AML for Crypto: A Compliance Playbook for 2026

Add TechGaged as your preferred source on Google

See more TechGaged stories across Google News and Discover.

Add

AML for crypto means applying risk-based Know Your Customer (KYC) and Customer Due Diligence (CDD), continuous transaction monitoring, sanctions screening, and suspicious activity reporting to virtual-asset activity, with strong scrutiny reserved for fiat on-ramps, off-ramps, and anonymity-enhancing features. Virtual Asset Service Providers (VASPs) and Crypto-Asset Service Providers (CASPs) sit at the center of this obligation because they are the points where illicit funds most often touch the regulated financial system.

If you run compliance for a crypto business, three moves matter more than anything else this quarter. First, complete a documented risk assessment covering your customer base, products, geography, and transaction channels, then register with the relevant regulator or supervisor in each jurisdiction you serve. Second, implement KYC and CDD onboarding that captures the originator and beneficiary information the Travel Rule requires, not just a name and an ID photo. Third, deploy transaction monitoring calibrated to detect the specific red flags of crypto, including mixer exposure, rapid layering across chains, and sudden large withdrawals to high-risk jurisdictions.

Latest Stories

3 min read • 16 hours ago

Top Crypto Analyst Signals Dogecoin Could Be Ready For A Parabolic Rally

3 min read • 16 hours ago

Goldman Sachs XRP ETF Claim Resurfaces — But The Numbers Look Familiar

3 min read • 17 hours ago

Crypto Markets Get A Major Regulatory Boost Even Without CLARITY Act Passage

Read all latest stories →

Your short list of deliverables for the next 30 days should include a written AML policy signed off by senior management, a named Money Laundering Reporting Officer (MLRO) or equivalent accountable owner, and a minimum viable monitoring stack that can flag wallet risk scores before funds settle. Skip these steps and the exposure is not theoretical: Grant Thornton’s analysis concludes that the era of regulatory leniency toward crypto firms is over, and the businesses least prepared for that shift are the ones facing the largest penalties.

Key Takeaways

Effective AML for crypto combines risk-based KYC and CDD, continuous transaction monitoring, sanctions screening, and disciplined SAR filing, mapped against FATF, EU, and FinCEN requirements simultaneously.

Table of Contents

• What Makes AML for Crypto Different From Traditional Finance
• The Regulatory Landscape Every Compliance Team Must Track
• Turning Obligations Into a Working Control List
• High-Risk Features That Should Trigger Enhanced Due Diligence
• Building an AML Compliance Program From the Ground Up
• Choosing Blockchain Analytics and AML Scoring Tools
• What Enforcement Actions Are Teaching Compliance Teams
• Getting Compliant: A Phased Timeline and Cost Reality
• Training and Certification Paths for Your Compliance Team
• Cross-Border Cooperation in Crypto AML Enforcement
• AI and Machine Learning Beyond Blockchain Analytics
• Risk Profiling by Crypto Service Type
• Building Sanctions Screening Into the Program
• Why DeFi Demands a Different Compliance Approach
• Compliance Is Now the Price of Staying in Business
• Primary Sources and Further Reading
• Sources
• FAQ

What Makes AML for Crypto Different From Traditional Finance

Crypto AML borrows its vocabulary from banking but the underlying risk is not the same animal. A wire transfer moves through a handful of correspondent banks that can each check a name against a sanctions list. A crypto transaction can hop across five wallets, two chains, and a decentralized exchange in the time it takes to read this sentence, and none of those hops require a bank’s permission.

Before going further, it helps to fix the terms compliance teams throw around loosely:

• VASP/CASP: A Virtual Asset Service Provider (the FATF term) or Crypto-Asset Service Provider (the EU term under MiCA) is any business that exchanges, transfers, safekeeps, or administers crypto-assets on behalf of customers.
• Travel Rule: The requirement that originator and beneficiary information travel with a crypto transfer, mirroring the wire-transfer rule that has existed in banking for decades.
• Self-hosted (unhosted) wallet: A wallet controlled directly by an individual with no custodial intermediary, meaning no KYC checkpoint exists at that address by default.
• Mixers and tumblers: Services that pool and scramble crypto from multiple users specifically to break the audit trail between sender and receiver.
• Stablecoins: Tokens pegged to a fiat currency, increasingly used as the settlement layer for illicit transfers because they combine crypto’s speed with dollar-denominated value.
• UTXO vs. account-based models: Bitcoin tracks ownership through unspent transaction outputs, while Ethereum uses account balances; the distinction changes how analytics tools trace fund flow.

