KYC for Web3 Projects in 2026: Who Needs It, What It Covers, How to Pass It
What KYC means for crypto founders in 2026: the FATF Travel Rule, EU rules, which parts of your stack need it, and how Otonomos handles your entity's KYC.
Know Your Customer used to be a bank problem. In 2026 it is a Web3 problem, a DAO problem and, for anyone who touches fiat, a licence problem. Here is what it covers, where it applies to you, and how to get through it without losing a month.
KYC is the step everybody wants to skip and nobody can. The good news: for most Web3 projects it is narrower than the fear around it. It lands on specific parts of your stack, and once you know which parts, it stops being a vague cloud of compliance dread and becomes a checklist.
83%
Of surveyed jurisdictions (91 of 109) now have Travel Rule legislation in force, up from 73% a year earlier (FATF, July 2026)
60%
Of those 91 had not yet issued a single supervisory finding or enforcement action on Travel Rule compliance
Dec 2024
When the EU Transfer of Funds Regulation started applying to crypto-asset service providers
1 Jul 2026
The latest date MiCA's transitional period could run to. The grace period is over
The short version. KYC lands on four things: your own entity (we run that for you), your users (only if you handle their money), your token distribution, and any EU activity. Most Web3 projects carry far less than they fear, once each obligation sits with the right entity.
1. What KYC actually is
Know Your Customer, or Know Your Client, is the process of verifying who someone is and whether the money they bring is clean. In practice it has four jobs:
- Establish the customer's identity.
- Understand the purpose and nature of what they are doing.
- Check the money laundering risk attached to their financial profile.
- Confirm the source of the money coming in is legitimate.
For a company rather than a person, the same checks extend to where it is based, who owns it (the beneficial owners), and its legal status.
KYC is the front door of anti-money laundering (AML) and counter-terrorist financing (CFT) rules. A firm that runs it properly can show a regulator, a bank or a counterparty that it knew who it was dealing with. That is also its commercial value: a project with a clean KYC process reads as a trustworthy counterparty, which matters when you want a bank account, an exchange listing or an institutional investor.
2. Why it matters more in 2026 than it did in 2024
Two things changed. The rules became law almost everywhere, and the conversation moved from "is there a rule" to "who checks."
The FATF, the global standard setter, published its seventh annual report on virtual assets in July 2026. Its headline numbers:
- 83% of surveyed jurisdictions have passed Travel Rule legislation, up from 73% in 2025. Including laws still in progress, coverage reaches 93%.
- 60% of the jurisdictions with a Travel Rule law have not yet taken a supervisory or enforcement step on it. The FATF explicitly urges them to start.
- More than a third of jurisdictions that license crypto firms (39 of 114) now extend licensing or registration to offshore firms based on what they do: targeted marketing, onboarding local residents, using local payment rails. Where you are incorporated is no longer the only test.
- Only 18% of responding jurisdictions have assessed DeFi risks, and only a handful have put licensing rules on DeFi arrangements. Regulators are early here, not absent.
Low enforcement today is not a safe harbour. Laws are on the books, the FATF is pushing supervisors to operationalise them, and the firms that built to the rule early are the ones that will not be rebuilding under pressure later.
3. Who has to KYC whom? It depends on which layer you are talking about
"Do we need KYC?" is the wrong question. The useful question is: KYC on whom, by which entity, for what activity? The four tabs below cover the cases we see most.
Every entity Otonomos forms for you goes through KYC on the people behind it: directors, shareholders or foundation council members, and beneficial owners. This is a legal requirement of the registry and of Otonomos as your registered agent. It is also the part we take off your plate.
What the process looks like in practice:
Identity and address, collected through Sumsub
We use a digital verification tool called Sumsub. You get a link by email and the tool walks you through personal details, an ID document upload, a proof of address and a liveness check. For offshore entities we generally require a passport, and in some cases a second ID. For a US LLC a driver's licence is usually enough. Offshore entities tend to carry stricter requirements and extra questions. Step by step: KYC Verification using Sumsub.
Re-usable KYC saves you a second round
If you already verified through Sumsub at another provider, enter the same email and the tool re-uses what is on file, asking only for what is missing. If you verified with Otonomos recently, the system detects it and asks only for the gaps.
Certified copies, where required
Some registries want certified copies of your ID and proof of address. A lawyer, notary public, accountant or another recognised professional can certify them. The required details and templates are in Certified Onboarding Documents.
