SPECIALIST · CUSTOMER DUE DILIGENCE (KYB) OPERATIONS · KUALA LUMPUR
Independent homework on the KYB desk
Unsolicited. Written from the public posting, the court and regulator record, and group filings. Everything on this page is public. I also built a working KYB triage tool, linked below, because a due-diligence role is easier to show than to describe.
The one thing that shapes this seat. In February 2025 the OKX operating entity pleaded guilty in the Southern District of New York to running an unlicensed money transmitting business, and agreed to roughly $505M in fine and forfeiture. The plea requires an external compliance consultant to stay in place through February 2027. Every onboarding file the KYB desk touches between now and then sits inside that consultant's sampling universe.
So the output standard is set from outside. A file has to be defensible to a third party who was not in the room, months later, reading only what was written down. That changes what "done" means on a case, and it is the frame I would work to.
The second signal is about typologies. Malta's FIAU fined the European entity €1.05M in April 2025 over a 2023 examination, and the named weakness was the business risk assessment: it did not adequately capture exposure to privacy coins, stablecoins, mixers and DEX-traded tokens. That is a finding about risk thinking rather than paperwork, and it says what a KYB reviewer here should be good at.
What I built. Verity, a KYB case workbench that resolves indirect beneficial ownership through layered structures, screens every party against the real OFAC SDN and Consolidated lists (19,846 designated parties), and turns the gaps into a document request. It runs in the browser. Try the demo ↗
01 · OKX in context
A group with a listed arm, a controlling parent, an offshore operating company, and per-jurisdiction licensed subsidiaries. Reading structures like this one is the actual skill the job tests.
| Entity | Jurisdiction | What it carries |
|---|---|---|
| OKG Technology Holdings Limited | Hong Kong, HKEX 1499 | Listed arm. OKLink Web3 data, blockchain technology services, trust and custody, digital asset and equity investment. Public filings available. |
| OKC Holdings Corporation | Offshore | Controlling parent above the fellow subsidiaries below. |
| Aux Cayes FinTech Co. Ltd. | Seychelles | Exchange operating company. The entity that entered the February 2025 US guilty plea. |
| OKCoin Europe Ltd | Malta | MiCA CASP authorisation, January 2025. Payment Institution licence, February 2026, covering OKX Pay and the OKX Card. FIAU fine of €1.05M, April 2025. |
| OKX SG Pte Ltd | Singapore | MAS Major Payment Institution licence since September 2024. |
| OKX Middle East Fintech FZE | Dubai | Full VARA VASP licence covering spot and derivatives. |
READ 1
Depth alone is not adverse. Each layer here has a licence or a listing behind it, and that reason is checkable in public filings. The question on any file is what each layer is for, and whether the answer survives a document request.
READ 2
The Kuala Lumpur office is a global operations hub. OKX is not on the Securities Commission Malaysia registered exchange list, so this desk reviews global cases against another jurisdiction's rulebook. The shift allowance in the package says the queue follows someone else's business hours.
READ 3
The group owns OKLink, a chain-analytics capability most exchanges buy from Chainalysis, Elliptic or TRM. Name screening and onchain screening are separate disciplines, and an institutional file benefits from both being read by the same person.
02 · What a KYB file actually contains
KYC identifies a person who is standing in front of you. KYB identifies people who are deliberately several documents away. The gap between those two is where the work is.