Three structural forces drive crypto’s elevated AML risk profile. Pseudonymity paired with a fully public ledger creates a strange paradox: every transaction is visible, but tying a wallet address to a real identity takes specialized attribution work. Speed and reach compound that problem, since a transaction that would take three days to clear through correspondent banking settles on-chain in minutes, often across borders with no intermediary bank to pause and ask questions. Then there is the growth of privacy-enhancing technology and decentralized finance (DeFi), which can strip out the very features that made blockchain traceable in the first place.

Picture a typical illicit flow: stolen funds land in an exchange-hosted wallet, get split into a dozen smaller transactions, route through a mixer, and re-emerge as a “clean” balance ready for cash-out at a different exchange. Every one of those hops is a chokepoint where a control can intervene, but only if the exchange at each end is actually watching for it.

The blockchain’s transparency is a double-edged sword. Raw on-chain data only becomes useful once specialized analytics turn it into address clustering, entity attribution, and risk scoring, according to the BIS Bulletin on AML compliance for cryptoassets.

The Regulatory Landscape Every Compliance Team Must Track

No single regulator owns crypto AML. Compliance teams have to map several overlapping regimes and treat the strictest applicable rule as the operating standard, because global businesses rarely get to pick just one jurisdiction’s playbook.

The Financial Action Task Force (FATF) sets the international baseline. Its guidance defines virtual asset terms, extends the Travel Rule to VASPs, and increasingly addresses DeFi exposure directly, and FATF’s own publication on virtual currency risk remains the reference document most national regulators build from. In the European Union, Regulation (EU) 2023/1113 requires information to accompany every crypto-asset transfer and obliges providers to detect and act on missing or incomplete originator and beneficiary data, effectively codifying the Travel Rule into binding EU law. The European Banking Authority (EBA) layered on top of that with amended Risk-Factors Guidelines that name mixers, tumblers, ring signatures, and stealth addresses as specific triggers for enhanced due diligence.

In the United States, most crypto firms handling customer funds are classified as money services businesses and fall under the Bank Secrecy Act framework FinCEN administers, which means KYC, recordkeeping, and Suspicious Activity Report (SAR) filing obligations apply regardless of whether a firm calls itself a “crypto company” or a “financial institution.” The Anti-Money Laundering Act of 2020 expanded FinCEN’s enforcement authority and information-sharing powers, giving U.S. regulators more reach than they had a decade earlier.

A rough timeline for compliance teams to track:

The takeaway for any firm operating across borders: sanctions screening, SAR-equivalent reporting, and Travel Rule compliance are no longer optional line items you can defer to “phase two.” They are the baseline every regulator listed above now expects on day one.

Turning Obligations Into a Working Control List

Regulatory text is not a control system. Someone has to translate “apply CDD” into a workflow a compliance analyst can actually run every day, and that translation is where most crypto AML programs either succeed or quietly fall apart.

The core controls, mapped to what regulators expect:

• KYC/CDD at onboarding — identity verification, source-of-funds checks, and beneficial-ownership identification for corporate accounts.
• Transaction monitoring — automated rules and analytics scoring that flag structuring, rapid layering, and high-risk counterparty exposure.
• SAR/STR filing — a documented escalation path from analyst alert to formal report, filed within your jurisdiction’s statutory window.
• Recordkeeping — retaining KYC files, transaction records, and SAR documentation, typically for five years or longer depending on jurisdiction.
• Sanctions screening — checking counterparties and wallet addresses against OFAC, EU, and UN sanctions lists at onboarding and on an ongoing basis.
• Travel Rule data exchange — capturing and transmitting originator/beneficiary information on qualifying transfers, per Chainalysis’s overview of AML and KYC for crypto.

The workflow itself typically runs in three stages. Onboarding establishes the customer’s risk profile and captures the data the Travel Rule requires. Transaction monitoring runs continuously against that baseline, scoring each transfer for anomalies. When a transaction crosses a risk threshold, it escalates to a human analyst who decides whether it warrants a SAR filing, a request for additional documentation, or an account freeze.

