Why do criminals use crypto to launder money?
On 1 November 2026, the FCA's registration figures showed that of the 395 cryptoasset applications it had decided since January 2020, 68 ended in registration (17 percent) and 266 were withdrawn. The UK's 2025 national risk assessment found that 86 percent of applicants did not meet the standard, and it rates the money laundering risk from cryptoassets as "now assessed to be high" (paras 5.81, 5.82).
Speed and reach explain the appeal. A transfer crosses borders in minutes, can end at a wallet with no named owner and can pass through a platform nobody registered. Even so, the US 2024 National Money Laundering Risk Assessment still finds that the use of virtual assets for laundering "remains far below that of fiat currency".
The FATF answers with licensing and the travel rule. Its July 2026 targeted update counts 91 of 109 responding jurisdictions with a travel rule law, and 55 of those 91 had not yet issued findings or directives or taken any enforcement or supervisory action on it (paras 24, 25). For a crypto firm, anti money laundering (AML) starts with those two things: a license where it operates, and customer data that moves with each transfer.
Which crypto firms must comply, and who licenses them?
| Rulebook | Law (in force, November 2026) | Supervisor | Crypto firms caught |
|---|---|---|---|
| FATF standard | R.15 and its interpretive note (INR.15), text updated June 2026 | A national competent authority, not a self regulatory body (INR.15 para 5) | VASPs: exchange, transfer, safekeeping and administration, issuer services |
| EU | MiCA art. 59 (authorization); the AML directive as amended by TFR art. 38 (from 30 December 2024); the AMLR from 10 July 2027 (art. 90) | National competent authorities; from 2028 AMLA directly supervises selected high risk institutions active in at least six member states (Regulation (EU) 2024/1620 arts. 12, 13) | Crypto asset service providers (CASPs), financial institutions under the AML directive (art. 3(2)(g)) |
| UK | Money Laundering Regulations 2017 (MLR) regs 14A and 56 (FCA registration); FSMA authorization from 25 October 2027 (S.I. 2026/102 reg. 1(2)) | FCA | Cryptoasset exchange providers, crypto ATM operators included (reg. 14A(1)(c)); custodian wallet providers (reg. 14A(2)) |
| US | Bank Secrecy Act; money transmitters dealing in convertible virtual currency are money services businesses (31 CFR 1010.100(ff)(5)); GENIUS Act, signed 18 July 2025, in effect by 18 January 2027 at the latest (sec. 20) | FinCEN (registration within 180 days of being established, 31 CFR 1022.380); state licensing; OFAC for sanctions | Exchangers, administrators, kiosk operators; permitted payment stablecoin issuers, to be treated as BSA financial institutions once the Act takes effect (sec. 4(a)(5)(A)) |
| Türkiye | Capital Markets Law No. 6362 art. 35/B, added by Law No. 7518 (Official Gazette, 2 July 2024); Law No. 5549; Regulation on Measures (RoM) art. 4(1)(ü) | SPK grants the operating permit (art. 35/B(1)); MASAK supervises AML | Crypto asset service providers (platforms and custodians), financial institutions for AML since 25 December 2024 (RoM art. 3(1)(f)) |
| UAE | Federal Decree by Law No. 10 of 2025; Cabinet Resolution No. 134 of 2025 (CR 134) arts. 4, 35, 36(1); Dubai Law No. 4 of 2022 | The supervisory authority the law names for each firm: the CMA (formerly the SCA) under its Virtual Assets Framework; VARA in Dubai outside the DIFC; the DFSA and the FSRA in the DIFC and ADGM free zones | VASPs: exchange, transfer, safekeeping or administration, issuer services (CR 134 art. 4) |
Any firm that exchanges, transfers, holds or issues crypto for customers is a virtual asset service provider (VASP) in FATF terms, and must be licensed or registered at least where it was created (INR.15 para 3).
The deadlines are close or past. In the EU, firms already operating could go on without MiCA authorization until 1 July 2026 at the latest (art. 143(3)). The FCA's application period for the UK regime opened on 30 September 2026 and closes on 28 February 2027; by 31 October it had received no authorization applications and two variations of permission (gateway data).
