AML/KYC for Crypto-Asset Service Providers

Anti-money laundering (AML) and know-your-customer (KYC) requirements for crypto-asset service providers form the compliance backbone of the global effort to prevent the use of crypto markets for financial crime. These requirements flow primarily from the Financial Action Task Force (FATF) standards, which most jurisdictions have transposed into national law. For tokenised assets, AML/KYC requirements are among the most concrete and immediately operative compliance obligations — they cannot be deferred pending resolution of securities law questions or token classification uncertainty.

FATF Recommendation 15 and the VASP Definition

The foundation is FATF Recommendation 15, amended in 2019 to explicitly extend AML/CFT obligations to virtual asset service providers (VASPs). FATF defines a VASP as any natural or legal person that conducts, as a business, one or more of: exchange between virtual assets and fiat currencies; exchange between different virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or instruments enabling control over virtual assets; participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset. This definition is broad enough to capture exchanges, custodians, wallet services, and token issuers operating exchange-like functions.

Countries are expected to require VASPs to be licensed or registered, to conduct customer due diligence, to apply enhanced due diligence to higher-risk customers, to monitor transactions, and to report suspicious transactions to national Financial Intelligence Units (FIUs).

Customer Due Diligence

Standard customer due diligence (CDD) for VASPs requires: verification of customer identity using reliable independent documents (government-issued ID); identification of beneficial owners for corporate customers (typically persons owning more than 25% of voting rights or economic interest); understanding the nature and purpose of the customer relationship; and ongoing monitoring of transactions to ensure consistency with the customer’s stated profile. For crypto exchanges and custodians, this translates to onboarding verification requirements before account activation, with ongoing monitoring of deposit and withdrawal patterns.

Enhanced Due Diligence

Enhanced due diligence (EDD) is required for higher-risk customer categories. Politically Exposed Persons (PEPs) — current or former senior public officials and their family members and close associates — require EDD because of their elevated risk of corruption and bribery. Customers from high-risk jurisdictions (FATF’s grey list and black list countries) trigger EDD. Customers with unusual transaction patterns — large cash-equivalent deposits, rapid cycling between multiple assets, patterns inconsistent with stated purpose — may require EDD regardless of their formal risk category. EDD involves more intensive identity verification, source-of-funds documentation, and senior management approval for the business relationship.

Suspicious Transaction Reporting

VASPs are required to file Suspicious Transaction Reports (STRs) or Suspicious Activity Reports (SARs, in the US) with national FIUs when they identify transactions suspected of being related to money laundering, terrorist financing, or other financial crime. The “tipping off” prohibition means that VASPs cannot inform the customer that a report has been filed. In practice, crypto exchange compliance teams use rule-based and machine learning-based transaction monitoring systems to identify STR candidates.

The DeFi AML Challenge

DeFi protocols present the most serious structural challenge to the FATF AML framework. Where there is no identifiable VASP — no legal entity operating the service — there is no obligated party to perform CDD or file STRs. FATF’s 2021 and 2023 guidance acknowledged this challenge, distinguishing between DeFi protocols (potentially outside the VASP definition if truly decentralised) and DeFi platforms with controlling parties (which should be treated as VASPs). Front-end operators, fiat on-ramp providers, and governance token holders with meaningful control have all been proposed as potential obligated parties, but the legal framework for imposing AML obligations on DeFi participants remains immature.

Blockchain Analytics as Compliance Infrastructure

The practical implementation of AML/KYC in crypto relies heavily on blockchain analytics tools. Companies including Chainalysis, Elliptic, and TRM Labs provide transaction monitoring services that trace the on-chain provenance of crypto assets, identifying flows associated with darknet markets, ransomware, sanctions-designated addresses, and other illicit sources. VASPs use these tools to screen incoming deposits, monitor ongoing transaction patterns, and respond to law enforcement information requests. The effectiveness of these tools depends on the pseudonymous (not anonymous) nature of public blockchain transaction records — analytics is possible because all transactions are publicly visible, even if wallet addresses are not directly tied to identities.