1. Verify identity and screen against sanctions lists before any funds move.
2. Assign a risk tier (low, medium, high) based on product type, geography, and transaction volume.
3. Apply enhanced due diligence automatically for high-risk tiers, including source-of-wealth documentation.
4. Monitor transactions continuously, not just at onboarding.
5. Escalate flagged activity to a trained analyst within a defined service-level window.
6. File SARs where warranted and retain full documentation for the statutory retention period.

Enhanced CDD isn’t optional window dressing. It becomes mandatory the moment a customer’s activity touches a mixer, a privacy coin, or a jurisdiction on a sanctions or high-risk list, per the EBA’s guidance discussed above.

High-Risk Features That Should Trigger Enhanced Due Diligence

Some product features and transaction patterns are risk signals on their own, independent of who the customer is. Building your monitoring rules around these signals, rather than waiting for a customer to look suspicious in aggregate, is what separates a reactive compliance program from a proactive one.

Watch for these specific red flags:

• Transactions routed through mixers or tumblers, or wallets with prior mixer exposure.
• Heavy use of privacy-enhancing technologies such as obfuscated ledger technology including ring signatures and stealth addresses.
• Withdrawals to self-hosted wallets immediately following deposit, with no intervening activity.
• Sudden, large off-ramps to exchanges based in jurisdictions with notably weak AML enforcement.
• Peer-to-peer over-the-counter (OTC) trades structured to stay just under reporting thresholds.
• Rapid, high-frequency transfers across multiple chains in a short window (chain-hopping).

Pro Tip: When a case sits in a gray zone, don’t default to either “clear it” or “block it.” Apply a risk-based approach: request additional source-of-funds documentation first, and only escalate to a full block or SAR if the customer can’t or won’t provide a credible explanation.

Building an AML Compliance Program From the Ground Up

A crypto AML program is not a policy document sitting in a shared drive. It is a living system with clear ownership, and the businesses that get it right treat it the same way they treat security: something to test, break, and improve on a schedule.

The build sequence looks like this:

1. Conduct an enterprise-wide risk assessment covering customers, products, geography, and delivery channels.
2. Draft AML/CFT policies that map directly to your risk assessment findings, not a generic template.
3. Appoint a Money Laundering Reporting Officer (MLRO) with real authority to halt transactions.
4. Select and integrate transaction monitoring and blockchain analytics tooling.
5. Train staff at onboarding and on a recurring cadence.
6. Run independent testing and audits to validate the program actually works as designed.
7. Report key metrics to the board or senior management on a fixed schedule.
8. Update the risk assessment and policies annually, or immediately after a material business change.

Responsibility has to sit somewhere specific. The board or an accountable executive owns overall risk appetite. The MLRO or AML officer owns day-to-day program execution and SAR decisions. Compliance engineers build and maintain the monitoring rules and integrations. In more mature organizations, the security operations center (SOC) and cyber threat intelligence (CTI) teams feed intelligence on emerging attack patterns directly into the AML monitoring logic, closing the gap between fraud detection and financial crime compliance.

Independent testing should happen at least annually, with more frequent spot-checks for high-risk business lines. Track metrics like SAR filing rates, false-positive ratios, average time-to-escalation, and coverage of high-risk jurisdictions, then report them to senior management in plain language they can act on.

Choosing Blockchain Analytics and AML Scoring Tools

Raw blockchain data is not a compliance control until software turns it into a decision. AML scoring approaches assign a risk value to a wallet or transaction based on its provenance, meaning its history of interaction with known illicit addresses, mixers, sanctioned entities, or darknet markets. The BIS Bulletin’s proposed approach uses this kind of scoring specifically at fiat off-ramps, where an exchange has to decide whether to accept, block, or hold a token pending review.

Before signing with any analytics vendor, put these questions on the table:

• How does the tool integrate with your existing onboarding and transaction infrastructure?
• What data sources feed the risk scores, and how current is the attribution database?
• What is the tool’s false-positive rate on your specific transaction volume and customer mix?
• Does sanctions list coverage update in real time, and across which jurisdictions?
• What is the API latency, and can it support pre-settlement screening at your transaction volume?
• Does the platform maintain audit trails sufficient to satisfy a regulator during examination?

