Introduction
Crypto money laundering hit a new scale in 2025. Chainalysis estimates the on-chain money-laundering ecosystem exceeded $82 billion last year, with Chinese-language laundering networks alone moving over $16 billion.
That's roughly a fifth of all identified illicit crypto activity flowing through a single network type.
Regulators noticed. Heading into 2026, compliance frameworks are converging fast across major jurisdictions:
- US: The GENIUS Act pulls stablecoin issuers under the Bank Secrecy Act
- EU: MiCA and AMLA regimes are harmonizing supervision
- UK: The FCA is opening a new authorization gateway
- Global: FATF's Travel Rule expectations keep tightening
Virtual asset service providers (VASPs), fintechs, and payments companies with any crypto exposure now face a higher compliance bar.
This article breaks down what crypto AML compliance requires, how the 2026 regulatory landscape looks across major jurisdictions, the red flags compliance teams need to watch, and the practices that separate audit-ready programs from ones headed for enforcement.
Key Takeaways
- Crypto AML is ongoing: risk-based KYC/KYB, transaction monitoring, Travel Rule sharing, and timely SARs.
- The GENIUS Act, EU AMLA, and UK FCA cryptoasset gateway are reshaping 2026 duties for stablecoins and digital assets.
- Enforcement such as KuCoin’s $297M resolution shows regulators no longer tolerate weak controls.
- Examination-ready programs scale through strong governance and dedicated financial crime expertise.
What Is Crypto AML Compliance?
Crypto AML compliance covers the regulations, internal policies, and procedures Virtual Asset Service Providers (VASPs) must follow to detect and prevent money laundering and terrorist financing on their platforms. It's the same core discipline that governs traditional banks, applied to an asset class that moves faster, crosses borders instantly, and often lacks a central intermediary.
Most VASPs carry a similar set of baseline obligations:
- Registration and licensing with the relevant regulator (FinCEN, FCA, national competent authorities, etc.)
- Appointing a Money Laundering Reporting Officer (MLRO) or equivalent compliance lead
- KYC/KYB at onboarding, calibrated to customer and product risk
- Ongoing transaction monitoring for suspicious patterns
- Recordkeeping sufficient to reconstruct activity for examiners
- Timely SAR filing when suspicious activity is identified
Why It Matters Beyond the Regulation Itself
Weak AML controls don't just invite fines. They cost firms banking relationships, damage reputations with institutional partners, and create operational losses when accounts get frozen mid-investigation. Individual enforcement actions in 2023-2025 ran into the billions of dollars for the largest exchanges. Regulators are no longer settling for symbolic penalties.
Two related problems often get conflated. Crypto fraud is illegally obtaining assets through scams or hacks. Money laundering is concealing the proceeds of that (or any other) illicit activity so it appears legitimate.
The two overlap constantly. A fraud victim's stolen funds often move through the same mixer or chain-hopping pattern a drug trafficker might use, which is why compliance teams need to watch for both.
In December 2025, the OCC conditionally approved national trust bank charters for five digital asset firms, including Fidelity Digital Assets and Paxos Trust Company, bringing them under the same supervisory standards as roughly 60 other OCC-regulated trust banks. Crypto compliance is increasingly expected to look and function like bank-grade compliance, not a lighter-touch version of it.
The 2026 Regulatory Landscape for Crypto AML
FATF's Recommendation 15 remains the global baseline for VA/VASP AML standards, but implementation is uneven. As of April 2025, only 1 of 138 assessed jurisdictions was fully compliant, and 29 were rated non-compliant. Firms operating across borders can't assume equivalent enforcement everywhere. They need jurisdiction-specific mapping.
United States
The GENIUS Act, enacted July 2025, brought every permitted payment stablecoin issuer under the Bank Secrecy Act as a financial institution. That means:
- A documented AML program and risk assessment
- A designated AML officer
- Suspicious transaction monitoring and SAR reporting
- Customer identification, verification, and enhanced due diligence
- Transaction blocking/freezing capability and OFAC sanctions screening
Detailed rulemaking is still working through notice-and-comment, so the statutory duties exist now while implementation specifics continue to firm up.
Meanwhile, most crypto exchanges and administrators remain classified as money services businesses (MSBs) under FinCEN, requiring BSA registration. The OCC's five conditional trust charter approvals in late 2025 reinforce that federal regulators want digital asset firms operating inside, not around, the existing bank supervisory structure.
European Union
MiCA, in force since 2023 with most provisions active since December 2024, standardizes licensing and disclosure for cryptoasset service providers (CASPs). Separately, MiCA-authorized CASPs are classified as obliged entities under the EU's AML Regulation. That brings requirements for:
- Customer and beneficial-owner verification
- Risk-based monitoring
- Enhanced scrutiny of transfers involving self-hosted wallets
The Anti-Money Laundering Authority (AMLA) became operational in July 2025, focused initially on supervisory convergence for high-risk sectors like CASPs, with direct supervisory powers scheduled for 2028. Together, MiCA and AMLA are building toward a Single AML Rulebook across all EU member states.
United Kingdom
The FCA's new cryptoasset authorization gateway opens September 30, 2026 and closes February 28, 2027. Firms conducting regulated crypto activities in or to the UK will need full FSMA authorization by October 25, 2027, when the new regime takes effect. Firms should start gap assessments well before the window opens. Authorization backlogs at other UK regulatory gateways have historically run long.
Other Jurisdictions
Other markets are moving in parallel. The UAE's VARA rolled out a dedicated Compliance and Risk Management Rulebook in mid-2025, and Singapore's MAS tightened licensing for offshore-only digital token service providers the same year. Any firm with cross-border exposure needs to track these frameworks too, not just the US, EU, and UK.
