Crypto AML

Crypto AML is the set of controls, policies, and tools that virtual asset businesses use to detect and prevent money laundering through blockchain transactions. It encompasses KYC/CDD at onboarding, ongoing transaction monitoring, sanctions screening, and SAR filing. It matters because FATF Recommendation 15 requires VASPs to apply AML controls equivalent to traditional financial institutions — and regulators in the EU (MiCA/TFR), US (FinCEN/BSA), and UK (FCA) all have active enforcement frameworks.

Beyond legal compliance, effective crypto AML protects organisations from processing criminal proceeds — which creates asset freeze risk, reputational damage, and in serious cases, secondary liability exposure. FATF mutual evaluations in 2023–2024 found over 60% of assessed VASPs had inadequate controls, with transaction monitoring gaps cited most frequently.

A complete crypto AML programme includes: (1) Customer Due Diligence (KYC) — verifying identity at onboarding and applying EDD for high-risk users; (2) ongoing transaction monitoring — screening wallet addresses at every deposit and withdrawal using blockchain analytics; (3) sanctions screening — checking users and counterparty wallets against OFAC SDN and equivalent lists; (4) Travel Rule compliance — collecting and transmitting originator/beneficiary data above jurisdiction thresholds; (5) SAR/STR filing — reporting suspicious activity to the relevant FIU; and (6) record-keeping — maintaining documentation for the required retention period.

The FATF Travel Rule (Recommendation 16) requires VASPs to collect and transmit originator and beneficiary identity data with virtual asset transfers above a threshold — typically USD/EUR 1,000, with no threshold under the EU's Transfer of Funds Regulation. This mirrors the wire transfer requirement applied to banks. The practical challenge is that crypto lacks SWIFT-style messaging infrastructure, so specialised Travel Rule solutions (Notabene, Sygna, Verifyvasp) have emerged to handle VASP-to-VASP data exchange. Travel Rule compliance is a parallel obligation to transaction monitoring — passing identity data does not discharge the duty to screen funds for illicit exposure.

A SAR is required when you know, suspect, or have reasonable grounds to suspect that a transaction involves proceeds of crime or terrorist financing. In practice this covers: direct exposure to OFAC-sanctioned wallets, near-direct interaction with darknet markets or ransomware operators, structuring behaviour (multiple transactions below reporting thresholds designed in aggregate to move a larger amount), and customers whose on-chain activity is inconsistent with their stated source of funds.

Critically: once you have filed or are filing a SAR, you must not tip off the subject. Telling a customer their account was blocked due to a SAR is prohibited in most jurisdictions and can constitute an offence. You can tell users their account is restricted for compliance reasons without disclosing the SAR itself.

This is one of the most actively contested questions in crypto regulation. Truly decentralised protocols without a central operator are not yet clearly classified as VASPs under FATF guidance in most jurisdictions. However, the regulatory perimeter is moving. Frontend operators, deployer teams, governance multisig holders, and entities receiving fees from a protocol increasingly face scrutiny and potential VASP classification.

Many DeFi protocols have adopted voluntary wallet screening at the frontend level — blocking connections from sanctioned addresses and high-risk wallets — as a practical risk management measure, even without explicit legal obligation. The EU's MiCA regulation and FATF's evolving guidance both push toward broader coverage of DeFi participants over time.

The obligations are structurally similar — KYC, transaction monitoring, SAR filing, record-keeping — but the technical tools and data sources differ fundamentally. Traditional AML monitors counterparty bank account names and transaction narratives; crypto AML monitors blockchain address graphs and on-chain fund flows.

Crypto AML offers a genuine advantage traditional finance lacks: the complete transaction history of every wallet address is permanently and publicly visible on-chain. Unlike bank records (which require court orders or regulatory requests to access), blockchain data is open — meaning analytics tools can trace fund flows across years of history in seconds. This transparency is why FATF considers well-implemented crypto AML potentially more effective than traditional financial monitoring when properly deployed.

Match the tool to your primary chain exposure, transaction volume, and integration requirements. Chainalysis KYT is the market leader for large exchanges needing forensic quality and regulatory defensibility — it has the broadest entity database and the strongest track record in law enforcement contexts. Elliptic Navigator has stronger DeFi and cross-chain coverage. TRM Labs covers 30+ chains at competitive pricing, making it well-suited for mid-market VASPs with diverse asset mixes. Crystal Blockchain is strong for Bitcoin-focused European VASPs.

Before committing, run a test batch of addresses with known risk profiles through shortlisted vendors and compare the category breakdowns — not just the headline scores. Vendors who publish detailed methodology documentation tend to produce more defensible outputs in regulatory examinations.

Real-time at every transaction for regulated VASPs processing significant volume — screening at every deposit and withdrawal via API. This is the FATF Recommendation 15 standard for ongoing monitoring. Onboarding-only screening misses all post-signup activity and does not satisfy the ongoing monitoring obligation.

For existing user wallets: periodic batch re-screening at least quarterly for standard-risk users, more frequently for high-value accounts. Analytics databases are updated continuously — a previously-clean address can be re-attributed to a newly-identified illicit cluster without any new on-chain activity from the user. Documenting each re-screening run demonstrates the ongoing monitoring programme required by regulators.

Yes — false positives are inherent to probabilistic heuristic clustering. Common scenarios: CoinJoin users whose privacy technique resembles mixer activity; users withdrawing from large exchange hot wallets shared across thousands of customers; and addresses in clusters recently re-attributed to newly-identified illicit entities without any change to the user's own on-chain activity.

Managing false positives well is a marker of a mature crypto AML programme. Build a documented dispute resolution process with a clear SLA (typically 5 business days for review with evidence). Track the false positive rate quarterly — above 10–15% of blocked accounts being cleared after review signals miscalibrated thresholds, not insufficient blocking. Adjust the category-response matrix accordingly.