Verification-free crypto acceptance exists. It is not free. Merchants who take it pay in settlement options, legal paperwork, recourse when funds stop moving, and exposure to whatever their processor is doing with everyone else’s money. This guide separates the three things sold under one label and shows what each one costs.
Written for merchants already accepting crypto who are choosing or replacing a provider.
What does no-KYC mean for a crypto payment gateway?
“No-KYC” describes where verification happens, not whether it happens. It can sit at checkout with the buyer, at signup with the merchant, above a volume threshold, or nowhere at all because nobody operates the software. Most listings advertise the second position and quietly operate the third.
The regulatory floor keeps rising underneath all four. In its seventh Targeted Update, published 16 July 2026, the Financial Action Task Force reported that 83% of surveyed jurisdictions (91 of 109) now have Travel Rule legislation in force, up from 73% a year earlier; counting jurisdictions where implementation is under way brings the figure to 93%.
Enforcement is the part that has not caught up. Of the jurisdictions with laws on the books, roughly 40% reported supervisory or enforcement action in the same update. That gap is the actual product being sold when a gateway advertises no verification. It is not legality. It is latency.
KYB and KYC are not the same thing
KYB verifies a company. KYC verifies a person. A payment gateway is legally obliged to know which business it is paying out to, and in almost no configuration is it obliged to know which shopper clicked “pay”. Conflating the two is how a legitimate product feature becomes a compliance claim it cannot support.
What KYB checks about your business
Know Your Business establishes that the legal entity exists, who controls it, and what it does. In practice that means registration documents verified against an independent source, the ownership and control structure traced to the beneficial owners, a politically exposed person check on those owners, sanctions screening, and a description of the business activity that the processor can assess for risk.
Speend’s published AML Policy, last updated 11 May 2026, lists exactly this set: identification and verification from a reliable and independent source, beneficial owner identification sufficient to understand the ownership and control structure, PEP verification, sanctions screening, and ongoing monitoring of the business relationship.
What KYC checks about a person
Know Your Customer establishes the identity of a natural person: document, liveness, address, and screening against the same sanctions and PEP lists. It is the process a bank runs on an account holder and an exchange runs on a trader.
The distinction matters because the obligation follows the relationship. A gateway’s customer is the merchant. The shopper is the merchant’s customer, not the gateway’s.
Why a payment gateway needs one and not always the other
A licensed processor cannot skip KYB on a merchant it pays out to. It can skip KYC on a buyer because that buyer is not opening an account, holding a balance, or making a transfer between two regulated services.
The Travel Rule applies to transfers between virtual asset service providers above a threshold, and thresholds vary sharply. The European Union sets no threshold at all under the Transfer of Funds Regulation. The United States uses USD 3,000 under the Bank Secrecy Act. A shopper sending funds from a self-hosted wallet to a merchant checkout is not a VASP-to-VASP transfer, which is why buyer anonymity at the payment form is ordinary commerce rather than regulatory arbitrage.
Are crypto payments anonymous?
Public blockchains are pseudonymous, not anonymous. Every payment is permanently readable by anyone, and the work of attaching a name to an address is done constantly, at scale, by firms whose entire business is doing it.
A worked example makes the point better than the theory does. TRM Labs traced a ransomware payment of roughly USD 122,246, made by a Canadian victim in December 2025 to the Sinobi group, through to deposits at two payment processors that advertise minimal verification. If a laundering chain built by professionals resolves to named deposits, an e-commerce checkout resolves faster.
Privacy at the payment form and privacy on the ledger are different products. Only the first one is on sale.
Three configurations sold as no-KYC
Three architectures share the label and carry different consequences. Sorting a provider into the right one takes about ten minutes and determines everything downstream.
No verification for the buyer
The shopper opens a wallet, scans a code, sends funds, and leaves. No account, no document, no email. Most reputable processors work this way at the checkout layer, and nothing about it is legally exotic.
This is the configuration Speend operates and the one worth wanting. It removes friction where friction costs conversion, and it leaves the compliance obligation where regulators put it.
No verification for the merchant
Here the business goes live without submitting registration documents. This is what most “no-KYC gateway” listings actually advertise, and it usually applies only at the bottom of the volume curve.
Cryptomus demonstrates the ceiling. The processor introduced mandatory KYC in February 2025, and TRM Labs recorded on-chain volume falling from approximately USD 153 million that January to USD 86 million in March. Merchants who had chosen the platform for its onboarding found the reason they chose it withdrawn, with no notice and no migration path.
