Key points
- Any entity providing crypto-asset services must comply with the KYC obligations arising from French law and EU directives.
- These rules aim to prevent money laundering and combat financial fraud, and require a strict identity verification protocol.
- Customer identification comes before entering into a business relationship; due diligence then continues throughout the relationship, based on up-to-date knowledge of the customer.
- Verification relies on a valid official document bearing a photograph or on an electronic identification means; the French Monetary and Financial Code does not require proof of address for this purpose.
- Operators must check that documents are authentic; if they cannot verify identity, they carry out no transaction.
- The crypto project must keep this data securely for five years after the end of the relationship, so that it can respond to the authorities in the event of an inspection.
Projects involving crypto-assets face specific regulatory compliance challenges, in particular with the requirements of the KYC process (Know Your Customer). Compliance with these obligations is mandatory for anyone wishing to develop a cryptocurrency exchange platform or offer blockchain-related services. Understanding the rules and mechanisms of identity verification remains essential to support secure transactions and limit legal risks.
The legal framework for KYC in the crypto sector
Any entity providing crypto-asset services must comply with a number of legal obligations arising from French law (Article L. 561-2 of the French Monetary and Financial Code (Code monétaire et financier) (in French)) and from EU legislation. These rules mainly aim to prevent money laundering and combat financial fraud. The authorities require platforms to implement a strict protocol for verifying the identity of their customers.
Anti-money laundering (AML) rules require operators to collect customer data and verify the customer’s identity before entering into a business relationship (Article L. 561-5 of the Monetary and Financial Code (in French)). Throughout the relationship, the operator exercises ongoing due diligence and ensures that transactions are consistent with its up-to-date knowledge of the customer (Article L. 561-6 (in French)). These rules directly concern operators of cryptocurrency exchange platforms, but also affect sponsors of decentralised projects that include transaction intermediation functions.
What are the steps of an effective KYC process?
Setting up an effective KYC process requires defining precise procedures covering the different phases of interaction with the user. The aim is to validate each customer’s identity while ensuring the protection of their personal data. A number of key points structure this verification process.
In the digital assets field, consulting a crypto lawyer can make it easier to comply with KYC regulations.
From registration, the collection of supporting documents determines access to certain platform features. This requirement reflects the regulators’ aim of making all transactions traceable and secure from the very first exchange between the company and the user. Recent technologies offer automated solutions that speed up the verification phase without compromising the quality of the checks carried out.
Which documents should you request for identity verification?
For an individual, identification is based on collecting their surname, first names, date and place of birth (Article R. 561-5 of the Monetary and Financial Code (in French)). Verification is carried out in particular by presenting the original of a valid official document bearing a photograph, such as official identity documents (national identity card, passport, residence permit), or by means of a certified or presumed reliable electronic identification means (Article R. 561-5-1 (in French)). These provisions do not require proof of address; the platform may nevertheless request one in its internal procedures to meet its legal obligations. These items make it possible to dispel any doubt about the accuracy of the information provided by the user.
A crypto project must also provide for the secure retention of this data for five years from the closure of the account or the end of the relationship (Article L. 561-12 of the Monetary and Financial Code (in French)), so that it can respond promptly to requests from the authorities, in particular in the event of an inspection or an investigation relating to fraud prevention. Proper management of these supporting documents is a decisive element of regulatory compliance.
How should the information collected be analysed and kept up to date?
Once the supporting documents have been received, the KYC process involves validating them against predefined criteria. Operators must check that the documents are authentic and ensure they have not been falsified. If identity cannot be verified, the operator carries out no transaction and neither establishes nor continues the business relationship (Article L. 561-8 of the Monetary and Financial Code (in French)), which prevents any non-compliant transaction.
Ongoing vigilance remains advisable: regularly updating customer files meets the ongoing due diligence rules (Article L. 561-6 of the Monetary and Financial Code). Any significant change in the user’s profile or any atypical transaction triggers, where necessary, a new request for information. This rigour aims to strengthen the fight against money laundering and enhance user security on cryptocurrency exchange platforms.
What additional AML obligations apply?
Beyond simple identity verification, the regulations require proactive anti-money laundering (AML) measures. This involves setting alert thresholds suited to the type of activity carried out, and putting in place internal systems capable of detecting any attempt to conceal funds of illicit origin.
Obliged entities notify Tracfin (French financial intelligence unit) and their supervisory authority of the identity of the managers or employees authorised to file suspicious transaction reports (Article R. 561-23 of the Monetary and Financial Code (in French)). Appointing a person responsible for overseeing the entire AML framework, including the handling of alerts, gives structure to this monitoring and helps demonstrate the crypto project’s commitment to secure transactions under French and European standards.
How should regulatory compliance adapt as EU rules evolve?
EU legislation is evolving rapidly, with new obligations that gradually strengthen transparency and traceability requirements for crypto-asset businesses. Since 30 December 2024, Regulation (EU) 2023/1113 (the “travel rule”) has thus required transfers of crypto-assets to be accompanied by information on the originator and the beneficiary (Article 14). The KYC process should be adjusted continually to take account of regulatory developments. This includes in particular taking new identity verification methods into account and developing technological solutions compatible with current requirements.
Innovations in the automation of document verification now make it possible to optimise processes while limiting the risk of error. However, integrating such solutions requires careful legal support, to ensure that their deployment fully respects the confidentiality of the data collected and that the supporting documents always remain accessible in the event of an inspection.
What should you do in the event of an inspection or suspected fraud?
If an authority carries out an inspection, all documents relating to identity verification and to the transactions carried out should be made available. Precise and organised archiving makes it much easier to respond to these requests. Preparing cooperation scenarios in advance also reduces response times when questions arise: a centralised register of alerts and incidents is genuinely useful in this context.
Where there is a suspicion of fraud or money laundering, without waiting for it to be confirmed, a suspicious transaction report is sent to Tracfin (Article L. 561-15 of the Monetary and Financial Code (in French)). A failure to comply exposes the entity to administrative sanctions imposed by the supervisory authority (Article L. 561-36 (in French)); disclosing the report to the customer is also a criminal offence (Article L. 561-18 (in French)). Legal teams then play a central role in strictly applying the legal obligations governing these procedures.
Why keep up with legal developments regularly?
Staying informed of applicable regulatory changes helps keep internal practices in line with the law in force. Several bodies regularly publish updates on anti-money laundering, digital identity verification and the obligations of cryptocurrency exchange platforms. Consulting these resources frequently limits the risk of non-compliance by adjusting procedures as soon as new rules appear.
Introducing periodic reviews of KYC policies supports consistency between the crypto project’s day-to-day operations and its legal obligations. By anticipating legislative changes, the compliance officer can better protect the company and strengthen the legitimacy of the business over the long term.
