AML

AML stands for anti-money laundering. It is the framework of laws, regulations, policies, and procedures that banks, payment providers, crypto exchanges, and other regulated entities use to detect, prevent, and report money laundering, terrorist financing, and related financial crimes.

AML programmes typically include customer identification and verification (KYC), risk assessment, transaction monitoring, sanctions screening, suspicious activity reporting, employee training, and independent audits. For crypto businesses, AML rules increasingly mirror those for traditional financial institutions, adapted to the specifics of digital assets and blockchain transactions.

Why AML exists

Money laundering is the process of making illegally obtained funds appear legitimate. It typically involves three stages:

• Placement – introducing “dirty” money into the financial system (for example, via deposits, exchanges, or cash-intensive businesses).
• Layering – moving funds through multiple transactions, accounts, or jurisdictions to obscure their origin.
• Integration – reintroducing the funds into the economy as seemingly legitimate assets (for example, real estate, investments, luxury goods).

AML rules aim to disrupt this process by:

• Making it harder to open and use anonymous accounts.
• Detecting suspicious patterns of activity.
• Reporting concerns to authorities.
• Freezing or blocking funds linked to crime or sanctions.

This helps protect the integrity of the financial system, reduce crime, and meet international standards set by bodies such as the Financial Action Task Force (FATF).

Core components of an AML programme

While details vary by jurisdiction and business type, most AML frameworks include several key elements.

Customer due diligence (CDD) and KYC

• Customer identification – collecting basic information (name, date of birth, address, nationality, etc.).
• Verification – checking IDs, documents, and sometimes biometric data to confirm identity.
• Risk profiling – assessing each customer’s risk level based on factors such as geography, occupation, product usage, and transaction patterns.
• Enhanced due diligence (EDD) – additional checks for higher-risk customers (for example, PEPs, high-risk jurisdictions, complex structures).

KYC (Know Your Customer) is the operational part of CDD focused on verifying who the customer is.

Transaction monitoring

• Continuous analysis of customer transactions to detect unusual or suspicious patterns.
• Examples of red flags:
  • Rapid movement of large sums with no clear economic purpose.
  • Structuring transactions to avoid reporting thresholds.
  • Activity inconsistent with the customer’s profile or declared business.
  • Links to high-risk addresses, counterparties, or jurisdictions.
• Alerts are reviewed by compliance teams, and suspicious cases may be reported to authorities.

Sanctions screening

• Checking customers, counterparties, and transactions against official sanctions lists (for example, OFAC, UN, EU, UK).
• Blocking or freezing assets and transactions involving sanctioned parties.
• Ongoing screening as lists are updated.

Suspicious activity reporting

• Filing reports (for example, SARs – Suspicious Activity Reports) with financial intelligence units or regulators when suspicious activity is detected.
• These reports are confidential and typically cannot be disclosed to the customer (“tipping off” restrictions).
• Regulators and law enforcement use these reports to investigate and prosecute financial crime.

Internal controls, training, and audit

• Written AML policies and procedures tailored to the business.
• Designated compliance officers and clear governance.
• Regular training for staff on AML obligations and red flags.
• Independent audits or reviews to test the effectiveness of the AML programme.

AML in crypto vs traditional finance

Crypto-specific AML builds on traditional frameworks but adapts to digital assets.

Similarities

• Crypto exchanges, custodians, and payment processors are often treated as virtual asset service providers (VASPs) and subject to AML rules similar to banks.
• Requirements typically include:
  • KYC/CDD for users.
  • Transaction monitoring and risk scoring.
  • Sanctions screening.
  • Suspicious activity reporting.
  • Record-keeping for defined periods.

Crypto-specific elements

• On-chain monitoring – analysing blockchain transactions, wallet addresses, and fund flows to detect links to scams, hacks, mixers, darknet markets, or sanctioned entities.
• Travel Rule compliance – sharing originator and beneficiary information for certain transfers between VASPs, as required by FATF and local regulators.
• Address screening – checking deposit and withdrawal addresses against risk databases and blacklists.
• Pseudonymity – addresses are not directly tied to identities, so firms must link on-chain activity to verified customers through their own data and off-chain intelligence.

