When a wallet or payment app offers a crypto exchange it also takes on the crypto AML compliance work. In the US and Europe weak compliance checks can result in actual fines being levied. Some firms will have their licences revoked and if that happens to your exchange partner then the integrations built on that partner will simply cease to work. The way you manage cryptocurrency exchange compliance will impact which partners you can work with and what your users see when a transfer is being held for review.
What Is AML/KYC Compliance in Crypto?
AML/KYC compliance in crypto is the set of rules and procedures that a crypto business follows to prevent and detect money laundering. AML is the whole system. KYC (Know Your Customer) is the first step in that system: it's about gathering and verifying a user's identity data.
The data confirms that the user is not on a sanctions list and is not from a prohibited country, and it provides a basis for any subsequent investigations. KYC is run at signup, with AML monitoring in place on every transaction.
FATF, the international AML standard setter, divides its requirements for crypto businesses into three parts: KYC, ongoing transaction monitoring and response to suspicious activity. Over 200 jurisdictions have committed to FATF's standards. Most national rules are built on them, so the fundamentals of AML compliance for crypto are pretty much the same in every market.
AML obligations apply to exchanges, custodial wallet providers and all other VASPs (virtual asset service providers), i.e. businesses that provide crypto services to users. Banks with crypto custody and stablecoin payment providers are covered, and a payment app that adds stablecoins or swaps takes on the same obligations.
Cryptocurrency AML compliance also relies on blockchain analytics. These tools track funds and link addresses to known activity. A wallet's history is public on the blockchain, but without these tools you're just left with a string of characters.
Key Requirements for Crypto Exchange Compliance
In cryptocurrency exchange compliance, regulators now check that each control actually works.
Customer Due Diligence and Identity Verification
Under tiered KYC the level of verification goes up with your limits and volumes. A low risk user doing small amounts will be subject to a light check and can get going quite quickly. A higher risk user will move into enhanced due diligence which is a far more in depth review and will require further documentation, a source of funds check and will be subject to much more rigorous monitoring.
FAQ
Often not (if a licensed provider is running the swap and doing their own AML checks). In that scenario your app would simply pass the user's request on to the provider who would then do the swap. The rules vary from country to country and from integration to integration. Get a lawyer to look at your setup prior to launch. Apple have their own rules in place: under the App Store guidelines an app can only support crypto swaps in jurisdictions where the app itself has the requisite licences and permissions.
Typically the screening will trace the incoming coins back to a mixer or a sanctioned wallet, occasionally several transfers back. The provider will then ask the user for ID and an explanation as to where the funds originated. The swap will be on hold during this period. At ChangeNOW the verification link is active for three days and then the case is reviewed individually by the team.
KYC isn’t a default step under a risk-based approach. An ID check starts when there’s a specific reason, such as a transaction that looks unusual or a fraud report. That can happen mid-swap, and the transaction goes on hold while the user verifies. Some services also make KYC mandatory for users from certain countries.
It’s a screening vendor’s estimate of how exposed an address is to illicit funds. The tool traces where the money at that address came from, including through intermediate wallets, and weighs how much of it passed through addresses already linked to crime. Vendors use their own scales. Each business decides at what score a transfer goes to manual review.
Chain coverage is paramount. Funds will move between chains via bridges and a tool that can't follow that jump is going to lose the trail. After that you want to know how frequently the vendor updates their address labels and how the API performs at your peak volume. If you're sending transfers to other VASPs then you need to check for Travel Rule support.
Case management needs a full audit log, since regulators review the record behind each decision. Vendors charge per check or by volume-based subscription. Compare quotes against your real monthly transaction count.
FATF Travel Rule
The Travel Rule requires any crypto business that is sending a transfer over a threshold to pass on the sender and recipient information to the business on the receiving end. The FATF baseline is $1,000 or €1,000. If you're a crypto business sending funds to another crypto business, you have to handle that data exchange.
FATF's July 2026 report states that 83% of the jurisdictions surveyed (91 of 109) have Travel Rule legislation in place, and the businesses in those jurisdictions will expect to receive the data on incoming transfers. A business in a jurisdiction without the rule will not be able to return the data. Transfers to such businesses will need to be via a documented procedure which is in place prior to the first transfer going out.
Transaction Monitoring and Sanctions Screening
Every user is checked against the government sanctions lists. A clean result on that check doesn't clear a user whose funds came from a sanctioned source. Screening also looks for sanctions exposure, meaning funds that reached the user from a sanctioned address through other wallets.
