AML/KYC Services — Full Scope
AML/KYC compliance for crypto and fintech businesses is materially different from compliance for traditional financial institutions. The risk typologies (peer-to-peer transactions, mixer usage, cross-chain bridges, DeFi exposure), the tools required (blockchain analytics rather than just name screening), and the specific regulatory requirements (Travel Rule, VASP-specific FATF guidance) require specialist expertise that general compliance consultants typically do not have.
Our AML/KYC team has designed compliance frameworks for exchanges, custodians, payment processors, crypto lending platforms, DeFi-adjacent businesses, and EMIs. We understand what regulators in the EU, UK, Switzerland, Estonia, Lithuania, and offshore jurisdictions actually look for when they review an AML programme — not just what the forms ask for.
FATF, EU AMLD & VASP-Specific Requirements
The global AML/CTF framework for VASPs is built on FATF's 40 Recommendations, updated in 2018 and 2021 to specifically address virtual assets. FATF Recommendation 15 (New Technologies) requires member jurisdictions to regulate VASPs. FATF Recommendation 16 (Travel Rule) extends the traditional wire transfer rule to virtual asset transfers.
In the EU, the 5th and 6th Anti-Money Laundering Directives (AMLD5/6) brought VASPs within the AML framework from 2020, requiring registration or authorisation, CDD, ongoing monitoring, and STR reporting. MiCA (2024) adds market integrity and consumer protection requirements on top of the existing AMLD framework.
In the US, FinCEN's BSA (Bank Secrecy Act) treats VASPs as money service businesses (MSBs), requiring registration, SAR filing, and CTR reporting. State money transmission licences (MTLs) add a further layer of compliance in jurisdictions like New York (BitLicense) and others.
| Framework | Jurisdiction | Key Requirements for VASPs |
|---|---|---|
| FATF 40 Recommendations | Global (40 member jurisdictions) | VASP registration, CDD, Travel Rule (R.16), risk assessment |
| EU AMLD5/6 | EU / EEA | VASP registration/authorisation, CDD/EDD, STR, record keeping |
| MiCA (2024) | EU / EEA | CASP authorisation, asset reserve, consumer protection, market abuse |
| FinCEN BSA | USA | MSB registration, SAR, CTR, CIP, OFAC screening |
| FCA AML Rules | UK | VASP registration, UK MLRs, ongoing monitoring, SAR reporting |
| FINMA AML Act | Switzerland | SRO membership, CDD, reporting, Travel Rule |
Blockchain Analytics — Chainalysis, Elliptic, TRM Labs
For crypto VASPs, standard name-screening and transaction monitoring tools used by traditional banks are insufficient. You need blockchain analytics tools that can trace transaction flows across wallets, identify exposure to high-risk entities (mixers, darknet markets, sanctioned addresses), and assess the risk profile of counterparty wallets.
Chainalysis KYT (Know Your Transaction) is the industry-leading blockchain analytics platform for compliance teams. KYT provides real-time transaction monitoring, exposure scoring, and alerts for thousands of risk categories. Reactor provides investigative analysis for compliance escalations. Widely used by regulated exchanges and accepted by most major regulators.
Elliptic Lens and Navigator provide wallet screening (Lens) and cross-asset transaction monitoring (Navigator). Elliptic is particularly strong for DeFi exposure analysis and cross-chain tracking. Often used as a complement to Chainalysis for comprehensive coverage.
TRM Labs offers blockchain intelligence with a focus on forensic investigation and regulatory reporting. Preferred by some law enforcement-adjacent compliance teams and jurisdictions with strong US regulatory connections.
Travel Rule — FATF Recommendation 16: All VASPs transferring virtual assets above USD/EUR 1,000 must collect originator name, account number/wallet address, and physical address; plus beneficiary name and account number/wallet address — and transmit this data to the receiving VASP. Travel Rule is now enforced in the EU (TFR Regulation), UK, Switzerland, Singapore, UAE, Canada, and dozens of other jurisdictions. Our team implements compliant Travel Rule solutions using leading vendors.
What Non-Compliance Actually Costs
AML/KYC compliance is not optional for licensed crypto businesses — and the cost of getting it wrong is severe. Regulators globally have demonstrated willingness to impose substantial penalties on crypto businesses with inadequate AML programmes.
Notable enforcement actions: Binance's 2023 settlement with FinCEN, OFAC, and DOJ resulted in $4.3 billion in fines and criminal guilty pleas. BitMEX was fined $100 million by the CFTC. Poloniex paid $7.6 million to OFAC. Kraken paid $30 million to the SEC. Multiple EU-based VASPs have had licences revoked for AML failures.
Beyond fines, AML failures result in banking relationships termination, licence revocation, reputational damage, and potential criminal liability for directors and MLRO. The cost of a robust AML programme — €5,000–€20,000 for setup, €1,500–€3,000/month for MLRO — is a fraction of the cost of enforcement action.