When a fiat payments company adds crypto flows, the identity stack looks like the one part that should carry over unchanged. Verifying a person is verifying a person, after all. In practice, this is one of the places where hidden gaps accumulate, and where regulators and banking partners look first when something goes wrong.
The part that does carry over
Document verification, liveness checks, sanctions and PEP screening, adverse media: the core of individual KYC works the same whether the customer buys a sweater or a stablecoin. If your provider does these well for fiat, they will do them well for crypto onboarding too. The same is broadly true for company-level KYB: registry checks, ownership unwrapping and director screening do not care what product the customer will use.
Where crypto adds requirements
The differences start after onboarding. Crypto flows bring obligations that fiat-era providers often simply do not cover. Wallet screening is the obvious one: checking whether a customer's wallet has touched sanctioned addresses, mixers, darknet markets or known exploit proceeds. On-chain transaction monitoring is its sibling, watching flows continuously rather than checking once. Then there is travel-rule compliance, which requires exchanging originator and beneficiary information with counterparty VASPs through dedicated protocols that have no fiat equivalent.
Some jurisdictions also apply different regulatory standards to the same check depending on the product. A verification flow that satisfies the e-money rules may need additional elements under the crypto framework of the same country. The provider certification that covers one may not mention the other. It is worth reading the fine print on what your vendor's attestations actually attest.
One stack, several tools
The practical answer for most companies is a composed stack rather than a single vendor. A strong general KYC and KYB provider for onboarding, a specialized blockchain analytics tool for wallet screening and monitoring, and a travel-rule solution where volumes justify it. The composition needs an owner: someone in compliance who understands what each tool covers, where the seams are, and which alerts route where.
The most dangerous configuration we encounter is the confident monolith: one provider, adopted for fiat years ago, assumed to cover everything because nobody re-read the contract when crypto launched. The gap sits silently until an audit, a partner review or an incident finds it.
Questions to ask this month
Three questions surface most of the risk quickly. Which of our verification obligations are specific to crypto flows, and which tool covers each one? When did we last test our wallet screening against known bad addresses? And if our banking partner asked tomorrow for our crypto transaction monitoring methodology, could we send a document, or would we be writing one under deadline pressure? If the third question makes anyone uncomfortable, that is the project to start with.