Transaction monitoring will flag activity that doesn't fit the account. Two of the most common red flags are transactions kept just below a reporting threshold and a long-dormant account which then suddenly makes a large move or cashes out to fiat. A flag will trigger a review. The response is then graded to the risk:
asking the user to explain the activity
freezing funds
lowering limits
closing the account
Suspicious Activity Reporting and Recordkeeping
A Suspicious Activity Report (SAR) is the form that a business files with the regulator when it has a suspicion of illicit activity. There has to be a documented reason for the filing, there has to be evidence on file and there has to be an internal escalation process. The records are kept for a minimum of five years and contain on-chain data and wallet addresses as well as the user details. SAR reporting tools for AML crypto compliance let you go back years later and still see who made the call.
Regulatory Requirements for Crypto Exchanges
A licence or registration is where compliance begins. Over 60 jurisdictions run a registration or licensing regime for crypto businesses. An AML compliance program in crypto includes five parts:
a named Money Laundering Reporting Officer (MLRO), the person responsible for suspicious activity reporting
staff training
regular policy updates
audits
timely SARs
Each piece needs an owner and the records to back it up, which a written policy on its own doesn't provide.
Crypto Wallet Compliance
Custodial vs. Non-Custodial Wallets
FATF consider both exchanges and custodial wallet providers (the ones that hold the keys and funds for the users) to be VASPs. A custodial wallet is subject to the same AML obligations as an exchange.
FATF's October 2021 guidance classifies a business by its function and business model irrespective of the technology it uses or whether it holds funds. A non-custodial wallet software (where the user keeps their own keys) is not in itself a VASP.
A business that operates a dApp (a dApp being a blockchain application) can be. If a wallet app adds a swap function then it is exchanging assets on behalf of its users and that step requires AML coverage from the app or from its exchange provider. ChangeNOW operates in a non-custodial model and screens every exchange transaction.
Wallet Screening and Transaction Monitoring
Wallet screening checks the address on the other side of the transaction. It runs prior to a deposit being accepted or a withdrawal being sent and looks for links to:
darknet markets
ransomware
sanctioned entities
mixers, services that pool coins from many users to hide their origin
stolen funds
Without it, an exchange has verified its own user and still knows nothing about the counterparty. An address’s risk can also change after a check, so crypto wallet screening tools for AML compliance rerun it when the address comes back.
Unhosted Wallets, Illicit Funds, and Cross-Chain Risks
A self-hosted wallet is a non-custodial wallet on the other end of a transfer, with no provider behind it. In the EU, for transfers to or from such a wallet above €1,000, the provider verifies that the user controls it. Users who move larger amounts to their own wallets should expect that check.
Privacy coins (Monero and Zcash being the prime examples) hide the transaction trails and are a red flag in themselves. Criminals will also move funds rapidly across the blockchains and a tool that only monitors one chain at a time will miss the portion of the trail that's running on the others.
FATCA Requirements
FATCA compliance in cryptocurrency is a gray area. FATCA is the 2010 US law on reporting foreign financial accounts, and it says nothing about digital assets. The IRS hasn’t cleared that up either.
The tax rules that do apply to crypto are newer, and they sit apart from AML. They mostly fall on platforms that hold user funds.
In the US, that’s Form 1099-DA. Brokers have reported what users sell crypto for since 2025. For assets bought from 2026, they also report the original purchase price.
Outside the US, it’s CARF, an OECD standard that 76 jurisdictions have signed up to, and under it exchanges and custodial wallets record where each user pays tax and report their transactions. The EU and UK share the first data in 2027, the US in 2028.
DAC8, the EU version, has applied since January 1, 2026. It covers these platforms whenever they serve EU residents, even if they are based elsewhere.
Cryptocurrency Risk and Compliance Solutions
Money Laundering
Risk: laundering leaves patterns: risky categories, groups of linked addresses and anomalous behaviour.
Solution: monitoring rules will flag them. Risk scoring, an automated risk rating for each user, is updated as new data comes in. Low-risk users then skip the additional checks.
Sanctions Exposure
Risk: crypto settles in minutes and cuts across borders so there's very little time to stop a transfer once it's been initiated.
Solution: outgoing transfers are screened prior to being sent. Any exposure that's identified afterwards is still a liability which a SAR doesn't fully resolve.
Fraud
Risk: fake identities and deepfakes are used to get through KYC at onboarding. Chargeback fraud (the buyer charging back the card payment after they've received the crypto) only occurs in the case of card purchases. Crypto-to-crypto swaps are irreversible.
