Onboarding
KYC that works: less friction, more evidence
“We turn requirements into processes: verification, risk and traceability, so onboarding is fast and defensible.”
Crypto KYC in Spain
We implement and optimize crypto KYC in Spain (onboarding and ongoing monitoring) with a 100% auditable approach: identification and verification, beneficial ownership, PEPs/sanctions, risk profiling and evidence. We design procedures you can defend before SEPBLAC and your internal control body (OCI), avoiding “paper compliance” and reducing operational friction and the risk of penalties.
Beneficial Owner
Consistent UBO identification in complex structures
“It is not enough to ‘upload documents’: we define criteria, evidence and retention so you can withstand a request for information.”
Risk
PEPs, sanctions and enhanced due diligence
“We design thresholds and enhanced measures with risk-based logic and verifiable evidence.”
Monitoring
Ongoing monitoring: alerts and traceable decisions
“We validate rules, alerts and alert handling so every decision is recorded and justifiable.”
What a defensible crypto KYC program includes
Identification and verification
Onboarding design: identity verification, document validation, liveness checks, data consistency and evidence retention.
AML risk profiling and scoring
Risk-based model: customer type, channel, jurisdiction, product, volume and behavior. Thresholds and periodic review.
Beneficial ownership and structures
Beneficial ownership procedure: consistency of corporate data, control documentation, evidence and criteria for complex structures.
PEPs, sanctions and alerts
Automated screening + match handling: evidence, decisions, escalation and enhanced measures where appropriate.
Ongoing monitoring and traceability
Review of alert rules, traceability of decisions, a log of internal investigations and evidence of closure.
Remediation plan
Prioritized findings + a plan with a timeline: owners, evidence and follow-up to close gaps without improvising.
Key timelines and evidence in crypto KYC
In crypto KYC, what matters is not “having screenshots” but showing sound criteria, process and traceability: what was verified, when, with what evidence, which alerts were triggered and how they were resolved, backed by evidence.
Onboarding (initial KYC): verification, risk assessment and complete documentation so you can operate without friction.
Event-driven review: changes in ownership, behavior, jurisdiction or volume → update and stronger measures.
Ongoing monitoring: alerts, internal investigations, recorded decisions and closure with evidence.
Internal escalation: criteria for escalating to the management body/OCI when there is high risk or a significant incident.
Record keeping: an organized file (KYC/UBO, screening, alerts, training) ready for a request for information.
Crypto KYC and supervision: an approach you can defend before SEPBLAC
In crypto KYC projects, the difference lies in the evidence. We design and review processes so you can prove verification, risk assessment, screening, alert handling, internal escalation and record keeping. At Molina Law Boutique we take a practical approach so your compliance is operational and defensible.
Scope of crypto KYC: what will we review?
We review the full cycle: onboarding, verification, risk, monitoring and record keeping. The goal is a system that works in practice and leaves defensible evidence.
1. KYC files and records
We audit the completeness of customer files: identification, verification, beneficial owner, risk, consents and organized retention of evidence for any request for information.
2. Monitoring, alerts and decisions
We validate rules and scenarios: alerts, internal investigation, documentation of decisions and a log of closures. If it is not traceable, the risk grows.
3. Training and internal governance
We review role-based training and proof of attendance. We also set criteria for escalation, approvals and internal control so that compliance is consistent.
Standard KYC or enhanced due diligence?
In crypto KYC, the risk-based approach requires you to distinguish between standard customers/activity and scenarios that call for enhanced measures. The key is to justify your criteria and keep evidence.
| Aspect | Standard KYC | Enhanced Due Diligence |
|---|---|---|
| When does it apply? | Low/medium risk, with a consistent profile and expected activity. | High risk: PEPs, sanctions, sensitive jurisdictions or unusual patterns. |
| Scope | Identification, verification and risk profiling with basic evidence. | Additional information, enhanced checks and documented approvals/escalation. |
| Controls | Screening and monitoring based on defined thresholds. | Enhanced monitoring, justification of exceptions and full traceability. |
| Goal | Fast, consistent onboarding with sufficient evidence. | Reduce exposure in high-risk scenarios with defensible decisions. |
*The level of due diligence must be aligned with your risk assessment and leave evidence of your criteria and decisions.
How we implement your crypto KYC
An agile methodology that does not slow down your operations: diagnosis, design, testing and evidence. In crypto, what matters is KYC that is usable and traceable.
01
Diagnosis and risk mapping
We analyze your model (product, channel, jurisdictions) and define the risk map, thresholds and evidence needs for sustainable KYC.
02
Policy and procedure design
We document KYC/UBO, screening, escalation, record keeping and controls. No “generic manual”: we translate it into real processes and auditable records.
03
Operational testing and adjustments
We test scenarios: onboarding, screening matches, risk changes and alerts. We adjust rules and keep a trail of decisions.
04
Implementation + evidence
We deliver a ready-to-use package: procedures, checklists, records and a remediation plan. Your KYC must “hold up” under inspection, with evidence.
Operational checklist
Evidence that speeds up defensible crypto KYC
In crypto, inspections are won with evidence: verification, risk, alerts and documented decisions. If traceability is missing, your KYC is weaker.
Traceable onboarding
Documented screening
Logged alerts
Organized records
-
Defined risk criteria
Make clear how you classify customers/activity and which thresholds trigger enhanced measures.
-
Verification with evidence
Document which checks were used (identity, consistency, validations) and keep evidence of the results.
-
UBO and structures: evidence, not assumptions
Define how you establish the beneficial owner and how you handle complex structures with consistent criteria.
-
Handling alerts and matches
If there are alerts (screening/monitoring), keep a record of the investigation, decision and closure, with supporting evidence.
