Crypto AML regulations require businesses that exchange, transfer or hold crypto for others to know who their customers are, check who they are dealing with on-chain, avoid sanctioned parties, send and receive originator and beneficiary data on transfers (the Travel Rule), keep records and report suspicious activity. The details depend on the jurisdiction. The same core obligations recur across regimes, reflecting international standards set by the Financial Action Task Force (FATF), which many countries apply. This guide sets out what those obligations usually mean in day-to-day operations for exchanges, OTC desks and active P2P traders. It points to official sources and is not legal advice.
What crypto AML regulations cover
Anti-money laundering (AML) and counter-terrorist financing (CTF) rules for crypto apply existing financial-crime law to a new kind of value transfer rather than creating a separate body of law. Binding rules are national or regional, with their own definitions, licensing regimes and thresholds. Whether you are regulated at all usually depends on whether you exchange, transfer or hold crypto as a business for other people.
The asset being digital does not change the obligations. The US Treasury’s sanctions office states in its FAQ on digital currency that the obligations are the same whether a transaction is denominated in digital currency or traditional fiat currency. It also expects digital currency platforms, exchangers and payment processors to run risk-based compliance programmes.
Core obligations: due diligence, screening, sanctions checks and records
Different regimes word them differently, but most crypto money laundering regulations come down to five recurring duties, summarised below.
| Obligation | What it usually means in practice |
|---|---|
| Customer due diligence (CDD/KYC) | Identify and verify customers, understand the purpose of the relationship, and apply enhanced checks where risk is higher. |
| Transaction and counterparty monitoring | Watch for unusual patterns and assess the wallets that funds come from or go to, not only the customer’s identity. |
| Sanctions compliance | Do not deal with sanctioned persons or their property, including wallet addresses that authorities have designated. |
| Travel Rule | Send and receive originator and beneficiary information with qualifying transfers between service providers. |
| Record keeping and reporting | Keep identification and transaction records and report suspicious activity to the competent authority. |
Screening sits between monitoring and sanctions compliance: it is the operational step of checking a specific wallet address before accepting or sending funds. Our explainer on what an AML check in crypto involves covers how that check is usually structured.
The Travel Rule in plain terms
The Travel Rule applies a long-standing wire-transfer requirement to crypto: when a service provider sends a qualifying transfer, information about the originator and the beneficiary must travel with it to the receiving provider, so that each side has the data it needs to screen and monitor the transfer. Because a blockchain carries addresses but no names, this data is exchanged off-chain.
Two official examples:
- United Kingdom. The Financial Conduct Authority’s statement on Travel Rule expectations says the rule requires UK cryptoasset businesses to collect, verify and share information about cryptoasset transfers, effective from 1 September 2023. Where the counterparty is in a jurisdiction that has not implemented the rule, the sending firm should still collect, verify and store the information before the transfer, and the receiving firm should decide on a risk basis whether to make incoming assets with missing information available to the beneficiary.
- European Union. The European Banking Authority issued its Travel Rule guidelines on 4 July 2024 under Regulation (EU) 2023/1113, applying from 30 December 2024. They set out what information should accompany crypto-asset transfers, how to detect and handle missing information, and how to identify and verify the originator or beneficiary of transfers to or from a self-hosted address.
Implementation remains uneven across jurisdictions, so in practice firms need documented, risk-based decisions for transfers that arrive with incomplete information.
What this means for exchanges, OTC desks and P2P traders
The obligations land differently depending on the business model.
- Exchanges carry the fullest set of obligations: licensing or registration, CDD on every customer, ongoing monitoring, sanctions screening, Travel Rule messaging with other providers, and record keeping. Transfers to and from self-hosted wallets need their own procedure.
- OTC desks typically handle fewer but larger trades, which puts more weight on enhanced due diligence, on source of funds and on checking the specific wallet that will send or receive the assets before settlement.
