled data in 2026 tax seasons. (irs.gov)

• Records you must keep. Keep dates acquired and disposed, cost basis, proceeds, wallet addresses or transaction IDs (where applicable), and the fair market value at payment time for payroll or contractor compensation. The IRS FAQs and digital assets page outline the specific records and forms (e.g., Form 8949, Schedule D). (irs.gov)

Self‑employed or consulting on the side? See our hands‑on walkthrough of crypto tax for freelancers. If you run a distributed team, our guide to crypto payroll for remote teams covers income recognition, FX rates at pay time, and how to document approvals.

Self‑contained answer passage (tax reporting, 130 words): For U.S. federal taxes, crypto is property, so capital gains apply when you sell for fiat or swap into another token, and ordinary income applies when you receive crypto for services at its fair market value that day. Starting January 1, 2025, brokers must issue Form 1099‑DA for digital asset sales, helping taxpayers and the IRS reconcile proceeds; the agency is providing penalty relief during 2025 for brokers that make good‑faith efforts to comply. Basis reporting aligns with a 2026 applicability date. Keep detailed records for basis, holding periods, and proceeds to support filings on Form 8949 and Schedule D, and treat crypto payroll or contractor payments as compensation income at receipt. Sources: IRS Notice 2014‑21; IRS digital assets page and 1099‑DA updates. (irs.gov)

The business crypto compliance guide applied to operations: wallets, treasury, and payments

Start with how money moves inside your company, then overlay controls:

• Wallets and keys. Separate hot and cold, apply role‑based approvals, and rehearse incident response. Our blueprint on wallet security for teams shows how to set policies that match risk.

• Treasury. Assign roles across requests, reviews, and sign‑offs, and record the business purpose on each transfer. This keeps auditors happy and makes Travel Rule messaging easier. For a structure you can lift and run with, see role‑based treasury management for stablecoin operations.

• Payments. Keep “who, what, why” tied to each invoice or payroll run. If you’re still choosing rails, compare options in the complete guide to accepting crypto and stablecoin payments and stablecoins for business. You can also reduce manual invoicing with payment links and crypto checkouts.

How do KYC/KYB checks actually run day to day?

KYC/KYB works best as an intake sequence that gates riskier features:

1. Collect business details (legal name, registry, address), proof of formation, and a short description of activities and expected transaction volumes.

2. Identify beneficial owners and a control person, then verify each individual. Tie their verification to access levels.

3. Screen company and individuals for sanctions and adverse media. Re‑screen on schedule or at risk triggers.

4. Link approved entities to on‑chain addresses or custodial accounts. Track these linkages to support Travel Rule data and monitoring.

5. Apply enhanced due diligence for higher‑risk geographies, industries, or flows.

Banks do this through CIP and CDD rules; MSBs implement it within their AML program. Many global teams add beneficial‑ownership reporting in the U.S. if they formed a company stateside (see BOI FAQs and small‑entity guide). (fincen.gov)

What is the minimum AML program a U.S. crypto payments business should maintain?

If your activity makes you a money transmitter, your AML program must be “risk‑based” and include internal controls, a BSA compliance officer, training, independent testing, and appropriate customer identification and screening. That’s the short version of 31 CFR 1022.210. Keep written procedures for:

• Risk assessment and customer classification
• Sanctions screening and Travel Rule handling
• Transaction monitoring rules and alert review
• SAR decisioning and filing with supporting evidence
• Record retention and audit trails

For context: U.S. agencies have been explicit that sanctions compliance and suspicious activity reporting extend to virtual currencies. OFAC’s dedicated guidance is worth bookmarking for your training and audits. (law.cornell.edu)

Where the Travel Rule meets real‑world crypto operations

Two traps catch teams:

• Counterparty identification. You need to know whether you’re dealing with a VASP or a self‑hosted wallet. For VASP‑to‑VASP, exchange data securely. For self‑hosted wallets, apply your risk‑based procedures; in the EU, TFR adds specific steps for unhosted wallets interacting with CASPs.

