Custom KYC/AML System for Crypto Exchange – Balanced Compliance

Developing a KYC/AML System for a Crypto Exchange

A crypto exchange without KYC/AML is a ticking time bomb. Regulators (FATF, MiCA, local central banks) impose heavy fines, banks terminate correspondent accounts, and users lose trust. A system that thoroughly checks every user filters out 40–60% of traffic — a fact confirmed by hundreds of projects. FATF Recommendation 16 recommends anti-money laundering and counter-terrorist financing measures. We build balanced KYC/AML: compliance without killing conversion rate.

A typical problem: an exchange launches with basic verification, and six months later gets a first request from a regulator demanding a suspicious transaction report. Without a monitoring system — fines and account freezes. Fines for missing KYC/AML can reach up to 4% of turnover. To avoid this scenario and reduce compliance costs, we embed KYC/AML from the first commit, not patched after an audit. Our team has 5+ years of experience in web3 compliance, with over 30 implemented KYC/AML projects for crypto exchanges.

Multi-Tier KYC Architecture

Single-level verification is an architectural mistake. The right approach is a multi-tier system:

Tier 0 (No KYC)

Only platform browsing. No transactions. Needed for user onboarding.

Tier 1 (Email + AML Check)

Up to a small limit in stablecoins per month. Deposit and withdrawal only in crypto. Automatic wallet screening via Chainalysis or Elliptic on each deposit. Verification time: under 1 minute.

Tier 2 (Full KYC)

Up to the limit for full verification. Passport + liveness check. Provider: Sumsub, Onfido, Jumio. Time: automatic 2–5 minutes, manual review up to 24 hours for complex cases. Unlocks: fiat deposit/withdrawal, unlimited crypto withdrawal.

Tier 3 (Enhanced Due Diligence)

No limits. Source of Funds + Source of Wealth + extended background check. Only for VIP clients, manual processing by compliance officer.

On-Chain AML Screening: Architecture

Every incoming deposit and every withdrawal is screened via wallet screening. We use a custom engine that aggregates data from multiple providers for higher accuracy:

class WalletScreeningService {
  async screenDepositAddress(
    walletAddress: string,
    asset: string,
    amount: number,
    userId: string
  ): Promise<ScreeningResult> {
    // Cache: same address not rechecked each time
    const cached = await this.cache.get(`wallet:${walletAddress}`);
    if (cached && cached.age < 3600) return cached.result; // 1 hour TTL

    const [chainalysisResult, ellipticResult] = await Promise.all([
      this.chainalysis.getAddressRisk(walletAddress, asset),
      this.elliptic.getWalletRisk(walletAddress),
    ]);

    const riskScore = Math.max(chainalysisResult.riskScore, ellipticResult.riskScore);
    const categories = [...new Set([
      ...chainalysisResult.categories,
      ...ellipticResult.categories,
    ])];

    const result: ScreeningResult = {
      allowed: riskScore < 70 && !this.hasBlockedCategory(categories),
      riskScore,
      categories,
      requiresReview: riskScore >= 40 && riskScore < 70,
    };

    await this.cache.set(`wallet:${walletAddress}`, { result, age: Date.now() });
    await this.logScreening(userId, walletAddress, result);

    if (!result.allowed) {
      await this.alertComplianceTeam(userId, walletAddress, result);
    }

    return result;
  }

  private hasBlockedCategory(categories: string[]): boolean {
    const BLOCKED = ['darknet_market', 'ransomware', 'stolen_funds', 'sanctions'];
    return categories.some(c => BLOCKED.includes(c));
  }
}

Transaction Monitoring and SAR Automation

Ongoing transaction monitoring to detect suspicious patterns after verification:

• Structuring detection: many transactions just below the reporting threshold (classic smurfing).
• Velocity monitoring: sudden increase in activity — 10x above normal daily volume.
• Round-trip detection: funds withdrawn and returned through several hops.
• Mixing/tumbling indicators: transactions through known mixing services (e.g., Tornado Cash).