Solution: apps that take cards will require more rigorous crypto AML compliance solutions than swap only products.
Reporting Failures
Risk: at high volumes, manual review simply won't meet the SAR deadlines. Not documenting the steps taken can on its own lead to penalties, regardless of what the decision was.
Solution: the firms will automate the case handling with crypto AML compliance software.
Risk
Typical signal
Solution class
Money laundering
Unusual behavior, linked addresses
Monitoring rules, risk scoring
Sanctions exposure
Sanctioned counterparty
Screening before sending
Fraud
Fake identity, chargeback
Identity checks at onboarding
Reporting failures
Missed SAR deadline
Automated case handling, logs
In any crypto AML compliance software cost comparison, the price depends on transaction volume, chain coverage and whether you build in-house or use a provider.
An exchange provider is one of the solutions for crypto firms' AML compliance: it can run these checks at the point of exchange. ChangeNOW only applies verification when required, on a risk-based approach. Every transaction is screened with in-house and external tools, including blockchain analytics. An app which integrates a provider will inherit that provider's AML policy and should make that policy known to its users. If a review identifies a high-risk transaction or a request is received from a regulator, the provider cannot release or refund the funds at its own discretion, and the app's users can run into that hold. It pays to explain this to them up front.
Compliance Requirements by Jurisdiction
The US, EU and UK all start from the FATF rules, the details of course vary depending on where your business and your users are.
In the US crypto businesses are MSBs (Money Services Businesses) just like any other business that is moving money on behalf of others. They are subject to the Bank Secrecy Act via FinCEN (with the requirement of a written AML programme, CIP, monitoring and SARs). OFAC deals with the sanctions.
The EU has one crypto licence under MiCA (issued to crypto asset service providers). The rules came into full force on 30th December 2024 and the transition period ended on 1st July 2026. A business without the licence is not permitted to serve EU users. There were approximately 321 CASPs with the licence as of 3rd August 2026. The maximum fine is €5m or 5% of annual turnover.
Two further EU laws are adjacent to MiCA. We have the Transfer of Funds Regulation (TFR) which contains the Travel Rule. We have the AMLR (Anti-Money Laundering Regulation) which is a single EU AML rulebook which will apply in all member states from 10th July 2027, replacing the national rules and which will hold CASPs to the same AML obligations as banks.
In the UK crypto businesses register with the FCA under the Money Laundering Regulations. The bar is very high so you need a working AML programme in place as a prerequisite to the application.
Jurisdiction
Regulator and framework
License or registration
Travel Rule threshold
Suspicious activity reporting
US
FinCEN (Bank Secrecy Act), OFAC
MSB registration
$3,000
To FinCEN within 30 days; $2,000 threshold for MSBs
EU
MiCA, TFR, AMLR
CASP license
None: all transfers between CASPs
To the national financial intelligence unit (the agency that receives these reports), promptly
UK
FCA, Money Laundering Regulations
FCA registration
Since September 2023: basic data on every transfer, extended data above €1,000 with a foreign firm
To the National Crime Agency as soon as reasonably practicable
What Are the Potential Changes to Crypto Laws in 2026?
FATF's July 2026 data shows that 60% of jurisdictions with Travel Rule legislation have not yet carried out any supervisory or enforcement action. Enforcement is still some way off with the EU, US and UK all having set dates.
The EU's move comes in 2028 when AMLA (the new EU AML authority) starts to directly supervise around 40 high risk cross border groups. Large CASPs can be selected for it in the same way as banks.
On January 18, 2027, the GENIUS Act (the first US federal law for payment stablecoins) comes into effect and brings stablecoin issuers under the Bank Secrecy Act with customer checks, monitoring, SARs and OFAC screening. Payment apps that deal in stablecoins will be working with the issuers under AML rules akin to those of a bank.
The UK comes in on October 25, 2027 (when the full crypto regime kicks in). The FCA take applications from September 30, 2026, to February 28, 2027.
Conclusion
For an app that adds exchange, choosing a provider is also choosing how much crypto AML compliance work stays in-house.
ChangeNOW runs AML screening and risk management on its own side, within a non-custodial model. It doesn't store any sensitive user data. Its SOC 2 and ISO 27001 certifications cover information security, which is a separate function to AML. Integration partners get 24/7 support and a dedicated account manager, which is obviously important when a transaction goes under review.
