KYC / AML

KYC and AML are different but related concepts. KYC (Know Your Customer) is the identity verification process: who are you, where do you live, and what is your source of funds. Standard KYC typically requires: government-issued identity document (passport, national ID), recent proof of residential address (utility bill or bank statement within 3 months), sometimes a tax identification number, and source of funds declaration for high-value investors. AML (Anti-Money Laundering) is a monitoring mechanism designed to identify and block illegal fund laundering through financial systems. KYC is the foundation of AML — you cannot monitor transactions from parties you cannot identify. On RWA platforms, KYC/AML is typically executed through third-party service providers (Jumio, Onfido, Synaps), which offer automated identity verification systems completing review within minutes to days. Once KYC-approved, your wallet address is added to the platform's compliance whitelist — smart contracts only allow whitelisted addresses to hold and receive the corresponding tokens.

Taiwan investors completing KYC on RWA platforms typically encounter several specific issues. Address verification documents: Taiwan utility bills are typically in Traditional Chinese; some platform KYC systems don't accept non-English documents, potentially requiring notarized English translations or English-language bank statements (some international banks provide these). Tax identification number: Taiwan national ID numbers (e.g., A123456789) are valid tax identifiers, but some platforms may not directly recognize the Taiwan national ID format — explaining in a notes field may be needed. Source of funds documentation: for large investments (typically above $10,000), some platforms require source of funds explanation (salary, investment returns, inheritance, etc.). High-risk region issues: Taiwan is not on the FATF high-risk list, so geographic rejection is unlikely. However, some platforms may restrict Taiwan users from certain specific features due to regulatory requirements (especially products involving US securities).

In tokenized equity and tokenized Treasury whitelist mechanisms, KYC is deeply integrated with token standards like ERC-3643. ERC-3643 mechanics: before any token transfer (purchase, sale, or DeFi protocol deposit), the smart contract automatically queries the Identity Registry contract, confirming both sender and receiver addresses are on the compliance whitelist. If either party is not whitelisted, the transfer is automatically rejected. This has an important implication: DeFi protocols wanting to accept ERC-3643 tokens (like OUSG) must have their own contract address added to OUSG's whitelist. Not any arbitrary DeFi protocol can integrate OUSG — only protocols explicitly approved and whitelisted by the issuer. Currently, Flux Finance (Ondo's official lending protocol), some Morpho Blue vaults, and a few other protocols are on OUSG's whitelist. If you want to deposit OUSG into a DeFi protocol, first confirm whether that protocol is on OUSG's official whitelist — otherwise the transaction will fail.

KYC/AML in RWA faces a fundamental contradiction: it's a necessary tool for investor protection and financial system integrity, but also the core obstacle to RWA achieving the goal of 'anyone can invest.' This contradiction has different solutions across products. Full KYC-gating (OUSG): all operations require KYC — safest but lowest accessibility. Lowering KYC financial threshold (USDY's $500 minimum): reduces financial barrier but KYC process itself remains friction. Yield-bearing stablecoin model (USDM): pushes KYC to the underlying layer (Mountain Protocol's compliance framework), letting users hold a stablecoin that superficially doesn't require KYC, while underlying mechanisms still have compliance controls. Semi-open public tokens (some agricultural credit tokens): some tokens accept broader on-chain holders while restricting transfer recipients, compromising between openness and compliance. Future direction: portable on-chain identity credentials (Verifiable Credentials / DID) may be the long-term solution — users complete KYC once, generating an on-chain identity credential verifiable by multiple platforms, dramatically reducing repeat-KYC friction.