Regulators in many jurisdictions (for example, US, UK, EU) now explicitly require crypto businesses to implement robust AML programmes, with registration or licensing and supervisory oversight.

How AML affects users

From a user’s perspective, AML shows up in several ways.

Onboarding and verification

• You are asked to provide identity documents and information when opening an account.
• Higher-risk users may face additional questions or documentation requests (EDD).
• Onboarding can take longer for complex cases or where documents need manual review.

Ongoing checks and monitoring

• Your transactions may be monitored for unusual patterns.
• You may be asked to explain the source of funds or purpose of certain transactions.
• Access to certain features or limits may depend on your verification level and risk profile.

Restrictions and reporting

• Some transactions may be delayed, blocked, or declined if they trigger AML alerts.
• Accounts can be frozen or closed if the firm suspects money laundering or sanctions breaches.
• Firms may file suspicious activity reports with authorities; they usually cannot tell you if or when this happens due to legal restrictions.

These measures are not accusations of wrongdoing; they are part of the firm’s legal obligations to prevent financial crime.

Common AML red flags

Examples of activity that may trigger AML scrutiny include:

• Rapid deposits and withdrawals with no clear business or personal rationale.
• Use of multiple accounts or identities to move funds (possible money muling).
• Transactions linked to high-risk jurisdictions, mixers, or known illicit addresses.
• Structuring: breaking up large amounts into smaller transactions to avoid thresholds.
• Sudden changes in behaviour (for example, dormant account suddenly moving large sums).
• Inconsistent information (for example, declared income vs transaction volumes).

For crypto, additional red flags include:

• Frequent use of privacy tools or mixers.
• Deposits from addresses associated with hacks, scams, or darknet markets.
• Complex layering across multiple chains and services with no clear purpose.

Regulatory landscape

AML rules are enforced by regulators and supervisors in each jurisdiction, guided by international standards.

Key bodies and standards

• FATF (Financial Action Task Force) – sets global AML/CFT standards and recommendations, including for virtual assets and VASPs.
• National regulators – for example:
  • FinCEN and federal regulators in the US.
  • FCA and HM Treasury in the UK.
  • National competent authorities in EU member states under AMLD (Anti-Money Laundering Directives).
• Sector-specific rules – banks, payment institutions, crypto firms, and other designated entities have tailored requirements.

Obligations for crypto businesses

Depending on the jurisdiction, crypto firms may need to:

• Register or obtain a licence to operate.
• Implement AML/CFT policies and controls.
• Conduct KYC/CDD and ongoing monitoring.
• Comply with the Travel Rule for certain transfers.
• File suspicious activity and sanctions-related reports.
• Keep records for specified periods and cooperate with investigations.

Non-compliance can lead to fines, licence revocation, and criminal liability for the firm and individuals.

Good practices for users

To reduce friction and stay compliant:

• Provide accurate, complete, and up-to-date information during onboarding and verification.
• Respond promptly to requests for additional documents or explanations.
• Be prepared to explain the source of funds for large or unusual transactions.
• Use official channels only for communications and document submission.
• Understand that certain jurisdictions, counterparties, or wallet addresses may be treated as higher risk under AML rules.
• Never attempt to hide your identity, split transactions to avoid checks, or use others’ accounts to move funds.

Good practices for firms

For financial and crypto businesses implementing AML:

• Design AML programmes that are risk-based, documented, and regularly updated.
• Invest in reliable KYC, transaction monitoring, and screening tools.
• Train staff thoroughly and maintain a strong compliance culture.
• Cooperate with regulators and law enforcement while respecting user rights and data protection laws.
• Clearly communicate AML requirements and processes to users in plain language.
• Continuously monitor and tune systems to balance effectiveness, false positives, and user experience.