Developing a KYC/AML System for a Crypto Exchange
A crypto exchange without KYC/AML is a ticking time bomb. Regulators (FATF, MiCA, local central banks) impose heavy fines, banks terminate correspondent accounts, and users lose trust. A system that thoroughly checks every user filters out 40–60% of traffic — a fact confirmed by hundreds of projects. FATF Recommendation 16 recommends anti-money laundering and counter-terrorist financing measures. We build balanced KYC/AML: compliance without killing conversion rate.
A typical problem: an exchange launches with basic verification, and six months later gets a first request from a regulator demanding a suspicious transaction report. Without a monitoring system — fines and account freezes. Fines for missing KYC/AML can reach up to 4% of turnover. To avoid this scenario and reduce compliance costs, we embed KYC/AML from the first commit, not patched after an audit. Our team has 5+ years of experience in web3 compliance, with over 30 implemented KYC/AML projects for crypto exchanges.
Multi-Tier KYC Architecture
Single-level verification is an architectural mistake. The right approach is a multi-tier system:
Tier 0 (No KYC)
Only platform browsing. No transactions. Needed for user onboarding.
Tier 1 (Email + AML Check)
Up to a small limit in stablecoins per month. Deposit and withdrawal only in crypto. Automatic wallet screening via Chainalysis or Elliptic on each deposit. Verification time: under 1 minute.
Tier 2 (Full KYC)
Up to the limit for full verification. Passport + liveness check. Provider: Sumsub, Onfido, Jumio. Time: automatic 2–5 minutes, manual review up to 24 hours for complex cases. Unlocks: fiat deposit/withdrawal, unlimited crypto withdrawal.
Tier 3 (Enhanced Due Diligence)
No limits. Source of Funds + Source of Wealth + extended background check. Only for VIP clients, manual processing by compliance officer.
On-Chain AML Screening: Architecture
Every incoming deposit and every withdrawal is screened via wallet screening. We use a custom engine that aggregates data from multiple providers for higher accuracy:
Code example: WalletScreeningService
class WalletScreeningService {
async screenDepositAddress(
walletAddress: string,
asset: string,
amount: number,
userId: string
): Promise<ScreeningResult> {
// Cache: same address not rechecked each time
const cached = await this.cache.get(`wallet:${walletAddress}`);
if (cached && cached.age < 3600) return cached.result; // 1 hour TTL
const [chainalysisResult, ellipticResult] = await Promise.all([
this.chainalysis.getAddressRisk(walletAddress, asset),
this.elliptic.getWalletRisk(walletAddress),
]);
const riskScore = Math.max(chainalysisResult.riskScore, ellipticResult.riskScore);
const categories = [...new Set([
...chainalysisResult.categories,
...ellipticResult.categories,
])];
const result: ScreeningResult = {
allowed: riskScore < 70 && !this.hasBlockedCategory(categories),
riskScore,
categories,
requiresReview: riskScore >= 40 && riskScore < 70,
};
await this.cache.set(`wallet:${walletAddress}`, { result, age: Date.now() });
await this.logScreening(userId, walletAddress, result);
if (!result.allowed) {
await this.alertComplianceTeam(userId, walletAddress, result);
}
return result;
}
private hasBlockedCategory(categories: string[]): boolean {
const BLOCKED = ['darknet_market', 'ransomware', 'stolen_funds', 'sanctions'];
return categories.some(c => BLOCKED.includes(c));
}
}
Transaction Monitoring and SAR Automation
Ongoing transaction monitoring to detect suspicious patterns after verification:
- Structuring detection: many transactions just below the reporting threshold (classic smurfing).
- Velocity monitoring: sudden increase in activity — 10x above normal daily volume.
- Round-trip detection: funds withdrawn and returned through several hops.
- Mixing/tumbling indicators: transactions through known mixing services (e.g., Tornado Cash).