SPK's lists of 28 October 2026 name 49 Turkish platforms in operation, which SPK says does not mean they are authorized, and 59 in liquidation. In the UAE, the CMA issued its Virtual Assets Framework on 13 April 2026, with an AML module among its five.
What are the AML requirements for crypto exchanges in 2026?
Crypto AML compliance comes down to nine duties. Each rulebook places them in its own article, and the EU cells give today's directive or TFR article first and the AMLR article that replaces it on 10 July 2027.
| Duty (in force, November 2026) | FATF | EU | UK | US | Türkiye | UAE |
|---|---|---|---|---|---|---|
| License or registration | INR.15 para 3 | MiCA art. 59 | MLR reg. 56; FSMA authorization from 25 October 2027 (S.I. 2026/102) | 31 CFR 1022.380; state licenses | Law 6362 art. 35/B(1); running a platform without the permit: 3 to 5 years' prison and a judicial fine of 5,000 to 10,000 days for those who run it (art. 109/A) | CR 134 art. 36(1) |
| Customer due diligence on occasional transactions | INR.15 para 7(a): above USD/EUR 1,000 | Directive art. 11(b)(i): €15,000 or more, single or linked; from 10 July 2027, AMLR art. 19(3): full CDD from €1,000, at least identification and verification below | MLR reg. 27(7E): transfers of £800 or more, linked ones together (since 30 June 2026); every crypto ATM transaction (reg. 27(7D)) | AML program with customer verification (31 CFR 1022.210(d)(1)(i)(A)) | RoM art. 5(1)(b), (c): 30,000 TL or more, single or linked | CR 134 art. 7(3): AED 3,500 or more, single or linked |
| Travel rule | INR.15 para 7(b) | TFR arts. 14, 16: any amount | MLR reg. 64C: names and account numbers on every transfer; one more identifier from £800 when a business outside the UK is in the chain (reg. 64C(4), since 30 June 2026) | 31 CFR 1010.410(e), (f): $3,000 or more | RoM art. 24/A(1), (2): from 30,000 TL, sender's name, wallet and one identifier, verified; below, names and wallet addresses | CR 134 art. 36(2)(a); VARA rulebook III.G.2: above AED 3,500 |
| Self hosted wallets | INR.15 para 7(b) | TFR arts. 14(5), 16(2): ownership assessment above €1,000; Directive art. 19a risk measures (AMLR art. 40 from 10 July 2027) | MLR reg. 64G: may request data, originator data from £800 when the customer receives; if requested data does not arrive, no release (64G(4)) | December 2020 proposal withdrawn on 6 October 2026 | RoM art. 24/A(6): the customer declares the wallet holder's name and one identifier | No specific article found |
| Sanctions screening | R.6; INR.15 para 7(b): freezing and prohibitions apply to transfers as in R.16 | EU restrictive measures | UK Sanctions List | OFAC | Law No. 6415 | CR 134 art. 36(3): the targeted financial sanctions duties of financial institutions |
| Suspicious transaction report | R.20 | Directive art. 33: "promptly", attempted transactions included; AMLR art. 69 from 10 July 2027 | POCA s. 330: as soon as practicable | 31 CFR 1022.320: $2,000 or more, conducted or attempted, within 30 calendar days of initial detection | RoM art. 28(2): within 10 business days of the suspicion | CR 134 art. 18(1)(a): "immediately and without delay", any value |
| Records | R.11: at least 5 years | Directive art. 40: 5 years (AMLR art. 77 from 10 July 2027) | MLR reg. 40: 5 years | 31 CFR 1010.430(d): 5 years | Law No. 5549 art. 8: 8 years | CR 134 art. 25(1): at least 5 years |
| Anonymous accounts and privacy coins | No crypto specific rule | AMLR art. 79(1), from 10 July 2027: no anonymous crypto asset accounts and no accounts allowing anonymization or increased obfuscation, including through anonymity enhancing coins | No crypto specific rule | No crypto specific rule | No crypto specific rule | Decree by Law art. 30(2): dealing in virtual assets that are fully anonymous or that block tracing is an offense |
| Correspondent VASPs | R.13 | Directive art. 19b(1) for respondents outside the EU (AMLR art. 37 from 10 July 2027); AMLR art. 39(2) (shell institutions) | No VASP specific rule until 1 February 2027, when MLR reg. 34A adds one for cryptoasset exchange and custodian wallet providers (S.I. 2026/621 reg. 1(4)) | No MSB rule (31 CFR 1010.610 binds covered financial institutions such as banks and broker dealers) | RoM art. 23 | CR 134 art. 26, applied to VASPs by art. 36(2) |
The due diligence line runs from £800 in the UK to 30,000 TL in Türkiye, while the EU's sits at €15,000 until the AMLR cuts it to €1,000. Report clocks run from "immediately" in the UAE to 30 calendar days in the US. Türkiye keeps records for eight years, the others for five.