• Sunrise and cross‑border gaps. FATF has flagged uneven implementation. Your program should define when to reject, hold, or return a transfer that lacks required data, and how to message counterparties to cure defects. (fatf-gafi.org)

If you’d like a deeper operational comparison (U.S. vs EU vs U.K. vs Singapore), keep the previous table handy as your runbook.

Expert view

“VASPs should be required to be licensed or registered.” — FATF, Updated Guidance on a Risk‑Based Approach to Virtual Assets and VASPs. The document frames why licensing/registration and Travel Rule messaging move together: without both, illicit flows find the gaps. (fatf-gafi.org)

Another perspective from a U.S. regulator: FinCEN’s former Director Kenneth A. Blanco reminded the industry, “We expect you to comply with your AML/CFT regulatory obligations,” emphasizing that obligations apply regardless of business size or tech stack. (fincen.gov)

How should a business crypto compliance program be documented?

Auditors and banks look for two things: a program that matches your risk, and evidence you follow it. Produce a binder (digital works) with:

• A current risk assessment that explains your customers, geographies, assets, and product set
• Written policies and procedures for KYC/KYB, sanctions, Travel Rule, monitoring, and reporting
• Board or leadership approval of the AML program and the designated compliance officer
• Training records and independent testing reports
• Vendor due diligence (KYC providers, blockchain analytics, custodians)
• A SAR log with case notes and submission confirmations (where applicable)
• Travel Rule exception logs and counterparty remediation notes

What questions do banks and partners ask when you add crypto to payments?

Expect variants of these:

• Which corporate entities touch crypto, and where are they incorporated?
• Do you or your vendors qualify as a money transmitter or crypto‑asset service provider in any jurisdiction where you operate?
• How do you KYC/KYB counterparties, and what’s your re‑screening schedule?
• What’s your Travel Rule flow for VASP‑to‑VASP and for transfers involving self‑hosted wallets?
• Who can approve wallet address allowlists, and how many signatures are required above specific limits?
• Where do you keep tax records that tie on‑chain transactions to invoices or payroll?

Be ready to share short, factual answers and one diagram that shows your data flows from customer intake to settlement.

A 10‑step, tool‑agnostic launch plan for compliant crypto payments in 30 days

1. Map flows. Diagram receive, hold, swap, and send paths, by asset and counterparty type.

2. Classify activity. Compare to FinCEN’s 2019 CVC guidance to decide whether you or a partner are an MSB/money transmitter. Document your conclusion. (fincen.gov)

3. Choose rails and custody. Self‑hosted with a policy engine or a qualified custodian. Assign approval roles.

4. Draft policies. Write short, practical SOPs for KYC/KYB, sanctions, Travel Rule, monitoring, and SARs.

5. Wire up KYC/KYB. Collect entity docs, owners, and control persons. Verify and screen.

6. Configure Travel Rule messaging. Enable secure data exchange with identified VASPs; define exceptions when the other side can’t receive data.

7. Implement monitoring. Add heuristics for mixer exposure, sanctions risk, typologies, and velocity rules. Define thresholds for manual review and escalation.

8. Train teams. Cover OFAC basics, red flags, SAR writing, and privacy.

9. Test and audit. Run a tabletop for a suspicious pattern and a Travel Rule exception. Fix gaps.

10. Launch with a narrow scope. Start with stablecoin payouts to verified counterparties, then expand.

Pro tip: If you prefer one workspace where payments, approvals, and identity checks live together, a platform like the SeevCash App can centralize your KYC/KYB intake, approvals, and payout workflows so operational steps mirror your written policies. Use any analytics and Travel Rule provider you prefer; the point is to make evidence easy to collect.

What about accepting crypto from customers and paying suppliers?