-
Records ready for a request for information
KYC/UBO, screening, alerts and training: organized, accessible and quick to hand over.
Common crypto KYC mistakes we fix
The goal of crypto KYC is not just to “onboard” customers but to control risk with evidence. These failures are often what leads to requests for information and penalties.
⚠️
Onboarding without traceability
Verifying “by eye” or without complete evidence. If you cannot show how you verified, the file is weak.
⚠️
Incomplete UBO
In companies/complex structures, evidence of control is missing or there are inconsistencies. Without clear criteria, the beneficial owner becomes a critical weak point.
⚠️
Poorly handled screening
Alerts without a documented investigation, or closures without justification. The problem is not the alert: it is the lack of evidence when resolving it.
⚠️
Enhanced measures skipped
Failing to apply enhanced measures when risk is high (PEPs, sanctions, unusual patterns). This is penalized as a failure of due diligence.
What crypto KYC must be able to prove
Beyond the “document”, what matters in an inspection is traceability: verification, risks, alerts, decisions and records.
Verification
Risk
Alerts
Evidence
Onboarding and verification
- Identification and verification with consistent evidence.
- Consistency of data and validations (avoid “inconclusive” files).
- Organized retention of onboarding evidence and records.
- Documented exceptions (and approved where applicable).
Key to making KYC defensible and scalable.
Risk, screening and enhanced due diligence
- Risk-based scoring with defined thresholds.
- PEPs and sanctions: match handling with a traceable investigation.
- Enhanced checks: additional measures when risk is high.
- Escalation: clear criteria for escalating to the OCI/management body.
Quality tip
What is reviewed is not only “whether it triggers”, but how you investigate and how you document the closure.
Monitoring and decisions
- Alerts with justified rules and tested scenarios.
- A log of internal investigations and decisions.
- Ongoing follow-up with event-driven reviews.
- Records ready to hand over in response to a request for information.
Reduces penalty and operational risk.
Consistency between the manual and reality
- Your procedure should reflect what is actually done.
- Controls proportionate to your activity and risk profile.
- Consistency between screens, records and evidence.
Inconsistent documentation is a typical finding.
Important note:
Request a readiness checklist
In crypto KYC, strength lies in the evidence: if you can reconstruct every decision with proof, you reduce exposure and friction.
Risks and penalties if your crypto KYC is not robust
Requests for information and findings due to incomplete files or files without evidence of verification.
Penalties and corrective measures for failures in due diligence, screening or ongoing monitoring.
Reputational risk: loss of trust from banks, partners, customers and investors.
Operational blocks: friction in onboarding, limits, reviews and internal escalation.
Cost of reacting: fixing things late and without records is usually more expensive than designing them properly from the start.
Do you need crypto KYC that stands up to supervisory scrutiny?
We help you design and implement crypto KYC with evidence: verification, risk, screening, alerts and records ready for a request for information.
All about crypto KYC
What is crypto KYC?
Crypto KYC is the set of measures used to identify and verify customers, assess their risk and keep evidence to prevent illicit use of the service. It includes verification, beneficial ownership, screening, monitoring and record keeping.
The key is not to “collect documents” but to have criteria, process and traceability.
Defensible KYC reduces penalties and friction with banks and partners.
What does good crypto KYC onboarding include?
Identification, verification, risk profiling, screening and retention of evidence. Plus criteria for escalation and event-driven updates.
Without records and evidence, the file is weak in the face of any request for information.
When should I apply enhanced due diligence?
When risk is high: PEPs, sanctions, sensitive jurisdictions, inconsistencies or unusual patterns. What matters is that the criteria are defined and documented.
Enhanced due diligence requires more evidence and more traceability, not just “more paperwork”.
What do we review in a crypto KYC audit/diagnostic?
We review files, UBO, screening, alerts, monitoring, escalation and records. We assess whether the system works and whether it leaves defensible evidence.
What makes the difference:
- Evidence of verification and consistency, not just “uploaded documents”.
- Screening records and match handling.
- Alerts with documented investigation and closure.
- A remediation plan with owners and deadlines.
What documentation should you prepare?
Policies and procedures, risk criteria, onboarding records, verification evidence, UBO, screening, alerts and training.
If it is organized, control and your defense in an inspection are much stronger.
What happens if my KYC is insufficient?
Risk of penalties, requests for information and reputational problems. It can also lead to operational blocks and friction with banks and partners.
Preventing problems with a traceable system costs less than reacting late without evidence.
How much does it cost to implement or improve crypto KYC?
It depends on onboarding volume, product complexity, jurisdictions and the maturity of your processes/evidence. The deciding factors are the actual scope and the state of your records.
We give you a quote after a quick diagnosis of your system and priorities.
Crypto and regulation
Other related resources you may find useful
If you are looking into this topic, these pages can help you take the analysis further on crypto regulation, taxation, inspections and specialist legal services.
Advice
Crypto lawyers in Madrid
A useful resource for exploring specialist legal services in crypto-assets, compliance, taxation and defense in regulatory incidents.
View page LegalCrypto and the law
See the key legal points for operating with greater legal certainty in settings linked to crypto and digital assets.
View page TaxTax audits and crypto
Review practical points on documentation, traceability, supporting transactions and responding to tax audits.
View page RegulationCrypto-assets regulation
A useful guide to understanding the applicable regulatory framework, its implications and the main compliance risks.
View pageBook a call
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2023/1114 of May 31, 2023 on markets in crypto-assets (MiCA)EUR-Lex · Official Journal of the EU
- Regulation (EU) 2023/1113 of May 31, 2023 on information accompanying transfers of funds and certain crypto-assetsEUR-Lex · Official Journal of the EU
Legislation and links reviewed in .