KYC and KYB for stablecoin payins: who verifies whom?

For a stablecoin payin, your business verifies its own customers (KYC for individuals, KYB for businesses), and the payin provider screens the deposits, runs sanctions checks, and monitors activity. The exact split is set by your provider's terms. With BlindPay, you register each customer through the API and BlindPay runs the verification as part of the same payment flow.

A payin is fiat coming in (for example a bank transfer) and stablecoins going out to a wallet. A stablecoin is a token pegged to a currency such as the US dollar. Both ends of that movement need an identified party.

Key takeaways

• Every payin belongs to a verified customer. On BlindPay, a customer must complete KYC or KYB before it can send or receive funds.
• Your company collects and submits the identity data. The provider verifies it, screens transactions, and can pause a payin for review.
• Verification speed depends on the level: about 60 seconds for KYC Standard, 3 hours to 1 business day for KYC Enhanced and KYB Standard (per BlindPay docs).
• Your own AML program, licensing, and customer relationships stay with you. A provider's checks add to yours. They do not replace them.

Why do payins need KYC and KYB?

Payins need KYC and KYB because money laundering and sanctions rules apply to the payment, not just to the account. Someone has to know who is behind each deposit and each wallet. FATF's guidance on virtual assets expects service providers to identify customers and apply a risk-based approach. In the US, FinCEN treats businesses that transmit convertible virtual currency as money transmitters, with the same program duties as other money services businesses (FinCEN guidance).

For a platform, this has a practical meaning. You cannot create a payin for an anonymous payer. The payin must hang off a customer record that passed verification. For the difference between KYC, KYB and transaction monitoring (KYT), see KYC vs KYB vs KYT and What is KYB?.

Who is responsible for what?

The general principle: a business that builds on a licensed provider's infrastructure usually keeps KYC and KYB on its own counterparties, while the provider handles transaction screening, monitoring, and the obligations that come from its own licenses. The table shows that split in plain terms, with what the BlindPay docs say for each line. "Typically handled by" is a general pattern, not a legal rule. Confirm it in your own agreement.

What information is collected from individuals and from businesses?

Individuals give identity and address data plus a government ID and selfie. Businesses give company data, formation and ownership documents, and details for every owner. The lists below come from the BlindPay KYC requirements and KYB documents pages.

Individuals (KYC Standard):

• First and last name, date of birth, email
• Residential address and tax ID (government ID number)
• ID document (passport, ID card, or driver's license) and a selfie
• Proof of address is optional on Standard

Individuals from high-risk countries (KYC Enhanced): everything above, plus mandatory proof of address, a source of funds document, and the purpose of transactions.

Businesses (KYB Standard):

• Legal name, tax ID, formation date, website, and registered address
• Incorporation document, proof of ownership document, and proof of address
• At least one owner (UBO or controlling person), each with the same identity data as an individual plus proof of address and a role

Two details trip teams up. A business has one tier only, so there is no enhanced KYB. And documents must be complete: a first page of the incorporation papers is not enough, and proof of address must be dated within the last 90 days.

Verification level also sets limits. These are the BlindPay defaults, calculated on the stablecoin amount, with separate limits for payins and payouts:

Limits can be raised by submitting additional documents through the limit-increase endpoint.

What is sanctions screening and ongoing monitoring?

Sanctions screening checks whether a party or country is on a sanctions list. Ongoing monitoring watches activity after onboarding for patterns that look wrong. Screening happens at onboarding and again as transactions move. Monitoring never really ends.

On BlindPay, the documented signals are concrete:

1. Countries under sanctions or outside BlindPay's risk appetite are blocked. Creating a customer in that tier returns an error with no manual exception path.
2. A sanctions or watchlist match on a transaction can put it on a compliance hold.
3. Transaction monitoring can flag a payin as suspicious, which sets its status to on_hold.
4. For a flag BlindPay cannot clear, the compliance team sends a request for information (RFI) covering the sender's relationship to the customer, the purpose, and the expected outcome. If it goes unanswered for 24 hours, the transaction may be refunded to the sender.
5. Compliance can also open an RFI on an already approved customer. The customer's kyc_status becomes approved_rfi and payouts, payins, and virtual accounts keep working while the RFI is open.

