Regulated vs No-KYC Crypto Gateways: The Legal Line

Choosing a non-custodial payment gateway removes a real set of onboarding steps. It removes exactly one category of them: the checks a platform performs because the platform is legally required to know who its account holders are. It removes none of the obligations that attach to you as the seller.

That distinction is the whole answer, and almost no page in this search result explains it. Under US federal law, money transmission means accepting value from one person and transmitting it to another. A custodial processor does both, so FinCEN’s 2019 guidance treats it as a money transmitter and it must onboard you into an account. A merchant selling its own goods accepts value and keeps it. There is no second leg, and so no account to open. The reduced friction is a structural consequence of custody, not a compliance loophole and not a favour anyone is doing you.

What survives every custody model: sanctions screening, income recognition, your own bookkeeping and record retention, whatever licensing your jurisdiction imposes on your line of business, and identity verification at the point where you convert to fiat. If a page tells you a gateway makes those go away, it is wrong in a way that could cost you money.

We sell a non-custodial gateway, so read the product sections with that in mind. This is also not legal advice. Every external claim below links to its primary source, re-verified on 2026-09-07, so you can check it rather than trust our reading.

Custody decides who runs KYC, not the marketing copy

FinCEN’s guidance FIN-2019-G001, issued 9 May 2019, is the clearest published statement of where the line sits, and it does not turn on what a company calls itself. It assesses an intermediary on four criteria: who owns the value, where it is stored, whether the owner interacts with the payment system directly, and whether the intermediary has total independent control over the value. Applied to the two models:

• Hosted wallet providers are described as “account-based money transmitters that receive, store, and transmit CVCs on behalf of their accountholders.” That is a regulated financial institution, and it will verify you.
• Unhosted wallets sit outside that definition. The value belongs to the owner, the owner interacts with the payment system directly, and no third party has independent control.
• Crypto payment processors specifically are addressed by name. The guidance states that they “fall within the definition of a money transmitter and are not eligible for the payment processor exemption because they do not satisfy all the required conditions.” The condition they fail is the second one: the exemption requires clearing through a system that admits only BSA-regulated financial institutions, and a crypto settlement path does not.

The practical consequence is a three-question test you can run on any gateway, and it is more reliable than the word “non-custodial” on a homepage:

1. Does it hold a balance you have to withdraw? A withdraw button, a minimum payout amount or a settlement schedule all mean something holds your funds between the customer’s payment and your receipt of it.
2. Can it freeze or reverse a payment after confirmation? Only a party with control can.
3. Did you supply an address you control at setup, or did the platform generate one for you and keep the key?

A gateway that answers “yes” to the first two is custodial in the sense that matters to a regulator, whatever its marketing says, and it will verify you sooner or later. We cover how the two custody models differ in practice and the costs that only appear in the custodial model elsewhere. The companion piece on accepting crypto payments through a non-custodial gateway covers the setup mechanics; this page covers what those mechanics do and do not change legally.

Platform responsibility versus merchant responsibility

The same question, answered obligation by obligation. The third column is the one that matters, and the answer in it is mostly “nothing.”

