6 October 2026 · 3 min read

KYC and AML integration for a crypto exchange

What a provider actually returns, what it costs per check, and the states your product needs before the first verification is ever run.

KYC appears in roughly one in seventeen exchange briefs as a single line, and it is never a single line. The integration is small; the product design around it is not.

What a provider gives you

You send a user's documents and details, they return a decision, usually one of: approved, rejected, or needs review. Alongside it you get a confidence level, extracted fields and the evidence they used.

What you build around that:

• A state machine. Unverified, pending, approved, rejected, expired, re review. Every state needs a screen and a rule about what the user can do while in it.
• Limits by state. Most venues allow deposits before verification and block withdrawals until it passes. That choice is yours and it is a policy, not a default.
• Manual review. Providers return "needs review" more often than vendors admit. Someone on your side looks at those, and that someone needs a screen in the console.
• Re verification. Documents expire. Rules change. People move country.

AML screening is a different job

KYC asks "is this person who they say they are". AML asks "should we be doing business with them", against sanctions and politically exposed person lists, plus ongoing monitoring of transactions.

They are usually separate products, sometimes from separate vendors, and they are billed differently: identity per check, screening per check plus a monitoring subscription.

A hit on a sanctions list is not a support ticket. Decide in advance who gets told, what the user sees, and what you are obliged to do, before it happens at 2am.

What it costs

Per verification, billed by the provider directly to you. Volume pricing varies by provider and document type, and the bill scales with signups rather than with revenue, which is the part that surprises operators who run a free signup funnel.

That is the same arrangement as hosting and market data: provider accounts in your name, billed to you, as set out in the cost breakdown.

Starting without a provider

Manual review is a legitimate starting point at low volume: a document upload, a queue in the console, an approve or reject with a note, and the evidence retained. It costs nothing per check and does not scale past a few a day.

Build the state machine first either way. Swapping manual review for a provider is then an integration, not a redesign, because the states, screens and limits already exist.

Questions

What is the difference between KYC and AML

KYC verifies identity. AML screens that identity against sanctions and risk lists and monitors transactions afterwards. They are usually separate products with separate bills.

How much does KYC cost per user

It is priced per verification by the provider and billed directly to you. The important part is that the cost scales with signups rather than revenue, so a free signup funnel is a real expense.

Can I launch without KYC

That depends on your jurisdiction and your activity, which makes it a legal question. Technically yes; whether you may is for your lawyer.

Should KYC block deposits or withdrawals

Most venues allow deposits and block withdrawals until verification passes. That is a policy decision you make deliberately, and the software should let you change it without a deployment.

What happens when a provider says "needs review"

A person looks at it. That is normal rather than exceptional, so the console needs a review queue, a decision with a note, and an audit trail of who decided what.

Can I start manual and add a provider later

Yes, and it is the cheapest way to start. Build the verification states and screens first; swapping in a provider then becomes an integration rather than a redesign.