Anti-Money Laundering (AML) in Crypto: Compliance Explained

Anti-money laundering (AML) in crypto is the set of laws and controls that make exchanges, custodial wallets and other virtual asset service providers (VASPs) verify their customers, monitor transactions, report suspicious activity and pass sender and recipient details along with transfers. The rules come from national law and, in the EU, from EU regulations, built on standards set by the Financial Action Task Force (FATF), which extended them to virtual assets in 2018 and 2019. Individual users meet AML mostly at the points where crypto touches a regulated service: identity checks when opening an account, questions about where funds came from, and checks on withdrawals to a private wallet.

Crypto AML at a Glance

What Is Anti-Money Laundering (AML)?

Anti-money laundering refers to the laws, regulations and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. AML frameworks compel financial institutions and certain businesses to monitor customer transactions and report suspicious activities to the authorities.

The core objective of AML measures is to detect and deter criminal activities including tax evasion, public corruption, market manipulation, trade in illegal goods and the financing of terrorism. According to the United Nations Office on Drugs and Crime, the estimated amount of money laundered globally in one year is 2-5% of global GDP, roughly $800 billion to $2 trillion.

How Did AML Rules Reach Crypto?

The integration of AML practices into the cryptocurrency ecosystem has evolved significantly since Bitcoin’s launch in 2009. At first, the decentralized and pseudonymous nature of blockchain technology created a regulatory blind spot. As digital assets gained mainstream adoption, regulators extended existing financial rules to cover the new asset class.

Key milestones in the evolution of crypto AML regulations include:

• 2013: FinCEN (the U.S. Financial Crimes Enforcement Network) issued guidance on March 18, 2013, stating that an administrator or exchanger of virtual currency is a money transmitter under its rules

• 2015: New York introduced the BitLicense regulatory framework

• 2018: The FATF updated Recommendation 15 to extend its AML/CFT requirements to virtual assets and virtual asset service providers

• 2019: The FATF Travel Rule was introduced for virtual asset service providers

• 2021: The Infrastructure Investment and Jobs Act introduced expanded reporting requirements for digital assets in the U.S.

• 2023-2024: More countries passed Travel Rule laws and tightened KYC/AML requirements for crypto exchanges

• 2024: The EU’s Transfer of Funds Regulation began to apply on 30 December 2024, bringing the Travel Rule to every crypto transfer handled by a provider in the EU

What Does AML Compliance Involve?

Compliance in the cryptocurrency sphere consists of several interlocking components that work together to detect and prevent illicit financial activity.

Know Your Customer (KYC)

KYC procedures form the foundation of effective AML implementation. They involve verifying the identity of customers and assessing the risks they may pose. For cryptocurrency platforms, KYC typically includes:

• Collection of personal information (name, address, date of birth)

• Verification of identity through government-issued IDs

• Address verification through utility bills or bank statements

• In some cases, source of funds verification for large transactions

KYC is also one of the practical differences between an exchange account and a wallet you control yourself; crypto exchange vs wallet explains the rest.

Transaction Monitoring

Cryptocurrency businesses use analytics tools to monitor the transactions on their platforms. These systems flag potentially suspicious activity based on parameters such as:

• Unusually large transactions

• Frequent small transfers that could indicate “structuring”

• Transactions with high-risk jurisdictions

• Unusual patterns of activity within an account

• Transactions with addresses linked to known illicit activities

Because every transaction on a public blockchain stays visible, analytics firms can follow funds from one address to the next long after a transfer.

Suspicious Activity Reporting (SAR)

When suspicious activity is detected, cryptocurrency businesses must file reports with the appropriate authorities, which helps law enforcement investigate financial crime. According to Chainalysis’ 2024 Crypto Crime Report, illicit addresses sent $22.2 billion worth of cryptocurrency to services in 2023, down from $31.5 billion in 2022, and centralized exchanges remained the primary destination for those funds.

Risk-Based Approach

Modern AML frameworks emphasize a risk-based approach, where the intensity of due diligence matches the level of risk associated with particular customers or transactions. High-risk scenarios that trigger enhanced due diligence include:

• Transactions involving politically exposed persons (PEPs)

• Business relationships with entities in countries identified as having weak AML controls

• Unusual transaction patterns or volumes

• Transactions involving privacy coins or mixing services

Why Does AML Matter for Individual Crypto Users?

Even if you’re not running a cryptocurrency business, AML requirements affect you. Your transactions may be monitored, your access to services may depend on completing KYC, and coins with a suspicious history can lead to frozen accounts or lengthy questions. In the worst cases, innocent users whose transactions look suspicious face significant inconvenience or even legal scrutiny.

What Is the FATF Travel Rule?

One of the most significant developments in cryptocurrency AML regulation is the Financial Action Task Force’s “Travel Rule.” Introduced in 2019, it requires virtual asset service providers to share customer information when transferring funds between institutions. Similar to requirements that have long existed in banking, the Travel Rule says the following information must “travel” with the transaction:

• Name of the originator

• Account number or wallet address of the originator

• Physical address, national identity number, or date and place of birth of the originator

• Name of the beneficiary

• Account number or wallet address of the beneficiary

The implementation of the Travel Rule has posed significant technological and operational challenges for cryptocurrency businesses and spurred a range of compliance solutions. These aim to share the required information securely without exposing more user data than necessary.

The FATF tracks how countries put the rule into practice. In its July 2026 targeted update, 91 of the 109 jurisdictions that answered its survey (83%) had passed Travel Rule legislation, up from 73% a year earlier, but experience in supervising and enforcing the rule was still limited.