When must a crypto firm run customer due diligence?
An account or a suspicion triggers due diligence everywhere, whatever the amount. For occasional customers, picture one walk in customer (illustrative) sending a transfer in four markets:
- Lisbon, €900: below the Directive's €15,000 line today (art. 11(b)(i)), though national law may set a lower one; from 10 July 2027, below €1,000, so at least identification and verification (AMLR arts. 19(3)(b), 20(1)(a)).
- London, £700: below the £800 line (MLR reg. 27(7E)); at a crypto ATM, full CDD applies at any amount (reg. 27(7D)).
- Istanbul, 25,000 TL: below 30,000 TL (RoM art. 5(1)(b), (c)).
- Dubai, AED 3,000: below AED 3,500 (CR 134 art. 7(3)).
All four count linked transactions together, so a second transfer that day can cross the line.
How fast must a crypto firm report a suspicious transaction?
Take an analyst at a Turkish platform (illustrative) who confirms a suspicion on Monday 2 November 2026. MASAK must have the report by Monday 16 November, the tenth business day (RoM art. 28(2)). A US exchange counts 30 calendar days from initial detection, so a $2,000 case found that Monday is due by 2 December, and an ongoing scheme also needs an immediate call to law enforcement (31 CFR 1022.320(b)(3)). The UAE wants the report "immediately and without delay" (CR 134 art. 18(1)(a)), the UK as soon as practicable (POCA s. 330) and EU law "promptly" (Directive art. 33).
Which red flags should a crypto firm's monitoring catch?
Six of the flags below come from FinCEN's kiosk notice of 4 August 2025, which ties them to scam payments.
No single flag decides, FinCEN notes. You weigh the facts around it: the chain side through know your transaction (KYT) monitoring and the address itself through a wallet AML check.
| Red flag | Why it matters | Source |
|---|---|---|
| Cash deposits just under the currency transaction report threshold or a kiosk's daily limit, split across machines or accounts | Structuring to stay under a reporting line | FinCEN kiosk notice |
| A customer with little or no history makes a large deposit that moves at once through several addresses or is swapped into another coin | Layering right after placement | FinCEN kiosk notice |
| Many customers paying one address from kiosks far apart within a short time | One collector behind many senders | FinCEN kiosk notice |
| Several accounts or transactions linked to one phone number or wallet address | Accounts run by one person or network | FinCEN kiosk notice |
| Blockchain analysis tying the receiving wallet to fraud or other illicit activity | The funds' destination is already known | FinCEN kiosk notice |
| An older customer with no crypto history making a high value kiosk transaction | A common sign of a scam victim being directed | FinCEN kiosk notice |
| Users in sanctioned places, or VPNs used to hide location | Sanctions exposure the onboarding data does not show | OFAC, Exodus Movement (16 December 2025); CoinList Markets (13 December 2023) |
| Transfers to or from unregistered mixing services | Obscured origin of funds | FinCEN, Paxful order (at least 13 unregistered mixing services) |
| A counterparty VASP that keeps sending incomplete travel rule data | Warnings and deadlines, then rejection, restriction or exit, reported to the supervisor (EU); return the transfer and weigh an exit (Türkiye) | TFR art. 17(2); RoM art. 24/A(3) |
| A self hosted wallet above €1,000 with no evidence of who controls it | The ownership assessment cannot be completed | TFR arts. 14(5), 16(2) |
| A monitoring rule set that leaves a stream of transactions unscored | Suspicion is never raised, so reports are late | Central Bank of Ireland, Coinbase Europe (6 November 2025) |
Which crypto firms were fined for AML failures since 2023?
