AML onboarding for crypto projects

A crypto project lives or dies on the quality of its onboarding. It is not a form to be signed in a hurry: it is the first control that decides who gets in, with what risk profile and with what subsequent monitoring obligations. Weak onboarding is paid for with banks closing accounts, partners pulling out and, in cases subject to anti-money-laundering rules, with direct liability. Here is how to set it up well from the start.

First question: is the project subject to the rules?

Not all crypto projects are financial intermediaries within the meaning of the Swiss Anti-Money Laundering Act. The classification depends on the actual activity: those who accept third-party assets, hold them in custody or transfer them on behalf of others tend to fall within the scope of financial intermediaries; those who merely develop software or issue a pure-utility token may find themselves in a different framework.

The classification must be done before raising funds or clients. Building onboarding without having established whether you are subject to the rules means risking discovering too late that mandatory procedures were missing.

The pillars of AML onboarding

Regardless of the details, solid onboarding covers a few recurring elements.

• Client identification (KYC): verification of the counterparty’s identity with suitable documents, for both natural persons and legal entities.
• Beneficial owner: identification of the natural person who controls or benefits from the assets, beyond the formal holder. In structures with companies or vehicles, the chain of control is traced back.
• Origin of funds and means: understanding where the wealth originates and its consistency with the declared profile. In crypto, the on-chain origin of the assets also matters.
• Sanctions and PEP screening: checking against sanctions lists and identifying politically exposed persons, with enhanced controls where required.
• Risk profiling: assigning a risk level (country, type of activity, volumes, nature of the assets) that determines the intensity of the controls.

The crypto specificity: on-chain analysis

Compared with traditional onboarding, crypto adds a layer: the traceability of assets on the blockchain. A wallet can be linked, directly or within a few steps, to illicit sources, mixers or untrustworthy platforms. Blockchain analytics tools make it possible to assess the risk associated with an address before accepting it.

This does not replace KYC on the person: it completes it. The counterparty’s identity and the on-chain provenance of the assets are two distinct checks, both necessary.

It does not end at account opening: ongoing monitoring

Onboarding is the beginning, not the end. You need transaction monitoring that detects movements inconsistent with the profile, transactions above thresholds, suspicious patterns. Where elements emerge that raise suspicion of an illicit origin, the obligations to clarify and, in the cases provided for, to report to the competent authority are triggered. The client’s profile must be updated over time, not frozen on day one.

Documentation: if it isn’t written down, it doesn’t exist

Every check must be documented and retained. In the event of an inspection, the question is not only “did you carry out the controls” but “can you prove it”. You need: written procedures, KYC evidence, the rationale for the risk profiling, a screening log, records of the decisions. A procedure that is applied but not documented is equivalent, at the audit stage, to a missing procedure.

The correct sequence

First you establish whether and how the project is subject to the rules; then you define procedures and thresholds; then you choose the tools (KYC provider, blockchain analytics, screening); finally you train the team and set up document retention. Taking on clients before having the procedures in place is the mistake that compromises the whole project downstream.

How SIH ONE approaches the topic

SIH ONE handles structuring and advisory: classification of whether the rules apply, design of onboarding and monitoring procedures, setup of the AML documentation and the risk profile, coordination with the verification tools. Where activities subject to authorisation or affiliation with a supervisory body are needed, the regulated activities go through authorised partners. The goal is onboarding that holds up before banks, partners and authorities.

This content is informational and does not constitute legal or regulatory advice. The obligations must be checked in the specific case.

Are you starting a crypto project and want solid onboarding from the very first client? Let’s talk: we set up procedures and controls, with authorised partners where needed.