The transaction monitoring engine processes 5x more events without lag compared to off-the-shelf solutions. Our custom solution is 3x more flexible in configuring screening rules.
class TransactionMonitor {
async analyzeTransaction(tx: Transaction): Promise<AlertLevel> {
const userHistory = await this.db.getUserTxHistory(tx.userId, 30); // 30 days
const checks = await Promise.all([
this.checkStructuring(tx, userHistory),
this.checkVelocity(tx, userHistory),
this.checkGeographicAnomalies(tx),
this.checkTimePatterns(tx, userHistory),
]);
const maxLevel = Math.max(...checks.map(c => c.level));
if (maxLevel >= AlertLevel.HIGH) {
await this.createSAR(tx, checks.filter(c => c.level >= AlertLevel.MEDIUM));
}
return maxLevel;
}
private async checkStructuring(tx: Transaction, history: Transaction[]): Promise<Check> {
const threshold = await this.getReportingThreshold(tx.currency);
const last24h = history.filter(h =>
Date.now() - h.timestamp < 86400000 && h.amount < threshold
);
const total24h = last24h.reduce((sum, h) => sum + h.amount, 0) + tx.amount;
if (total24h >= threshold * 0.9 && last24h.length >= 3) {
return { level: AlertLevel.HIGH, reason: 'structuring_detected' };
}
return { level: AlertLevel.NONE };
}
}
What's Included in SAR Automation?
When alerts trigger — automatic generation of a SAR draft for the compliance officer:
async function generateSARDraft(
userId: string,
transactions: Transaction[],
alerts: Alert[]
): Promise<SARDocument> {
const user = await getUserKYCData(userId);
return {
reportType: 'SUSPICIOUS_ACTIVITY',
filingEntity: COMPANY_DETAILS,
subject: {
name: `${user.firstName} ${user.lastName}`,
address: user.residenceAddress,
dob: user.dateOfBirth,
idNumber: user.documentNumber,
},
suspiciousActivity: {
dateRange: { from: transactions[0].date, to: transactions[transactions.length - 1].date },
totalAmount: transactions.reduce((sum, t) => sum + t.usdValue, 0),
description: generateNarrative(alerts, transactions),
alertTypes: alerts.map(a => a.type),
},
supportingTransactions: transactions.map(formatForSAR),
};
}
How We Build Balanced KYC/AML?
A custom solution based on Sumsub and Chainalysis offers 3x more flexibility than off-the-shelf products: you define screening rules, risk thresholds, and verification levels. No vendor lock-in — providers can be swapped without rewriting the architecture.
Step-by-Step Implementation Plan
- Requirements analysis — define regulatory obligations (FATF, 5AMLD, local laws) and select providers.
- Architecture design — KYC state machine, AML screening pipeline, transaction monitoring engine.
- KYC provider integration — Sumsub/Onfido, webhook setup and state machine.
- AML screening implementation — connect Chainalysis KYT, Elliptic, result caching.
- Transaction monitoring development — custom detectors for structuring, velocity, mixing.
- SAR module — automatic report generation, compliance dashboard.
- Testing and compliance review — validation on real cases, load testing.
- Deployment and team training — 2-day workshop for compliance officers.
Comparison: Custom vs Off-the-Shelf
| Criterion | Custom Solution | Off-the-Shelf Solution |
|---|---|---|
| Rule flexibility | Full control over logic | Limited configuration set |
| Time to implement | 3-4 months | 2-3 weeks |
| Cost | Higher, but scalable | Lower, but monthly fee grows |
| Vendor dependency | Low (painless provider change) | High (lock-in) |
For exchanges with over 1000 users, a custom solution pays off in 6-12 months through savings on provider fees and penalty prevention.
Technical Stack and Timelines
| Component | Technology | Development Time |
|---|---|---|
| KYC provider | Sumsub (primary) / Onfido (fallback) | 3-4 weeks |
| On-chain AML | Chainalysis KYT + Elliptic | 2 weeks |
| PEP/Sanctions | Refinitiv World-Check or ComplyAdvantage | 2 weeks |
| Transaction monitoring | Custom + Chainalysis Reactor | 4-5 weeks |
| SAR management | Custom compliance module | 2-3 weeks |
| Backend | Node.js + TypeScript + PostgreSQL | - |
| Queue | BullMQ (Redis) for async | - |
Full KYC/AML system for an exchange: 3-4 months development.
The scope of work includes: full architecture documentation (UML diagrams, API specs), integration with selected providers, custom transaction monitoring engine, compliance dashboard, automatic SAR module, source code, deployment instructions, team training (2-day workshop), and 6-month bug warranty.
Contact us for a free consultation — we will assess your project in 2 days. Order turnkey KYC/AML system development and ensure compliance with regulatory requirements.