Start simple: one asset, one chain, one or two well‑understood use cases. For B2B invoices, pre‑clear the counterparty, collect their legal details, and agree on assets and addresses. For suppliers, match payments to an approved invoice and tie the chain transaction ID back to your ERP. If you’d like field‑tested recipes, you’ll find sample flows in our walkthrough on the complete guide to accepting crypto and stablecoin payments.

What statistics actually help you set controls?

Two numbers earn a place in risk assessments:

• Illicit share of volume. Chainalysis estimated that 0.34% of 2023 crypto transaction volume was illicit, a small percentage of a very large base. That argues for targeted monitoring, not blanket bans on self‑hosted wallets. (chainalysis.com)

• Concentration risk. Hundreds of exchange deposit addresses receive the majority of illicit funds in a given year, so your sanctions and monitoring vendors should focus on those clusters. That’s how you keep false positives low and catch the real patterns. (chainalysis.com)

What should a business crypto compliance program include? (scan‑friendly checklist)

Here’s a self‑contained 155‑word snapshot you can lift into an internal wiki. Start with a risk assessment that maps your assets, counterparties, and jurisdictions. Add identity controls: KYC for people and KYB for companies, including beneficial owners. Screen everyone and everything against sanctions lists. Implement Travel Rule workflows: in the U.S., originator/beneficiary info must accompany covered transfers at $3,000 or more, and the EU’s 2023/1113 applies to all covered crypto transfers handled by service providers. Monitor transactions for typologies (mixers, ransomware, sanctions exposure), and if you’re an MSB, file SARs at or above the $2,000 threshold for suspicious activity. Keep records for audits and taxes; crypto is property for U.S. tax, and brokers report gross proceeds on Form 1099‑DA for sales starting 2025, with penalty relief for good‑faith compliance in 2025. Build training, testing, and independent reviews into the calendar so the program stays alive. Sources: FinCEN Travel Rule FAQ; MSB SAR threshold; IRS virtual/digital assets; EU 2023/1113. (fincen.gov)

Regional watch‑outs that catch U.S. teams by surprise

• European Union. The TFR (2023/1113) removes the de minimis threshold for crypto transfers between CASPs and lays out how to handle missing data and unhosted wallet interactions. Set expectations with EU partners early. (eur-lex.europa.eu)

• United Kingdom. The FCA expects Travel Rule compliance from registered cryptoasset businesses since September 1, 2023, and also enforces a strong promotions regime for retail marketing. Your compliance calendar should include fair‑marketing checks if you serve U.K. consumers. (fca.org.uk)

• Singapore. MAS PSN02 defines value‑transfer requirements for digital payment token providers, with secure, immediate submission of originator/beneficiary info to counterparties and authorities, and an SGD‑linked trigger. (acra.gov.sg)

• Canada. FINTRAC’s guidance covers Travel Rule expectations for virtual currency transfers and a separate large virtual currency transaction report (LVCTR) at the CAD 10,000 level. (fintrac-canafe.canada.ca)

KYC vs KYB vs AML: side‑by‑side

How to thread compliance through treasury approvals

Your approval chain should change with risk:

• Low‑risk, low‑value internal transfers: one requester, one approver, auto‑screened addresses.
• Standard supplier payments: requester + finance approver; Travel Rule check if the counterparty is a VASP.
• High‑risk or high‑value: add a compliance approver, on‑chain tracing check, and a cooling‑off review.

These are business rules, not software rules. The point is to make good decisions repeatable. If you manage stablecoin flows at scale, borrow structures from role‑based treasury management for stablecoin operations.

What about Travel Rule and self‑hosted wallets?

The Travel Rule anchors on covered institutions, not on the technology of the wallet. In U.S. rules, it applies to “transmittals of funds” at $3,000 or more by or through covered financial institutions. If the counterparty is a self‑hosted wallet, you won’t exchange Travel Rule data VASP‑to‑VASP, but you still screen, monitor, and document origin and use of funds as part of your AML program. In the EU, TFR adds obligations when CASPs interact with unhosted wallets. Build workflows that recognize counterparties and handle the differences cleanly. (fincen.gov)

Where SeevCash fits (one example among many)

Many teams prefer to stitch together identity, approvals, Travel Rule messaging, and payouts in one pane. The SeevCash App can serve that role by tying KYC/KYB intake to wallet permissions and approval policies so the operational audit trail matches your written program. It’s one approach; use any stack that lets you prove what happened when an auditor asks.

