How do you vet a crypto OTC counterparty?

You vet a crypto OTC counterparty by building a due-diligence file in layers and checking every claim at a source the counterparty does not control: the company registry, the regulator's own register, the official sanctions lists, the blockchain itself, and people you reach through contact details you found yourself. A document the counterparty sends you tells you what it claims; the independent check tells you whether the claim is true.

OTC means over the counter: a trade agreed directly between two parties, or through a desk or a broker, instead of on an exchange order book. No exchange vets the other side for you, and a well-run desk will ask you for the same file in return.

The rules that make parts of this file mandatory depend on where you and the counterparty are established and on whether you are a regulated firm. What follows is general information, not legal or compliance advice, and your own policy or your regulator may ask for more.

What goes into a due-diligence file on an OTC counterparty?

A due-diligence file on an OTC counterparty holds nine layers: legal identity, licences and registrations, beneficial owners and the people you deal with, sanctions screening, source of funds and source of the assets, wallet screening, bank and custodian references, track record, and the trade terms. Each layer has a request you send and a check you run yourself.

One habit runs through every layer: you never use contact details or portals supplied by the counterparty to verify the counterparty. The table below is the working core of the file.

How do you confirm the legal identity of an OTC counterparty?

You confirm the legal identity of an OTC counterparty by pulling its record from the official company registry of its country of incorporation and matching it, field by field, against the documents it sent and the entity named in the trade terms. Where the entity has a legal entity identifier, you run a second match against the Global LEI Index.

Run the registry search yourself. You are checking that the legal name is identical to the letter, that the registration number matches, that the company is active and not struck off or in liquidation, that the directors are the people you were told about, and that the incorporation date fits the track record claimed.

The legal entity identifier, or LEI, gives you a second, cross-border source. The Global Legal Entity Identifier Foundation describes it as a unique 20-character alphanumeric code based on the ISO 17442 standard, linked to reference data that answers two questions: who is who, and who owns whom. The data is available free of charge. Not every company has an LEI, and the absence of one proves nothing on its own. Where one exists, check that the record's name and address match the registry and that the registration is current and has not lapsed.

The most common finding at this layer is not a fictitious company. It is a group in which the brand you spoke to, the entity that holds the licence and the entity that will sign and receive your payment are three different companies. Every later layer has to be run on the entity that actually faces you.

How do you check that an OTC desk is licensed or registered?

You check that an OTC desk is licensed or registered by searching the regulator's own public register for the exact legal entity and the exact activity, and never by relying on a certificate, a logo or a number quoted in an email. A licence document is a claim; the register entry is the evidence.

Which register applies depends on where the firm operates. In each one, read the entry and do not just find it: the legal name, the activities the permission covers, any restriction and the status. A registration for one activity does not cover another, and a registration in one country does not by itself permit the firm to serve clients in yours.

• European Union. Under the Markets in Crypto-Assets Regulation, the European Securities and Markets Authority publishes a register that includes authorised crypto-asset service providers and a separate list of non-compliant entities, built from information supplied by national authorities. A withdrawn authorisation stays in the publication with the date the withdrawal took effect, so the register also tells you about the past.
• United Kingdom. The Financial Conduct Authority registers cryptoasset businesses for anti-money-laundering purposes, and its register is where that registration is confirmed.
• United States. The Financial Crimes Enforcement Network publishes a search of registered money services businesses, and state-level licences are confirmed with the state regulator concerned.

Not every counterparty needs a licence. A fund, a treasury or a private holder trading its own assets is often not a regulated service provider at all. In that case you record why no licence applies, and the ownership, source of funds and reference layers carry more weight. A register entry confirms a status for a stated activity; it does not tell you how the firm will perform on your trade.

How do you identify the beneficial owners and the people you deal with?

You identify the beneficial owners of an OTC counterparty by asking for an ownership chart that ends in natural persons, then testing that chart against registry filings and any public ownership data. Separately, you confirm that the individuals negotiating with you are authorised to commit the firm.

A beneficial owner is the natural person who ultimately owns or controls the entity, whatever companies sit in between. The ownership threshold that makes someone a beneficial owner is set by the regime that applies to you, so use your own regime's figure, and add anyone who controls the firm without owning much of it: a managing director, a trustee, a person who directs the trading. Where the chain passes through a jurisdiction with no public ownership data, record it as an open item instead of treating the chart as proven.

The person on the call may be an employee, a contractor, an introducing broker or an agent with no authority at all. Ask for a board resolution or an authorised-signatory list naming who may agree trades and who may issue settlement instructions, compare the names with the directors on the registry, and place one call to the firm's main line, on a number you found yourself, to confirm that the individual works there in the stated role. If a broker or introducer stands between you and the principal, ask who the principal is and run the file on the principal.