Non-custodial with no account at all
Self-hosted software such as BTCPay Server has no operator in the middle, so there is nobody to run verification on anyone. The merchant runs a node, holds the keys, and absorbs the full operational load.
The compliance obligation does not disappear in this configuration. It transfers. A merchant who becomes a VASP under local rules is a VASP whether or not any software vendor asked for a passport.
What custodial and non-custodial actually change
One question separates them: who owns the deposit address the buyer pays into? If it belongs to the gateway, the funds are the gateway’s first and the merchant’s second, and the merchant is an unsecured creditor for everything in transit. Several providers marketed as non-custodial route payments through their own wallet by default.
This is also where a widely repeated statistic falls apart on inspection. The claim that custodial crypto payment processors lost over USD 1.8 billion to hackers between 2023 and 2025 traces to the marketing blog of a non-custodial competitor, and roughly USD 1.46 billion of it is the February 2025 Bybit theft. Bybit is an exchange, not a payment processor. Removing exchange breaches leaves the incidents that actually involve payment infrastructure: CoinsPaid lost USD 37.3 million and Alphapo approximately USD 60 million on the same day, 22 July 2023, both attributed by Elliptic and later the FBI to the Lazarus Group, with a further USD 7.5 million taken from CoinsPaid in January 2024.
Around USD 105 million across three incidents is a real risk and a serious one. It is not 1.8 billion, and a merchant who repeats the inflated figure to a board will be corrected by the first person who checks it.
What you give up with a fully anonymous gateway
Four costs, all of them deferred, which is why they rarely appear in the comparison table that sold the decision.
No fiat settlement
A processor that never established who a merchant is cannot open a banking rail in that merchant’s name. Settlement stays in stablecoins, and the conversion problem moves to the merchant, usually at a worse rate and always with the identity check simply relocated rather than avoided.
No invoice with legal details
B2B counterparties need documents with a registered entity, an address, and a tax identifier. A gateway with no record of the merchant’s legal identity cannot issue one, which closes off business customers, most accounting workflows, and any procurement process.
No recourse when something breaks
An unverified relationship runs in both directions. TRM Labs assesses Heleket with high confidence to be a parallel service launched by Cryptomus or its controllers, and a merchant with settlement frozen there has effectively no one to bring a claim against.
Want to accept crypto payments on your website?
Fast setup and KYC/KYB, fee starts from 0.5%
Contact UsThe stated policy is not a safeguard either. TRM’s profile notes that Heleket’s AML policy claims to require identity documentation while observing that transacting without providing it remains possible. A published policy describes an intention; only the onboarding flow describes the practice.
Problems at the bank when money leaves crypto
The off-ramp is where deferred questions arrive at once. Exchanges and banks screen incoming deposits against clustering data, and a settlement wallet that shares counterparties with sanctioned infrastructure gets held regardless of what the merchant sold.
The exposure is measurable. TRM found that approximately 0.6% of Heleket’s incoming volume in 2025 was illicit, close to five times the average ratio across payment service providers in its data, with sanctions-related entities accounting for 60% of those inflows, driven largely by flows from the sanctioned Russian exchange Garantex. Merchants do not choose their processor’s other customers, but they inherit the cluster.
Is it legal to accept crypto without KYC?
What is known: no major jurisdiction requires a merchant to identify a shopper who pays for goods, and buyer anonymity at checkout is not a regulatory violation anywhere in the FATF network. What varies is whether a merchant’s own activity brings them inside the VASP perimeter, which depends on what they do rather than how large they are.
What belongs with a specialist: the licensing question in the specific jurisdiction, the tax treatment of received crypto, and whether a particular business model constitutes virtual asset services locally. These are answered by a local adviser reading local law, not by a payment provider’s blog.
The processor’s posture is a separate question from the merchant’s obligations, and neither one settles the other.
How long merchant verification takes, and what documents you need
Speend’s AML Policy sets document verification at up to three business days from submission. Verification runs through a third-party provider, AMLBot, covering identity checks, document review, sanctions screening, and risk assessment, with records retained for no less than five years after the business relationship ends.
Expect to supply the registration certificate for the legal entity, the ownership and control structure down to beneficial owners, identity documents for those owners, a PEP declaration, and a description of the business activity and expected volumes. Nothing on that list is unusual, and assembling it before signup is the single change that most shortens the wait.
How Speend handles this: KYB for the merchant, no KYC for the payer
Speend verifies the business and does not put an identity check in front of the buyer. Payers connect a wallet and send funds. The verification obligation sits at merchant onboarding, which is where the applicable standards put it, and the checkout stays as frictionless as any gateway advertising no verification at all.
