AML and KYC Basics When You Accept Bitcoin

If you run a US business that accepts Bitcoin, two acronyms come up fast: AML (anti-money laundering) and KYC (know your customer). They sound like bank jargon, but they have real meaning for merchants, freelancers, and platforms that handle Bitcoin on behalf of others. This guide explains what these rules are, who they apply to, and what compliance looks like in plain terms.

Nothing here is legal or financial advice. Rules change, interpretations shift, and the stakes can be significant, so talking to a qualified attorney or compliance professional before you build a process around this material is the smart move.

What AML and KYC Actually Mean

Anti-money laundering refers to a set of laws and regulations designed to prevent criminals from passing illegally obtained funds through legitimate financial channels to make them appear clean. In the US, the Bank Secrecy Act (BSA) of 1970 is the foundational statute. It requires covered businesses to keep records, file reports, and maintain programs that detect and deter money laundering.

Know your customer is a specific component of AML. It refers to the practice of verifying who your customers are before doing business with them. In traditional finance this means collecting a name, address, date of birth, and a government-issued ID. In crypto, the same principle applies to businesses that fall under covered categories.

Together, AML and KYC requirements form a compliance framework meant to create a paper trail that law enforcement can follow if something looks suspicious.

Who Has to Follow These Rules

Not every business that accepts Bitcoin needs a formal KYC program. A retailer who takes Bitcoin as payment for goods is in a different regulatory position than a platform that exchanges Bitcoin for dollars on behalf of customers.

The key category under US law is the money services business (MSB). FinCEN, the Financial Crimes Enforcement Network (a bureau of the US Treasury), defines MSBs to include money transmitters, currency dealers or exchangers, and certain other businesses. Importantly, FinCEN guidance has made clear that companies engaged in the exchange or transmission of convertible virtual currency can qualify as MSBs.

If your business:

• Buys or sells Bitcoin for customers
• Transfers Bitcoin on behalf of others
• Operates an exchange or swap platform
• Runs a Bitcoin ATM (BTM)

...then you likely meet the MSB definition and must register with FinCEN, implement an AML program, and comply with KYC requirements.

On the other hand, a merchant who simply accepts Bitcoin as payment for a product or service, and then converts it to USD, generally does not qualify as a money transmitter under FinCEN guidance. The merchant is acting as the recipient of payment, not as an intermediary transmitting funds for a third party.

That distinction matters, but it is not always clean. If you are unsure which side of the line your business falls on, that is a question for a lawyer with BSA or FinCEN experience.

The FinCEN Framework: MSBs and Crypto

If your business qualifies as an MSB, the compliance obligations are substantial.

Registration. You must register with FinCEN using the BSA E-Filing System. Registration is not a license; it is a reporting requirement. You also need to check whether your state requires a separate money-transmitter license (more on that below).

AML program. FinCEN requires covered MSBs to develop, implement, and maintain a written AML program. The program must cover four core elements:

1. Policies and procedures for compliance
2. Designation of a compliance officer
3. Ongoing employee training
4. Independent testing of the program

Suspicious Activity Reports (SARs). If you detect a transaction or pattern of transactions that you know, suspect, or have reason to suspect involves illegal funds, or is structured to evade reporting requirements, you may be required to file a SAR with FinCEN. The threshold for crypto-related SARs is generally transactions involving $2,000 or more.

Currency Transaction Reports (CTRs). If a customer conducts a cash transaction (or series of related transactions) of more than $10,000 in a single day, a CTR must be filed. Bitcoin is not cash, but if someone pays you in Bitcoin that is immediately exchanged for dollars and the equivalent exceeds that threshold, the rules around structuring still apply.

What KYC Looks Like in Practice

For businesses required to conduct KYC, the standard US approach involves collecting and verifying:

• Legal name
• Date of birth
• Physical address
• Government-issued ID (passport, driver's license)
• Taxpayer Identification Number in some cases

For business customers, you typically also need information about the business entity itself and its beneficial owners.

Most licensed crypto exchanges, Bitcoin ATM operators, and custody platforms in the US have built out automated identity verification pipelines. They use third-party identity services that check IDs, run sanctions screening against OFAC lists, and apply risk scoring.