who is declared
multiply through layers
sum across paths
applicant, intermediates, owners, officers
written rationale per hit
gaps become documents
The failure modes, ranked by how often they hide a real owner
| Pattern | What it looks like on the register | What resolves it | Severity |
|---|---|---|---|
| Aggregation across paths | A holder at 24% directly, plus a stake in a corporate shareholder. Each line looks compliant. The sum does not. | Multiply and sum every path, do not read the register line by line. | blocking |
| Unallocated equity | Declared holdings total 83%. Nobody names the rest. | Reconciled shareholding statement to 100%, with share certificates. | blocking |
| Nominee holder | A corporate services provider "holding on behalf of clients". Ownership stops there. | Declaration of trust and identification of the beneficiaries to natural persons. | blocking |
| Sub-threshold clustering | Three or four natural persons at 24% each, none disclosable. | Ask whether they are related parties or acting in concert, and get it in writing. | enhanced |
| Control without ownership | No shareholder reaches 25%, so no UBO is declared and the file looks finished. | Board appointment rights, shareholders' agreement, veto or golden share. Senior managing official as fallback. | enhanced |
| Opaque jurisdiction | Seychelles, BVI, Marshall Islands. No public beneficial ownership register to check against. | Certificate of Incumbency or Good Standing issued by the registered agent. A customer-prepared register carries no independent weight. | enhanced |
| Bearer shares | Nothing on the register indicates them. Ownership can change hands without any filing. | Written confirmation that none are in issue, and constitutional documents that prohibit them. | enhanced |
| Stale documents | An undated register of directors, or one certified three years ago. | Certified and dated within 3 months. A stale register is an unverified register. | standard |
The 25% figure comes from FATF Recommendation 10 and is carried into nearly every implementing regime. It sets who must be identified. A person at 24% who appoints the board is still a beneficial owner, and the file has to say so.
03 · The compliance map
Every large exchange has now been through some version of the same reckoning. Where each one sits tells you what its onboarding desk is optimising for.
| Exchange | AML enforcement record | Oversight now | What that means for its onboarding desk |
|---|---|---|---|
| OKX | Guilty plea, unlicensed money transmitting, SDNY, Feb 2025. $84.4M fine plus $420.3M forfeiture. Malta FIAU €1.05M, Apr 2025. | External consultant to Feb 2027 | Files are sampled and tested by a third party. Documentation quality is the constraint, and rebuilding a demonstrably sound KYB function is the current mandate. |
| Binance | Nov 2023 settlement, $4.3B. Founder pleaded guilty to a Bank Secrecy Act charge. | Two monitors from 2024, three-year terms; DOJ monitor reported in talks to end early | The heaviest oversight structure in the sector. Two separate reporting lines, to DOJ and to FinCEN. |
| KuCoin | Operator PEKEN Global pleaded guilty to unlicensed money transmitting, Jan 2025. $297.4M. | Two-year US market exit; founders removed from operations | Remediation by withdrawal rather than by rebuild. A different answer to the same problem. |
| BitMEX | Bank Secrecy Act violations 2015 to 2020. Additional $100M ordered Jan 2025, on top of $110M already agreed. | Resolved, historic | The oldest version of this story, and the one that established that founders are personally exposed. |
| Bybit | DNB (Netherlands) fine €2.25M, Oct 2024, for offering crypto services without registration to Sept 2023. | MiCA licence via Austria FMA, May 2025 | Registration and licensing rather than AML programme failure. A lighter file, and a licensing-led posture. |
| Coinbase | NYDFS consent order Jan 2023, $50M penalty plus a $50M compliance investment, over onboarding and KYC backlogs. | Consent order remediation completed | The one that shows what happens when onboarding capacity does not scale with growth. The backlog itself was the violation. |
THE GAP THAT MATTERS
Coinbase was penalised for a backlog. The delay itself was the violation. That is the tension inside any KPI-linked onboarding queue: throughput and file quality are both failure modes, in opposite directions. A desk under external oversight has to hit both, and the only way to do that is to make each file cheaper to produce without making it thinner.
WHERE OKX SITS
Between Binance and Bybit. Heavier oversight than a licensing-led exchange, lighter than a dual-monitor structure, and unlike KuCoin it is rebuilding rather than withdrawing. That combination puts unusual weight on the people writing the individual files, which is what this role is.
★ FOCUS
The February 2027 clock
The plea requires an external compliance consultant through February 2027. That is the single fact I would keep in front of me on every file.
WHAT CHANGES
A file is no longer finished when the reviewer is satisfied. It is finished when it would read correctly to someone who pulls it cold, months later, with no access to the reviewer.
WHAT GETS TESTED
Sampling usually targets the judgement calls: cleared screening alerts, approvals with an incomplete ownership picture, and EDD triggers that were not applied. The easy files are not the exposure.
THE PRACTICAL RULE
A disposition is only as good as the reason recorded with it. "No match" is a conclusion. "DOB, nationality and place of birth all differ; common patronymic; no adverse media" is a record.
