KYB for crypto firms: documents checklist

A practical preparation pack for ownership, permissions, payment flows and compliance evidence.

FiatBridge · Updated 2026-11-07

Editorial preparation guidance, not financial or legal advice. Requirements depend on your entity, activity and jurisdiction. Sources are linked within each guide.

Build a document index

Create an index with the document name, issuing entity, date, owner and delivery status. Ask the prospective provider about accepted formats, certification, translations and freshness before ordering documents. Requirements differ; the list below is a preparation aid rather than a mandatory list for every application.

Entity and ownership

Prepare incorporation evidence, constitutional documents, registered address and current directors. Draw an ownership chart that connects the applicant through intermediate entities to its ultimate owners. Explain any trusts, nominees or ownership changes rather than leaving unexplained gaps.

Keep identity and address evidence in a restricted folder. Ask the provider which individuals must be verified and which ownership or control tests it applies; do not assume one percentage threshold works everywhere.

Activities and permissions

Describe the actual service: exchange, brokerage, custody, software or another model. Link to the relevant official register and identify the entity and scope recorded there. Record any pending applications separately from permissions already granted.

The FATF Recommendations, amended June 2026, provide the international AML/CFT standards that countries implement through measures adapted to their circumstances. The July 2026 virtual-asset implementation update reviews progress and remaining gaps under Recommendation 15, including VASP licensing or registration, the Travel Rule and supervision. These sources provide international context; they are not a provider’s onboarding checklist or a substitute for applicable local law.

Payment and compliance evidence

Our recommended working pack includes:

• A diagram of fiat and crypto flows, including third-party providers and account ownership.
• Expected volumes, average and maximum transaction sizes, currencies and countries.
• An explanation of how business funding was obtained, with supporting records available securely.
• Your customer due-diligence, sanctions, monitoring and escalation procedures.
• A description of who operates each control, and examples of implementation where appropriate.
• A clear explanation of client-money handling, reconciliation and withdrawal processes.

Avoid sending customer datasets or raw identity documents merely to demonstrate that a control exists. Ask what redacted or aggregate evidence is acceptable.

Resolve inconsistencies before submission

Compare the website, corporate documents, application and financial forecast. The business activity and applicant name should be consistent. Label projections, explain material changes and nominate one person to coordinate responses. A polished policy alone does not demonstrate that its controls operate.