Bot type
Let the right people in, and be able to prove why
A KYC-gated access bot verifies identity and jurisdiction through a licensed provider before admitting someone to a Telegram group or channel, and keeps the evidence trail. It enforces access rules. It is not itself a KYC provider, and it does not make an unlicensed offering compliant.
KYC-gated access bots: price, timeline and limits
- Fixed price
- $7,500 USD
- Delivery
- 32 calendar days from kickoff
- Join requests
- Approve or decline only — there is no partial admission state
- Required rights
- Administrator able to add and remove members
- Residency signal
- Telegram exposes none that can be relied on
- Removal
- Removes the member, not their copy of prior messages
As of 2025-10-01, Telegram Bot API 13.4
The problem this solves
A regulated crypto business with a Telegram community has a problem its unregulated competitors do not. Some of what is discussed in that channel is, in some jurisdictions, a financial promotion. Who is in the room therefore matters legally, and "anyone with the invite link" is not a defensible answer when the link has been forwarded four hundred times.
The instinct is to make the group private and manage invites manually, which fails at the first hundred members and produces no record of why anyone was admitted. The next instinct is a form, which collects claims rather than verification — a user typing that they are not a US person is not evidence of anything, and a regulator asking how you established it will not accept a screenshot of a checkbox.
What actually works is boring and unavoidable: a licensed verification provider does the identity work, the bot enforces the outcome, and every admission decision is recorded with what it was based on and when. The bot is the enforcement and audit layer, not the verification. Confusing those two is the mistake that produces a system which looks compliant and proves nothing.
How the build runs
The user requests access and is sent to the provider
A join request or an invite link starts the flow. The bot hands off to the KYC provider's own hosted process, so identity documents never pass through your infrastructure — which is both safer and simpler to defend.
deep-linkThe provider returns a verdict, not documents
Pass, fail, or manual review, with the country determination and a reference. Storing the verdict rather than the documents keeps your data footprint small and your obligations proportionate.
webhookJurisdiction rules are applied per channel
A channel discussing a product that cannot be promoted in a given country simply does not admit residents of it. Rules are per channel because a business rarely has one uniform restriction.
chat-member-updatesAdmission is automatic and immediate on pass
The join request is approved by the bot within seconds. Manual approval queues are where these systems break down, because the queue is never staffed at the moment someone verifies.
chat-member-updatesA failure is explained without being insulting
Which check failed, at a level that does not leak the rule set, and what recourse exists. A blank rejection generates support load and, in the cases where the check was wrong, justified anger.
commandsLapsed verification removes access
Where your regime requires periodic re-verification, members are prompted before expiry and removed after it. Access that outlives its basis is exactly the gap an audit is looking for.
chat-member-updates
What Telegram will and will not let you do
Telegram join requests must be approved or declined through the Bot API; there is no partial admission state.
A user in manual review sits outside the group entirely and must be told so. Designing the copy for that waiting state matters, because it is where most abandonment happens.
A bot must be an administrator with the right to add and remove members to enforce access.
Your enforcement depends on an admin bot remaining an admin. Removal of that permission silently disables the gate, so it is monitored and alerted on rather than assumed.
Telegram exposes no reliable location or residency signal for a user.
Jurisdiction comes from the KYC provider's determination, never from an IP address or a phone prefix. Both are trivially changed and neither is evidence.
An invite link, once shared, can be used by anyone who holds it unless join requests are enabled.
The group must be configured to require approval for every join. A gated bot in front of an open link is decorative, and this misconfiguration is common.
Members can be removed by the bot, but Telegram does not delete their copy of prior messages.
Revoking access stops future exposure, not past. Where a regulator's concern is what someone has already seen, access control is only part of the answer.
When not to build this
- Your offering is not licensed in the first place. Gating the audience does not make an unlicensed promotion compliant; it makes it a documented one.
- You have no KYC provider contract and no intention of getting one. The bot enforces verification, it does not perform it, and there is no version of this that skips the provider.
- Your community is informational and carries no regulated content. Adding identity verification to a general discussion group will cost you the community for no benefit.
- You want the bot to store identity documents. It should not, and a design that does has taken on a data protection obligation it did not need.
What it runs on
| Component | Version | Why |
|---|---|---|
| grammY | 1.45 | Bot framework, with join-request and chat-member handlers. |
| Cloudflare Workers | current | Runtime and the provider webhook endpoint. |
| Cloudflare D1 | current | Verdicts, jurisdiction rules, admission decisions and the audit trail. |
| Zod | 4.4 | Validation of provider callbacks, which are security-critical input. |
| TypeScript | 5.9 | Strict mode, with jurisdiction rules typed rather than string-matched. |
Questions people ask before committing
Does this make us compliant?
No. It enforces a rule you have defined and produces evidence that it was enforced. Whether the rule is the right one, and whether your underlying offering is licensed, are questions for your counsel and are upstream of anything a bot can do.
Do identity documents pass through your infrastructure?
No, and they should not. The user completes verification on the provider's hosted flow and the bot receives a verdict with a reference. That keeps your data footprint small and your obligations proportionate to what you actually need.
How is jurisdiction determined?
By the KYC provider, from verified identity documents. Not from IP address and not from phone country code — both are trivially changed and neither would survive a question about how you established residency.
What happens to someone who fails?
They are told which category of check failed and what recourse exists, without exposing the rule set in enough detail to be gamed. A blank rejection produces support load and, when the check was wrong, entirely justified complaints.
Can it remove members whose verification expires?
Yes, with a warning before expiry and removal after. Access that outlives the basis for granting it is precisely the gap an audit looks for, so lapse handling is part of the build rather than an option.
Which KYC providers do you integrate with?
Sumsub and Onfido are the ones most crypto businesses in this region end up with, and both have workable webhook models. The choice is yours and is contracted directly; the bot integrates with whichever you hold an agreement with.