Source of wealth and source of funds
We are required to collect two explanations. Source of wealth is how you built your overall wealth (employment, a company sale, investing, inheritance). Source of funds is where the money for this specific entity comes from. The more detail and supporting documents you give, the smoother onboarding goes. See Source of Wealth Explanation and Source of Funds Explanation for what to prepare.
Extra due diligence at the registry's discretion
Registry compliance teams can ask for more: a professional reference letter from someone who has known you at least six months, or a bank reference letter. Have these ready and you avoid delays. Details: Additional Compliance/KYC Due Diligence.
The whole flow, from ordering to a verified profile, is in How to order an entity at Otonomos.
This is where Web3 projects get surprised. Your entity's KYC is one thing. KYC on your own customers is another, and it applies the moment your project does something a regulator treats as a financial service for other people.
The usual triggers:
- You run an exchange, a custodial wallet, or any product that holds or moves customers' assets for them.
- You offer a fiat on-ramp or off-ramp yourself, instead of embedding a licensed provider that carries the obligation.
- You sell tokens to the public and the sale falls under securities or MiCA rules.
- You transmit value between customers on a professional basis.
When a transfer moves between two regulated crypto firms, the Travel Rule applies: the sending firm collects and passes on information about the sender and recipient. In the EU the Transfer of Funds Regulation has applied to crypto-asset service providers since 30 December 2024 and covers transfers regardless of amount. For larger transfers involving a self-hosted wallet, EU rules also require the firm to assess whether the wallet really belongs to its customer.
If you do not hold or move customer funds, most of this sits with someone else. Embedding a licensed provider is often the cleanest way to keep it there. Our companion guide covers how: On-Ramps and Off-Ramps in 2026.
The question we hear every week: do I need to KYC when I simply hold or vote with governance tokens in a protocol? And how does KYC work in a decentralised foundation if I am the lead?
There is no single answer, and anyone who gives you one is guessing. What we can give you is the test and where the pressure points are.
Holding and voting. A protocol with no intermediary that simply lets wallets interact with code does not usually run KYC on those wallets. The EU's MiCA regulation says services provided in a fully decentralised manner without any intermediary fall outside its scope (recital 22). But the term is not defined in the operative law, and in January 2025 the EU's banking and securities regulators reported that very few DeFi systems actually reach that level of decentralisation. In 2026 the Commission opened a review and ESMA asked for a tighter definition and a narrower exemption. Do not build a plan on the exemption without a legal opinion.
The pressure points. KYC tends to attach where a person or entity is identifiable and does something concrete:
- Whoever sells or distributes the token. The token issuer has to know who it sells to, in many regimes.
- The foundation or entity that pays grants and contractors. It needs to know its counterparties, like any company.
- Whoever operates the front end, if it touches fiat or custody.
- A lead or council member of a foundation. As an individual behind a legal entity, you are KYC'd by the registry and the banks, regardless of how decentralised the protocol is.
Structure helps keep each obligation with the right entity. We walk through that in The DeFi Entity Stack in 2026 and DAO Governance: Trust vs. Foundation vs. DUNA.
Four dates matter if you serve EU customers:
- 30 December 2024: the Transfer of Funds Regulation (the EU Travel Rule) started applying to crypto-asset service providers.
- 1 July 2026: the latest end date of MiCA's transitional period. Several member states chose shorter windows. If you relied on a legacy national registration, you needed full authorisation by then.
- July 2027: the EU's new anti-money-laundering regulation is set to start applying, including a ban on crypto-asset service providers maintaining anonymous accounts or handling privacy coins.
- Ongoing: MiCA reaches you based on who you sell to and what you sell, not where you are incorporated. Our MiCA scope check tells you in five minutes whether you are in.
4. The four layers of a KYC stack
If you do have to run KYC on others, a credible programme has four layers. The tools below are examples of each category, not endorsements. Check each vendor's current coverage and pricing before you commit.
| Layer | What it does | Category of tool | Examples |
|---|---|---|---|
| Customer identification | Confirms the person or entity is real and who they say they are | Identity verification, document and liveness checks | Sumsub |
| Customer due diligence | Assesses risk: sanctions, politically exposed persons, adverse media | AML screening platforms | Sumsub, Chainalysis, Elliptic |
| Enhanced due diligence | Extra scrutiny for higher-risk customers: source of wealth, reference letters | Manual review on top of tooling | Compliance team or outsourced reviewer |
| Ongoing monitoring | Re-screens customers and watches transactions and wallets for red flags | Blockchain analytics, wallet screening, Travel Rule messaging | Chainalysis, Elliptic, Notabene, 21 Analytics |
Two practical notes. First, the best tool for a Web3 project is the one that covers wallets and on-chain activity as well as documents. Second, data protection counts: collecting passports from EU residents makes you a data controller, so check where the vendor stores data.
