KYC verifies people, KYB verifies businesses and their owners, and KYT watches transactions and wallets. What each covers, when it runs, and who owns it.
KYC verifies individuals, KYB verifies businesses and their owners, and KYT monitors transactions and wallet addresses after onboarding. KYC and KYB answer "who is this?" once at the start and on refresh. KYT answers "is this payment normal?" every time money moves. Blockchain payments need all three, because the counterparty is often a wallet, not a bank account.
These checks come up wherever a business uses blockchain payments, which is covered in blockchain payments vs crypto payments. This page compares the three checks side by side.
Key takeaways
KYC (know your customer) is identity verification for an individual. It confirms a real person exists, matches the documents, and is not on a sanctions list.
Definition: KYC (know your customer) is the process of collecting and verifying an individual's identity data, usually name, date of birth, address, and a government ID number, checked against documents, a selfie or liveness check, and watchlists before the person can transact.
In the US, an MSB's AML program must include "verifying customer identification," per 31 CFR 1022.210. How deep the check goes depends on risk. A standard-risk individual can pass an automated check. Someone from a high-risk country, or moving large amounts, gets enhanced due diligence: proof of address, source of funds, purpose of transactions, and a human reviewer.
KYB (know your business) verifies a company and the people behind it. The company check is the easy part. The hard part is the owners.
A KYB file usually covers legal name, registration and tax ID, formation date, registered address, website, and what the business does. Then the people: beneficial owners and controlling persons, each verified like a KYC individual. In the US, the customer due diligence rule at 31 CFR 1010.230 defines beneficial owners as anyone holding 25% or more of the equity, plus one individual who controls, manages, or directs the company, such as an executive officer.
The point of KYB is to stop a shell company from hiding the person who really controls the money. What is KYB goes deeper on documents and ownership structures.
KYT (know your transaction) is ongoing transaction monitoring. It watches payments after onboarding for patterns that do not fit the customer's profile, and in crypto it also screens the wallet addresses on each side.
Definition: KYT (know your transaction) is the continuous review of transactions and counterparties, including blockchain wallet addresses, to detect sanctions exposure, fraud, and money laundering patterns in real time or close to it.
KYT is industry shorthand, not a legal term. The legal hook is the AML program and suspicious activity reporting. For sanctions, OFAC's guidance for the virtual currency industry (October 2021) expects firms to screen wallet addresses and use tools that identify and block transactions tied to listed addresses. OFAC began adding digital currency addresses to SDN entries in 2018, and its FAQ 562 says those listings are not likely to be exhaustive. That is why blockchain analytics exist.
KYT catches what onboarding cannot. A verified customer can still receive funds from a hacked wallet tomorrow. Real-time transaction monitoring for stablecoin payments covers the rules and alert handling.
They check different things at different moments. The table puts them side by side.
| KYC | KYB | KYT | |
|---|---|---|---|
| What is checked | An individual | A company, its UBOs, and controlling persons | Transactions and wallet addresses |
| When it runs | Onboarding, periodic refresh, on triggers | Onboarding, periodic refresh, ownership changes | Every transaction, continuously |
| Typical data | Name, date of birth, address, ID number, ID document, selfie | Registration, tax ID, incorporation and ownership documents, owner KYC | Amount, frequency, counterparties, wallet risk score, sanctions hits |
| Main risk addressed | Identity fraud, sanctioned persons | Shell companies, hidden owners | Laundering patterns, sanctions exposure, stolen funds |
| Typical outcome on a problem | Rejection or request for more documents | Request for information on ownership or activity | Transaction held for review, RFI, or refund |
| Speed | Seconds (automated) to a day (enhanced) | Hours to days | Real time or near real time |
The Travel Rule makes the KYC data move with the payment. When a virtual asset service provider (VASP) sends funds to another VASP, it must pass along who sent and who receives them.
FATF applies its wire transfer rule, Recommendation 16, to virtual asset transfers. Its 2021 updated guidance on virtual assets explains how VASPs should obtain, hold, and transmit originator and beneficiary information, with a de minimis threshold of USD/EUR 1,000 available to countries. Each country implements it with its own thresholds and data fields. The Travel Rule for stablecoin off-ramps covers what fails and why.
So the order is: KYC or KYB creates the verified identity, the Travel Rule carries it with the transfer, and KYT checks the transfer itself.
Responsibility follows the license and the relationship. If you are onboarding users, you own your onboarding. A provider that also verifies those users adds a second layer, it does not replace yours.
| Obligation | Platform (you) | Payments provider |
|---|---|---|
| Your own AML program and policies | Yes | No |
| Collecting accurate customer data | Yes | Reviews what you send |
| KYC or KYB on customers who use the provider | Shared: you collect, the provider verifies | Yes, for its own regulatory needs |
| Wallet screening and transaction monitoring on the provider's flows | Monitor your own platform | Yes |
| Answering requests for information | Yes, you hold the customer relationship | Sends the request |
| Suspicious activity reporting | Yes, if your license requires it | Yes, for its own obligations |
The split varies by provider and license. Get it in writing. Who owns compliance when you integrate a crypto on-ramp API walks through a full responsibility matrix.
Every BlindPay payment flows through a customer that has completed verification. Platforms register each of their customers, and a customer who moves money for others must register those end customers too.
The levels, from BlindPay's KYC requirements:
| Level | Applies to | Review | Typical time |
|---|---|---|---|
| KYC Standard | Individuals in standard-risk countries | Automated | About 60 seconds |
| KYC Enhanced | Individuals in high-risk countries | Manual | 3 hours to 1 business day |
| KYB Standard | Businesses | Manual | 3 hours to 1 business day |
KYB requires incorporation and ownership documents, proof of address, and at least one owner, each verified like a KYC individual with a role as beneficial owner, controlling person, or both. If something is missing, compliance opens a request for information and the customer is paused until it is answered (information requests).
On the KYT side, BlindPay's transaction monitoring holds payins or payouts it flags as suspicious for compliance review. If a request for information about a held transaction is not answered within 24 hours, the transaction may be refunded to the sender (on-hold transactions). Moving money for parties BlindPay has not onboarded is nesting, which is not allowed (nested payments).
Write down, for your product, who runs each of the three checks and when. If any row says "the provider handles it" with nothing on your side, fix that first: you still need your own onboarding data, monitoring, and a named person who answers RFIs within hours.
Read BlindPay's KYC requirements to see the exact fields and limits before you design your onboarding form.
The evidence examiners expect from automated risk monitoring: a 10-item evidence table, good vs poor practice, SAR timelines, RFIs, and a 30-day plan.
Blockchain payments are legal for businesses in the US, EU, UK, Brazil, and Mexico, under different rules. What each country regulates, as of October 2026.
Why a stablecoin card purchase can be a taxable disposal, how the US, UK, Germany, Spain, the Netherlands, and Brazil differ, and which records to keep.