Do merchants need to KYC crypto payers? What the standard-setters and US regulators have written.

Who is KYC written for?

KYC, short for know your customer, is the set of checks a regulated business runs to identify the people it serves; the standards call it customer due diligence (CDD). In crypto, the international standard comes from the Financial Action Task Force (FATF), and its obligations attach to virtual asset service providers (VASPs): businesses that exchange, transfer or hold crypto for others, or provide financial services around issuing it.

FATF explains where its obligations sit in paragraph 37 of its Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021). FATF calls a transfer made without any VASP, such as one between two people's own wallets, peer-to-peer (P2P), and writes: "P2P transactions are not explicitly subject to AML/CFT controls under the FATF Standards. This is because the Standards generally place obligations on intermediaries, rather than on individuals themselves (with some exceptions, such as requirements related to implementing targeted financial sanctions)." Each country turns the standard into its own law, so the question for a specific business is always what its own country's law says.

Nothing here is legal advice, and none of it tells you whether you must identify your customers. That depends on your country, your business and your bank, which is a question for a lawyer who knows them.

What do FATF, FinCEN and the IRS say about a merchant paid in crypto?

The rows below come from three texts: FATF's guidance, FinCEN's 2019 guidance and an IRS announcement. Words in quotation marks are copied from the source, with its paragraph or section; the IRS row is a summary, quoted in the next section.

An unhosted wallet, in FinCEN's words, is software on "a person's computer, phone, or other device" that lets the person store and send crypto, and "Unhosted wallets do not require an additional third party to conduct transactions." It is the kind of wallet a Fianto customer pays from: the customer's own wallet signs, and nobody holds the money in between.

Does a business have to report large crypto payments to the IRS?

US law has counted digital assets as cash for Form 8300 since the start of 2024, but the IRS has said they need not be counted yet. Form 8300 is the report a US business files when it receives more than $10,000 in cash in one transaction or related ones, and it names the payer, so it is a rule that asks an ordinary US business for a customer's details.

The 2021 Infrastructure Investment and Jobs Act added digital assets to the definition of cash for that report, for returns due after 31 December 2023. In Announcement 2024-4, the IRS said that "at this time, digital assets are not required to be included when determining whether cash received in a single transaction (or two or more related transactions) meets the reporting threshold", and that this holds until Treasury and the IRS publish regulations to implement the change. As of 15 October 2026 we found none: the Federal Register lists no such rule, and the IRS Form 8300 reference guide (last reviewed 27 July 2026) does not mention digital assets. Check again before you rely on the announcement.

What to keep for each payment for your books, regardless of Form 8300, is covered in accounting for USDC revenue.

What does Fianto know about the person who pays?

Fianto knows the paying wallet and, sometimes, an email address that nobody has checked. It never asks a payer for a name, an ID document, an address or a date of birth. The wallet address and the payment itself are public on Solana, as blockchain privacy for merchants explains.

The merchant is the one Fianto identifies. Before a merchant can take a payment, a person at Fianto reviews a typed business profile (a company adds its owners holding 25% or more), mandatory two-factor sign-in and a signed proof of the receiving wallet, and the answers are kept six years. No identity documents are collected from merchants either. The steps are in set up your business.

Does Fianto check payer wallets?

Fianto checks payer wallets by hand only, and nothing is checked automatically. A member of Fianto's team with the compliance or owner role can mark a wallet Clear, Review or Blocked, with a written reason. A blocked wallet cannot start a checkout or a subscription, and its renewals stop.

A customer paying from a blocked wallet sees "Fianto can't take payments from this wallet. Use another wallet, or contact [merchant name]." On a subscription the line reads "Fianto can't take a subscription from this wallet. Subscribe with another wallet, or contact [merchant name]."

When might a merchant collect more about a payer?

A merchant may want more than a wallet for reasons that have nothing to do with crypto rules: an order large enough to fall under a cash-reporting rule once it applies to digital assets, goods with age or export limits, a bank that asks how you know your customers, or a refund you need to send back to the right person. Each is a business decision to make with your lawyer and your bank. Fianto does not collect identity for you, so anything beyond the wallet and email is yours to collect and keep under your own privacy policy.

Questions worth bringing to that conversation:

1. Which country's law applies to you, and has it written FATF's VASP definition into law in a way that touches what you do?
2. Do you only sell your own goods and services, or do you ever receive crypto to pass on to someone else?
3. Could a single sale, or a group of related sales, exceed the thresholds in your country's cash or transfer rules?
4. What does your bank require when you deposit proceeds you converted from USDC?

Where a licence comes into it, do you need a licence to accept crypto payments quotes FinCEN and New York's regulator. For EU businesses, MiCA and stablecoins quotes the regulation, and for the US stablecoin law, see the GENIUS Act explained for merchants. How a payment reaches your wallet is in how to accept USDC on Solana.