The Central Bank of Ireland fined Coinbase Europe €21,464,734 on 6 November 2025. Faults in the configuration of its monitoring system left more than 30 million transactions, worth over €176 billion and about 31 percent of its transactions while the faults lasted, not properly monitored over a 12 month period. Finishing the monitoring took almost three years and produced 2,708 suspicious transaction reports. The High Court confirmed the sanction on 12 January 2026.
| Date | Regulator | Firm | Outcome | Main finding |
|---|---|---|---|---|
| 21 November 2023 | FinCEN; OFAC | Binance | $3.4 billion; $968,618,825 | Willful BSA violations; 1,667,153 apparent sanctions violations, August 2017 to October 2022 |
| 13 December 2023 | OFAC | CoinList Markets | $1,207,830 | 989 transactions for users resident in Crimea, April 2020 to May 2022 |
| 25 July 2024 | FCA (UK) | CB Payments (Coinbase group electronic money institution) | £3,503,546 | Onboarded or served 13,416 high risk customers despite a requirement barring new ones; about $226 million of crypto trades followed |
| 30 September 2024 | FCA (criminal) | Olumide Osunkoya | Guilty plea to 5 offenses | At least 11 crypto ATMs run without FCA registration and with no customer due diligence |
| 15 January 2025 | DOJ (SDNY) | BitMEX | $100 million fine | Willful failure to keep an adequate AML and KYC program |
| 27 January 2025 | DOJ (SDNY) | KuCoin (Peken Global) | Over $297 million; exit from the US for at least two years | Unlicensed money transmission; no FinCEN registration; suspicious transactions not reported |
| 24 February 2025 | DOJ (SDNY) | OKX | Over $504 million | Unlicensed money transmission; over $5 billion of suspicious transactions and criminal proceeds |
| 22 September 2025 | OFAC | ShapeShift AG | $750,000 | Trades with users in Cuba, Iran, Sudan and Syria, 2016 to 2018 |
| 6 November 2025 | Central Bank of Ireland | Coinbase Europe | €21,464,734 | 30,442,437 transactions not properly monitored; 2,708 reports after the late review |
| 19 November 2025 | DOJ (SDNY) | Samourai Wallet founders | Five and four years in prison | A mixer that facilitated over $237 million in illegal transactions |
| 9 December 2025 | FinCEN | Paxful | $3.5 million ($1.75 million credited to the DOJ payment) | Willful BSA violations: lapsed registration (974 days unregistered, 2017 to 2019), no effective AML program, over $500 million of suspicious activity |
| 16 December 2025 | OFAC | Exodus Movement | $3,103,360 | 254 apparent violations involving Iran |
| 3 June 2026 | VARA (Dubai) | CoinMENA FZE | Financial penalty | Failures in AML program controls, governance and internal systems |
| 17 June 2026 | VARA (Dubai) | MEXC; KuCoin | Cease and desist orders, financial penalties | Unlicensed activity in Dubai; MEXC also onboarded users without KYC |
| 24 July 2026 | VARA (Dubai) | Shelbit General Trading | Cease and desist orders, financial penalties | Repeated unlicensed activity, marketing in Dubai and breaches of AML, CFT and PF duties |
Most rows are one of two failures: a firm served customers where it held no license or registration, or its controls missed sanctioned users and suspicious flows. MASAK has named no crypto platform it fined for AML in the period, and VARA publishes no amounts.