The typology point. The Malta finding named privacy coins, stablecoins, mixers and DEX-traded tokens as gaps in the business risk assessment. On a KYB file that translates into a concrete question: what does this customer actually do with the account, and does the declared business model touch any of those flows? An OTC desk that settles in stablecoins, a payments agent that on-ramps to a chain with mixer exposure, and a fund that only trades majors are three different risk profiles behind identical constitutional documents.
04 · JD duties, my method
Each bullet from the posting, and how I would actually do it.
| JD duty | Method | Shown in |
|---|---|---|
| Complete comprehensive reviews of incoming onboarding cases against KYB policy and customer risk assessment | Work the structure before the documents. Resolve ownership to natural persons first, because that determines which documents are even required. A register read line by line misses aggregation across paths. | §02, demo |
| Review KYB documents using validation tools and reputable sources | Prefer registry-issued evidence over customer-prepared evidence: Certificate of Incumbency over a typed register, SSM e-Info over a photocopy, HKEX filings over a corporate deck. Where the jurisdiction has no public register, say so on the file rather than treating the customer's document as verification. | §02 |
| Request appropriate CDD/EDD documentation | Generate the request from the findings themselves, and send it once and complete. Every extra round trip is days of SLA and a worse customer experience for the same outcome. | demo, RFI tab |
| Follow up on pending requests within SLAs | Two clocks, tracked separately: the internal SLA that governs when I must act, and the customer's response window. Only the first is the team's performance. Conflating them is how a queue quietly ages. | demo, RFI tab |
| Investigate possible matches against sanctions, PEP and adverse media | Adjudicate on identifiers: date of birth, place of birth, nationality, passport or registration number, and the listing programme. Write the discriminating fact down. Where nothing discriminates, escalate. | demo, screening tab |
| Provide information to management on AML/CDD issues arising | Escalate with the decision already framed: what was found, which threshold or typology it engages, what I recommend, and what I need from them. Escalation should cost the reviewer less time than doing it themselves. | §06 |
| Maintain service quality to customers and other departments | Most onboarding friction is a document request that was vague. Name the exact document, the issuer, the acceptable age, and why it is needed. Customers respond faster to a specific ask. | demo, RFI tab |
| Support enhancement of the CDD function and maintain procedures | Watch what the queue repeats. A document requested three times a week belongs in the customer-facing guidance; an alert cleared for the same reason every day belongs in a tuning discussion. | §06 |
| Manage specific projects as they arise | I build tools. The demo linked here was built for this application, and the same instinct turns a recurring queue problem into a fix. | §05 |
05 · A working demo
Verity, a KYB case workbench I built for this application. Three demo files, real sanctions data, everything computed in the browser.
okx-kyb.leverlabs.workers.dev
Verity, a KYB case workbench → open it
Resolve ownership through the layers · screen every party against 19,846 OFAC designated parties · adjudicate each alert with a written rationale · generate the document request · export the case pack.
CASE-2041
Layered shell. Seychelles applicant over a BVI holdco, 17% unallocated, 34% behind a nominee. Two genuine sanctions matches fall out, both on alias records rather than on the primary listed name.
CASE-2042
The reference file. A listed group, built from public filings. Similar shape to the shell case, materially different substance. It is there to show that depth is a question to ask, and the answer is what decides the file.
CASE-2043
Sub-threshold engineering. A Malaysian Sdn Bhd where three shareholders sit at 24% each. The register discloses no UBO. Resolving the paths puts one of them at 40.8%.
The finding worth the whole build: the threshold is a policy decision
Screening the same three files at different match thresholds. The two genuine matches survive at every level. Everything else is workload.
| Threshold | CASE-2041 | CASE-2042 | CASE-2043 | Genuine matches kept |
|---|---|---|---|---|
| 65% | 63 alerts | 29 | 25 | 2 |
| 70% | 52 | 20 | 7 | 2 |
| 75% | 20 | 17 | 0 | 2 |
| 80% | 8 | 9 | 0 | 2 |
| 85% | 2 | 0 | 0 | 2 |
| 90% | 2 | 0 | 0 | 2 |
At 65% these three files raise 117 alerts. At 85% they raise 2, and both are real. That looks like an argument for a high threshold until you consider what disappears first: heavier transliteration variance, a maiden name, a reversed Arabic or Chinese name order. Whoever sets the number owns what it misses, and the defensible version of that decision is measured and written down.