Crypto Money Laundering Risks & Red Flags
Crypto carries elevated money laundering risk for structural reasons. Pseudonymous wallet addresses, instant cross-border transfers, and the lack of a centralized clearinghouse make tracing harder. Mixers and privacy coins were built specifically to obscure transaction trails.
Chainalysis found that addresses tied to illicit activity received at least $154 billion in 2025, a 162% jump from the prior year, driven largely by sanctioned-entity volume. Even so, illicit activity stayed below 1% of total attributed crypto transaction volume. The risk is concentrated in specific networks and typologies, and it is growing fast.
Compliance teams should be watching for:
- Structuring: splitting transfers into smaller amounts to stay under reporting thresholds
- Chain-hopping: converting between assets or platforms to break the transaction trail
- Mixer or tumbler use: anonymity-enhancing services FATF treats as a standing red flag
- Dormant account reactivation: long inactivity followed by large, rapid withdrawals
- Unlicensed counterparties: transfers involving unregistered or unlicensed exchanges
- PEP involvement: politically exposed persons in account activity or beneficial ownership
None of these alone confirms illicit activity. Each one calls for enhanced due diligence on source of funds, transaction history, and customer behavior before you decide whether a SAR is warranted. Treating every red flag as guilt-by-default clogs the investigation queue and slows the cases that actually matter.
Best Practices for Crypto AML Compliance in 2026
Strong crypto AML programs share a handful of characteristics regulators consistently look for during examinations.
Governance and Board Oversight
Compliance can't function as an afterthought bolted onto the business side. Leadership needs to set the tone from the top, resource the compliance function adequately, and bring in specialized expertise, especially CAMS-certified professionals. That expertise helps design programs that scale as the business grows rather than needing a rebuild every 18 months.
Dynamic, Tailored Risk Assessments
Generic risk assessments don't hold up under examination. Programs need assessments tailored to the firm's actual products, customer base, and geographic footprint, with documented action plans tracked to completion, not filed away until next year's review.
Advanced Transaction and Blockchain Monitoring
Manual review doesn't scale to blockchain transaction volumes. Firms need analytics tools capable of:
- Real-time wallet risk scoring
- Fund-flow tracing across multiple hops
- Alert enrichment that reduces false positives and surfaces genuinely suspicious activity
Travel Rule Compliance
VASPs need working processes to collect, verify, and share originator and beneficiary information with counterparty VASPs on qualifying transfers. FATF data shows 73% of assessed jurisdictions have enacted Travel Rule legislation, but well over half haven't taken supervisory action on it yet. Enforcement pressure is likely to increase, not ease, through 2026.
Ongoing Training and Recordkeeping
Staff training and audit-ready documentation prove the compliance program works. Examiners want to see that policies translate into consistent staff behavior and that records can reconstruct any transaction or decision on demand.
Common Compliance Challenges & Lessons From Recent Enforcement
Recent cases make the stakes concrete. Binance's 2023 resolution totaled over $4.3 billion between DOJ and FinCEN penalties, plus a five-year monitorship, following BSA and sanctions violations.
More recently, KuCoin's operator agreed to pay nearly $300 million in 2025 after pleading guilty to operating an unlicensed money-transmitting business. The firm failed to register with FinCEN, lacked effective AML/KYC controls, and agreed to exit the US market for at least two years.
The pattern is consistent: registration gaps, weak controls, and delayed remediation draw the heaviest penalties. Beyond those headlines, several structural challenges still make crypto AML harder than traditional banking:
- Pseudonymity makes source-of-funds analysis harder than in traditional banking
- DeFi and peer-to-peer platforms often lack a clear compliance obligor
- Privacy coins complicate transaction tracing even with sophisticated blockchain analytics
For fintechs and payments companies scaling into crypto without a built-out compliance function, outside expertise can close those gaps faster than building everything in-house. Pillars FinCrime Advisory supports growing companies across policy development, risk assessments, transaction monitoring optimization, and exam readiness.
Founder Joshua Douglas brings 12+ years of financial crime experience to engagements that help leadership teams balance growth ambitions with the compliance expectations regulators continue to enforce.
Frequently Asked Questions
Is there an AML certification for crypto?
CAMS (Certified Anti-Money Laundering Specialist) remains the broadest recognized AML credential and covers VASP-specific risk topics. ACAMS also offers a dedicated Certified Cryptoasset Anti-Financial Crime Specialist credential for deeper crypto-specific training.
How does AML apply to cryptocurrency?
VASPs must perform KYC/KYB at onboarding, run ongoing transaction monitoring, comply with Travel Rule data-sharing requirements, and file SARs when suspicious activity is identified. These obligations mirror traditional bank AML duties, adapted for blockchain-based transactions.
Do cryptocurrencies have a high money laundering risk?
Yes. Pseudonymity, cross-border reach, and the absence of centralized oversight make crypto attractive for laundering. That said, blockchain's public, permanent ledger helps investigators trace fund flows more effectively than cash ever allowed.
What is the FATF Travel Rule and does it apply to crypto?
The Travel Rule requires VASPs to obtain, hold, and securely transmit originator and beneficiary information on qualifying virtual asset transfers. It applies directly to crypto and is a core FATF standard that most major jurisdictions have now adopted in some form.
What happens if a crypto company fails to comply with AML regulations?
Recent cases show fines running into the hundreds of millions or billions of dollars, criminal pleas, multi-year monitorships, and forced market exits. Reputational damage and strained banking relationships are common additional consequences.
How can fintechs and payments companies prepare for 2026 AML changes?
Start with a compliance gap assessment against GENIUS Act, MiCA/AMLA, or FCA requirements relevant to your footprint. Update your risk assessment, invest in monitoring technology, and close remaining gaps with experienced compliance advisors ahead of the next exam cycle.
