Meet Dr. Marcus Hartmann
Dr. Marcus Hartmann has spent over two decades at the intersection of financial law and emerging technology. Based in Zug — Switzerland's Crypto Valley — he has guided startups, trading platforms, and institutional investors through the full spectrum of VASP licensing: from FINMA FinTech notifications to MiCA CASP applications and offshore structuring across 60+ jurisdictions.
He joined CryptoLicenses.net as Senior Licensing Advisor after a decade leading the fintech practice of a Swiss-regulated law firm, where he managed regulatory mandates in the UAE, Singapore, Liechtenstein, and the Cayman Islands.
- AML (Anti-Money Laundering) refers to the full system of controls to prevent, detect, and report money laundering activity
- KYC (Know Your Customer) is the identity verification component of AML — confirming who your customers are before they transact
- AML/KYC compliance is mandatory for all Virtual Asset Service Providers (VASPs) globally under FATF Recommendation 15
- Key legal instruments: FATF R.15, EU 6th AMLD, US Bank Secrecy Act, UK Money Laundering Regulations 2017, UAE Cabinet Decision 111/2022
- Non-compliance penalties reach into the billions — Binance paid $4.3B in 2023, the largest financial crime settlement in history
- Regulators are increasingly sophisticated: blockchain analytics, cross-border data sharing, and AI monitoring mean evasion is harder than ever
What Are AML and KYC?
Anti-Money Laundering (AML) is the broad framework of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. For a crypto business, AML encompasses everything from how you assess customer risk to how you monitor transactions, screen against sanctions lists, and report suspicious activity to financial intelligence units.
Know Your Customer (KYC) is the identity verification process within that framework. Before onboarding a customer — or at defined transaction thresholds — you must collect and verify information that proves who they actually are. This typically means government-issued ID, proof of address, and in many cases a selfie or liveness check for biometric matching.
The Key Distinction
KYC answers the question: "Who is this person?" AML answers the question: "What are they doing with their money, and does it look suspicious?" KYC is the gatekeeper at onboarding. AML is the ongoing surveillance that continues throughout the relationship.
In practice, the two are inseparable. Without solid KYC, your AML transaction monitoring is worthless — you cannot assess whether a transaction is suspicious if you do not know who is conducting it. And strong KYC alone is insufficient if you have no mechanism to detect patterns of suspicious behaviour after onboarding.
How This Applies to Crypto
Crypto introduces complications that traditional finance does not face: pseudonymous on-chain activity, instant cross-border transfers, decentralised protocols, and the technical ability to obfuscate transaction trails using mixers or privacy coins. Regulators have responded by extending AML obligations — originally designed for banks — to any entity that exchanges, transfers, or custodies virtual assets professionally. This includes exchanges, OTC desks, custodians, crypto brokers, and increasingly DeFi protocol operators where a service provider is identifiable.
The Global Legal Framework
AML obligations for crypto businesses flow from an interlocking set of international standards and national laws. Understanding which instruments apply to your specific jurisdiction and business model is the first step in building a compliant program.
| Instrument | Jurisdiction | Key Requirements for VASPs | Effective / Updated |
|---|---|---|---|
| FATF Recommendation 15 | Global (40+ countries) | VASPs must be licensed/registered; apply AML/CFT measures equivalent to financial institutions; implement Travel Rule for transfers ≥$1,000 | 2012 / Updated 2019 |
| EU 6th Anti-Money Laundering Directive (6AMLD) | EU / EEA (27+ states) | Harmonised list of 22 predicate offences; expanded criminal liability including corporate entities; minimum 4-year imprisonment for ML offences | Transposed by June 2021 |
| EU MiCA + AMLR (2024) | EU / EEA | CASPs subject to full AML/CFT obligations; EU Single AML Rulebook; new AMLA supervisory authority from 2025 | 2024–2027 (phased) |
| US Bank Secrecy Act (BSA) | United States | Crypto exchanges are MSBs; must register with FinCEN; file SARs (Suspicious Activity Reports) and CTRs (Currency Transaction Reports); implement CIP (Customer Identification Program) | 1970 / Crypto guidance 2013+ |
| UK Money Laundering Regulations 2017 (MLR 2017) | United Kingdom | Crypto businesses must register with FCA; apply CDD; maintain records for 5 years; report to National Crime Agency (NCA) | 2017 / Amended 2019, 2022 |
| UAE Cabinet Decision 111/2022 | UAE (including DIFC/ADGM) | VASPs licensed under VARA/FSRA must implement AML/CFT programs; report to UAE Financial Intelligence Unit (FIU); comply with FATF Travel Rule | 2022 |
FATF Travel Rule: Under FATF Recommendation 16 (the "Travel Rule"), VASPs must collect and transmit originator and beneficiary information for any virtual asset transfer of $1,000 / €1,000 or more. This applies regardless of whether the receiving entity is another VASP or an unhosted (self-custody) wallet. Implementation varies by jurisdiction — the EU's Transfer of Funds Regulation (TFR) applies from 2024 with specific requirements for unhosted wallet transfers.