As a merchant using a third-party payment processor such as BitPay, Strike, or OpenNode, you generally do not run KYC yourself. The processor handles it on their end because they are the regulated entity. Your responsibility is to use a processor that is actually operating within the regulatory framework, not to bypass it.

If you are building your own Bitcoin payment system that holds or moves customer funds, you need to think seriously about whether you are operating as a money transmitter and what that triggers.

Form 8300 and Large Transactions

One rule that applies more broadly, not just to MSBs, is Form 8300. If your business receives more than $10,000 in cash or cash equivalents in a single transaction, or in two or more related transactions, you must file Form 8300 with the IRS within 15 days.

Whether Bitcoin qualifies as a "cash equivalent" for Form 8300 purposes is a question the IRS has not answered with a single clear ruling. Some tax practitioners read the current guidance to suggest Bitcoin could be treated as a cash equivalent in some contexts; others disagree. Given that the IRS treats Bitcoin as property for tax purposes (see bitcoin taxes for US businesses explained), the analysis gets complicated quickly.

The practical takeaway: if you receive large-value Bitcoin payments, speak with a tax professional about whether Form 8300 applies to your situation. Getting this wrong carries civil and potentially criminal penalties.

Solid recordkeeping is the foundation of any compliance effort. For more on what records to keep, see recordkeeping for Bitcoin payments at tax time.

State-Level Requirements

Federal registration with FinCEN does not satisfy state-level obligations. Most states have their own money-transmitter licensing regimes, and many explicitly cover virtual currency businesses.

New York's BitLicense (issued by the NYDFS) is the most well-known example, but it is not alone. States including California, Texas, and Washington have licensing frameworks that can apply to businesses transmitting Bitcoin on behalf of others. As of the mid-2020s, most US states require some form of license for money transmission, and a growing number specify that convertible virtual currency businesses fall within their scope.

Operating as an unlicensed money transmitter at the state level is a crime in most jurisdictions, even if you are registered with FinCEN.

If you are building a platform that moves Bitcoin for users, a multistate licensing analysis is not optional. The compliance map is complex, and the cost of getting it wrong is high.

Sales tax on Bitcoin transactions is a separate (and still-evolving) topic. For a look at how states are treating Bitcoin sales, see do you charge sales tax on Bitcoin sales.

Frequently Asked Questions

Does a small merchant who accepts Bitcoin need to set up a KYC program?

Generally no, if you are simply accepting Bitcoin as payment for goods or services and not acting as an intermediary for others. A standard retail merchant is not a money transmitter under FinCEN's framework. That said, if your business model involves any element of holding or transmitting Bitcoin on behalf of customers, the analysis changes. When in doubt, get a legal opinion.

What is OFAC, and does it apply to Bitcoin transactions?

The Office of Foreign Assets Control (OFAC) administers US sanctions programs. It maintains lists of designated individuals and entities (such as the Specially Designated Nationals list) that US persons are generally prohibited from transacting with. OFAC has applied sanctions to specific Bitcoin wallet addresses and has enforcement authority over crypto transactions. Businesses with compliance obligations typically screen transactions against OFAC lists as part of their KYC process.

Can FinCEN see my Bitcoin transactions?

FinCEN can receive reports from regulated entities (SARs, CTRs, etc.) that may reference Bitcoin transactions. Additionally, Bitcoin's blockchain is public, meaning transactions are visible to anyone who analyzes the chain. Law enforcement agencies and analytics firms have tools to trace on-chain activity. Treating Bitcoin as anonymous is a misreading of how the technology actually works.

What happens if a business operates as an unlicensed money transmitter?

At the federal level, operating as an unlicensed money-transmitting business is a federal crime under 18 U.S.C. 1960, with penalties including fines and imprisonment. FinCEN also has civil penalty authority under the BSA. State regulators have their own enforcement mechanisms. Prosecutions have occurred in crypto contexts, so this is not a theoretical risk.

Do processors like BitPay or Strike handle AML/KYC compliance for merchants?

Yes, reputable US-based payment processors handle their own regulatory compliance, including AML programs and KYC verification of users on their platforms. As a merchant, you benefit from using a licensed processor because it keeps you out of the money-transmission business. It does not, however, eliminate your own tax reporting and recordkeeping obligations. The processor handles their side; the IRS still expects you to account for Bitcoin income correctly on your tax return.