Obligation	Who it binds	What changes if the gateway is non-custodial	Primary source
Customer due diligence on the payment service itself	The gateway, when it meets the money transmitter definition	There is no account for the gateway to onboard you into, so this step is absent rather than waived	FinCEN FIN-2019-G001
US federal money services business registration	Any person who accepts and transmits value as a business	Nothing. As a seller you accept value for your own sale and keep it; there is no second leg	FinCEN FIN-2019-G001
Funds Travel Rule data on transfers of $3,000 or more	Money transmitters acting in the transmittal chain	Nothing. You are not a financial institution in that chain	31 CFR 1010.410(f), discussed in FIN-2019-G001
EU travel-rule information accompanying crypto-asset transfers	Crypto-asset service providers and intermediary CASPs	Nothing. The duty attaches to the service provider, not to the counterparty being paid	Regulation (EU) 2023/1113, applicable from 30 Dec 2024
Sanctions screening and blocking of designated parties	All US persons, on a strict liability standard	Nothing. This one is yours in every model	OFAC virtual currency guidance, Oct 2021
Recognising the payment as income at fair market value in USD	You	Nothing	IRS digital assets guidance
Third-party gross proceeds reporting on Form 1099-DA	Brokers, including custodial “processors of digital asset payments” above $600 per customer per year	No form is issued, because a gateway that never receives the assets is not a processor under that definition. Your own ledger becomes the only record	IRS Instructions for Form 1099-DA
Section 6050I cash reporting above $10,000 (Form 8300)	You, for cash received in a trade or business	Nothing. Digital assets are currently excluded from that threshold test pending regulations, in both models	IRS Announcement 2024-4
Sales tax, VAT or GST on the underlying sale	You	Nothing. Crypto is the payment method; the sale is still the taxable event	Jurisdiction-specific
Identity verification when converting to fiat	The exchange or broker you cash out through	It moves later in the flow. It does not disappear	Applicable local licensing regime
Record retention sufficient to support your tax positions	You	It gets harder, not easier: there are no third-party statements to fall back on	IRS digital assets guidance

The three that never move

Sanctions screening is strict liability and it is yours

This is the obligation most commonly missing from articles in this category, and the one with the sharpest teeth. OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry, published October 2021, states that “All U.S. persons are required to comply with OFAC regulations,” covering citizens and permanent residents wherever located, everyone inside the United States, and every US-organised entity including foreign branches. It adds that OFAC “may impose civil penalties for sanctions violations generally based on a strict liability legal standard,” so liability can attach “even without having knowledge or reason to know.”

No gateway’s onboarding discharges that for you. Two operational points follow, and the second is counter-intuitive enough to state plainly:

• You cannot run identity checks on a blockchain address, but you can screen the party you hold data on. Customer records, billing and shipping details, and B2B counterparties are all screenable against the SDN list before you ship.
• Refunding a payment you suspect is connected to a designated party is not the safe default. The guidance describes blocking the property and reporting it to OFAC within 10 business days, then annually while it stays blocked. Sending it back is itself a dealing in blocked property. Stop and get counsel before touching the funds.

The tax paperwork gets thinner, and that makes your records more important

The IRS digital assets page requires records of “the fair market value as measured in U.S. dollars of all digital assets received as income or as a payment in the ordinary course of a trade or business.” Crypto received for goods and services is ordinary business income at the moment of receipt, valued in dollars. Custody model is irrelevant to that.

What custody changes is who else has a copy. The Instructions for Form 1099-DA define a processor of digital asset payments as “a broker who regularly facilitates payments from one party to a second party by receiving digital assets from the first party and paying those digital assets, cash, or different digital assets to a second party.” The definition turns on receiving. A custodial processor meets it and must report your sales once they pass $600 in a year. A gateway that never takes possession does not, so no form is generated and nothing is filed for you.

The second-order effect is the opposite of how this is usually sold. Less third-party reporting does not mean less income. It means the only ledger of that income is yours. Our note on building an audit trail for non-custodial payments sets out the field list an auditor will actually ask for.

One US-specific item is frequently reported wrongly. Section 6050I was amended to add digital assets to the definition of cash for the $10,000 threshold, but IRS Announcement 2024-4 issued transitional guidance clarifying that “at this time, digital assets are not required to be included when determining whether cash received in a single transaction (or two or more related transactions) meets the reporting threshold.” Treasury and the IRS intend to prescribe regulations. That position was still current when we checked on 2026-09-07, and it is exactly the kind of item to re-check rather than inherit from an article.

The off-ramp is where verification actually happens

Receiving crypto and converting crypto are two different regulatory events, and every page that stops at the first leaves you with half the picture. Selling to a fiat balance means dealing with a licensed venue, and that venue carries the travel-rule and due diligence obligations. In the EU, Regulation (EU) 2023/1113 places information requirements on crypto-asset service providers and intermediary CASPs, applicable from 30 December 2024. In the US, the Funds Travel Rule attaches at transmittals of $3,000 or more and binds the money transmitter, not you.

