AML for crypto: a guide to money laundering risks and checks

An Indian crypto exchange spotted a pattern. Some customers did one thing only: each funded the account with USDT from a payment provider based in Southeast Asia, sold it at once and withdrew rupees to a bank account. Their IP addresses traced to Southeast Asia. Phones went unanswered, and several customers logged in from the same device. The exchange reached 21 of them, and FIU India found people working in scam centers who sent their pay home through that provider. It placed 241 user locations in and around scam compounds in Cambodia and acted against the provider in October 2025. The FATF published the case in its report on stablecoins and unhosted wallets on 3 March 2026. The exchange caught one of the money laundering typologies that now run through stablecoins, from its own trade, login and device data.

Which crypto firms carry anti money laundering duties, and what do they come down to?

Any business that exchanges, transfers or holds crypto for customers carries anti money laundering (AML) duties. In FATF terms it is a virtual asset service provider (VASP).

The EU calls it a crypto asset service provider under MiCA.

The US generally treats it as a money transmitter that registers with FinCEN.

AML compliance comes down to four duties. Hold a license or registration where you operate. Know the customer through KYC and customer due diligence (CDD), with enhanced due diligence (EDD) for a PEP or a high risk profile. Send customer data with each transfer under the travel rule. Then monitor, screen and report.

AML is important for crypto businesses because the banks and payment partners they depend on review those duties, and regulators suspend registrations over them. The regulatory framework differs by country: FinCEN registration in the US, MiCA and the transfer of funds regulation in the EU, MLR registration in the UK.

Two changes are dated. In the EU, the AMLR applies from 10 July 2027. In the UK, the FCA regime is expected to start on 25 October 2027.

The four duties meet in one customer file, where a clean name can still deposit from a wallet with sanctions exposure. complead, formerly Sanction Scanner, builds its AML for crypto firms on that point: sanctions, wallet and name screening run on one engine.

What changed for crypto AML in 2026?

• 3 March. FATF's stablecoin report adds case studies and risk indicators.
• 23 June. FinCEN proposes extending its October 2025 Huione Group rule to a Cambodian payment firm.
• 21 July. A FATF report on decentralized finance (DeFi) sets recommendations for VASPs that deal with DeFi.
• 3 September. FinCEN issues a scam center alert and a trend analysis of 33,904 BSA reports on suspected crypto investment scams: about $12.7 billion, September 2023 to December 2025.
• 30 October. The FATF plenary takes Monaco, the Democratic Republic of the Congo, Bulgaria and Côte d'Ivoire off increased monitoring; its call for countermeasures on Iran names VASPs.
• 6 November. FinCEN orders US institutions to stop transfers involving MEXC Global, effective 30 days after Federal Register publication.
• 6 November. FinCEN and the Federal Reserve withdraw the proposal to lower the travel rule threshold for transfers that begin or end abroad; $3,000 stays.

How is cryptocurrency used for money laundering, stage by stage?

Criminals and professional launderers use cryptocurrency for money laundering in the same three stages as cash. Placement moves criminal money into crypto through an exchange account, a kiosk or a peer to peer seller. Layering moves it across wallets, chains and tokens. Integration is the cash out, through an OTC broker, an exchange or a business account.

Table 1. Six crypto laundering methods, the signals they leave and the check that catches each (as of November 2026)

FATF's case study from Canada shows the whole path. A crime network bought ether at a regulated exchange, swapped it for USDT and USDC on DEXs and coin swap platforms that ran no KYC, and sent the coins to wallets of a shell import export company. OTC brokers and regulated exchanges cashed them out, and some fiat reached the criminals' bank accounts as "investment proceeds". Regulated exchanges sat at both ends. The middle never asked who the customer was.

