KYC, PII & AML: how the off-chain link actually works
On-chain heuristics link addresses to each other, but the link from an address to a person almost always comes from off-chain systems. Three acronyms do most of the work:
- (Know-Your-Customer) — regulated exchanges and VASPs verify a customer’s identity at onboarding. The moment you deposit to or withdraw from a KYC’d service, it has both your address and your identity, and that mapping is the single most common way on-chain activity is attributed to a person.
- (Personally Identifiable Information) — the name, government ID, address, and sometimes IP/device data collected at KYC. PII is the bridge between “address X” and “person Y.” Because it’s sensitive, its handling raises data-protection and breach concerns: exchanges have leaked PII + address mappings, which then feed tracing.
- (Anti-Money-Laundering) — firms must monitor for suspicious patterns, file Suspicious Activity/Transaction Reports (SARs/STRs), and screen counterparty addresses against sanctions lists. Chain-analysis tools (Chainalysis, TRM, Elliptic) are how AML teams do that on-chain monitoring.
The ties these together: it requires regulated firms to pass PII about the originator and beneficiary of transfers above a threshold, so the identity travels with the funds across institutions. For a compliance team, the practical takeaway is that tracing isn’t mainly about breaking crypto — it’s about maintaining and querying the off-chain identity graph that KYC/PII build and AML obligations require using.
How an address gets a name