So the honest framing of low-friction onboarding is that it defers identity verification to the point where you convert, onto a relationship you would have needed anyway. Plan the off-ramp before your first payment, not after your first $50,000 sits in a wallet. If you sell across borders, the comparison of EU, UK, Singapore and Australian reporting regimes is the right next read.

Where Aurpay actually sits, stated precisely

Payments settle directly to a wallet you control. We do not take possession of merchant funds in transit, which is why there is no payout schedule and no withdrawal step. Aurpay’s public description of onboarding is that there are no contracts or banking details required to start. That is a statement about contracts and bank-account setup. It is not a statement that identity checks never occur anywhere in your payment chain, and we are not going to stretch it into one.

The parameters, so nothing here is vague: 0.8% per transaction; chains are Ethereum, Tron, Bitcoin mainnet and Bitcoin Lightning; assets are BTC, Bitcoin Lightning, ETH, USDT on ERC-20 and TRC-20, USDC on ERC-20 and TRC-20, and DAI on ERC-20.

Three things we do not do, because they change your compliance planning:

• No fiat settlement or automatic conversion. You receive crypto. Converting it is your step, at a venue that will verify you.
• No tax form on your behalf. By the 1099-DA definition above, we are not a processor of digital asset payments, so nothing is filed for you. Budget for bookkeeping accordingly.
• No compliance programme for your business. Sanctions screening, licensing and tax filings sit with you, and no gateway can assume them.

A merchant compliance checklist

Run these in order before your first crypto payment. Each produces a document you keep on file, which is the point: if anyone asks, the answer is a folder, not a recollection.

1. Confirm your own licensing position. Ask counsel one narrow question: does accepting crypto for our own goods or services trigger any registration where we operate? The federal accept-and-transmit test settles US MSB status only; state money transmitter laws and non-US regimes are separate analyses.
2. Run the custody test on your gateway and write down the result. Withdraw button, payout schedule, freeze capability, who generated the receiving address. One paragraph, dated, in the file.
3. Set a valuation policy before you take a payment. One rate source, one timestamp convention (typically confirmation time), one reporting currency. Changing it later breaks comparability across periods.
4. Define the per-order record. Order ID, transaction hash, chain, asset, amount, USD fair market value, rate source, timestamp. Automate the capture at order creation rather than reconstructing it at year end.
5. Screen the counterparty data you actually hold against the SDN list before fulfilment, and keep the screening log. Screening is worth little without evidence that you screened.
6. Confirm the indirect tax treatment of the underlying sale. The payment method does not change what is taxable. Our breakdown of US state sales tax rules on crypto payments covers the common variations.
7. Open the off-ramp account now. Whichever venue you convert through will require business verification. In week one that costs an afternoon; when you urgently need liquidity it costs whatever the delay costs.
8. Set a retention period matching the longest requirement across your tax, accounting and sanctions obligations, and store the per-order records independently of the gateway.

Bring in a professional rather than a checklist when any of these is true: you are a US person or entity, where the strict liability standard alone justifies an hour of advice; you sell into the EU or UK; a single order would exceed your jurisdiction’s cash reporting threshold; or you start holding crypto across a period end instead of converting same-day, which moves you into fair-value measurement and disclosure.

What this article is not

Not legal or tax advice, and no substitute for a professional who knows your jurisdiction and your facts. Rules here change on a timescale of months, which is why each claim above carries its source and verification date.

Two closing cautions. Treat any gateway advertising itself as requiring no verification as a claim to test with the custody questions above, because a platform that skips checks at signup will apply them at withdrawal, when your funds are already inside it. And be sceptical of any page in this category, this one included, that does not say whose obligation each duty is. The value is not the list of rules. It is knowing which line has your name on it.

If a non-custodial setup fits how you want to receive payments, the Aurpay product overview covers the integration options and the 0.8% rate, and the API documentation shows which fields you can capture per order to make the record-keeping above automatic.