Pro Tip: Run any new analytics vendor against six months of your historical transaction data before go-live. A tool that looks strong in a sales demo can generate an unmanageable flood of false positives once it meets your actual customer base.

What Enforcement Actions Are Teaching Compliance Teams

Regulators are no longer treating crypto as a novelty deserving a grace period. Grant Thornton’s 2026 compliance outlook argues plainly that firms failing to invest in robust AML and sanctions programs now face record penalties and, in some cases, loss of market access entirely.

The pattern across large enforcement actions tends to repeat itself: weak or inconsistent KYC at onboarding, transaction monitoring that exists on paper but doesn’t actually catch layering behavior, and SAR programs that file reports too late or not at all. The IC3’s annual report on internet crime documents the scale of cryptocurrency-enabled fraud investigators encounter each year, underscoring why regulators keep raising the bar on proactive monitoring rather than after-the-fact reporting.

Firms that treat AML and sanctions compliance as a checkbox exercise, rather than a strategic priority, are the ones most exposed to the next enforcement cycle.

Common failure patterns worth building your own checklist around:

• KYC procedures applied inconsistently across products or customer tiers.
• Transaction monitoring rules that never got updated after initial deployment.
• SAR filings delayed past the statutory window due to unclear escalation ownership.
• Sanctions screening limited to onboarding, with no ongoing rescreening against updated lists.
• Travel Rule data capture treated as optional for lower-value transfers.

Regulators are increasingly focused on cross-border information exchange, sanctions screening consistency, and whether firms can demonstrate Travel Rule compliance end-to-end, not just at the policy level. Techgaged has covered how this scrutiny plays out at the national level, including the EU banking watchdog’s draft guidelines on crypto risks and China’s tightened scrutiny on crypto transactions.

Getting Compliant: A Phased Timeline and Cost Reality

Most crypto firms underestimate how long a real AML program takes to stand up properly. Rushing it produces exactly the kind of gaps regulators are now penalizing.

A realistic phased approach:

1. Discovery (weeks 1 to 4): Complete the risk assessment, audit existing controls, and identify gaps against FATF, EBA, and FinCEN expectations.
2. Remediation (weeks 4 to 12): Draft or update policies, select analytics and monitoring vendors, and appoint the MLRO.
3. Pilot (weeks 10 to 16): Run monitoring rules against live but limited transaction volume, tuning for false positives.
4. Deployment (weeks 14 to 20): Roll out full monitoring, sanctions screening, and Travel Rule data capture across all products.
5. Review (ongoing, starting month 6): Independent testing, board reporting, and annual risk assessment refresh.

Cost drivers worth budgeting for early: analytics subscription licensing (often the largest recurring line item), compliance staff salaries, external legal counsel for multi-jurisdiction mapping, and independent audit fees. Smaller firms sometimes underbudget the staffing side, assuming software alone can carry the program. It can’t. A tool flags risk; a trained analyst decides what to do about it.

Prioritization for founders and compliance leads under time pressure: in month one, finish the risk assessment and appoint an accountable owner. In month three, have KYC, sanctions screening, and basic transaction monitoring live in production. In month six, complete your first independent test and report results to the board.

Training and Certification Paths for Your Compliance Team

A monitoring system is only as good as the people reading its alerts. Analysts who don’t understand why a mixer transaction matters will either over-escalate everything or miss the pattern entirely, and both failure modes are expensive.

Structure training around three cadences:

• Onboarding training: Every new compliance hire should complete a foundational course covering crypto-specific typologies, Travel Rule mechanics, and your firm’s own escalation procedures before touching a live case.
• Monthly refreshers: Short sessions covering newly observed typologies, recent enforcement actions, and rule tuning updates keep the team current without pulling analysts off the floor for days.
• Annual deep-dive: A full-day session revisiting the risk assessment, regulatory changes from the past year, and lessons from internal audit findings.

For certification, industry-recognized AML credentials with dedicated crypto-asset curriculum tracks, similar in structure to ACAMS-style programs, give analysts a portable credential and a shared vocabulary with regulators and auditors. Certification matters most for staff who interact directly with examiners or sign off on SAR filings; for junior analysts focused purely on alert triage, hands-on shadowing under a senior analyst often builds practical skill faster than a classroom course alone. Treat certification as a credibility layer on top of real casework experience, not a replacement for it.

