AML (Anti-Money Laundering) refers to laws, regulations, and procedures that require financial institutions to detect, prevent, and report activities that could involve laundering illegally obtained money. For crypto businesses, this means: monitoring transactions for suspicious patterns, filing Suspicious Activity Reports (SARs), screening against sanctions lists, and maintaining records that can be shared with law enforcement.
What Is AML (Anti-Money Laundering, As It Applies to Crypto)?
3 min read
The short version
AML is the system that makes it harder to use financial services to hide dirty money. Banks have done this for decades (flagging large cash deposits, reporting wire transfers to certain countries). Crypto businesses now face the same requirements: they must watch for suspicious activity and report it, or face heavy fines and criminal liability for the business operators.
How It Works
How AML applies to crypto businesses: (1) Transaction monitoring: automated systems flag unusual patterns (large sudden deposits, rapid movement through many wallets, interaction with known illicit addresses). (2) Sanctions screening: check every deposit/withdrawal address against OFAC (US), EU, and UN sanctions lists. Addresses flagged by Chainalysis, Elliptic, or TRM Labs as associated with sanctioned entities or criminal activity. (3) SAR filing: when suspicious activity is detected, the business files a report with FinCEN (US), FCA (UK), or equivalent. They cannot tell the user they have been reported (tipping off is illegal). (4) Travel Rule: for transfers above $3,000 (US) or 1,000 EUR (EU), the sending institution must share originator and beneficiary information with the receiving institution. This applies to crypto transfers between regulated entities. The global standard-setter: FATF (Financial Action Task Force) issues guidance that most countries implement into their national AML frameworks. Their Virtual Asset guidance specifically addresses crypto businesses.
How a crypto exchange handles a suspicious deposit
A user deposits 50 BTC ($3M) from a wallet that Chainalysis flags as having received funds from a known darknet marketplace 3 hops back. The exchange's monitoring system generates an alert. Compliance team reviews: (1) The depositing address has multiple links to flagged entities. (2) The user's KYC profile shows no obvious source of $3M in legitimate income. (3) The user immediately attempts to swap to stablecoins and withdraw (possible layering). Action taken: the exchange freezes the withdrawal, files a SAR with FinCEN, and reaches out to the user for source-of-funds documentation. If the user cannot provide legitimate documentation, the account remains frozen and law enforcement is notified. If the user provides legitimate proof (inherited crypto, early mining, legitimate business), the freeze may be lifted after review. The entire process happens without the user knowing they are being investigated (until a freeze occurs).
What People Get Wrong
AML means crypto is fully traceable and crime-free
AML creates reporting obligations for businesses, not omniscient surveillance. Criminals still use crypto (mixers, chain-hopping, peer-to-peer trades, privacy coins). AML makes it harder and riskier to cash out through regulated channels but does not make illicit use impossible.
Only criminals get flagged by AML systems
AML systems produce many false positives. Receiving funds from a wallet that once interacted with a flagged address several hops back can trigger alerts for completely innocent users. Getting caught in an AML review does not mean you did anything wrong; it means the automated system flagged a pattern for human review.
DeFi has no AML obligations
Currently, most DeFi protocols (smart contracts) have no KYC/AML requirements because they are not classified as financial institutions. However, regulatory pressure is increasing. The EU (MiCA transfer rules) and US (proposed broker definitions) are working to extend AML requirements to DeFi service providers and frontends. The landscape is evolving rapidly.
Keep Reading
Sources & Further Reading
- FATF Virtual Assets Guidance
International AML standards that national regulators implement for crypto
- FinCEN
US AML regulator for money services businesses including crypto exchanges
Questions People Also Ask
- What is the Travel Rule?
- A FATF requirement that when a crypto transfer above a threshold ($3,000 in US, 1,000 EUR in EU) moves between regulated entities (exchanges), the sending entity must share the originator's name and account info with the receiving entity. This is the crypto equivalent of how banks share sender info on wire transfers. It is being implemented globally between 2024-2026.
- Can my exchange freeze my account without explanation?
- Yes. During an AML investigation, exchanges are legally prohibited from tipping off the user about the investigation. They can freeze your funds with minimal or no explanation while compliance reviews your account. This can take days to months. This is a real risk of using custodial services.
- What is Chainalysis and why does it matter?
- Chainalysis (and competitors Elliptic, TRM Labs) are blockchain analytics companies that track and label on-chain addresses (exchanges, mixers, darknet markets, sanctioned entities). Their data feeds the AML systems of virtually every major exchange. If your address or transaction path touches a Chainalysis-flagged entity, it may trigger alerts at exchanges you use.