A blocking RFI on a customer (compliance_request) pauses new payins and payouts for that customer. The customer has 27 days to respond or is auto-rejected. Holds on transactions can take up to 30 days to resolve.

Build your product so these states are visible. Subscribe to the customer.update and payin.update webhooks and show your customer why a deposit is waiting. The payin status lifecycle lists processing, on_hold, completed, failed, and refunded.

What stays with my company?

Your company keeps the relationship with the customer, the quality of the data you submit, and your own regulatory position. A payin provider cannot take those over.

• Customer onboarding experience. You collect the data, handle document uploads, and respond to RFIs on time.
• Accuracy and consistency. Data that does not match the documents is a common reason for slow reviews. BlindPay lists blurry or cropped images, screenshots, and photos of screens as common rejection causes.
• Fair use of your account. Nested payments, where a customer moves money for parties BlindPay has not onboarded, are prohibited. A customer that needs to serve its own client base needs its own instance.
• Disclosure. Customers must disclose business activity during onboarding. High-risk activity such as money services or virtual asset businesses is allowed with disclosure and enhanced due diligence.
• Your own obligations. Whether you need a license, a registration, or an AML program depends on what you do and where. Ask counsel. See also who owns what when you integrate an on-ramp API.

What questions should I ask a provider?

Ask the same questions of every provider, including Bridge, BVNK, Zero Hash, and BlindPay. This list makes no claim about what any named provider does. Check each answer against the provider's own documentation and contract, and note the date you checked.

1. Who verifies my customers: the provider, a third-party vendor, or me? What does each level cost and how long does it take?
2. Which customer types and countries are supported or blocked?
3. What triggers a compliance hold on a payin, and how long can a hold last?
4. How do requests for information reach me, through webhooks, email, or both? What is the response deadline?
5. What happens to the deposit if I miss a deadline: refund, return to sender, or a failed status?
6. Which licenses does the provider hold, and which obligations does it take on under them?
7. How are the Travel Rule and sanctions checks split between us? See the Travel Rule on payins for what the rule requires on the off-ramp side.
8. Can I get an audit trail, meaning customer decisions, timestamps, and documents, to show a regulator or bank partner?

Where does BlindPay fit?

BlindPay builds compliance into the payin flow. You create a customer, BlindPay verifies it, and only an approved customer can have a payin or a virtual account. Compliance is a status on the same objects you already use, not a separate vendor integration.

Facts from the docs:

• KYC Standard, KYC Enhanced, and KYB Standard are the verification levels. Documented review times are about 60 seconds, then 3 hours to 1 business day for the manual levels.
• On development instances, customers auto-approve. Set the first name or legal name to Fail to force a rejection for testing.
• A virtual account has its own two-stage review, compliance first and then the bank, with extra documents such as source of funds and source of wealth. See virtual accounts for stablecoin payins.
• Payins can be refunded when compliance requirements are not met.

For the full picture, start with what a stablecoin payin API is, the guide on automating KYC and KYB, and BlindPay's compliance overview. BlindPay does not describe itself as a substitute for your own legal analysis.

Sources

• FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html (checked on 2026-10-21)
• FinCEN, Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies: https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models (checked on 2026-10-21)
• BlindPay docs, KYC requirements: /docs/kb/kyc
• BlindPay docs, KYB documents: /docs/kb/kyb-documents
• BlindPay docs, On-hold transactions: /docs/kb/on-hold-transactions
• BlindPay docs, Prohibited activities and Nested payments: /docs/kb/prohibited-activities and /docs/kb/nested-payments

This article is general information, not legal advice.