Cross-Border Cooperation in Crypto AML Enforcement

Crypto transactions ignore borders by design, which means enforcement only works when regulators talk to each other. A wallet that moves funds from a U.S. exchange through a European off-ramp and into an Asian OTC desk touches three separate regulatory regimes in minutes, and no single national regulator can trace that full path alone.

FATF’s role as an international standard-setter matters here specifically because it gives member jurisdictions a shared vocabulary and a shared minimum bar, even when implementation details differ. The EU’s Travel Rule threshold, for instance, is stricter than the threshold Chainalysis describes for the U.S. approach, which creates friction for firms operating across both regions. Compliance teams handling cross-border volume need to build to the strictest applicable standard rather than assuming one jurisdiction’s rules satisfy another’s regulator.

Information-sharing agreements between financial intelligence units, along with growing cooperation on sanctions enforcement, mean a SAR filed in one jurisdiction can trigger a parallel investigation elsewhere. Firms operating internationally should map every jurisdiction where they hold a license or serve customers, and treat inconsistent SAR quality across regions as a program-wide vulnerability, not an isolated local issue.

AI and Machine Learning Beyond Blockchain Analytics

Blockchain analytics tell you where funds moved. They don’t always tell you why a customer’s behavior looks unusual for that specific customer, and that’s the gap machine learning models are increasingly filling.

Behavioral anomaly detection models learn a customer’s typical transaction pattern, size, timing, and counterparty mix, then flag deviations that a static rule-based system would miss entirely. A customer who suddenly triples their transaction frequency and starts routing through unfamiliar counterparties looks unremarkable to a threshold-based rule but stands out clearly to a model trained on that customer’s own history.

Natural language processing tools are also starting to parse unstructured data, court filings, sanctions list updates, and adverse media, faster than manual analyst review could manage, feeding that intelligence directly into risk scoring. The caveat compliance teams should hold onto: AI models still need human oversight and periodic validation, because a poorly tuned model can just as easily launder false confidence into your compliance program as it can catch genuine risk. Treat AI-driven detection as an accelerant for trained analysts, not a replacement for their judgment.

Risk Profiling by Crypto Service Type

Not every crypto business faces the same risk profile, and a one-size-fits-all customer risk model is a common source of both missed red flags and unnecessary friction. Risk profiling has to reflect what the specific service actually does.

Custodial exchanges handling fiat on/off-ramps carry the highest concentration of AML exposure because they are the chokepoint between the traditional financial system and the blockchain. Their risk models should weight source-of-funds verification and Travel Rule data capture heavily. Custodial wallet providers face a narrower risk surface since they don’t handle fiat conversion directly, but still need strong KYC given their role in asset custody. OTC desks handling large peer-to-peer trades warrant enhanced scrutiny on transaction structuring and counterparty screening, since large trades are precisely where threshold-splitting behavior tends to concentrate. Payment processors integrating crypto rails need risk models tuned to merchant-level behavior rather than individual consumer patterns, since a single merchant account can aggregate thousands of underlying transactions.

Building distinct risk tiers for each service type, rather than applying one generic scoring model across the whole business, produces sharper detection and fewer false positives across the board.

Building Sanctions Screening Into the Program

Sanctions screening in crypto has to run at two levels simultaneously: the customer level and the wallet address level. Screening only the named account holder against OFAC, EU, and UN lists misses the reality that sanctioned entities frequently operate through wallet addresses that aren’t tied to any publicly known identity until analytics attribution catches up.

Effective programs screen new customers against sanctions lists at onboarding, then rescreen the full customer base every time a list updates, not just annually. On the transaction side, every outgoing and incoming transfer should be checked against known sanctioned wallet addresses in real time, ideally before settlement rather than after. This is where sanctions screening and blockchain analytics tooling need to work as one integrated system rather than two separate checklists, since a wallet’s sanctions status and its broader risk score often depend on the same underlying attribution data.

Document every screening decision, including false positives your team clears manually, since regulators examining your program will want to see not just that screening happened, but that a human reviewed and reasoned through the edge cases.