How the EU Applies the Travel Rule

The EU wrote the rule into Regulation (EU) 2023/1113, which has applied since 30 December 2024. A crypto-asset service provider must send the originator’s name, distributed ledger address and account number, and their address, official document number and customer number or date and place of birth, plus the beneficiary’s name and distributed ledger address. Unlike bank transfers, crypto transfers get no small-amount exemption: the regulation applies the same requirements regardless of the amount. For a transfer of more than €1,000 to or from a self-hosted address, the provider must also assess whether that address is owned or controlled by its own customer, which is why some exchanges ask you to prove that a withdrawal address is yours.

What Makes Crypto Hard to Monitor?

DeFi and Regulatory Coverage

Decentralized finance (DeFi) platforms present unique regulatory challenges. Unlike centralized exchanges, many DeFi protocols operate without a central controlling entity, which raises the question of who is responsible for AML controls. Tools such as atomic swaps let two people trade coins across blockchains with no intermediary at all. Regulators worldwide are working out how to extend AML requirements to these systems without stifling innovation.

Privacy Coins and Anonymizing Technologies

Privacy-focused cryptocurrencies like Monero, Zcash and Dash, as well as mixing services and tumblers, present significant challenges for AML compliance. These technologies are designed to obscure transaction details, making it difficult to trace the flow of funds. As a result, many regulated exchanges have delisted privacy coins or restricted their use.

Cross-Border Nature of Transactions

The global nature of cryptocurrency transactions creates jurisdictional complexities. Countries take different approaches to cryptocurrency regulation, which creates opportunities for regulatory arbitrage. Efforts to harmonize international standards, such as those led by the FATF, aim to close these gaps, but significant disparities remain.

“Implementation progress remains incomplete, uneven and inconsistent. This creates opportunities for regulatory arbitrage…”

— Arthur Yuen, Hong Kong Monetary Authority, on the Financial Stability Board’s October 2025 peer review of its crypto framework

Best Practices for Individual Users

Even individual cryptocurrency users should be aware of AML considerations to protect themselves and keep their transactions running smoothly. Here are some best practices:

Keep Detailed Records

Keep records of your cryptocurrency transactions, including dates, amounts, counterparties and purposes. This documentation is invaluable if you ever need to show that your activities are legitimate.

Choose Compliant Platforms

Use exchanges, peer-to-peer marketplaces and wallet services that implement proper AML measures. While this may require providing more personal information, it reduces your risk of unwittingly using platforms that facilitate illicit activity.

Be Cautious with Privacy Tools

Using privacy coins, mixers or tumblers may trigger additional scrutiny. Privacy tools aren’t inherently illegal everywhere, but their use can complicate your dealings with regulated entities.

Stay Informed About Regulations

Monitor regulatory developments in your jurisdiction. Compliance requirements can change quickly, and staying informed helps you adapt.

What Is Changing in Crypto Compliance?

The landscape of cryptocurrency AML regulation keeps evolving. Several trends are shaping compliance:

Integration of Blockchain Analytics

Blockchain analytics tools are becoming more sophisticated, tracking funds across multiple blockchains and through conversion attempts. They help identify patterns associated with money laundering and other financial crimes, even when perpetrators try to hide their activity.

Regulatory Focus on DeFi

Regulators are turning their attention to decentralized finance platforms. While the approach varies by jurisdiction, there is a growing consensus that DeFi protocols should not remain outside the regulatory perimeter. This is likely to drive “decentralized compliance” solutions that preserve the core attributes of DeFi while addressing AML concerns.

Global Harmonization Efforts

International bodies like the FATF continue to work toward greater global consistency in cryptocurrency regulation. As more countries implement the FATF’s recommendations, AML standards should become more uniform, reducing opportunities for regulatory arbitrage.

Privacy-Preserving Compliance Technologies

Emerging technologies like zero-knowledge proofs could satisfy regulatory requirements while preserving user privacy, for example by proving that a user passed a check without exposing all of their personal data.

How Do the Rules Affect Self-Custody Users?

For users of self-custody solutions, including those who secure their assets with seed phrases and hardware wallets, AML brings both challenges and opportunities. When you hold your own private keys, you gain independence but also take on more responsibility for compliance. The trade-off between the two models is covered in custodial vs non-custodial wallets.

Key considerations for self-custody users include:

• On/off ramp interactions: When you move assets between self-custody wallets and centralized exchanges or fiat gateways, you’ll encounter AML procedures. Clear records make these transitions smoother.

• Address whitelisting: Some platforms require you to pre-register withdrawal addresses, which adds security but also friction.

• Transaction history transparency: Blockchain analytics can trace the history of assets held in self-custody. Coins with a questionable history may face restrictions when you move them to regulated platforms.

• Travel Rule implications: As the Travel Rule spreads, transfers between self-custody wallets and regulated services face more checks, such as proving that a withdrawal address belongs to you.

AML rules are part of what lets regulated institutions treat crypto as a legitimate asset class, even though they sit uneasily with the original vision of a frictionless, private financial system. For individual users, choosing compliant platforms, keeping good records and following regulatory changes is usually enough to avoid trouble. More on trading and regulation is in our crypto markets guides.

Frequently Asked Questions

Do I need to pass KYC to use a self-custody wallet?

No. Wallet software that only stores your keys doesn’t verify anyone. KYC applies when you use a service that holds or exchanges crypto for you, such as an exchange or a broker, including when you send coins from your own wallet to it.

Why did my exchange ask where my crypto came from?

Source-of-funds questions are part of the risk-based approach: large deposits, unusual patterns or coins that analytics link to risky services trigger enhanced due diligence. Answering with records of where you bought the coins is usually enough.

Does the Travel Rule apply to withdrawals to my own wallet?

The provider still records who is sending and receiving, usually from your own account details. In the EU, for withdrawals of more than €1,000 to a self-hosted address, the provider must also assess whether the address belongs to you.