---
title: "KYC and KYB for stablecoin payins: who verifies whom?"
seoTitle: "Stablecoin KYC and KYB for payins: who verifies whom"
description: "Stablecoin KYC for payins: your business verifies its customers, the payin provider screens and monitors. A responsibility table and BlindPay facts."
date: "2026-10-21"
category: "compliance"
author: "BlindPay Team"
faq:
  - q: "Do I need KYC to accept stablecoin payments through a payin API?"
    a: "In most setups, yes. The people or companies that send or receive funds through your product must be identified before money moves. With BlindPay, every payin belongs to a customer that has completed KYC (individuals) or KYB (businesses), so you register each customer first and BlindPay verifies it."
  - q: "What is the difference between KYC and KYB for crypto payments?"
    a: "KYC checks an individual: legal name, date of birth, address, government ID, and usually a selfie. KYB checks a business: legal name, tax ID, formation date, incorporation documents, and the owners behind it, called ultimate beneficial owners (UBOs). Both must pass before the customer can send or receive funds."
  - q: "How long does KYC or KYB take on BlindPay?"
    a: "Per the BlindPay docs, KYC Standard for individuals is automated and typically takes about 60 seconds. KYC Enhanced, used for individuals from high-risk countries, and KYB Standard for businesses are manual, typically 3 hours to 1 business day. Missing documents or an information request can add time."
  - q: "What happens if a payin gets flagged for review?"
    a: "The payin moves to on_hold while BlindPay's compliance team reviews it. If the flag cannot be cleared internally, BlindPay sends a request for information about the sender, the purpose, and the expected outcome. Per the docs, if that request is not answered within 24 hours, the transaction may be refunded to the sender."
  - q: "Can a payin provider do my compliance for me?"
    a: "Only part of it. A provider verifies customers you register, screens and monitors transactions, and runs the checks tied to its own licenses. You still own your customer relationships, your own AML program, and the accuracy of what you submit. Confirm the exact split in your provider's agreement before you launch."
  - q: "What documents does KYB require for a business customer?"
    a: "On BlindPay, KYB needs the legal name, tax ID, formation date, address, website, an incorporation document, a proof of ownership document, proof of address, and at least one owner with identity details. Corporate formation documents must be complete, not just the first page. Some sectors face enhanced due diligence."
---

For a stablecoin payin, your business verifies its own customers (KYC for individuals, KYB for businesses), and the payin provider screens the deposits, runs sanctions checks, and monitors activity. The exact split is set by your provider's terms. With BlindPay, you register each customer through the API and BlindPay runs the verification as part of the same payment flow.

A payin is fiat coming in (for example a bank transfer) and stablecoins going out to a wallet. A stablecoin is a token pegged to a currency such as the US dollar. Both ends of that movement need an identified party.

## Key takeaways

- Every payin belongs to a verified customer. On BlindPay, a customer must complete KYC or KYB before it can send or receive funds.
- Your company collects and submits the identity data. The provider verifies it, screens transactions, and can pause a payin for review.
- Verification speed depends on the level: about 60 seconds for KYC Standard, 3 hours to 1 business day for KYC Enhanced and KYB Standard (per BlindPay docs).
- Your own AML program, licensing, and customer relationships stay with you. A provider's checks add to yours. They do not replace them.

## Why do payins need KYC and KYB?

Payins need KYC and KYB because money laundering and sanctions rules apply to the payment, not just to the account. Someone has to know who is behind each deposit and each wallet. [FATF's guidance on virtual assets](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html) expects service providers to identify customers and apply a risk-based approach. In the US, FinCEN treats businesses that transmit convertible virtual currency as money transmitters, with the same program duties as other money services businesses ([FinCEN guidance](https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models)).

For a platform, this has a practical meaning. You cannot create a payin for an anonymous payer. The payin must hang off a customer record that passed verification. For the difference between KYC, KYB and transaction monitoring (KYT), see [KYC vs KYB vs KYT](/resources/more/kyc-vs-kyb-vs-kyt) and [What is KYB?](/resources/more/what-is-kyb).