"AML compliance in crypto is not a checkbox exercise — it is an operational discipline. The exchanges that have survived regulatory scrutiny in 2026 are the ones that built their compliance programs before they needed them, not after an enforcement notice arrived. Every VASP I have advised that treated AML as a core competency from day one has had a fundamentally different relationship with its regulator than those who retrofitted compliance onto an existing operation."
— Dr. Marcus Hartmann, Senior Licensing Advisor
KYC Requirements for Crypto — Three-Tier Verification
Most crypto compliance frameworks use a risk-based, tiered approach to KYC. Higher transaction volumes and higher-risk customer profiles trigger more intensive verification. The following structure reflects best practice under EU/FATF guidance as of 2026.
The lowest verification tier, used for low-value or exploratory access. Customers provide an email address and phone number. Identity is not formally verified against a government document. Transaction and withdrawal limits are strict — typically €1,000 per day or €2,000 per month aggregate across the platform.
Tier 1 is appropriate for users who want to explore the platform or make small transactions, but regulators are increasingly scrutinising whether this tier creates a loophole. Under EU's revised AMLD framework, even basic access may require an identity declaration. Review your jurisdiction's specific rules before implementing a Tier 1 regime.
The standard tier for retail customers. Customers must provide a government-issued photo ID (passport, national ID card, or driving licence) and a selfie or liveness check for biometric comparison. Address verification is required — typically a utility bill or bank statement dated within 3 months.
The identity check must be completed by an automated identity verification (IDV) provider in real time, or manually reviewed within defined SLAs. The system must check the document's authenticity (NFC chip reading or document forensics), compare the selfie to the ID photo, and screen the name against sanctions lists (OFAC, UN, EU) and Politically Exposed Person (PEP) databases before approval.
Source of funds enquiry is triggered for transactions approaching the upper tier limit (typically €10,000+), even within Tier 2.
Enhanced Due Diligence (EDD) is required for high-volume customers, high-risk profiles, or customers from high-risk jurisdictions. In addition to Tier 2 documents, EDD requires: proof of source of wealth (not just source of funds — where did the overall wealth come from?), a detailed business relationship questionnaire, enhanced ongoing monitoring with lower alert thresholds, and senior management approval for onboarding.
For corporate customers at Tier 3, the process extends to full beneficial ownership verification (all UBOs with ≥25% ownership or effective control), corporate structure diagrams, certificate of incorporation, articles of association, evidence of business activity, and KYC packages for each director and UBO individually.
EDD relationships must be reviewed at least annually, or more frequently if risk indicators change. EDD customers should be flagged in your monitoring system for manual review of flagged transactions, regardless of alert thresholds.
AML Program Components — Five Pillars
A compliant AML program is more than a KYC checklist. Regulators expect a documented, operational program covering five core pillars. Missing any one of these pillars will result in findings during an AML audit or regulatory examination.
Enhanced Due Diligence — When EDD is Required
Enhanced Due Diligence is the highest level of customer scrutiny, required when a customer or transaction presents elevated money laundering or terrorist financing risk. The following situations automatically trigger EDD obligations under FATF guidance and most national implementations.
Politically Exposed Persons (PEPs)
A PEP is any individual who holds or has held a prominent public function — heads of state, senior government officials, senior executives of state-owned enterprises, senior military officers, senior judiciary, and their family members and close associates. PEPs are not automatically prohibited as customers, but they carry elevated corruption risk by virtue of their position. EDD is mandatory for all PEPs: enhanced source of wealth verification, senior management sign-off at onboarding, and enhanced ongoing monitoring. Foreign PEPs (from outside your jurisdiction) are treated as higher risk than domestic PEPs in most frameworks.
High-Risk Countries
FATF publishes two lists relevant to EDD triggers: the "black list" (High-Risk Jurisdictions Subject to a Call for Action — currently North Korea, Iran, Myanmar) and the "grey list" (Jurisdictions Under Increased Monitoring). Customers resident in, or transactions involving, listed countries trigger EDD. The EU maintains its own high-risk third-country list which may differ from FATF. For US-regulated entities, OFAC country-based sanctions add additional restrictions beyond EDD.