Sanctions evasion now has tokens of its own: the ruble backed A7A5 moved over $93.3 billion in under a year by Chainalysis' count, and over $72 billion by TRM's. The FATF notes stablecoins settling underground banking deals, the hawala side of the trade. FinCEN found that Huione Group received at least $4 billion in illicit proceeds from August 2021 to January 2025 and barred US correspondent accounts for it from 17 November 2025. DeFi services let a user move proceeds, received from a wallet that pools suspected scam funds, into another token or chain. FinCEN's September alert lists that as a red flag. Privacy coins such as Monero hide the amounts and parties that a public chain such as Bitcoin's shows.

How much crypto was laundered in 2025?

Chainalysis puts laundering itself at over $82 billion in 2025, up from $10 billion in 2020, in its 2026 money laundering report. The figure measures the laundering of funds, not the illicit inflows behind it. Chinese language money laundering networks processed an estimated $16.1 billion in 2025. Over five years they handled about 20 percent of illicit crypto funds, with techniques such as OTC desks, money mules and gambling platforms.

The illicit total depends on whose data you read. Chainalysis counts at least $154 billion received by illicit addresses in 2025 and has already raised its 2024 figure to $57.2 billion. TRM Labs counts $158 billion, against $64.5 billion in 2024. Both put illicit activity at a small share of crypto volume: under 1 percent for Chainalysis, 1.2 percent for TRM. By Chainalysis' count, 84 percent of illicit volume moved in stablecoins.

The UNODC estimate for all money laundering, 2 to 5 percent of world GDP or $800 billion to $2 trillion a year, carries no year, so it does not line up with these 2025 counts.

Terrorist financing runs through the same rails in small amounts. In a FATF case from France in early 2025, a customer sent small, frequent stablecoin transfers to one wallet. Blockchain analysis tied it to sanctioned addresses linked to terrorist financing. The VASP reported to Tracfin.

Which red flags should a crypto compliance team watch?

A VASP in France reported funds that started in online casinos. The winnings went into stablecoins in a custodial wallet at once, were sold, and landed in several bank accounts. Two of its flags: gambling that did not fit the customer's profile or declared source of funds, and a conversion with no economic purpose.

A single flag opens a review. The analyst then looks for a second pointing the same way. The flags below come from the FATF report's annex and FinCEN's September 2026 alert, grouped by where a team sees them.

On chain

• Stablecoins arriving from unhosted wallets several hops away from any wallet covered by the travel rule (FATF annex, anonymity 1).
• Coins bridged step by step across chains, such as TRON to Ethereum to Solana, just before the off ramp (anonymity 10).
• Stablecoins combined with mixers, privacy coins or privacy wallets (anonymity 11).

In the account

• An account used as a transit point for large transfers to and from other people (transaction 4).
• One person converting to and from stablecoins through several accounts or payment instruments in a short time (transaction 11).
• Above market fees, accepted to cash out stablecoins (transaction 12).
• Stablecoins that fund gambling balances, or refunds paid to wallets not linked to the payer (transaction 6).

At the counterparty

• Large, unexplained two way flows with offshore stablecoin exchanges (anonymity 3).
• Deposits from a DeFi service with no AML controls, converted to fiat and withdrawn (FinCEN).
• Heavy use of a stablecoin whose issuer advertises that it does not cooperate with law enforcement or that the coin cannot be frozen or seized (FinCEN).

How does a crypto firm run the risk checks, from onboarding to a suspicious activity report?

Six checks run in a fixed order. The first three finish before the first transfer settles.

