rsync always uses checksums to verify that a file was transferred correctly. If the remote file already exists, rsync may skip updating the file if the modification time and size match the source file, but if rsync decides that data need to be transferred, checksums are always used on the data transferred between the sending and receiving rsync processes. This verifies that the data received are the same as the data sent with high probability, without the heavy overheard of a byte-level comparison over the network.
Once the file data are received, rsync writes the data to the file and trusts that if the kernel indicates a successful write, the data were written without corruption to disk. rsync does not reread the data and compare against the known checksum as an additional check.
As for the verification itself, for protocol 30 and beyond (first supported in 3.0.0), rsync uses MD5. For older protocols, the checksum used is MD4.
. While long considered obsolete for secure cryptographic hashes, MD5 and MD4 remain adequate for checking file corruption.
Source: the man page and eyeballing the rsync source code to verify.