One engineering detail that is really a compliance detail. The first version of the matcher scored "OKC Holdings Corporation" at 88% against an unrelated "RG Holdings Ltd", purely on the shared word HOLDINGS. Weighting each token by inverse document frequency, so that rare words carry identity and common corporate words carry almost none, dropped that noise and left the genuine alias matches at 100%. Alert volume is not fixed. A large part of it is a tuning artefact, and someone has to notice.
Built by me for this application. It is not connected to any exchange system. Demo applicants are fictional; the listed group in CASE-2042 is drawn from public filings. Watchlist is the US Treasury OFAC SDN and Consolidated lists, public domain, retrieved 9 September 2026. No PEP or adverse-media provider, no vendor model, no case management system, no maker-checker step. What it shows is the reasoning.
06 · How I would work the queue
Under external oversight, throughput and file quality both have to hold. These are the working rules that let them.
Structure first, documents second
Resolving ownership determines which documents are required. Collecting documents first means collecting the wrong ones and going back twice.
One complete request, sent once
Every round trip costs days of SLA and customer goodwill for no additional assurance. Batch the ask, specify the issuer and the acceptable age of each document.
Write the discriminating fact, always
Every cleared alert gets the identifier that cleared it. Where no identifier discriminates, escalate it.
Escalate with the decision framed
What was found, which threshold or typology it engages, what I recommend, what I need. An escalation should cost the reviewer less time than doing it themselves.
Treat repetition as a defect
The same document requested three times a week is a guidance gap. The same alert cleared for the same reason daily is a tuning question. Both are cheaper to fix once than to absorb forever.
Languages as a working tool
I read English, 中文 and Bahasa Malaysia natively. Hong Kong and PRC corporate documents and Malaysian SSM filings can be read directly rather than routed through translation, which removes a delay and a source of error.
07 · First 90 days
DAYS 1 TO 30
Learn the rulebook that applies. Which licensed entity's customers this queue serves, and therefore whose CDD standard governs. Read the customer risk assessment and the acceptance policy before touching a case.
Clear volume on the simple files to earn the right to be slow on the hard ones, and log every question rather than guessing.
Learn what the consultant samples. Ask directly what has been tested and what came back, then work to that standard from the first file rather than from month six.
DAYS 31 TO 60
Take the harder structures. Multi-layer, nominee, opaque jurisdiction. These are where the desk's exposure sits and where an extra reviewer is worth most.
Measure my own file. Track SLA hit rate, rework rate, and how often a request I sent had to be followed by a second one. Rework is the honest quality metric.
Start the credential. Put the annual training benefit toward ACAMS CAMS in year one and close the formal gap on the team's calendar.
DAYS 61 TO 90
Bring one procedure improvement backed by queue data: the document most often missing, the alert reason most often repeated, or the jurisdiction that generates the most rework.
Write the guidance I wished existed in week one, so the next joiner reaches useful output faster than I did.
Take the Chinese and Malay document load as a standing part of my allocation, since it removes a translation step for the whole team.
08 · Method & sources
Built from the public job posting (2026), the US Department of Justice and Malta FIAU records, group filings, and regulator licence registers. No non-public information, no contact with anyone at the company. Figures are quoted as published; where a monitorship or consultant term is described, it is taken from the enforcement announcement.
The demo tool is mine, built for this application. Its watchlist is the US Treasury OFAC SDN and Consolidated lists in the public domain, retrieved 9 September 2026. It is not connected to any production system and does not represent any exchange's actual controls, thresholds or decisions.
This is unsolicited interview homework. Happy to walk through any section, including the parts I got wrong.
DOJ / SDNY, OKX guilty plea: justice.gov
$505M figure and terms: CNBC, Feb 2025
Malta FIAU fine: CoinDesk, Apr 2025
OKG group filings: okg.com.hk
MiCA authorisation: OKX, MiCA licence
SC Malaysia registered exchanges: sc.com.my
KuCoin plea: justice.gov
Bybit, DNB fine: dnb.nl
OFAC lists: treasury.gov, OFAC
FATF Recommendations 10 and 16: fatf-gafi.org
Independent KYB / CDD homework for the OKX Customer Due Diligence Specialist role · 2026 · edwardtay.com