When you buy Bitcoin for a company, the providers you use will apply anti-money laundering (AML) and know-your-customer (KYC) checks similar to opening a bank account, plus extra questions about wallets and the source of funds. Transfers between service providers are also subject to the FATF Travel Rule. Preparing the documents and internal controls in advance is the simplest way to avoid delays.
Why AML and KYC matter when you buy Bitcoin for a company
Bitcoin transfers are final and can move across borders in minutes. That is useful for settlement, and it is also why regulated providers apply strict checks. A provider that cannot verify who you are, who controls you and where your money comes from will not trade with you.
For a corporate buyer, these checks are not only a hurdle. They are evidence. When your auditors, bank or board ask how you know the Bitcoin you hold is clean, the onboarding file and transaction records are a large part of the answer.
What onboarding usually involves
Licensed liquidity providers and custodians run their own processes, and requirements differ by provider and jurisdiction. In practice, most ask for a similar set of items.
Corporate documents
- Certificate of incorporation and constitutional documents.
- Register of directors and register of shareholders.
- Proof of registered address.
- Recent financial statements.
Ownership and control
- An ownership chart down to ultimate beneficial owners above the provider's threshold.
- Identity documents and proof of address for beneficial owners, directors and authorised signers.
Purpose and authority
- A board resolution or extract authorising the company to buy and hold Bitcoin and naming authorised signers.
- A short description of the intended activity: expected size, frequency and purpose.
Source of funds and source of wealth
- Bank statements showing where purchase funds originate.
- An explanation of how those funds were generated, consistent with the financial statements.
Wallet information
- Details of the wallets that will receive Bitcoin, and evidence that the company controls them.
Build a single onboarding pack once and keep it current. Most providers ask for the same documents, and a ready pack can save weeks.
The FATF Travel Rule in plain terms
The Financial Action Task Force (FATF) is the global standard setter for AML. Its Recommendation 16, known as the Travel Rule, was originally written for bank wire transfers. FATF has applied it to transfers of virtual assets between virtual asset service providers (VASPs), such as exchanges, brokers and custodians.
In practice this means:
- when a provider sends Bitcoin to another provider, identifying information about the sender and recipient must be passed along with it;
- the receiving provider checks that information before crediting the transfer;
- transfers to or from wallets not hosted by a provider (self-hosted wallets) often require extra information or proof of ownership.
How each country implements the rule differs, and so do any thresholds. Your providers will tell you what they need. The practical effect for a company is that transfers can be paused if the paperwork does not match, so it pays to set up wallet details correctly before the first trade.
Your own controls
AML is not only the provider's job. A well-run company keeps its own controls, especially once it holds Bitcoin and may later move or sell it.
| Control | What it does | Owner |
|---|---|---|
| Counterparty due diligence | Confirms each provider is licensed and has suitable AML controls | Treasury and compliance |
| Wallet whitelisting | Only pre-approved addresses can receive company Bitcoin | Operations |
| Address screening | Checks receiving addresses against sanctions and risk lists before use | Compliance |
| Record keeping | Keeps quotes, confirmations, transfer IDs and screening results together | Finance |
| Periodic review | Re-checks providers and wallets at least annually | Internal audit |
Many custodians offer address screening and whitelisting as part of their service. The company still needs to decide who approves a new address and how that approval is recorded. See key management and signing policies for how this links to custody.
Sanctions and red flags
Sanctions apply to Bitcoin transfers as they do to any other payment. A company should never receive Bitcoin from, or send it to, a sanctioned party. Screening addresses before use and buying only through licensed providers greatly reduces this risk.
Red flags that should pause a transaction include:
- a counterparty that is unwilling to complete onboarding;
- pressure to settle to or from an unverified wallet;
- prices that are far better than the market without a clear reason;
- requests to split trades to stay below reporting thresholds.
If something looks wrong, stop and escalate. Speed is never a good reason to skip a check. Our guide to choosing a Bitcoin liquidity provider covers the warning signs in more detail.
Fitting this into the treasury process
The cleanest approach is to make AML and KYC steps part of the written process from the start:
- onboarding pack prepared before board approval is finalised;
- providers approved only after due diligence is signed off;
- wallet whitelists in place before the first trade;
- a small test transfer to confirm Travel Rule information flows correctly;
- records filed in a way auditors can follow.
The steps in how companies buy Bitcoin show where each check fits. Companies should take their own legal and compliance advice on the rules that apply to them.
How The Bitcoin World helps
We help companies prepare onboarding packs, structure provider due diligence and design wallet and screening controls as part of our OTC liquidity work. AML and KYC checks, execution and custody are carried out by licensed third-party institutions under their own regulatory obligations.