## Who is responsible for what?

The general principle: a business that builds on a licensed provider's infrastructure usually keeps KYC and KYB on its own counterparties, while the provider handles transaction screening, monitoring, and the obligations that come from its own licenses. The table shows that split in plain terms, with what the BlindPay docs say for each line. "Typically handled by" is a general pattern, not a legal rule. Confirm it in your own agreement.

| Obligation | Typically handled by | With BlindPay |
| --- | --- | --- |
| Register each customer who sends or receives funds | Your company | Required. Every customer on your platform must be registered in BlindPay. A customer that is itself a money transmitter must also register its end customers. |
| Collect identity and business data and documents | Your company | You submit the fields and files through the customer API. BlindPay publishes required fields and document quality rules. |
| Verify identity and business documents | Provider | BlindPay verifies. KYC Standard is automated. KYC Enhanced and KYB Standard are manually reviewed by BlindPay's compliance team. |
| Terms of service acceptance | Your company and your customer | The customer accepts BlindPay's terms on the BlindPay app. You pass the returned `tos_id` when you create the customer. |
| Sanctions and watchlist screening | Provider | A sanctions or watchlist match is a documented trigger for a compliance hold. Customers in prohibited countries are blocked. |
| Transaction monitoring | Provider | BlindPay's monitoring system flags suspicious payins and payouts. Flagged ones go `on_hold`. |
| Answering requests for information | Your company | BlindPay opens the request. You collect the answer from your customer and submit it. |
| Per-customer limits | Provider sets, your company requests increases | Limits depend on the verification level. Increases need supporting documents. |
| Your own AML program and licensing | Your company | Not delegated. BlindPay's checks add to your obligations. They do not replace them. |

## What information is collected from individuals and from businesses?

Individuals give identity and address data plus a government ID and selfie. Businesses give company data, formation and ownership documents, and details for every owner. The lists below come from the BlindPay [KYC requirements](/docs/kb/kyc) and [KYB documents](/docs/kb/kyb-documents) pages.

**Individuals (KYC Standard):**

- First and last name, date of birth, email
- Residential address and tax ID (government ID number)
- ID document (passport, ID card, or driver's license) and a selfie
- Proof of address is optional on Standard

**Individuals from high-risk countries (KYC Enhanced):** everything above, plus mandatory proof of address, a source of funds document, and the purpose of transactions.

**Businesses (KYB Standard):**

- Legal name, tax ID, formation date, website, and registered address
- Incorporation document, proof of ownership document, and proof of address
- At least one owner (UBO or controlling person), each with the same identity data as an individual plus proof of address and a role

Two details trip teams up. A business has one tier only, so there is no enhanced KYB. And documents must be complete: a first page of the incorporation papers is not enough, and proof of address must be dated within the last 90 days.

Verification level also sets limits. These are the BlindPay defaults, calculated on the stablecoin amount, with separate limits for payins and payouts:

| | KYC Standard | KYB Standard | KYC Enhanced |
| --- | --- | --- | --- |
| Per transaction | $10,000 | $30,000 | $50,000 |
| Daily | $50,000 | $100,000 | $100,000 |
| Monthly | $100,000 | $250,000 | $500,000 |

Limits can be raised by submitting additional documents through the limit-increase endpoint.

## What is sanctions screening and ongoing monitoring?

Sanctions screening checks whether a party or country is on a sanctions list. Ongoing monitoring watches activity after onboarding for patterns that look wrong. Screening happens at onboarding and again as transactions move. Monitoring never really ends.

On BlindPay, the documented signals are concrete:

1. Countries under sanctions or outside BlindPay's risk appetite are blocked. Creating a customer in that tier returns an error with no manual exception path.
2. A sanctions or watchlist match on a transaction can put it on a compliance hold.
3. Transaction monitoring can flag a payin as suspicious, which sets its status to `on_hold`.
4. For a flag BlindPay cannot clear, the compliance team sends a request for information (RFI) covering the sender's relationship to the customer, the purpose, and the expected outcome. If it goes unanswered for 24 hours, the transaction may be refunded to the sender.
5. Compliance can also open an RFI on an already approved customer. The customer's `kyc_status` becomes `approved_rfi` and payouts, payins, and virtual accounts keep working while the RFI is open.