| Rulebook (in force, November 2026) | Basis | Ceiling |
|---|---|---|
| EU, MiCA | Art. 111(1)(d), (3)(a), (c), for breaches of arts. 59, 60, 64 and 65 to 83 | National law sets maximum fines of at least €5,000,000 and of at least 5% of total annual turnover |
| EU, AML directive | Art. 59(1), (3)(a): serious, repeated or systematic breaches, or a combination, by a financial institution | Maximum fines of at least €5,000,000 or 10% of total annual turnover |
| UK | MLR reg. 76 (civil); reg. 86 (criminal) | No stated civil maximum, and no penalty where the firm took all reasonable steps; up to two years' prison, a fine or both on indictment |
| US | Bank Secrecy Act: 31 U.S.C. 5321, 5330 | Willful violations after 2 November 2015: $71,545 a day for the AML program, $10,556 a day for registration, and for each SAR breach the amount involved up to $286,184, or $71,545 if greater, as cited in the Paxful order |
| Türkiye | Law No. 6362 art. 109/A; Law No. 5549 art. 13 | 3 to 5 years' prison and a judicial fine of 5,000 to 10,000 days for running a platform without the permit; AML fines on financial institutions capped at 379,271,547 TL per obligation a year in 2026 |
| UAE | Federal Decree by Law No. 10 of 2025 art. 17(1) | AED 10,000 to 5,000,000 per violation, unless other legislation sets a more severe sanction, plus measures up to license revocation |
What must a crypto transfer carry under the travel rule and MiCA?
Picture a customer of a Lisbon exchange (illustrative) who withdraws €1,500 in crypto to her account at a Dubai VASP, then moves it on to her own self hosted wallet.
Under the EU travel rule, Lisbon attaches her name, wallet address and, where one is used, her account number. It adds her address with her official document number and customer number, or else her date and place of birth, plus the Dubai customer's name and wallet address (TFR art. 14(1), (2)). The data goes before or with the transfer and need not ride on the chain itself (art. 14(4)). Her data is verified first, and nothing moves before full compliance (art. 14(6), (8)). Any amount counts.
The amount is above AED 3,500, so VARA's travel rule rulebook has the Dubai VASP obtain and hold the sender's data before she can use the assets (rule III.G.3), and CR 134 art. 36(2)(b) has it keep accurate data on both parties. If one counterparty keeps sending incomplete data, the receiver may first warn and set deadlines, then reject, restrict or end the relationship, and it reports the failure to its AML supervisor (TFR art. 17(2)). A Turkish receiver asks for the missing data, returns the transfer if it does not come and weighs the same exit (RoM art. 24/A(3)).
Outside the EU, the full data set has a floor: £800 in the UK when a business abroad is in the chain (MLR reg. 64C), $3,000 in the US (31 CFR 1010.410(f)) and 30,000 TL in Türkiye (RoM art. 24/A(1)).
If Lisbon keeps a standing relationship with the Dubai VASP, it must already check that VASP's license, assess its controls and get senior management approval, because the AML directive's art. 19b(1) has applied to respondents outside the EU since 30 December 2024. AMLR art. 37(1) takes over on 10 July 2027.
What does MiCA add to a CASP's AML duties?
MiCA makes AML controls a condition of the license. The application describes the CASP's internal controls for money laundering and terrorist financing risks (art. 62(2)(i)), one of the MiCA compliance steps before authorization. An authorized firm keeps effective procedures to comply with national AML law and reviews them regularly (art. 68(8)). The AML duties themselves still come from the TFR and the AML directive, and from the AMLR in 2027.
How should transfers to self hosted wallets be handled?
Here the rules part ways. An EU CASP obtains and holds the travel rule data for a transfer to or from a self hosted address, and above €1,000 assesses whether its customer owns or controls the address (TFR arts. 14(5), 16(2)). It also applies risk measures to those transfers, such as verifying the other party or monitoring them more closely (Directive art. 19a; AMLR art. 40 from 10 July 2027). A UK firm may request the data, with originator data from £800 when its customer receives; if requested data does not arrive, it must not make the cryptoasset available (MLR reg. 64G). Türkiye takes a declaration of the wallet holder's name and one identifier (RoM art. 24/A(6)). FinCEN withdrew its December 2020 unhosted wallet proposal on 6 October 2026.
What changed for crypto AML in 2025 and 2026, and what comes next?
- 18 July 2025. The US GENIUS Act is signed; once in effect, it treats permitted payment stablecoin issuers as BSA financial institutions (sec. 4(a)(5)).
- 14 December 2025. The UAE's CR 134 takes effect, 30 days after publication (art. 71).
- 10 April 2026. FinCEN and OFAC propose AML and sanctions rules for stablecoin issuers.
