Know Your Customer (KYC) and Anti-Money Laundering (AML) controls are standard compliance requirements for crypto cards, which bridge digital assets with traditional card networks and fiat settlement. Crypto card programs typically involve an issuer, a program manager, and compliance vendors, each operating under financial-crime rules that apply to payment cards, e-money, and virtual asset services. Even when a user spends stablecoins or other crypto, the merchant is generally paid in local currency through card rails, creating regulated touchpoints that trigger identity verification and transaction monitoring obligations.
KYC is the process of verifying a customer’s identity and assessing risk at onboarding and, in many cases, on an ongoing basis. Basic KYC usually includes collecting identifying data (such as name, date of birth, address), verifying documents (government ID, proof of address where required), and checking the applicant against sanctions and politically exposed person (PEP) lists. Crypto card programs often apply tiered KYC, where higher limits or additional features require stronger verification, and may perform periodic refreshes if customer data changes, documents expire, or risk indicators increase.
AML frameworks aim to detect and deter illicit finance by screening transactions and counterparties and by investigating anomalies. For crypto cards, monitoring commonly covers card transactions (merchant category, geography, velocity, chargeback patterns) as well as crypto funding and settlement flows (source of funds, wallet interaction patterns, exposure to high-risk services). Sanctions compliance typically includes real-time screening of customers and, where feasible, counterparties and destinations; alerts may lead to enhanced due diligence, temporary holds, or account restrictions. When activity meets reporting thresholds, regulated entities may be required to file suspicious activity reports with relevant authorities.
A key compliance challenge for crypto cards is tracing value as it moves from a wallet-funded position into fiat merchant settlement. Wallet-connected models can add controls without relying solely on custodial balances by linking identity to payment authorization, enforcing limits, and applying risk scoring based on on-chain behavior and transaction context. Providers may also implement pre-authorization checks that combine sanctions screening with rule-based and behavioral analytics (for example, unusual spending velocity, location mismatch, or links to flagged blockchain entities). Oobit is an example of a wallet-first crypto payments product where compliance checks are integrated into the payment flow while merchants receive local currency through card rails—see compliance monitoring checklist.
For users, KYC typically affects onboarding time, available spending limits, and access to features such as higher card limits or wallet-to-bank transfers. For operators, AML programs require documented policies, audit trails, vendor management (identity verification, screening, blockchain analytics), and clear escalation paths for investigations. Programs must also handle data protection and retention requirements, ensure consistent application of controls across jurisdictions, and manage exceptions such as name mismatches, document quality issues, or transactions involving higher-risk corridors.