A blocking RFI on a customer (`compliance_request`) pauses new payins and payouts for that customer. The customer has 27 days to respond or is auto-rejected. Holds on transactions can take up to 30 days to resolve.

Build your product so these states are visible. Subscribe to the `customer.update` and `payin.update` webhooks and show your customer why a deposit is waiting. The [payin status lifecycle](/docs/payins) lists `processing`, `on_hold`, `completed`, `failed`, and `refunded`.

## What stays with my company?

Your company keeps the relationship with the customer, the quality of the data you submit, and your own regulatory position. A payin provider cannot take those over.

- **Customer onboarding experience.** You collect the data, handle document uploads, and respond to RFIs on time.
- **Accuracy and consistency.** Data that does not match the documents is a common reason for slow reviews. BlindPay lists blurry or cropped images, screenshots, and photos of screens as common rejection causes.
- **Fair use of your account.** Nested payments, where a customer moves money for parties BlindPay has not onboarded, are prohibited. A customer that needs to serve its own client base needs its own instance.
- **Disclosure.** Customers must disclose business activity during onboarding. High-risk activity such as money services or virtual asset businesses is allowed with disclosure and enhanced due diligence.
- **Your own obligations.** Whether you need a license, a registration, or an AML program depends on what you do and where. Ask counsel. See also [who owns what when you integrate an on-ramp API](/resources/more/crypto-on-ramp-compliance-who-owns-what).

## What questions should I ask a provider?

Ask the same questions of every provider, including Bridge, BVNK, Zero Hash, and BlindPay. This list makes no claim about what any named provider does. Check each answer against the provider's own documentation and contract, and note the date you checked.

1. Who verifies my customers: the provider, a third-party vendor, or me? What does each level cost and how long does it take?
2. Which customer types and countries are supported or blocked?
3. What triggers a compliance hold on a payin, and how long can a hold last?
4. How do requests for information reach me, through webhooks, email, or both? What is the response deadline?
5. What happens to the deposit if I miss a deadline: refund, return to sender, or a failed status?
6. Which licenses does the provider hold, and which obligations does it take on under them?
7. How are the Travel Rule and sanctions checks split between us? See [the Travel Rule on payins](/resources/more/travel-rule-stablecoin-off-ramps) for what the rule requires on the off-ramp side.
8. Can I get an audit trail, meaning customer decisions, timestamps, and documents, to show a regulator or bank partner?

## Where does BlindPay fit?

BlindPay builds compliance into the payin flow. You create a customer, BlindPay verifies it, and only an approved customer can have a payin or a virtual account. Compliance is a status on the same objects you already use, not a separate vendor integration.

Facts from the docs:

- KYC Standard, KYC Enhanced, and KYB Standard are the verification levels. Documented review times are about 60 seconds, then 3 hours to 1 business day for the manual levels.
- On development instances, customers auto-approve. Set the first name or legal name to `Fail` to force a rejection for testing.
- A virtual account has its own two-stage review, compliance first and then the bank, with extra documents such as source of funds and source of wealth. See [virtual accounts for stablecoin payins](/resources/more/virtual-accounts-for-stablecoin-payins).
- Payins can be refunded when compliance requirements are not met.

For the full picture, start with [what a stablecoin payin API is](/resources/more/what-is-a-stablecoin-payin-api), the guide on [automating KYC and KYB](/resources/more/how-to-automate-kyc-kyb-stablecoin-payments), and BlindPay's [compliance overview](/compliance). BlindPay does not describe itself as a substitute for your own legal analysis.

## Sources

- FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html (checked on 2026-10-21)
- FinCEN, Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies: https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models (checked on 2026-10-21)
- BlindPay docs, KYC requirements: /docs/kb/kyc
- BlindPay docs, KYB documents: /docs/kb/kyb-documents
- BlindPay docs, On-hold transactions: /docs/kb/on-hold-transactions
- BlindPay docs, Prohibited activities and Nested payments: /docs/kb/prohibited-activities and /docs/kb/nested-payments

*This article is general information, not legal advice.*