Know Your Customer (KYC) has always been the cornerstone of a credible AML programme. But in the digital asset space — and particularly across the Caribbean and Latin America — the challenge has multiplied. Compliance teams are navigating a patchwork of FATF-inspired national regulations, immature beneficial ownership registries, high cash-economy exposure, and the unique operational realities of serving customers who may have limited formal documentation but significant legitimate wealth.
This checklist is designed for compliance officers, MLROs, and founders at crypto exchanges, virtual asset service providers (VASPs), and fintech businesses operating in or serving the Caribbean and LATAM region. It covers what a modern KYC programme needs to look like — not just what the rules say, but what examiners and auditors will actually test.
The regulatory landscape: what Caribbean and LATAM VASPs are facing
The FATF Recommendations — particularly Recommendation 15 on virtual assets and R.16 (the Travel Rule) — now apply to VASPs in every FATF member and observer jurisdiction. Most Caribbean nations (Barbados, Trinidad and Tobago, Jamaica, the Cayman Islands, and others) and major LATAM markets (Brazil, Mexico, Colombia, Argentina) have either enacted or are actively implementing VASP registration and AML/CFT obligations.
Key regional realities that shape your KYC risk environment:
- Informal economy exposure — significant portions of the regional economy operate outside formal banking, meaning customers may have legitimate wealth with unconventional documentation trails.
- Beneficial ownership opacity — company registries vary widely in quality; some jurisdictions have strong requirements, others have minimal beneficial ownership data publicly accessible.
- Correspondent banking risk — Caribbean institutions in particular face de-risking pressure from major correspondent banks. Weak KYC controls accelerate this problem.
- Cross-border remittance flows — the region has among the highest remittance-to-GDP ratios globally. Crypto remittance corridors present both opportunity and risk.
- Dollarised economies and stablecoin use — USD stablecoins are increasingly used as functional currencies in the region, which has implications for transaction monitoring and counterparty identification.
The KYC Checklist
1. Customer identification programme (CIP) — foundations
- ☐ Collect full legal name, date of birth, nationality, and residential address at onboarding
- ☐ Verify identity against a current government-issued photo ID — national ID, passport, or driver's licence
- ☐ For customers without standard documentation (common in some LATAM rural markets), define an acceptable alternative documentation policy with senior management sign-off
- ☐ Screen all customers against PEP lists, sanctions lists (UN, OFAC, EU, local regulator), and adverse media at onboarding and on a continuous basis
- ☐ Assign a risk rating at onboarding — at minimum, High / Medium / Low — based on customer type, geography, product use, and transaction patterns
2. Digital identity verification — modern tools
- ☐ Deploy document OCR + liveness check (biometric) for remote onboarding — manual document review is no longer the baseline standard
- ☐ Implement IP geolocation cross-check — flag discrepancies between stated location and login location, especially for crypto wallets
- ☐ Integrate device fingerprinting and velocity checks at onboarding to detect synthetic identity applications
- ☐ For high-risk or high-value customers, conduct video verification (live agent or AI-assisted) regardless of automated pass rate
- ☐ Validate phone numbers and email addresses via OTP at onboarding — flag VoIP numbers and temporary email addresses for escalation
- ☐ Ensure your verification vendor has regional document coverage — Caribbean national ID formats and LATAM CURP/CPF/cédula numbers must be accurately processed
3. Beneficial ownership — crypto-specific
- ☐ For corporate customers: identify and verify all UBOs at or above your threshold (typically 10–25% depending on jurisdiction) — do not accept corporate structures that cannot be fully unwound
- ☐ For wallet addresses associated with corporate accounts: document the relationship between the wallet controller and the verified entity
- ☐ Screen UBOs through the same sanctions/PEP process as individual customers
- ☐ Maintain a beneficial ownership register and review it on at least an annual basis, or on any trigger event (ownership change, new product, adverse media)
- ☐ For DeFi protocol interactions or self-custody wallet counterparties: apply enhanced due diligence and document your rationale for proceeding or declining
4. FATF Travel Rule compliance
