To buy a security token, expect to submit a government-issued photo ID, a recent proof of address, and — for most offerings — documentation proving you qualify as an accredited investor, followed by sanctions and anti-money-laundering screening before your wallet is approved to receive tokens. Security token KYC requirements exist because putting a share, bond, or real estate interest on a blockchain does not change its legal status: the SEC treats every offer and sale as a securities transaction that must be either registered or exempt, and the buyers must be identified.1U.S. Securities and Exchange Commission. Statement on Tokenized Securities
Traditional brokerages already know their customers before an order is placed. Security tokens often move peer-to-peer on blockchain networks, so the compliance work shifts to the issuer, the transfer agent, or the platform running the offering. The Bank Secrecy Act requires those institutions to maintain programs that detect and prevent money laundering, keep records, and report suspicious activity.2Financial Crimes Enforcement Network. The Bank Secrecy Act The specific exemption an issuer relies on shapes how strict the checklist is: Rule 506(b) allows self-certification, Rule 506(c) requires the issuer to take reasonable steps to verify accredited status independently,3U.S. Securities and Exchange Commission. General Solicitation – Rule 506(c) and Regulation A+ Tier 2 offerings let non-accredited investors participate but cap the raise at $75 million and add ongoing reporting.4U.S. Securities and Exchange Commission. Regulation A
Identity and Address Documents
The baseline is set by the Customer Identification Program rule: financial institutions must collect your full legal name, date of birth, residential address, and an identification number before opening an account.5FFIEC BSA/AML InfoBase. Customer Identification Program Examination and Testing Procedures In practice, platforms ask you to upload a high-resolution scan or photo of a passport or national ID card showing your name, photo, and a valid expiration date. Automated systems check security features like watermarks and holograms, so a clear image matters.
Proof of residency is the second layer. A utility bill or bank statement issued within the past 90 days is the usual document, and the name and address must match your ID exactly. This step is not only about confirming where you live. It also lets the issuer flag whether you reside in a jurisdiction the offering excludes, whether for sanctions reasons or because of the geographic limits attached to the exemption being used.
The Selfie or Liveness Check
Many platforms now add a live selfie or short video during onboarding to confirm that the person submitting the ID is the person pictured on it. These liveness systems are typically evaluated against the ISO/IEC 30107 standard for presentation attack detection. Level 1 checks resistance to basic spoofing like a printed photo; Level 2 covers sophisticated attacks including 3D masks and deepfake video. Expect prompts to turn your head, blink, or angle the camera in a specific way.
Proving You Are an Accredited Investor
Most token offerings sold under Regulation D are limited to accredited investors, so this is usually the longest part of onboarding. The income test requires earnings above $200,000 in each of the two most recent years, with a reasonable expectation of the same in the current year. Filing jointly with a spouse or spousal equivalent raises the threshold to $300,000.6eCFR. 17 CFR 230.501 – Definitions and Terms Used in Regulation D Supporting documents typically include tax returns or W-2s for the prior two years, and some platforms accept a written confirmation letter from a CPA, attorney, or registered broker-dealer.
The net worth test is the alternative: net worth above $1,000,000, calculated jointly with a spouse or spousal equivalent if applicable. Your primary residence is excluded from the asset side, and mortgage debt up to the home’s fair market value is excluded from liabilities, but mortgage debt exceeding the home’s value counts against you.6eCFR. 17 CFR 230.501 – Definitions and Terms Used in Regulation D Platforms usually collect this through a standardized disclosure of brokerage accounts, real estate, and debts. Accuracy matters. Inaccurate disclosures can void the exemption the issuer relies on, creating legal exposure for both sides.
The License Path
You also qualify as accredited, regardless of income or net worth, if you hold certain FINRA licenses in good standing: the Series 7, Series 65, or Series 82.7U.S. Securities and Exchange Commission. Accredited Investors The SEC chose these because the underlying exams demonstrate sophistication in evaluating investment risk.6eCFR. 17 CFR 230.501 – Definitions and Terms Used in Regulation D Verification is usually faster on this path because FINRA records can be checked directly.
Investing Through an Entity
When a business or trust invests instead of an individual, the checklist expands. The issuer needs to verify the entity through articles of incorporation, operating agreements, and a certificate of good standing. On top of that, FinCEN’s Customer Due Diligence rule requires financial institutions to identify and verify any individual who owns 25% or more of the legal entity, plus at least one individual with significant management control, regardless of ownership percentage.8Financial Crimes Enforcement Network. CDD Final Rule
Each beneficial owner then runs through the same identity checks as an individual investor: government ID, proof of address, and sanctions screening. Multi-layer holding structures take longer because the issuer must trace ownership up through each layer until it reaches the humans who ultimately control the entity. If you are investing through an LLC, trust, or fund, plan for a materially longer timeline.
Non-U.S. Investors
Offerings that include buyers outside the United States typically rely on Regulation S, which provides a safe harbor from SEC registration for offshore sales. Purchasers must certify that they are not U.S. persons and are not buying on behalf of one.9U.S. Securities and Exchange Commission. Offshore Offers and Sales – Regulation S The KYC steps include the standard identity and address checks plus geographic verification — IP address and residency documentation — to confirm the buyer is genuinely located outside the U.S. Purchasers also agree to resale restrictions preventing tokens from flowing back into U.S. markets before the applicable distribution compliance period ends.
