Crypto Payment Industries Are Scaling Fast. Is Compliance Keeping Up

1. Introduction  

Crypto-enabled payment cards are scaling faster than their compliance controls. An investigation by 《The Economist》describes a market in which card issuance is surging while a meaningful share of providers apply weak or no know-your-customer (KYC) checks. This paper argues that weak KYC is not a growth strategy but a systemic liability that transfers reputational and regulatory risk to issuers, card networks, and the wider payments industry.
2. The Growth Side of the Ledger

Stablecoin cards were used in transactions worth more than USD 1.3 billion in September 2026, three times the level of a year earlier, according to Paymentscan. The overall market value of stablecoins has nearly doubled in two years to more than USD 300 billion. Between April and September 2026, the number of identifiable crypto-card providers grew from roughly 100 to around 250.

3. The Compliance Side of the Ledger

The compliance picture is less favourable. A report by Crystal Intelligence in April 2026 found that nearly seven in ten crypto-card providers had weak KYC requirements or none at all. About half of the no-KYC providers it identified were based in Hong Kong, and roughly a fifth in the United States. TRM Labs estimates that illicit crypto flows exceeded USD 158 billion last year.
The two sides of the ledger are connected. Growth that depends on weak verification is fragile, because it rests on regulatory arbitrage and diluted accountability rather than on a durable customer base.
The growth side is unlikely to sustain itself if the compliance side does not improve, because card networks and regulators ultimately control access to the very infrastructure that crypto cards require. A provider that cannot pass network due diligence loses the ability to issue cards regardless of its marketing.

4. How Weak KYC Emerges

Weak KYC is produced by a specific structure. The first element is offshore licensing. Some providers are licensed in the Caucasus or the Gulf, where KYC rules are weaker and less vigorously enforced, while their cards still connect to global Visa and Mastercard acceptance networks.

The second element is the intermediary issuing model. Card networks have opened membership, previously reserved mostly for banks, to licensed card issuers. Those issuers in turn lend network access to crypto-card brands, which acquire customers under their own names. The longer the chain, the easier it is for compliance responsibility to be diluted.

The third element is product design. Virtual cards are in some cases entirely legal, but promises of no documents, no waiting, and no long forms sell weak verification as a feature. Some providers request identity information only after the cardholder begins using the card.
5. The Risk Chain

Weak KYC creates risks beyond individual bad actors. It facilitates sanctions evasion by providing payment channels to individuals and entities locked out of the Western financial system. It is used to bypass export controls on frontier AI models: Chinese-language tutorials teach users to subscribe to restricted services using crypto cards and fabricated addresses. It contributes to pseudo-dollarisation in economies with weak currencies. Finally, it transfers reputational risk to the card networks themselves, which state that illegal activity and reloadable no-KYC cards are prohibited on their networks.

Reported cases illustrate how weak verification operates in practice. A source at an American provider whose cards are issued by Rain described seeing hundreds of users sign up each month with Chinese-issued IDs and addresses outside China. In one instance, a user with a Shenzhen IP address and a Chinese ID applied for a card with a non-Chinese address and spent USD 50,000 on ChatGPT subscriptions through the Bolivian Apple App Store. Rain accepts Chinese IDs because holders may reside abroad, but rejects applicants with a Chinese address; some providers allow users who fail KYC with a Chinese address to retry with another. Rain states that it maintains high standards for its compliance programme and is investigating the reports.

The economic asymmetry is worth stating plainly. A weak-KYC provider can acquire customers at lower cost, but every such customer imports future liability. A strong-KYC provider pays more to onboard, but its customer base survives the next round of enforcement. Over a full cycle, the latter is cheaper; the accounting simply spreads the cost differently.

6. The Regulatory Response

Regulators and card networks are moving in the same direction. The United States is drawing stablecoins and crypto payments into the existing financial supervisory framework. Europe's MiCA regime imposes reserve, redemption, and licensing obligations on stablecoin issuers and requires crypto-asset service providers to obtain authorisation. Hong Kong operates a licensing regime for virtual asset service providers. Card networks are tightening issuer oversight and restricting no-KYC reloadable products.

The trajectory is clear: crypto payments that want access to the mainstream financial system will have to meet mainstream compliance standards.

The tension is structural. Card networks want the volume that crypto cards bring, while bearing the reputational cost of their misuse. Issuers want the economics of network access, while carrying the regulatory burden. Brands want growth, while the cheapest growth comes from weak verification. Until the incentive structure changes, individual commitments to compliance will compete with commercial pressure to loosen controls.
The comparison to neobanks is instructive. Digital banks such as Monzo and Revolut issue cards only to verified customers. The crypto-card market's departure from that norm is the anomaly, not the rule. When the anomaly closes, providers converge on the same verification standard that neobanks already meet.

7. Implications for Legitimate Providers

For providers that take compliance seriously, the episode carries three implications. First, KYC is an entry condition, not a one-time step; identity verification must occur before account activity and be refreshed over the customer lifecycle. Second, transaction monitoring and know-your-transaction (KYT) screening are ongoing capabilities embedded in daily operations, including blockchain risk screening, anomaly detection, and sanctions-list matching. Third, the responsibility boundary for merchant onboarding and underlying-customer risk must be explicit: who performs KYC, who performs risk screening, and how funds are handled in an exception must be answerable in terms of a specific jurisdiction's rules.
It is important not to overstate. The Crystal Intelligence finding does not mean the entire industry is non-compliant. Many providers enforce KYC and some cap payments to specific merchants. The problem is heterogeneity: the weakest cohort defines how regulators and the public perceive the whole, and their exit will be the painful part of the correction.

8. Compliance as the Moat

Among legitimate providers, compliance is shifting from a cost centre to an entry credential. On the same card-network infrastructure, compliance capability determines the banking relationships, issuance limits, and merchant quality a provider can access. DogPay's approach is to place KYC/AML with Sumsub and KYT and on-chain risk screening with Elliptic. The value of this structure is not outsourcing compliance, but making it part of every transaction flow rather than a retrospective patch.

Compliance capability does not by itself confer market position. The stratification of the crypto-card market is only beginning, and it remains to be seen which providers can combine on-chain efficiency with bank-grade controls.
For a legitimate provider, compliance is an underwriting decision in disguise. Every onboarding without proper KYC imports future losses and reputational exposure. Every transaction screened after the fact is a risk already realised. The providers that treat compliance as part of the product, rather than a cost to be minimised, are the ones whose banking relationships and card-network standing survive the next round of enforcement.
9. Conclusion  

Growth built on weak KYC is borrowed growth. It depends on regulatory gaps and diluted responsibility, neither of which is permanent. As regulators and card networks tighten simultaneously, the first to exit will be the participants that treated compliance as a cost and identity verification as friction.

A useful way to state the baseline: the asset class may change the speed of settlement, but it does not change the requirement that a supervised, auditable entity stand behind each transaction. That requirement, more than any technical feature, determines which providers remain viable.
For payments infrastructure, the baseline is not how fast the technology moves, but whether every transaction has behind it a subject that can be held accountable, audited, and supervised. That standard does not change with the asset class.

References:

The Economist, The AI boom meets a new kind of crypto scam (2026);

Crystal Intelligence (April 2026); TRM Labs; Paymentscan, cited via The Economist. Accessed 2026-10-22.
Figures and card-network rules should be verified against official sources.

Disclaimer: This content is for informational purposes only and does not constitute legal, financial, or investment advice. Third-party data is cited as accessed. Service availability and figures are subject to change and vary by jurisdiction.