KYC for Crypto Exchanges: Documents, Liveness, Sanctions

KYC for crypto exchanges comes down to four checks done well: the identity document is genuine and valid, the person holding the camera is live and is the person in the document, the name is screened against sanctions (and usually PEP) lists, and the same document has not already been used to open another account. Each check should produce a clear outcome and evidence, so the system can approve the easy cases and send the rest to a human.

This guide is written for compliance officers, MLROs and founders of exchanges, OTC desks and payment companies. It covers what a solid onboarding flow includes, where spoofing attacks get through, how to set face match zones and screening rules, and why identity checks stop short of the risk that lives in a customer's wallets.

What a solid onboarding check includes

Exact crypto KYC requirements depend on your licence and jurisdiction, and on the customer's risk level. Across most regimes, a standard individual onboarding includes:

1. Customer data: full name, date of birth, nationality, address.
2. A government-issued identity document: passport, national ID card or driver's license.
3. Proof of address where your rules require it.
4. A liveness check and a face match against the document photo.
5. Sanctions and PEP screening, repeated over the life of the relationship.
6. Duplicate detection across existing customers.
7. A risk rating that decides the level of ongoing monitoring.

The order matters less than the rule that each step leaves a recorded result. A reviewer opening the case six months later should see what was checked, what failed and who decided.

Document verification and MRZ check digits

Most passports and many ID cards carry a machine readable zone (MRZ), the two or three lines of characters at the bottom of the data page. ICAO Document 9303 defines its format, including check digits for the document number, date of birth, expiry date and a composite of these fields.

Each check digit is calculated from the characters before it: digits keep their value, letters map to numbers (A is 10, B is 11 and so on), filler characters count as zero, then values are multiplied by repeating weights of 7, 3 and 1, summed, and taken modulo 10. A forged or edited MRZ often fails this calculation. Even when it passes, the MRZ should agree with the printed front side: same name, same document number, same dates.

Useful document checks:

• MRZ check digits valid for every protected field.
• MRZ and front side agree.
• Document not expired on the day of onboarding.
• Document fields match what the customer typed into the form.
• Image quality good enough to read every field without guessing.

In Cryptic AI KYC, an expired document or an invalid MRZ blocks approval automatically. The system reads passports, ID cards, driver's licenses and proof of address, computes MRZ check digits per ICAO 9303, compares them with the front side, and checks the fields against what the client entered.

Liveness and the attacks it has to stop

A liveness check confirms that a real person is in front of the camera right now. Attackers try to get around it with:

Attack	How it works	Countermeasure
Replay	A pre-recorded video of the victim is played to the camera	Random challenge order the video cannot predict
Screen presentation	A photo or video shown on a phone or monitor	Light the face with a random color from the screen and look for the matching reflection on skin
Virtual camera	Software feeds synthetic or recorded video instead of a real camera	Detect virtual camera devices and inconsistent frame signals
Mask or printed photo	A printed face or 3D mask held up to the camera	Motion challenges and texture, depth and reflection cues
Face swap mid-session	One face passes the challenge, another appears in later frames	Compare frames from the same session with each other

The Cryptic AI liveness check asks the client to turn left, turn right and blink in a random order, so a pre-recorded video cannot guess the sequence. During the session the screen lights the face with a random color and the system looks for that reflection, and it checks for virtual cameras. ISO/IEC 30107-3 is the reference standard for testing presentation attack detection if you need to discuss methodology with an auditor.

Face match thresholds and manual review zones

Face matching produces a similarity score between the selfie frames and the document portrait. Using one threshold to split pass and fail is a mistake. Document photos are often old, small and printed at low quality, so genuine customers land just below a strict cutoff, while a loose cutoff lets lookalikes through.

A better design uses three zones:

• Match: high similarity, eligible for auto-approval if everything else passes.
• Weak match: the middle band, routed to manual review with both images side by side.
• Likely a different person: low similarity, blocked or escalated.

Cryptic AI KYC returns exactly these three outcomes and also compares frames from the same session with each other, which catches a face that changes partway through the challenge. Review how analysts decide in the weak-match band over time. If most weak matches end up approved, your middle band may be too wide.

Sanctions and PEP screening with fuzzy names

Sanctions screening crypto customers is harder than it looks because names do not travel cleanly between alphabets. One Russian or Arabic name can appear in Latin script in several spellings. Customers also make typos, swap name order or use shortened forms.

Exact matching misses real hits. Overly loose matching drowns analysts in false positives. Good screening:

• Handles typos, transliteration variants and name order.
• Uses date of birth and nationality to separate the customer from a namesake.
• Covers the lists your regulators expect, typically OFAC, UN, EU and UK.
• Re-screens existing customers when lists change.
• Records why each potential match was cleared or confirmed.

Cryptic AI screens against OFAC, UN, EU and UK lists with matching that accounts for typos, transliteration and name variants, refined by date of birth and nationality.

Duplicate documents

The same passport showing up on two accounts is a strong fraud or mule signal. Detecting it means comparing document numbers across customers, but storing raw numbers in an extra lookup table widens your data exposure. A safer approach stores a keyed, secure hash of the number and compares hashes. Cryptic AI does this, and searches only within your own organization.

Auto-approval vs manual review

Auto-approval keeps onboarding fast for the majority of clean applicants. It should only fire when every check is clean: valid document, valid MRZ, passed liveness, face match in the top zone, no screening hits, no duplicate. Any concern or failed step should stop it and route the case to a reviewer, who records the reason for the decision.

The Cryptic AI visual workflow builder lets you set this up as steps, conditions and outcomes, starting from templates. Exchanges can embed the flow as a widget, connect by API key, receive signed webhooks and follow status in real time. Every action goes to the audit log.

Data deletion obligations

KYC data is sensitive personal data. Privacy laws such as the GDPR give people a right to request deletion, while AML laws require you to keep customer due diligence records for a set period, commonly at least five years after the relationship ends. Your policy should say which applies when, and your system should be able to delete a person's images, frames and document data on request once the retention basis lapses. Cryptic AI supports data deletion on request.

Why KYC alone is not enough

KYC tells you who opened the account. It says nothing about where their crypto came from. A fully verified customer can deposit funds from a sanctioned address, a hacked exchange or a mixer. Screening the wallets a client deposits from and withdraws to is the other half of the job, and that is what KYT covers. For transfers between providers, the Travel Rule adds another layer of originator and beneficiary data.

FAQ

Is a selfie enough for a liveness check?

No. A single selfie can be a photo of a photo. Liveness needs an active challenge or other signals that prove the person is present at that moment.

Should a failed MRZ check always reject the applicant?

It should block automatic approval. A reviewer may find a poor scan and ask for a new image, but the application should not pass without a valid MRZ.

How often should existing customers be re-screened?

Whenever the sanctions lists you rely on are updated, and when customer data changes. Ongoing screening is a standard expectation, not an onboarding-only step.

Do we need PEP screening as well as sanctions?

In most regimes, yes. A PEP match does not block onboarding by itself, but it usually triggers enhanced due diligence and senior approval.

A good KYC flow approves clean applicants in minutes and gives reviewers clear evidence for the rest. To see how documents, liveness, face match and screening fit into one configurable workflow, explore Cryptic AI KYC.