- ☐ Implement a compliant Travel Rule solution — originator and beneficiary information must travel with crypto transfers above the applicable threshold (USD/EUR 1,000 in most FATF jurisdictions)
- ☐ Verify that your Travel Rule solution covers the specific corridors you operate (Caribbean ↔ US, LATAM ↔ Europe are common gaps in Travel Rule tooling)
- ☐ Establish a counterparty VASP due diligence process — do not transmit to or receive from VASPs that cannot demonstrate AML/CFT compliance
- ☐ Handle unhosted wallet transfers with a documented policy — most regulators now require some form of customer attestation for transfers to/from self-custody wallets above threshold
- ☐ Conduct sunrise issue monitoring — many LATAM jurisdictions are in different stages of Travel Rule implementation, so bilateral compliance may not yet be achievable for all corridors
5. Ongoing monitoring and review
- ☐ Set transaction monitoring rules calibrated to crypto typologies — not just traditional banking patterns. Key indicators: structured transfers just below reporting thresholds, unusual geographic patterns, wallet addresses flagged in blockchain forensics tools
- ☐ Conduct periodic review of customer files — at minimum annually for high-risk, every 2–3 years for standard-risk customers
- ☐ Trigger file review on any material change: large new transfer, change in business nature, adverse media, sanctions match, or suspicious activity alert
- ☐ Keep KYC documentation current — expired IDs must be refreshed. Document your expiry-tracking process
- ☐ Integrate a blockchain analytics tool for on-chain transaction screening — Chainalysis, Elliptic, TRM Labs, or equivalent — and ensure alerts feed into your SAR/STR process
6. Enhanced due diligence triggers (Caribbean/LATAM specific)
- ☐ PEP connections — Caribbean and LATAM have significant PEP populations; ensure your PEP screening covers domestic as well as foreign PEPs, and apply EDD proactively
- ☐ High-risk corridors — Venezuela, Haiti, and certain other markets present elevated risk; document your enhanced controls for customers with connections to these jurisdictions
- ☐ Correspondent crypto relationships — if you are providing services to other exchanges or fintech businesses, apply CBDD (correspondent-level due diligence) equivalent processes
- ☐ Stablecoin heavy usage — customers primarily transacting in USD stablecoins in jurisdictions with capital controls or currency instability warrant additional scrutiny
- ☐ Large cash-to-crypto or crypto-to-cash transactions — document the source of funds for any transaction above your internal threshold
Staying current: the intelligence gap
The single biggest KYC failure mode in the region is not a gap in policy — it is a gap between policy and practice, and between current intelligence and outdated risk assessments. New typologies emerge, new sanctions designations land, and new guidance from Caribbean AML/CFT bodies (CFATF, FATF) and regional regulators gets issued faster than most compliance programmes can absorb.
amlx.io is built specifically to close that gap. It aggregates real-time AML intelligence, emerging typologies, regulatory updates, and sanctions activity in one place — purpose-built for AML professionals and MLROs who need to keep their risk assessments and monitoring calibration current without waiting for the next training cycle. For VASPs and crypto businesses operating in the Caribbean and LATAM, where the regulatory environment is moving especially fast, it is the most practical tool available for staying ahead.
What regulators are actually testing
When Caribbean and LATAM regulators examine VASPs, the most common findings are not exotic technical failures. They are:
- Customer files that were complete at onboarding but never updated
- Risk ratings that do not reflect actual transaction behaviour
- Sanctions screening against outdated lists, or with no process for handling false positives
- Beneficial ownership that stops at the first corporate layer
- Travel Rule non-compliance, particularly for outbound transfers to smaller regional VASPs
- No documented rationale for proceeding with high-risk customers
A KYC programme that checks all the boxes at onboarding but has no ongoing monitoring discipline will not survive a competent regulatory examination — and in a region where CFATF and national regulators are actively increasing their VASP oversight, that examination is becoming a matter of when, not if.
If you want an independent assessment of where your KYC programme stands against current regulatory expectations, speak to the Four CCCC team. We work with crypto businesses, VASPs, and fintech companies across the Caribbean and beyond — and we know what examiners are looking for.