1. KYC or KYB at onboarding. KYC checks confirm who the customer is; for a company, KYB finds the beneficial owners. A PEP or high risk profile gets EDD and a source of funds question. Why: monitoring needs a profile to compare against.
2. Name and wallet screening before the first deposit is credited. The name runs against sanctions and PEP lists, and each deposit or withdrawal address goes through a crypto wallet AML check. Why: a wallet can carry sanctions exposure that the name does not show.
3. Travel rule data with each transfer. Under the travel rule, originator and beneficiary data go with the transfer: at any amount in the EU, with one more identifier from £800 in the UK, linked transfers counted together, where the chain includes a business abroad, and from $3,000 in the US. For a transfer above €1,000 to or from a self hosted wallet, an EU firm also assesses whether its customer owns or controls that wallet. Why: the data lets the firm screen the counterparty.
4. Monitoring after settlement. Know your transaction (KYT) checks each transfer against the customer's profile and the addresses' history. A custodial wallet has an account behind it, with deposits, trades and withdrawals to watch. A non custodial wallet has none. The firm watches the transfers that touch its customers instead. Why: stablecoin in, fiat out shows only across several transfers.
5. Alert review with the evidence. An analyst reviews each alert with the rule that fired, the signals that matched and the wallet exposure, then records the decision and who made it. Why: an examiner asks why each alert was closed.
6. The report. Where suspicion holds, the MLRO files a suspicious activity report. In the US, a crypto exchange or other money transmitter must report any suspicious transaction, attempted or completed, that involves or adds up to at least $2,000, within 30 calendar days of first detecting it (31 CFR 1022.320).

Run steps 2 and 5 in separate tools and one customer gets two answers. One exchange on complead unified wallet exposure and name screening: it went from 2 systems per case to 1, was live in 4 weeks, and 100 percent of its cases carry both trails.

Which monitoring rules catch money laundering through bridges, mixers and stablecoin off ramps?

Blockchain AML monitoring turns red flags into rules with a logic, a threshold and a data source. Table 2 lists six. Each firm sets its own thresholds from a backtest on its own history.

Table 2. Six monitoring rules for crypto laundering (thresholds illustrative)

Picture an exchange (illustrative) testing the first rule: a 30 day backtest at three cycles raises 120 alerts, and 18 of them match accounts the team had already escalated: a hit rate of 15 percent. At five cycles the rule raises 45 alerts and still catches 15 of the 18, or 33 percent. Before it chooses, the team reads the three cases it would lose.

Rules catch the patterns a team already knows. Scoring each transfer against the customer's own baseline picks up drift that no fixed rule describes, and the analyst still decides. When an e money firm on complead transaction monitoring began scoring with AI against each customer's own baseline, alert volume fell 52 percent and confirmed cases rose 30 percent.

What happens when a crypto firm gets AML wrong?

On 6 November 2026, FinCEN moved to cut MEXC Global off from the US financial system. It found the exchange facilitated at least $16 billion in illicit transactions tied to Iranian, North Korean and Russian sanctions evasion and cybercrime, including direct dealings with sanctioned actors. MEXC's due diligence barred customers from certain countries on paper, but FinCEN found that transactions with those countries went through anyway. Steps 1 and 2 failed.

Three earlier exchange cases rank among the biggest AML fines; AUSTRAC added a fourth failure in 2026:

• OKX, 24 February 2025: a guilty plea to operating an unlicensed money transmitting business and over $504 million in penalties, after over $5 billion in suspicious transactions and criminal proceeds (registration and step 1).
• KuCoin, 27 January 2025: its operator pleaded guilty and agreed to pay more than $297 million, after failing to run effective KYC, report suspicious transactions or register with FinCEN (registration, steps 1 and 6).
• BitMEX, 15 January 2025: fined $100 million for willfully failing to keep an adequate AML and KYC program; the operator, its founders and its first employee were pardoned on 27 March 2025 (step 1).
• Cryptolink, 9 August 2026: AUSTRAC suspended its registration for three months and ordered its 96 crypto ATMs offline. It had failed to file threshold transaction reports or answer a request for information (reporting, step 6).

That leaves one decision: where each of the six checks sits against settlement. KYC, name and wallet screening and travel rule data have to be complete before the first deposit is credited or the first withdrawal leaves, because after that the coins have moved. Monitoring, alert review and the report run after settlement, on a clock that is 30 calendar days in the US. Write that split into the crypto AML policy, with who decides at each check and the threshold behind each rule, and test each rule against it.