Running KYC/AML for a token offering means verifying each investor's identity, screening them against sanctions and watchlists, confirming eligibility for your exemption, and keeping records of it all. Only verified, cleared investors should reach your whitelist and hold the token. Most issuers use a specialist provider to run the checks, but you own the policy, the standards, and the audit trail. Here is how the process works, step by step.

Step 1: Verify identity (KYC)

Collect and verify who each investor is - legal name, address, date of birth, and government ID, with document and often biometric checks. For entities, identify the business and the people behind it.

This is the foundation. A verification provider - names in this market include Jumio, Onfido, and Persona - handles the mechanics of document and biometric checks, but you set the standard for what counts as sufficient, and keep the evidence on file for every investor. Underneath the vendor sits a legal obligation: a written AML program under the Bank Secrecy Act, with a designated compliance officer and a customer identification program (CIP), is what regulators expect to see, and the vendor is a tool for executing it, not a substitute for having one.

Step 2: Screen for sanctions and risk (AML)

Run each investor through sanctions screening against OFAC and other watchlists, plus politically-exposed-person and adverse-media checks. Anyone on a restricted list cannot participate - this is not a judgment call.

AML also means watching for red flags: unclear source of funds, unusual structures, or mismatched information. Flag and resolve these before the investor is admitted, not after.

Tokenization adds a layer traditional offerings do not have: you also screen the wallet, not just the person. On-chain analytics tools such as Chainalysis or TRM Labs check whether an investor's address has touched mixers, sanctioned addresses, or known illicit funds, so a clean passport attached to a tainted wallet still gets caught. And because payments move on-chain, the FinCEN Travel Rule can apply - transmitting originator and beneficiary information for transfers above the threshold (generally $3,000) - which is an obligation for the regulated intermediaries in the flow, so confirm who in your stack carries it.

Step 3: Confirm exemption eligibility

Layer your exemption's rules on top. For a 506(c) raise that means accreditation verification; for Reg S it means confirming non-US status. KYC confirms identity; this step confirms the investor is allowed in your specific offering.

Keep these checks distinct in your records. They answer different questions, and a regulator will expect to see both.

Step 4: Record, then monitor

Only once an investor clears every check do you add them to the whitelist. Store the full evidence trail - who was checked, when, by whom, and the result - in a form you can produce on request.

Then monitor: re-screen periodically, watch for status changes, and vet secondary transfers. KYC is not one-and-done.

Two practices separate a credible program from a box-ticking one. First, a risk-based approach: a straightforward domestic individual investing a small amount warrants standard checks, while a complex offshore entity, a politically exposed person, or an unusually large subscription warrants enhanced due diligence - more documentation, source-of-funds evidence, senior sign-off. Second, record retention: the Bank Secrecy Act generally requires AML records to be kept for five years, so your evidence trail needs to survive long after the raise closes, in a form you can actually retrieve. Your investors feel the front of this process in how investors experience KYC.

Where to go next

• Next: investor whitelisting and allow-list management.
• The investor's view: how investors experience KYC.
• Glossary: sanctions screening.

Sources: FinCEN (fincen.gov); U.S. Treasury OFAC (ofac.treasury.gov), as of 2026.