Why DeFi Demands a Different Compliance Approach

Decentralized finance breaks the basic assumption most AML frameworks were built on: that there’s an identifiable, regulated intermediary somewhere in the transaction chain. A fully permissionless DeFi protocol may have no company, no customer-facing entity, and no one obviously accountable for compliance failures.

That doesn’t mean DeFi sits outside the scope of AML entirely. Research from Georgetown Law’s international law journal argues that practical oversight works best when it concentrates on fiat on/off-ramps and identifies “responsible persons,” such as a development team, a foundation, or a front-end operator, in DeFi arrangements where such a party genuinely exists. Compliance teams should map every DeFi integration their firm touches, whether as a liquidity provider, an on-ramp partner, or a front-end host, and treat those exposures as part of the enterprise risk assessment rather than assuming DeFi activity is automatically out of scope.

For firms building compliance around DeFi exposure specifically, the practical approach looks different from custodial exchange monitoring: focus on the points where DeFi activity intersects with a regulated entity (the moment funds enter or exit a DeFi protocol through your platform), rather than trying to monitor the protocol’s internal smart contract logic directly. That intersection point is where your KYC data, your Travel Rule obligations, and your transaction monitoring rules actually have jurisdiction to apply.

Compliance Is Now the Price of Staying in Business

The pattern across this entire regulatory shift is consistent: regulators stopped treating crypto as an experimental sector that deserved patience, and started treating it as a financial services category that deserves the same scrutiny banks have faced for decades. That shift changes the calculus for every founder who used to view AML spending as a cost center to minimize.

Enforcement actions and penalty amounts aren’t abstractions. They translate directly into lost banking relationships, revoked licenses, and, in the worst cases, businesses that simply can’t operate anymore because no partner will touch them. Techgaged has tracked this trend across multiple jurisdictions, from national-level regulatory tightening in China to state-level initiatives in New York targeting private key theft and rug pulls, and the throughline is the same everywhere: regulators are converging on stricter, more specific expectations rather than relaxing them.

What gets underestimated most often isn’t the regulatory text itself, it’s the reputational cost of a public enforcement action. A firm that gets fined can often pay and continue operating. A firm that loses customer trust because its compliance failures became a headline has a much harder road back, regardless of what the balance sheet says.

Primary Sources and Further Reading

Compliance decisions should rest on primary regulatory text, not secondary summaries, including this one. Consult these directly when drafting policy or preparing for examination:

• FATF’s guidance on virtual currency definitions and AML/CFT risk
• The EBA’s amended ML/TF Risk-Factors Guidelines
• Regulation (EU) 2023/1113 on information accompanying transfers of crypto-assets
• FinCEN’s Bank Secrecy Act resources
• The Anti-Money Laundering Act of 2020
• The BIS Bulletin on AML compliance scoring for cryptoassets

For an example of how a crypto-adjacent platform documents its own AML obligations publicly, DROP.SKIN’s published AML policy is worth reviewing as a reference point for policy structure. For ongoing coverage of how these regulations evolve in practice, Techgaged’s news hub tracks regulatory developments, enforcement actions, and market-moving compliance stories as they break.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Sources

• Final Amending Guidelines on ML/TF Risk Factors
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets

FAQ

Is There an AML Certification Specific to Crypto?

Several AML certification programs now include dedicated crypto-asset curriculum tracks alongside traditional banking content, similar in structure to ACAMS-style courses, and completing one builds portable credibility with regulators and examiners.

Can the IRS See Your Crypto Wallet?

Tax authorities can trace crypto transactions tied to identified wallets through exchange reporting requirements and blockchain analytics, particularly once funds move through a KYC-compliant exchange or off-ramp.

Can the FBI Track Crypto?

Federal investigators use blockchain analytics tools to trace transaction flows and, per the IC3’s annual crime report, have documented significant recovery success in cryptocurrency-enabled fraud cases by following on-chain fund movement to identifiable exchanges.

How Do You Check AML Compliance for Crypto?

Verify a crypto business’s AML posture by reviewing its published policy, confirming its registration status with the relevant national regulator, and checking whether it applies KYC, transaction monitoring, and Travel Rule data capture consistently across its products.

Recommended

• EU banking watchdog issues new draft guidelines on crypto risks
• Posts
• Crypto News | TechGaged.com | Read Now
• Alabama man admits participation in 2024 SEC X account hack