Crypto AML Compliance Program

It is an integrated set of policies, controls, procedures and responsibilities that ensures an entity dealing in crypto-assets complies with the applicable rules (AML/CFT, sanctions, data protection and sector-specific requirements). It is not a standalone document, but an operating system backed by evidence you can demonstrate.

VASPs (exchanges, custodians, brokers, transfer providers) and, in general, anyone providing crypto-asset services on behalf of customers. They are already obliged entities for anti-money laundering purposes, and the new EU AML package reinforces this for CASPs from 2027.

In Spain, Law 10/2010 (anti-money laundering), with SEPBLAC as supervisor. In the EU, MiCA (Regulation 2023/1114) and the Travel Rule (Regulation 2023/1113). And the new AML package: the AMLR (Regulation 2024/1624), the Sixth AML Directive and the AMLA authority. The international standard is set by the FATF.

It is the methodology that combines on-chain, off-chain and product indicators to classify customers, counterparties and transactions and to apply proportionate measures: standard due diligence, enhanced due diligence (EDD) or blocking and escalation. Documenting the RBA lets you justify each decision to supervisors and auditors.

Verification of the identity of the customer (KYC) or of the company and its beneficial owners (KYB), segmented by type (retail, institutional, OTC, market maker). It combines document verification, biometrics and on-chain correlation, with jurisdictional assessment, PEP screening and identification of ultimate beneficial owners, plus enhanced due diligence procedures for higher-risk cases.

A SAR is a report of a suspicious transaction to the competent authority (in Spain, SEPBLAC). It is filed when there are signs of money laundering or terrorist financing (interaction with sanctioned addresses, cross-chain movements to hide traceability, large unexplained amounts). The Compliance Officer assesses the technical and legal evidence before reporting it, preserving confidentiality.

Yes. You should appoint a Compliance Officer with authority, independence and experience in virtual assets, who coordinates the risk-based approach, SARs, the relationship with supervisors and team training. The role can be in-house or outsourced to a specialized third party to strengthen independence and speed up the launch.

The AMLR (Regulation (EU) 2024/1624) is the EU’s anti-money laundering “single rulebook”, directly applicable from July 10, 2027. It makes CASPs direct obliged entities, strengthens KYC and beneficial ownership rules, restricts anonymous accounts and privacy coins, and sets a €10,000 cash limit. Preparing your program early is the only sensible strategy.

It depends on the business model (exchange, custodian, DeFi), the volume, the number of jurisdictions and the level of automation. We work with a defined scope after an initial diagnosis; write to us for a tailored quote.

It depends on the scope, but a baseline program (diagnosis, manual, policies and flows) is usually up and running within a few weeks. What takes longest is the technical integration of monitoring, end-to-end testing and team training.

VASP (Virtual Asset Service Provider) is the FATF term for providers of virtual asset services. CASP (Crypto-Asset Service Provider) is the equivalent EU term under MiCA. In practice they refer to the same players: exchanges, custodians, brokers and transfer providers.

It is checking customers, counterparties and addresses against sanctions lists (the US OFAC lists and the EU and UN lists) to detect and block transactions with sanctions risk. It is a critical obligation: failing to meet it leads to serious legal liability and to blocks by correspondent banks.

Yes, on regulated platforms. From 2027, the AMLR bans anonymous crypto-asset accounts and anonymity-enhancing coins (such as Monero or Zcash) at authorized EU providers, which will have to fully identify their customers.

They complement each other: MiCA regulates services and issuers; the Travel Rule governs the information that accompanies each transfer; and the AML package sets the anti-money laundering obligations. A good compliance program brings them together in a single system.

KYT (Know Your Transaction) is the risk analysis of transactions and addresses: clustering, exposure to illicit funds (hacks, ransomware, sanctions), mixer detection and scoring. It is the technical layer that feeds the program’s alerts and evidence.

AMLA is the new EU Anti-Money Laundering Authority, based in Frankfurt and created by Regulation (EU) 2024/1620. It will coordinate national supervisors and will directly supervise a group of high-risk entities (including large CASPs) from 2027–2028.

No. SEPBLAC remains Spain’s Financial Intelligence Unit and the main point of contact for obliged entities, now under AMLA’s technical coordination. It is a two-tier model: European supervision and national supervision with the same regulatory bar.