Large or Unusual Transactions
Transactions that are materially inconsistent with a customer's established profile — a sudden large deposit from a new source, an unusual counterparty jurisdiction, a transaction structure with no apparent economic rationale — trigger enhanced review. "Large" thresholds vary by jurisdiction but FATF guidance identifies $15,000 as a typical cash transaction reporting threshold; crypto platforms often apply lower thresholds given the speed and scale of digital asset movement.
Correspondent Relationships
When your platform has a business-to-business relationship with another VASP (e.g., acting as a liquidity provider, aggregator, or white-label partner), this is treated as a correspondent relationship. EDD must be applied to the counterpart VASP: assess their AML program, obtain senior management approval for the relationship, and document ongoing oversight. Shell VASP relationships — entities with no real regulatory oversight or compliance substance — must be refused.
MLRO Responsibility: The Money Laundering Reporting Officer (MLRO) — or equivalent Chief Compliance Officer — bears personal legal responsibility for the adequacy of the AML program. In many jurisdictions, the MLRO can be criminally prosecuted if the firm fails to implement required AML measures. This person must be a named, senior individual with direct board access, not a nominal appointment.
Crypto-Specific AML Challenges
Crypto introduces compliance challenges that have no direct equivalent in traditional finance. Understanding these challenges — and the regulatory and technological responses to them — is essential for building an AML program that actually works.
Pseudonymity
Blockchain addresses are pseudonymous, not anonymous. A Bitcoin address reveals all associated transactions but not the identity of the owner — unless the owner interacts with a regulated VASP that has completed KYC. The compliance approach: rigorously link on-chain activity to off-chain identity at every deposit and withdrawal. Use blockchain analytics to trace transaction history both upstream (where did the funds originate?) and downstream (where did the funds go after leaving your platform?). A wallet with direct exposure to a dark market or sanctions entity — even several hops removed — requires investigation and likely SAR filing.
DeFi and Non-Custodial Protocols
Decentralised finance protocols pose fundamental compliance challenges: there is often no identifiable service provider, no KYC capability, and no central point of control. The regulatory trend is toward front-end regulation: if your entity operates the UI, manages smart contract upgrades, collects fees, or has governance control, you may be treated as a VASP. The EU's MiCA framework explicitly carves out "fully decentralised" protocols but applies full obligations to partially centralised DeFi. Monitor ESMA and national regulator guidance closely — the definition of "decentralised" is actively contested.
Mixers and Tumblers
Cryptocurrency mixers (also called tumblers) are services that pool and re-distribute cryptocurrency to obscure transaction trails. Using funds that have passed through a known mixer is a major red flag. OFAC sanctioned Tornado Cash in 2022, making it illegal for US persons to interact with it. Most blockchain analytics platforms can detect mixer exposure. Any customer depositing funds with recent mixer exposure must be investigated and the relationship reviewed. Accepting funds with high mixer exposure without investigation is a regulatory violation.
Privacy Coins
Privacy coins (Monero, Zcash in shielded mode, Dash via PrivateSend) use cryptographic techniques to hide transaction amounts and addresses. Transacting in privacy coins creates audit trail gaps that regulators consider inherently high-risk. Several jurisdictions — including Japan, South Korea, and Australia — have effectively banned privacy coin trading on licensed exchanges. EU MiCA guidance suggests privacy coins present significant AML challenges. If you support privacy coins, document your risk rationale carefully and implement compensating controls.
Cross-Chain Transactions
Cross-chain bridges and atomic swaps allow assets to move across blockchains, potentially breaking the analytics trail. A transaction might originate on Ethereum, bridge to a Layer 2, bridge again to Solana, and arrive at your platform — with each bridge potentially obscuring the original source. The compliance approach: require source of funds documentation for large cross-chain deposits, use multi-chain analytics tools, and apply enhanced scrutiny to funds arriving from chains or bridges with known high-risk exposure.
Not sure which licence fits your business? Get a free 30-minute consultation with our advisors. We'll review your model and recommend the right jurisdiction.
Get Free Consultation →AML Technology & Tools
No manual compliance program can adequately monitor the volume and velocity of crypto transactions. Effective AML compliance requires purpose-built technology across three functional areas: blockchain analytics, transaction monitoring, and identity verification.
"The enforcement cases of the last three years share a common thread: regulators found not a lack of compliance rules, but a lack of compliance culture. Binance had policies on paper. What it lacked was leadership commitment to actually implement them. In 2026, the most important AML question regulators ask is not 'do you have a policy?' — it is 'can you demonstrate it is actually working?'"
— Dr. Marcus Hartmann, Senior Licensing Advisor
Major Enforcement Cases — Lessons Learned
The most effective argument for investing in AML compliance is the cost of non-compliance. The following cases illustrate the scale of regulatory consequences — and the specific failures that led to them.