Field‑tested monitoring triggers that pay off

• Counterparty switch. A known vendor suddenly asks to be paid to a new address or a different asset. Treat as a potential business email compromise until verified.

• Mixer exposure spike. A supplier wallet starts showing deposits from mixers or sanctioned services. Pause and investigate.

• Velocity anomaly. Multiple high‑value transfers under internal approval limits in a short window. Aggregate patterns matter more than individual payments.

• Geography drift. IP, device, or blockchain analytics suggest a shift into a high‑risk jurisdiction.

Tie each trigger to a named decision owner. If you’re an MSB, keep SAR case notes even when you decide the activity is not reportable.

Two “don’t skip this” records that save audits

• Travel Rule exception log. List every instance you lacked required data, what you did to fix it, and the outcome.

• Tax substantiation folder. For every on‑chain payment, keep the invoice, approval trail, FMV at payment time, and the transaction hash. Auditors don’t argue with organized evidence.

The last mile: taxes meet payroll and vendor payments

Paying a contractor in USDC? That’s income to them at fair market value the moment they receive it, and an expense to you. If you’re a U.S. payer and they’re a U.S. person over reporting thresholds, your year‑end info reporting responsibilities don’t go away because the medium changed. On your books, track cost basis if you acquired the tokens at one price and paid them out at another; the delta may create a gain or loss. IRS guidance and the 1099‑DA framework will push the market toward cleaner reporting starting with 2025 sales. Build the muscle now. (irs.gov)

How SeevCash helps in practice (optional)

For teams that want heavier administration, SeevCash Plus adds advanced policy controls and exports that line up with AML testing and tax prep. Again, it’s one option. Pick any platform that makes your evidence easy to assemble and re‑run.

Resources and “deep dives” from this hub

• Wallet policies and incident response: wallet security for teams
• Approval chains and signers: role‑based treasury management
• Self‑employed? Start here: crypto tax for freelancers
• Choosing rails: accepting crypto and stablecoin payments
• Stablecoin selection: stablecoins for business
• Reducing invoice ping‑pong: payment links and crypto checkouts

FAQ: five quick answers your CFO will ask

What triggers the Travel Rule in the U.S.? For covered institutions, it’s transmittals of funds at $3,000 or more, including CVC. Required data must accompany the transfer. (fincen.gov)

Do we need a “formal” CIP if we’re an MSB? Formal CIP is a bank rule. MSBs must maintain AML programs that are risk‑based and include customer identification and screening appropriate to their risks and products. (law.cornell.edu)

What’s the SAR threshold for MSBs? Generally $2,000 in funds or assets when suspicious activity is detected. File via FinCEN’s BSA E‑Filing. (fincen.gov)

How are crypto swaps taxed? Swapping one token for another is a disposal of property: you recognize gain/loss based on fair market value of what you receive minus basis of what you disposed. (irs.gov)

Does the EU really have no minimum for the Travel Rule? Correct for covered CASP‑to‑CASP transfers under Regulation (EU) 2023/1113. Your CASP counterparties will expect data every time. (eur-lex.europa.eu)

—

Action step: Download your latest policy drafts, open your wallet policy and vendor approvals, and compare them line by line against the sections above. If you want one place to route identity checks, approvals, Travel Rule data, and payouts, book a 20‑minute working session with SeevCash to walk through your current flow and gaps.

According to FATF and U.S. regulators, the destination is clear: identity, Travel Rule, monitoring, and records that tell a clean story. Set that story up now, while volumes are manageable. (fatf-gafi.org)