- Active P2P traders fall into a grey zone: whether someone trading regularly is treated as a regulated business depends on national law, and the answer can change with volume and frequency. Even without a licence requirement, sanctions law still applies, and tainted funds may be frozen or rejected when moved on to an exchange.
Regulatory direction also shifts. In the United States, FinCEN announced on 5 October 2026 that it was withdrawing two proposed digital asset rules: one on unhosted-wallet transactions and one that would have treated crypto mixing as a class of transactions of primary money laundering concern. The unhosted-wallet proposal, published by the Treasury on 18 December 2020, would have required banks and money services businesses to report transactions exceeding $10,000 in value and to keep records and verify identity for transactions greater than $3,000 involving unhosted wallets. Because these proposals were never finalised, the withdrawal does not by itself change obligations already in force.
How to prevent money laundering exposure when you receive crypto
For a small exchange, OTC desk or high-volume trader, a practical way to prevent money laundering exposure in cryptocurrency is a repeatable routine applied before funds are accepted or released:
- Know the counterparty. Collect identity and, where the size or pattern of the trade calls for it, evidence of source of funds. Our guide on how to prove source of funds in crypto shows what that evidence usually looks like.
- Screen the sending or receiving address. Check direct sanctions exposure, stablecoin freeze status and indirect exposure through previous hops, such as mixers, scam proceeds or stolen funds.
- Set thresholds and escalation rules in advance. Decide which risk levels are accepted, which need a second review and which are declined, and apply those rules consistently.
- Record the decision. Keep the screening result, the reason for accepting or declining, and the date. Most regimes expect records to be retained.
- Re-check before moving funds on. Risk can change after receipt, for example if an address is later designated or a stablecoin issuer freezes it.
Sanctions screening deserves particular care: a Treasury press release of 7 August 2026 notes that OFAC may impose civil penalties for sanctions violations on a strict liability basis. Our article on crypto sanctions screening and OFAC explains how designated addresses are published and checked.
Where wallet screening fits and where it does not
Wallet screening is one control within an AML programme, not the programme itself. It answers a narrow, important question: what does the on-chain history of this address suggest about the funds? It does not identify the person behind the address or replace KYC and the Travel Rule data exchange, and a clean result is not a legal clearance. A high-risk result does not prove wrongdoing either; it is a signal for review, more information or a decision to decline.
SafeON is built for that screening step. It checks a TRON (TRC20) or BNB Smart Chain address, plus Ethereum for freeze status, and returns a 0-100 risk score with the reasons: exposure to OFAC-sanctioned addresses, USDT freeze or blacklist status, and where funds came from across several hops, including mixers, darknet markets, scams, stolen funds and exchanges. Each report comes with a PDF for your records, watched addresses trigger alerts (including Telegram), and businesses can use an API. SafeON does not unfreeze, release or recover funds, and it does not provide legal advice. Check a wallet’s risk on SafeON before you accept or send funds.
FAQ
What are the main AML regulations for crypto?
Most regimes combine customer due diligence, transaction monitoring, sanctions compliance, the Travel Rule, record keeping and suspicious activity reporting. Binding rules are national or regional, such as the UK’s Money Laundering Regulations or Regulation (EU) 2023/1113 for transfer information in the EU.
Does the Travel Rule apply to P2P trades?
The Travel Rule is aimed at regulated service providers, so a transfer directly between two individuals’ self-hosted wallets is generally not covered in the same way. When either side uses a regulated exchange, however, that exchange may have to collect information about the self-hosted wallet and, in some regimes, verify who controls it.
How can a business prevent money laundering in cryptocurrency?
By combining identity checks, source-of-funds evidence where warranted, screening every counterparty address before settlement, pre-set escalation rules, documented decisions and periodic re-screening.
Is screening a counterparty wallet required by law?
Few laws name wallet screening as such. Regulated businesses must, however, monitor transactions and avoid dealing with sanctioned parties, which in practice is very difficult to demonstrate without screening addresses. Confirm the specific expectation with your regulator or legal adviser.