> For the complete documentation index, see [llms.txt](https://faq.finchtrade.com/guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faq.finchtrade.com/guide/regulatory-compliance/kyb-aml-and-compliance-responsibilities-in-b2b-crypto.md).

# KYB, AML and compliance responsibilities in b2b crypto

Crypto activity carries compliance obligations regardless of who holds the licence. Know-Your-Business (KYB), Anti-Money-Laundering (AML), Counter-Financing of Terrorism (CFT), sanctions screening, and Travel Rule compliance all need to be performed by someone in the chain. This page walks through what each is, who's typically responsible, and how the responsibilities split between partners and infrastructure providers in B2B crypto.

## The components

**KYB (Know-Your-Business).** Verification of corporate clients — incorporation documents, ownership structure, ultimate beneficial owners (UBOs), business activity, source of funds. Required at onboarding, refreshed periodically.

**KYC (Know-Your-Customer).** The individual equivalent of KYB. Verification of individual clients or the individuals controlling corporate clients.

**AML / CFT.** The regulatory framework that drives KYC, KYB, transaction monitoring, and suspicious activity reporting. Applies in every major jurisdiction in some form.

**Sanctions screening.** Checking counterparties and transaction destinations against sanctions lists (OFAC, EU, UK, UN, others). Required for every transaction; typically automated.

**Transaction monitoring.** Ongoing analysis of transaction patterns to identify suspicious activity — unusual size, unusual frequency, unusual counterparties, structuring patterns. Required continuously.

**Travel Rule.** A FATF-driven requirement that crypto transfers above defined thresholds between regulated entities include originator and beneficiary information. Applies to cross-VASP transfers.

**Suspicious Activity Reporting (SAR).** When monitoring or screening flags potential issues, regulated entities have obligations to report to authorities. The threshold and process vary by jurisdiction.

Each of these has to be performed correctly by someone in the chain. The question is who.

## How responsibility typically splits

In a typical B2B crypto integration, responsibility splits between the partner platform and the infrastructure provider as follows.

### What the partner platform usually owns

**KYB and KYC on the partner's clients.** The partner is the one with the customer relationship; the partner does the verification. The infrastructure provider does KYB on the partner itself, not on the partner's clients.

**Transaction monitoring at the user level.** Monitoring user-level patterns (this user's deposits and withdrawals over time) is the partner's responsibility because the partner has the user-level visibility.

**SAR filing for partner-side activity.** When suspicious activity surfaces on the partner's platform, the partner files reports to its relevant regulator (typically in its own jurisdiction).

**Customer-facing compliance.** Communicating compliance requirements to users (terms of service, KYC requirements, dispute processes) sits with the partner.

### What the infrastructure provider usually owns

**KYB on the partner.** The infrastructure provider verifies the partner as a B2B counterparty before onboarding.

**Compliance on the wholesale activity.** The infrastructure provider screens its own transactions, runs Travel Rule on cross-VASP transfers, and monitors at the wholesale layer.

**Compliance under its own regulatory regime.** The infrastructure provider meets its own regulator's requirements (in our case, VQF supervision under Swiss law).

**Sanctions screening on transactions through its infrastructure.** Provider-side screening is universal, regardless of partner-side practices.

### What's shared

**Information flow.** When the provider's screening flags an issue, it surfaces to the partner. When the partner's monitoring flags an issue affecting partner-to-provider transactions, the partner shares relevant information with the provider.

**Reporting.** Both sides have reporting obligations to their respective regulators, and information needs to flow between them to support both.

**Audit cooperation.** Both sides cooperate with their respective audit and supervisory processes when the other side's data is relevant.

## What partners need to build

A B2B platform integrating crypto needs compliance infrastructure of its own. Specifically:

**KYB onboarding flow.** Document collection, ownership verification, source-of-funds review. Can be built in-house or through a KYB-as-a-service provider.

**Transaction monitoring system.** Software that watches user-level transaction patterns and flags anomalies. Can be built or bought.

**Sanctions screening.** Real-time checking against current sanctions lists. Usually integrated through specialised providers (Chainalysis, Elliptic, ComplyAdvantage, etc.).

**Travel Rule capability.** Where the partner is the originator or beneficiary in cross-VASP transfers, Travel Rule data has to be exchanged. Specialised tooling exists.

**Reporting workflows.** SAR drafting, regulator communication, audit-trail maintenance. Some platforms automate these; some keep them manual.

**Compliance staffing.** Even with automation, humans need to review flagged activity, make decisions, and engage with regulators.

For partners using infrastructure providers, some of this can be reduced — the provider handles the wholesale layer — but the user-level compliance remains the partner's job. Partners that try to outsource user-level compliance to the provider find that it doesn't work; the provider doesn't have the visibility or the relationship to do it.

## Common gaps

A few patterns that show up consistently when partners haven't thought through the compliance split clearly.

**Assuming the provider's screening covers user-level activity.** It doesn't. Provider-level screening covers partner-to-provider transactions. User-level activity needs partner-level monitoring.

**Underbudgeting compliance staff.** Compliance isn't just software. Humans review flags, file reports, engage with auditors. Most platforms underestimate the headcount.

**Treating KYB as a one-time event.** KYB requires periodic refresh, especially for higher-risk clients. A KYB done once at onboarding and then forgotten is a gap.

**Not planning for SAR filing.** Most platforms hope they'll never need to file. The platforms that have a process — drafting, review, regulator engagement — handle the inevitable filing better than platforms that figure it out under pressure.

**Insufficient documentation.** Compliance is auditable. Process, decision logs, evidence of monitoring, records of training — all auditable. Sparse documentation creates risk during audits.

## How FinchTrade approaches this

FinchTrade operates as a VQF-supervised financial intermediary in Switzerland. Our compliance framework covers:

* KYB on every B2B partner before onboarding
* Sanctions screening on every transaction through our infrastructure
* Travel Rule compliance for cross-VASP transfers above thresholds
* Transaction monitoring at the wholesale layer
* SAR filing where required by Swiss law
* ISO/IEC 27001 and 27701 certifications covering information security and privacy management

We're explicit with partners about which obligations are theirs and which are ours. The split is documented in the partnership agreement; no ambiguity at the boundary.

For partners under [Regulated Crypto Access](file:///3576885/solutions/regulated-crypto-access/overview.md), the regulatory perimeter is more interconnected — specific activities sit within our framework, with corresponding compliance flowing through us. The split there is structured case by case during scoping.