Fees start at 0.5% with 300+ assets across major networks, and an auto-converter lets a merchant decide when to move a balance into USDT.
Where this fits: businesses that want buyer-side frictionlessness with a verified merchant record behind it. A merchant whose requirement is that no entity anywhere holds their registration documents is looking for the self-hosted configuration, not for Speend or for any other operated gateway.
No-KYC gateways in 2026: who offers what
Cells marked “not published” mean the provider does not state it publicly, which is itself information. Verification posture below is taken from published policies and third-party analysis, not from marketing pages.
| Provider | Merchant onboarding | Buyer check at checkout | What is publicly checkable |
|---|---|---|---|
| Speend | KYB, documents verified in up to 3 business days via AMLBot | None | Published AML Policy dated 11.05.2026 |
| BTCPay Server | None, self-hosted | None | Open source. No operator, so compliance sits entirely with the merchant |
| NOWPayments | Tiered. Light at low volume, documents above thresholds | None | Tiering is publicly described, threshold values are not |
| Paymento | Positioned as none | None | Non-custodial, wallet-to-wallet positioning. Chain coverage is narrower |
| MaxelPay | Advertised as none, 0.4% | None | Self-reported user counts differ by an order of magnitude across directories, so published scale claims count as unverified |
| Cryptomus | Mandatory KYB since February 2025 | None | CAD 176.9m FINTRAC penalty issued 22.10.2025, under appeal. Extensive on-chain exposure to Garantex per TRM Labs |
| Heleket | “Project moderation” only | None | TRM Labs assesses it a parallel service to Cryptomus. Around 0.6% of 2025 inflows illicit, 60% of those sanctions-related |
A twenty-minute version of this check works on any provider. Read the AML policy rather than the landing page, find the named legal entity in the footer, search the entity name alongside the local regulator, and compare self-reported scale across two independent directories. Providers whose numbers move between sources are telling you something about the rest of their disclosures.
FAQ
What is a no-KYC crypto payment gateway?
A gateway that does not require identity verification at one or more points in the payment flow. Most commonly it means the buyer is not verified at checkout, which is standard practice rather than a special category.
Is it legal to accept crypto payments without KYC?
Accepting crypto from unverified buyers is legal in the jurisdictions covered by the FATF network. Whether the merchant’s own activity requires licensing is a separate question that depends on local law and the business model.
What is the difference between KYC and KYB?
KYC verifies a natural person. KYB verifies a legal entity, its registration, its ownership and control structure, and its beneficial owners. A payment gateway’s obligation runs to the merchant, which makes KYB the relevant process.
Do my customers need to verify their identity to pay me in crypto?
No. At Speend and at most established gateways, the payer connects a wallet and sends funds without an account or a document.
Can I accept crypto anonymously as a business?
Configurations exist that will let you, primarily self-hosted software. They remove the operator, not the obligation, and they remove fiat settlement, legal invoicing, and recourse along with it.
Are crypto payments traceable?
Yes. Public blockchains are pseudonymous, and attribution is routine. Ransomware proceeds have been traced through mixing chains to named processor deposits, which is a harder problem than tracing a checkout payment.
How long does merchant verification take?
At Speend, document verification takes up to three business days from submission per the published AML Policy. Having the entity and ownership documents ready before signup is what shortens it.
What documents does a crypto payment gateway ask for?
Registration certificate, ownership and control structure, identity documents for beneficial owners, a PEP declaration, and a description of business activity and expected volumes.
Can I get fiat payouts from a no-KYC gateway?
Generally not. A processor that never established the merchant’s legal identity cannot open a banking rail in that merchant’s name, so settlement stays in crypto and the conversion problem moves to the merchant.
What happens if my no-KYC gateway freezes my funds?
There is usually no effective remedy. An unverified relationship gives the merchant no documented claim, and processors in this segment are frequently registered in jurisdictions where pursuing one is expensive and slow.
Onboard with Speend
If the requirement is a frictionless checkout with a verified merchant record behind it, the next step is the document list above: registration certificate, ownership structure, beneficial owner identification. Verification runs up to three business days.
Before signing anywhere, run the twenty-minute check on the shortlist. The provider that publishes a dated AML policy and a named legal entity is not necessarily the best one, but the provider that publishes neither has already answered the question.
Start onboarding · Full gateway comparison · How to start accepting crypto · Payments for iGaming operators · Payments for adult businesses