Sanctions, PEP, and Source of Funds Screening
Once your documents are in, the issuer screens your name against OFAC’s Specially Designated Nationals list and its consolidated sanctions list, which covers foreign sanctions evaders, sectoral targets, and other restricted parties.10Office of Foreign Assets Control. Sanctions List Search Tool The search uses fuzzy matching, so similar names produce false positives that you may be asked to help resolve.
Screening also flags Politically Exposed Persons: individuals who hold or have held prominent public positions such as heads of state, senior government officials, military leaders, or executives of state-owned enterprises. The concern is not that every PEP is corrupt but that the position creates elevated bribery and money-laundering risk. Enhanced scrutiny extends to family members and close associates, since illicit funds often move through personal networks. If you are flagged as a PEP, expect the platform to ask for extra documentation about the source of your investment funds before opening access.
Larger investments frequently trigger a Source of Wealth or Source of Funds declaration: a written statement, often backed by supporting documents, showing the capital has a legitimate origin such as employment income, business proceeds, inheritance, or prior investment returns. This is where most friction occurs, particularly when wealth comes from multiple streams or from jurisdictions with limited financial documentation standards. If the explanation and documentation do not line up, the platform can reject the application or freeze the transaction.
Wallet Whitelisting and Transfer Lockups
After verification, the issuer adds your blockchain wallet address to a smart contract’s approved list — the whitelist. That contract checks every attempted transaction against the list and blocks any transfer involving an unapproved wallet. Compliance is enforced at the code level, so security tokens only move between verified participants.
Whitelisting does not mean you can immediately resell. Security tokens issued in private placements are restricted securities under Rule 144. If the issuer files reports with the SEC, the minimum holding period is six months; if not, it is one year.11U.S. Securities and Exchange Commission. Rule 144 – Selling Restricted and Control Securities Well-designed token platforms encode these lockups directly into the smart contract, so a transfer simply cannot be initiated until the holding period expires. That is a real difference from typical cryptocurrencies, which can be traded within minutes of purchase.
What Onboarding Actually Looks Like
You upload identity documents, proof of residency, and any accreditation evidence through the issuer’s portal. Most platforms confirm receipt by email. Review times generally run from 24 hours to five business days depending on queue volume. A blurry document or a mismatched address usually produces a follow-up request rather than a rejection. The common holdups are expired IDs, addresses that do not match between documents, and financial statements that do not cover the required period.
Ongoing Monitoring and Re-Verification
KYC is not a one-time event. Issuers and platforms have continuing obligations to watch for suspicious activity and may periodically ask for updated documentation. Federal rules do not set a fixed refresh frequency; FinCEN’s CDD rule does not require routine updates to beneficial ownership information unless a risk-based concern arises.12Financial Crimes Enforcement Network. CDD Rule FAQs In practice, most platforms re-verify when your ID expires or when your transaction patterns shift significantly.
Certain behaviors trigger enhanced due diligence: cross-border transfers, sudden spikes in transaction volume, activity involving high-risk jurisdictions, and transactions inconsistent with your stated source of wealth. When that happens, the platform may temporarily restrict your account while it requests more documentation. Prompt cooperation is the fastest way back to normal access.
Secondary transfers add their own layer. When security tokens worth $3,000 or more move between institutions, the sending institution must transmit identifying information about both sides to the receiving institution under the Travel Rule.13FFIEC BSA/AML InfoBase. Funds Transfers Recordkeeping – Overview For investors, that means wallet-to-wallet transfers across platforms carry more friction than a routine crypto transfer.
How Your KYC Data Feeds Tax Reporting
The taxpayer identification number collected during KYC does not stay inside the compliance file. Starting with sales on or after January 1, 2026, brokers handling digital asset transactions must report gross proceeds on Form 1099-DA and, for digital assets treated as covered securities, cost basis information as well.14Internal Revenue Service. Digital Assets Your TIN is what connects those reports to you.
If you do not provide a valid TIN during onboarding, the platform may apply backup withholding at a flat 24% on your proceeds.15Internal Revenue Service. Topic No. 307 – Backup Withholding That money is remitted to the IRS on your behalf and can be reclaimed on your return, but it ties up a large share of your proceeds until then. A correct TIN at the KYC stage avoids the problem entirely.
What Happens to the Documents You Upload
KYC collects a lot of sensitive material: passport scans, financial statements, tax returns, wallet addresses. The Gramm-Leach-Bliley Act requires financial institutions to maintain an information security program with administrative, technical, and physical safeguards to protect customer information.16Federal Trade Commission. Gramm-Leach-Bliley Act For token platforms, that typically means encrypted storage, restricted access controls, and retention policies limiting how long documents are kept after verification.
Before uploading, check whether the platform discloses its data handling practices, the third-party verification providers it uses, and where your data is stored. Reputable platforms rely on specialized KYC vendors rather than storing raw identity documents themselves, which reduces exposure if there is a breach. If a platform cannot explain what happens to your passport scan after you are verified, treat that as a warning.