Which sanctions lists should you screen a counterparty against?

You screen an OTC counterparty against the official lists of the jurisdictions that bind you and, in practice, at least the United States, United Kingdom and European Union lists, because banks and custodians in the payment chain apply them. You screen the entity, its directors, its beneficial owners, the people you deal with and the wallet addresses.

• United States. The Office of Foreign Assets Control at the US Treasury publishes the Specially Designated Nationals and Blocked Persons List. Its published guidance states that a digital currency address tied to a listed person can appear on the list in its own field, and that these address listings are not likely to be exhaustive. The same guidance states that an entity owned 50% or more by blocked persons is itself treated as blocked, even if the entity is not named.
• United Kingdom. The UK Sanctions List, published by the Foreign, Commonwealth and Development Office, has been the single list of UK designations since 28 January 2026. The former consolidated list of financial sanctions targets is no longer updated, so check that your screening procedure points at the current list.
• European Union. The European Commission maintains the consolidated list of persons, groups and entities subject to EU financial sanctions, which reflects the legal texts published in the Official Journal of the EU.

Screen on full legal names with dates of birth and nationalities, because a name alone produces false matches and missed matches. Apply the ownership rule: a company that is not listed can still be off limits because of who owns it, which is why the ownership layer comes before this one. If a name or an address returns a hit you cannot clear with confidence, stop the trade and take advice from sanctions counsel, because the duties that follow a true match are specific to each regime.

How do you verify source of funds and source of the assets?

You verify source of funds and source of the assets by asking for documents that explain where the money or the crypto came from, then checking that those documents agree with each other, with the entity's stated business and with what the blockchain shows. A story that is plausible in one document and contradicted by another is the finding.

Source of funds is the origin of the specific money or assets used in this trade; source of wealth is the origin of the counterparty's overall means. The Financial Action Task Force's Recommendations, the international standard behind national anti-money-laundering rules, include checking the source of funds where necessary, which is why a regulated counterparty will ask you the same question.

For the party paying cash, the usual evidence is accounts, bank statements for the paying account and, for an individual or a family office, the documents behind the wealth, such as a sale agreement. For the party delivering crypto, ask how the assets were acquired: exchange purchase records and withdrawal confirmations, mining or validation records, a token allocation agreement, proceeds of a business paid onchain. An exchange withdrawal confirmation carries a transaction reference you can look up on the chain yourself, and the receiving address should be one the counterparty controls.

Proof that the counterparty holds the funds today is a different question from where they came from, and it is covered by a bank or custodian confirmation or an onchain signature. Keep the two apart in the file: holding assets shows capacity, while the acquisition trail shows legitimacy.

What does wallet screening tell you about a counterparty?

Wallet screening tells you whether the addresses a counterparty will use have direct or indirect exposure to sanctioned addresses or to activity classed as illicit, such as proceeds of theft or fraud. It is a family of blockchain-analytics checks that trace where an address's funds came from and where they went, and score that exposure by category.

You can run the check with your own subscription or through a compliance provider, a custodian or a desk that screens as a service. The result usually separates direct exposure, where the address itself transacted with a flagged address, from indirect exposure several steps away.

Attribution of an address to a category is the analytics provider's judgement, built from its own data, and two providers can score the same address differently. A clean result on a new address says little, because a new address has no history; ask where the assets sat before, and screen that address too. Indirect exposure is a matter of degree, so set the level that triggers a question and the level that triggers a refusal before you look at any particular counterparty.

Screening proves nothing about control. An address can be clean and belong to somebody else. Confirm control separately with a message signed by the address or a small agreed test transfer, and screen again on the day of the trade, because an address that was clean when you opened the file can receive funds afterwards.

How do you use bank, custodian and trade references?

You use bank, custodian and trade references by confirming each one through a contact route you found yourself and by asking narrow factual questions that the reference can actually answer. A reference letter attached to an email is a claim like any other document.

A bank or a custodian will rarely vouch for a client's character. What it can often confirm, with the client's consent, is that an account in the stated legal name exists and that the person named is authorised on it. That ties the account that will pay you, or receive your payment, to the legal entity you vetted in the first layer. Ask the counterparty to authorise the confirmation, then reach the institution through its published switchboard, not through a number in the letter. A custodian's confirmation does the same job for the crypto leg.

Trade references test the track record. Ask for at least two counterparties that have traded with the firm. Find their contact details independently, and ask questions with factual answers: how long the relationship has run, roughly how many trades and in what size band, whether any trade failed or was delayed and how it was resolved, and whether settlement instructions ever changed at short notice.

