I suggest you also to consider AML aspects in your project.
If your Company wants to set up an ICO you have to be sure to be compliant to the KYC/AML regulations. There are several differences from Country to Country to achieve such compliance.
In principle your Company must know information about customers who is in business with: this means that you must know who the customers are, the revenues sources and where the transactions take place.
Your Company is the only responsible of the abovementioned data.
Some important steps that you should check are, more or less, the following (this is not a legal advice: for sure an ICO expert lawyer can go deeper in details):
- Data gathering and basic information assessment of customers identity info;
- Customers lists checks/comparisons with PEP (Politically Exposed Person) lists;
- Risk assessment of a physical/legal person that takes responsibilities in fields like money laundering and terrorist financing;
- Keep track of customers transactions in relation with their presumed behavior vs. registered profile...
Last but not least, it is a non-negligible effort to be regulatory-laws/rules compliant over all Countries: e.g. considering United States of America, the ICO must be SEC compliant.
Definitely you have to be fully informed about your Country laws but also on laws of your-business-target Countries.