- 13 April 2026. The UAE's CMA issues its Virtual Assets Framework.
- 30 June 2026. The UK £800 lines apply; the FCA publishes final crypto rules.
- 1 July 2026. The MiCA transition ends at the latest.
- 6 October 2026. FinCEN withdraws its mixing and unhosted wallet proposals.
- 7 October 2026. Türkiye raises its crypto lines to 30,000 TL (RoM arts. 5, 24/A).
Next: the GENIUS Act takes effect by 18 January 2027 at the latest (sec. 20). The AMLR and its anonymous account ban apply on 10 July 2027, the UK regime starts on 25 October 2027, and AMLA's direct supervision starts in 2028.
What belongs in a crypto AML program checklist for 2026?
An examiner or auditor will cite the rule behind each line, so each line carries it. The last column says where complead, formerly Sanction Scanner, fits; elsewhere the control stays with the firm.
| Control | Source | Where complead fits |
|---|---|---|
| License or registration in every market served | INR.15 para 3; MiCA art. 59; MLR reg. 56; 31 CFR 1022.380; Law 6362 art. 35/B; CR 134 art. 36(1) | The firm's own control |
| Business wide risk assessment covering products, chains, counterparties and countries | Directive art. 8 (AMLR art. 10 from 2027); MLR reg. 18 | The firm's own control |
| Customer due diligence at each market's line, with the data set in an exchange KYC form | Obligations table above | Client screening at onboarding |
| Customer and transfer parties screened against sanctions lists at onboarding and on each transfer | INR.15 para 7(b) | Client screening; payment screening checks the sender and the receiver through the API while the transfer is processed |
| Travel rule data sent before or with the transfer; incomplete messages held or returned | TFR arts. 14, 16, 17; MLR regs 64C to 64E; RoM art. 24/A | The firm's travel rule messaging |
| Self hosted wallet policy with ownership checks | TFR arts. 14(5), 16(2); Directive art. 19a; MLR reg. 64G | The firm's own control |
| Counterparty VASP due diligence, filed on a VASP KYB form | Directive art. 19b (AMLR art. 37 from 2027) | KYB and UBO verification follows a counterparty's owners up the chain until natural persons are reached |
| Monitoring rules tested so no transaction stream goes unscored | Central Bank of Ireland, Coinbase Europe | Rules backtested on 30, 60 or 90 days of history |
| Report clock written per market | Obligations table above | Reporting support within case management |
| Records for 5 years, 8 in Türkiye | Directive art. 40; Law No. 5549 art. 8 | Every search recorded with who searched, what, when and the result |
| No anonymous accounts or accounts using anonymity enhancing coins from 10 July 2027 | AMLR art. 79(1) | The firm's own control |
| Stablecoin issuer program where the GENIUS Act applies | GENIUS Act sec. 4(a)(5) | The firm's own control |
| Training and independent review | 31 CFR 1022.210(d)(3), (4) | The firm's own control |
How does complead fit a crypto firm's AML program?
Consider an exchange (illustrative) in three of these markets. Its examiner asks for the screening record of each customer and transfer, and who cleared each alert.
complead records both. Client screening and ongoing monitoring screens each customer name on data holding 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
A sanctions list can get a lower fuzzy matching threshold than a watchlist, set per list type or per single list. Each search goes into a log, matches or none, showing who searched, which name, at what time and the outcome. In transaction monitoring, its team writes rules without code and backtests them before they go live. Agents close the routine cases with the evidence, the narrative and the work log attached; an analyst decides the rest, and the record names who decided. An exchange that unified wallet exposure and name screening on complead for crypto went from two systems per case to one and was live in 4 weeks.
This week, three steps:
- Sample last month's outbound transfers and check each carried the data its market requires.
- List every counterparty VASP with its license status and the date you checked it.
- Write each market's report clock on the page your analysts escalate from.
What the 2026 PDF adds. Each legal line above was checked against its official text as in force on 4 November 2026, and nothing on this page is held back for the form. Downloading the PDF from the form next to the page gets you five crypto templates: a travel rule field map per market, a counterparty VASP due diligence file, an ownership record for self hosted wallets, a report clock card and a license tracker for the five jurisdictions.
