Crypto Payment Processing: The Compliance Part Nobody Budgets For

Accepting crypto payments puts a merchant closer to the compliance perimeter than accepting cards does. Most of the obligation sits with the provider, but not all of it, and the part that does not is worth understanding before launch rather than during an audit. Anyone comparing this should have crypto acquiring for businesses open alongside, because it publishes what the rest leave implicit.

What the provider handles

A licensed crypto payment processor performs sanctions screening on incoming transactions, applies transaction monitoring rules, maintains the records regulators require, and files reports where thresholds are met.

It also applies the travel rule where it applies: for transfers above a threshold between regulated entities, originator and beneficiary information must accompany the transfer. In practice this affects payments from exchanges more than payments from self-custodied wallets.

The merchant does not perform these checks. The merchant benefits from them being performed and inherits the consequences when a payment fails them.

What the merchant handles

Knowing your customer for your own purposes. Accepting crypto does not change your own obligations under whatever regime applies to your business. If you would have needed to identify a customer paying by bank transfer, you need to identify them paying in crypto.

Explaining the source of your crypto revenue. Your bank will ask, and the answer has to be documented. Which customers, under what contracts, for what goods or services.

Keeping the payment records. Transaction hash, amount, asset, fiat value at the time, the customer it relates to, and the invoice it settles. Your provider keeps its own records and you should not rely on being able to retrieve them years later.

Handling a rejected payment properly. When a payment is flagged and the funds cannot be released, you need a process. Usually the provider returns the funds to the sender, and your order has to be cancelled cleanly.

What happens when a payment is flagged

The provider screens the incoming transaction against sanctions lists and against risk scores derived from the address history. A flag can be a direct match, which is rare, or an indirect association, which is not. Firms building payment products hit this first, which is what a payment processor for high-risk e-commerce is for.

An indirect association means the funds passed through an address linked to something the screening provider considers high risk at some point in their history. This catches legitimate customers regularly, particularly those who have used certain mixing services or certain exchanges.

The outcome varies: release after review, return to sender, or freeze pending a report. From the merchant’s side, all three look like an order that has not completed, and you need a customer service answer for that which does not accuse anyone of anything.

The correct answer is that the payment could not be processed and the customer should use a different method. Not an explanation of why, which you do not have and should not speculate about.

The records that matter in an audit

For each payment: what was sold, to whom, for how much in fiat, which crypto and how much, at what rate, when, with the transaction hash, and the settlement from the provider that corresponds to it.

Filed together, per payment. Not reconstructable from three separate exports. The difference between an audit that takes a day and one that takes three weeks is whether this filing happened at the time or has to be assembled afterwards.

Choosing a provider with this in mind

Which regulator authorises the provider, and does the permission cover the activity it performs for you. What screening provider does it use and can it describe its policy. What is the process and typical timeline when a payment is flagged. What records does it retain and for how long, and can you export them. Does it support the travel rule where it applies to your flows.

A licensed crypto payment processor answers these as routine, because it answers them for its own regulator regularly.

The practical advice

Budget for a small percentage of payments to require intervention. Have a customer-facing response written before launch. File records per payment rather than per month. And tell your bank what you are doing before the first settlement arrives rather than after.

None of this is difficult. All of it is considerably harder retrospectively.