The transaction monitoring engine processes 5x more events without lag compared to off-the-shelf solutions. Our custom solution is 3x more flexible in configuring screening rules.

class TransactionMonitor {
  async analyzeTransaction(tx: Transaction): Promise<AlertLevel> {
    const userHistory = await this.db.getUserTxHistory(tx.userId, 30); // 30 days
    const checks = await Promise.all([
      this.checkStructuring(tx, userHistory),
      this.checkVelocity(tx, userHistory),
      this.checkGeographicAnomalies(tx),
      this.checkTimePatterns(tx, userHistory),
    ]);
    const maxLevel = Math.max(...checks.map(c => c.level));
    if (maxLevel >= AlertLevel.HIGH) {
      await this.createSAR(tx, checks.filter(c => c.level >= AlertLevel.MEDIUM));
    }
    return maxLevel;
  }

  private async checkStructuring(tx: Transaction, history: Transaction[]): Promise<Check> {
    const threshold = await this.getReportingThreshold(tx.currency);
    const last24h = history.filter(h => Date.now() - h.timestamp < 86400000 && h.amount < threshold );
    const total24h = last24h.reduce((sum, h) => sum + h.amount, 0) + tx.amount;
    if (total24h >= threshold * 0.9 && last24h.length >= 3) {
      return { level: AlertLevel.HIGH, reason: 'structuring_detected' };
    }
    return { level: AlertLevel.NONE };
  }
}

What's Included in SAR Automation?

When alerts trigger — automatic generation of a SAR draft for the compliance officer:

async function generateSARDraft(
  userId: string,
  transactions: Transaction[],
  alerts: Alert[]
): Promise<SARDocument> {
  const user = await getUserKYCData(userId);
  return {
    reportType: 'SUSPICIOUS_ACTIVITY',
    filingEntity: COMPANY_DETAILS,
    subject: {
      name: `${user.firstName} ${user.lastName}`,
      address: user.residenceAddress,
      dob: user.dateOfBirth,
      idNumber: user.documentNumber,
    },
    suspiciousActivity: {
      dateRange: {
        from: transactions[0].date,
        to: transactions[transactions.length - 1].date
      },
      totalAmount: transactions.reduce((sum, t) => sum + t.usdValue, 0),
      description: generateNarrative(alerts, transactions),
      alertTypes: alerts.map(a => a.type),
    },
    supportingTransactions: transactions.map(formatForSAR),
  };
}

How We Build Balanced KYC/AML?

A custom solution based on Sumsub and Chainalysis offers 3x more flexibility than off-the-shelf products: you define screening rules, risk thresholds, and verification levels. No vendor lock-in — providers can be swapped without rewriting the architecture.

Step-by-Step Implementation Plan

1. Requirements analysis — define regulatory obligations (FATF, 5AMLD, local laws) and select providers.
2. Architecture design — KYC state machine, AML screening pipeline, transaction monitoring engine.
3. KYC provider integration — Sumsub/Onfido, webhook setup and state machine.
4. AML screening implementation — connect Chainalysis KYT, Elliptic, result caching.
5. Transaction monitoring development — custom detectors for structuring, velocity, mixing.
6. SAR module — automatic report generation, compliance dashboard.
7. Testing and compliance review — validation on real cases, load testing.
8. Deployment and team training — 2-day workshop for compliance officers.

Comparison: Custom vs Off-the-Shelf

For exchanges with over 1000 users, a custom solution pays off in 6-12 months through savings on provider fees and penalty prevention.

Technical Stack and Timelines

Full KYC/AML system for an exchange: 3-4 months development.

The scope of work includes: full architecture documentation (UML diagrams, API specs), integration with selected providers, custom transaction monitoring engine, compliance dashboard, automatic SAR module, source code, deployment instructions, team training (2-day workshop), and 6-month bug warranty.

Contact us for a consultation — we will assess your project in 2 days. Order turnkey KYC/AML system development and ensure compliance with regulatory requirements.