5. What happens when KYC is missing
The clearest cases come from Tornado Cash, an on-chain mixing service. In May 2024 a Dutch court sentenced developer Alexey Pertsev to 64 months for money laundering. In the US, a jury reached a mixed verdict in 2025 against co-founder Roman Storm, and as of August 2026 the retrial on the remaining counts was scheduled for April 2027, with a motion for acquittal still pending. Both cases are contested and legally specific, so read them as a signal about enforcement appetite, not a rulebook.
The practical lesson is simple. Operating a financial service without any AML controls, while identifiable people are behind it, is the pattern prosecutors go after. Having a documented KYC process does not make you immune, but not having one removes your best defence.
6. A short prep list for your own onboarding
Before you order an entity, have these ready:
- A valid passport for every director, shareholder, council member and beneficial owner. Have a second ID to hand in case the registry asks.
- A recent proof of address in each person's name: a utility, internet or tax bill, a voter registration, or a lease. Bank statements are not accepted everywhere, and are not accepted at all for Cayman Islands entities.
- A short written explanation of source of wealth for each individual, and of source of funds for the entity.
- A professional reference letter, if you can get one in advance. It is only requested sometimes, but it is the most common cause of delays when it is.
- A phone or laptop with a camera, for the liveness check.
7. How Otonomos helps
We collect and verify the KYC for the entity you are forming, through Sumsub, and we handle the registry's compliance questions, certified-document requirements and follow-ups on your behalf. You choose the structure, upload your documents and pay. We do the rest, and we keep your entity in good standing afterwards.
What we do not do: run the customer-facing KYC programme of your exchange or ramp, or file a VASP or CASP licence application. That is specialist regulatory work for local counsel. What we can do is make sure the entity your licence depends on is formed correctly and never lapses. Not sure where your project sits? Book a call and we will map it before you spend anything.
Start your entity
Browse every jurisdiction and structure Otonomos sets up, with live pricing.
Check your MiCA scope
Five minutes to find out whether the EU rules apply to you.
Talk to us
A free 30-minute call to map your KYC obligations to your actual stack.
❓ 8. Frequently asked questions
Do I need to KYC if I only hold governance tokens?
Usually the protocol itself does not run KYC on wallets that hold or vote, if it truly operates without an intermediary. But that depends on facts: who sold you the tokens, whether a front end touches fiat, and whether the protocol is genuinely decentralised in the legal sense. If a foundation or company is involved in distribution, expect it to ask for KYC.
Will my DAO foundation lead be KYC'd?
Yes. Whoever sits behind a legal entity as a director, council member or beneficial owner is verified by the registry and by any bank. That is true however decentralised the protocol is.
Can I reuse KYC I already did elsewhere?
If you verified with Sumsub before, enter the same email at the start of the Sumsub flow and it re-uses what is on file. You only provide what is missing.
What is the difference between source of wealth and source of funds?
Source of wealth explains how you built your overall wealth. Source of funds explains where the money for this entity comes from. They overlap but are asked separately. See the two explainer pages linked above.
Does the Travel Rule apply to me?
It applies to regulated crypto-asset service providers and VASPs when they move assets between each other. If your project does not custody or transfer assets for customers, it is probably not the one carrying the obligation, but whoever you integrate with is.
Is KYC the same as AML?
No. KYC is a subset of AML. AML also covers transaction monitoring, suspicious activity reporting and sanctions screening, and it is what keeps KYC useful after onboarding.
Related reading
KYC Verification using Sumsub
Step by step through the verification flow.
Are You in Scope for MiCA in 2026?
The five-minute scope check.
On-Ramps and Off-Ramps in 2026
Who carries the licence when you move money between crypto and fiat.
Bank Account Opening in 2026
The practical side of banking a crypto-friendly entity.
CEX Legal Structuring in 2026
The entity behind the exchange.
How to order an entity at Otonomos
From checkout to a verified profile.
Sources: FATF, Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs, July 2026; Regulation (EU) 2023/1113 (Transfer of Funds Regulation); MiCA recital 22 and transitional provisions; EBA/ESMA Joint Report under Article 142 MiCA, January 2025; Otonomos Helpdesk onboarding pages. Updated November 2026.
This is a practical overview, not legal advice for your specific project. Talk to qualified counsel before you rely on any exemption.
Updated about 3 hours ago