Which trade terms belong in the vetting file?

The trade terms belong in the vetting file because they show whether the trade the counterparty proposes matches the entity you vetted: the same legal name, the same bank account holder, the same wallets, the same authorised people. A mismatch between the terms and the file is a due-diligence finding, not a commercial detail.

Record the asset and the quantity, how the price is set, the settlement method, the accounts and addresses on each side, what happens if either side fails to deliver, and the governing law. Record every party that is paid out of the trade, including an introducing broker and its fee, so that no undisclosed beneficiary appears at settlement.

Three terms carry most of the vetting weight. The account holder name on the cash leg must be the vetted legal entity; a request to pay a third party, or to receive from one, reopens the ownership and sanctions layers for that third party. The wallet addresses must be the ones you screened. And any change to settlement instructions must be confirmed through a second channel agreed in advance, by a named authorised person.

How the two legs are exchanged is a subject of its own. For the file, note that the less of the counterparty you were able to verify, the less you should be willing to deliver before you are paid.

How does the depth of vetting change with the size of the trade?

The depth of vetting rises with the amount you could lose and with the risk indicators in the file, so most firms set tiers: a baseline for small trades, the full file above a threshold, and enhanced checks with senior sign-off at the top. The thresholds are a policy choice, not a market standard, and a regulated firm's legal minimum applies at every size.

The tiers below are an illustration; replace the dollar bands with figures that fit your balance sheet.

Size is not the only trigger. A counterparty in a higher-risk jurisdiction, a complex ownership chain, a politically exposed owner, a request for third-party payments or urgency without a reason should each move a trade up a tier whatever its amount. Sanctions screening is never tiered away: it applies to the smallest trade.

What does a vetting file look like for a first $5,000,000 trade?

For a first trade of $5,000,000 with a counterparty you have never dealt with, a complete file can be assembled in about eight business days if the counterparty responds promptly. The example below is illustrative: the amounts and the counterparty are invented.

The assumptions: you are a corporate treasury selling $5,000,000 of a dollar-backed stablecoin for US dollars. The buyer is a trading company incorporated abroad, introduced by a broker. Under the illustrative tiers above, $5,000,000 falls in the enhanced tier, so all nine layers apply. The names to screen are the entity, its two directors, its two beneficial owners and the trader who will agree the deal: six names, each run against the three official lists, which makes 18 searches. The buyer supplies two wallet addresses, one bank confirmation, one custodian confirmation and two trade references.

What do you do when a check cannot be completed?

When a check cannot be completed, you do not waive it: you record the gap and reduce what you could lose until the gap is closed, by cutting the size, splitting the trade into tranches, using a neutral holder for the exchange, or declining. Which option fits depends on which layer is open.

In the worked example, the open item is the second trade reference. The head of compliance approves the trade in four tranches instead of one: a first tranche of $500,000, which is 10% of the total, followed by three tranches of $1,500,000 each, with each tranche completed before the next begins. The four tranches add up to $5,000,000, and the largest amount exposed at any one time falls from the full $5,000,000 to $1,500,000, or 30% of the trade.

Tranching has a cost: each tranche is a separate execution, and the price can move between tranches unless the terms fix it.

Identity, ownership, sanctions and authority are conditions for trading at all: no reduction in size cures a counterparty you cannot identify or a sanctions hit you cannot clear. When you decline, record the reason and keep the file.

Which records should you keep, and for how long?

You should keep the whole file, with the date and the source of every check, for at least as long as the law that applies to you requires and for as long as a dispute or an enquiry could arise. The Financial Action Task Force's Recommendations set the international baseline for regulated firms at a minimum of five years for transaction records; national rules set the exact period and may be longer.

Keep these items together, in a form that cannot be silently edited, and store them as the sensitive material they are: the file holds other people's identity documents, so data-protection law governs who can open it and when it must be deleted.

• The request list you sent and the date of each response.
• The registry extract and the LEI record, each saved as retrieved by you, with the retrieval date.
• The regulator register entry, saved with its date, and a note of the activities covered.
• The ownership chart, the identity documents and the evidence of each signatory's authority.
• Each sanctions search: list, search terms, date, result and the reasoning behind any cleared near match.
• The source-of-funds and source-of-assets documents and your reconciliation note.
• Each wallet-screening report, including the one run on trade day, and the evidence of address control.
• Notes of each bank, custodian and trade-reference call: who you spoke to, on what number, when, and what was confirmed.
• The agreed trade terms, the settlement instructions and the record of their confirmation on the second channel.
• The risk tier applied, the open items, the decision, who signed it off and when.
• The transaction references for both legs once the trade is done, and the date set for the next refresh of the file.