KYC Remediation for Crypto Exchanges: What Examiners Look For
Most crypto exchanges collect identity documents at sign-up. The problem examiners find is rarely that a file is empty. It is that the file does not support the risk rating, the activity on the account no longer matches what the customer told you, or nobody can show when the file was last reviewed. This article sets out what examiners and bank partners typically test in an exchange's KYC and KYB files, where files usually fall short, and how to scope a remediation that will stand up at the next review.
Who is looking at your files
A U.S. exchange registered as a money services business (MSB) must run a written anti-money-laundering program that includes procedures for verifying customer identification, a designated compliance officer, training and an independent review (31 CFR 1022.210). Depending on where you operate, the same files may be reviewed by state money transmitter examiners, federal BSA examiners, the New York Department of Financial Services, FINTRAC in Canada, your banking partners and your own independent tester. Each will pull a sample of customer files and test them against your own written procedures.
What examiners test in a KYC or KYB file
Identity and verification evidence. Is the customer who they say they are, and does the file show how that was verified, by which method and on what date?
Business customers and beneficial owners. For corporate accounts: the legal entity, who owns and controls it, and evidence that those people were identified and screened.
A risk rating that is explained. Examiners look for the factors behind the rating (geography, product use, expected volume, source of funds, on-chain exposure), not just a label of low, medium or high.
Expected activity versus actual activity. If a customer said they would trade a few thousand dollars a month and are moving millions, the file should show that someone noticed and reviewed it.
Sanctions and wallet screening. Evidence that customers and the addresses they transact with were screened, and how hits were cleared. New York's guidance expects exchanges to use blockchain analytics for customer due diligence, transaction monitoring and sanctions screening, with documented case management and escalation (NYDFS, April 2022).
Periodic and event-driven reviews. When was the file last refreshed, and did a trigger (an alert, a change of ownership, adverse media) lead to an updated review?
Consistency with your own policy. The most common finding is simply that the exchange did not do what its own procedures say it does.
Where exchange files usually fall short
In practice, the gaps tend to repeat:
Files opened under an older, lighter onboarding standard that were never brought up to the current one.
Corporate accounts with incomplete ownership information, or owners who were never screened.
Risk ratings assigned once at onboarding and never revisited.
Thresholds, such as identity checks only above a certain transaction size, that customers can avoid by splitting transactions.
Screening alerts closed without a note explaining why.
Blockchain analytics in place, but no written procedure for how its results feed into customer risk.
Enforcement actions show how far this can go. In December 2025, FinCEN and the Department of Justice announced penalties against a peer-to-peer virtual currency exchange that, among other failures, had no KYC process for several years, later applied identity checks only above $1,500 with no controls against structuring, and had no written AML program for more than four years after launch (Mayer Brown summary). Most exchanges are nowhere near that, but the same weaknesses show up in milder forms.
The international picture
Expectations are rising outside the U.S. as well. The FATF's June 2025 update found 99 jurisdictions had passed or were passing Travel Rule legislation, and noted that most on-chain illicit activity now involves stablecoins (FATF, 2025). Its July 2026 update added that almost half of jurisdictions with Travel Rule laws had not yet taken supervisory or enforcement action, which suggests examinations in this area are still to come (Regulation Tomorrow summary).
How to scope a KYC remediation
Start from the finding or the risk. Define exactly which customers are in scope: all accounts, accounts opened before a certain date, high-risk ratings, corporate accounts, or a specific product.
Set the standard. Agree in writing what a complete file looks like, based on your current policy, before anyone starts reviewing.
Prioritise by risk. Review high-risk and high-volume customers first, and agree timelines with your regulator or bank partner where a finding requires it.
Reconcile, do not just refresh. Compare the customer's stated profile with their actual on-chain and fiat activity, and update the risk rating where they differ.
Escalate what you find. A remediation will surface accounts that need a closer look. Have an escalation path ready so they are dealt with promptly and consistently.
Fix the cause. Change the onboarding and periodic-review process that let the gap open, or you will be remediating again next year.
Keep the evidence. Record what was reviewed, by whom, what changed and why. Examiners will test the remediation itself.
Independence matters
If an outside firm helps you design or remediate your program, a different party should carry out the independent test of that work. At ComplyChain we will not independently test work we designed or remediated ourselves.
How we can help
ComplyChain Solutions works with crypto exchanges, brokers and other virtual asset service providers on KYC/KYB file remediation, responses to exam and audit findings, lookbacks and blockchain analytics procedures. Read more about our services for crypto exchanges, or email info@complychainsolutions.com with a short description of what you need.
This article is general information, not legal advice. Speak to your counsel about the requirements that apply to your business.
