In 2025, crypto AML compliance stopped being a back-office policy problem and became a balance-sheet risk. Regulators issued 139 penalties across sectors in the first half of 2025, totaling $1.23 billion, while average fines for non-compliant crypto businesses globally rose to $3.8 million. By 2025, total crypto exchange AML fines had already surpassed $1 billion, and OKX faced $504 million in penalties for systemic AML failures tied to more than $5 billion in suspicious transactions, according to the enforcement data in the brief. That's the part many teams miss, AML is no longer just about proving you did KYC, it's about building infrastructure that won't break under volume, audit pressure, or cross-border scrutiny.
The enemy is not crypto itself. The enemy is a compliance stack that still behaves like a bank's weekend batch job, while crypto moves 24/7, across jurisdictions, through addresses that don't always map cleanly to named account holders. If your controls can't pause a transfer, trace a wallet, retain the right evidence, and reconcile the ledger in real time, then your “program” is really just a paper trail with a marketing budget.
Table of Contents
- Why Crypto AML Compliance Became a Balance-Sheet Issue
- The Regulatory Framework You Actually Need to Follow
- Building a Complete AML Program Beyond Onboarding
- Event-Driven Infrastructure for Real-Time Compliance
- Implementing Travel Rule and Self-Hosted Wallet Controls
- The DeFi and Permissionless Blockchain Compliance Gap
- Making Compliance Your Competitive Advantage
Why Crypto AML Compliance Became a Balance-Sheet Issue
The fines changed the conversation. A compliance miss used to mean a remediation plan, a consultant deck, and a lot of internal meetings. Now it can become a direct hit to cash, runway, and counterparty confidence, especially for exchanges and infrastructure providers that don't have the capital buffer of a large bank.
Why legacy AML thinking fails in crypto
Traditional AML programs were built around slower rails, clear customer-account boundaries, and a human review model that assumed time to intervene. Crypto doesn't give you that luxury. Funds can move fast, across chains and venues, and the operational burden isn't just screening a customer once, it's screening them repeatedly as their behavior changes.
That's why “we have KYC” doesn't mean much on its own. A team can verify an identity at signup and still miss suspicious flows, sanctions exposure, or counterparty risk once the customer is active. The primary failure mode is treating compliance as a front-door check instead of a live control system.
Practical rule: if your compliance team only learns about a risky transfer after settlement, your controls are too late to matter.
The enforcement trend also explains the boardroom urgency. The brief's 2025 data shows crypto AML failure has become a material operating expense, not a rare legal event. That changes how finance teams think about reserves, how product teams think about release gates, and how CTOs think about architecture.
What breaks first in production
The first thing that usually breaks is the manual review queue. Then the screening stack starts producing alert backlogs. After that, finance and compliance stop trusting the same transaction records because the ledger, case system, and settlement flow aren't aligned.
That's where the infrastructure question starts to matter more than the policy document. A sustainable crypto AML program has to control when funds move, what evidence is attached to the movement, and who can approve exceptions. If those controls live in separate tools, the team will spend more time reconciling systems than preventing risk.
The Regulatory Framework You Actually Need to Follow
The rules vary by jurisdiction, but the operating baseline is surprisingly consistent. Customer due diligence, transaction monitoring, sanctions screening, recordkeeping, and suspicious activity reporting show up everywhere in some form, even if the local terminology changes.
FATF set the baseline
The major turning point came in 2019, when FATF extended its global AML framework to virtual assets and VASPs, effectively bringing crypto intermediaries into the same risk-based control logic used in traditional finance. By 2025, FATF reported that 85 of 117 jurisdictions had passed legislation implementing the crypto Travel Rule, but only 1 jurisdiction was fully compliant with FATF Recommendation 15 in that assessment, which shows how wide adoption and weak execution can coexist. The practical meaning is simple, the rule spread fast, but implementation still varies sharply by market. FATF implementation overview
EU, UK, and US converge on the same controls
In the EU, the European Banking Authority says the revised AML/CFT framework extends to CASPs through Regulation (EU) 2023/1113, and CASPs must be authorised, show adequate control mechanisms, and make crypto transfers traceable by including originator and beneficiary information. The same framework requires specific measures for self-hosted addresses, which means the control model has to sit inside the transaction workflow, not outside it. EBA crypto AML framework guidance
The UK is similar in structure. The FCA became the AML supervisor for cryptoasset businesses in January 2020, and firms that provide exchange or custody services by way of business must register and meet AML requirements, including CDD, ongoing monitoring, sanctions and PEP screening, and SAR filing. UK crypto AML obligations
In the US, FinCEN's AML program rules for money services businesses require four core elements, written internal policies, a designated compliance officer, training, and independent review/testing. A complete crypto AML stack also needs transaction monitoring, sanctions screening, suspicious-activity reporting, and recordkeeping layered around those core program pillars. FinCEN AML program requirements
The jurisdictions differ, but the operational outcome is the same. Regulated firms have to know who the customer is, what the transaction is doing, and whether the flow makes sense before they let value move.
One internal link that matters for product teams
If your business is also thinking about tokenized products and regulatory boundaries, the adjacent issue is market structure, which is why teams often pair AML design with broader compliance planning. A useful reference is BroLabel's MiCA explainer, especially when product and compliance teams need a shared language around authorization, governance, and control design.
Building a Complete AML Program Beyond Onboarding
A program that stops at signup is incomplete. FATF-style preventive controls expect customer due diligence on new and existing customers, transaction recordkeeping, risk-based internal controls, enhanced due diligence in specific cases, and prompt suspicious activity reporting. That means compliance has to stay active after onboarding, not just before account creation. BIS AML preventive controls
Continuous controls beat one-time verification
The practical mistake I see most often is this, teams build a strong KYC workflow and assume they've built AML. They haven't. KYC identifies the customer, AML watches behavior, screens counterparties, and preserves evidence as the relationship evolves.
That's why continuous monitoring has to sit on the same operating path as onboarding. If a deposit arrives from a risky source, the system should be able to flag it, hold it, enrich it, and route it for review without asking operations to manually stitch together five different tools. The workflow has to be designed for action, not just documentation.
An effective operating flow usually looks like this:
- Customer onboarding and identity capture. Collect the customer data you need once, then reuse it across monitoring, screening, and reporting instead of re-entering it in separate systems.
- Ongoing customer due diligence. Re-score customer risk as behavior changes, not just at account opening.
- Transaction monitoring. Watch deposits, confirmations, and withdrawals as they happen, so alerts are tied to real transfer events.
- Sanctions and PEP screening. Keep screening active on a continuing basis, because risk exposure changes after onboarding.
- Reporting and escalation. Route suspicious activity into a case workflow that supports SAR or STR filing and keeps the evidence trail intact.
What good looks like in a live workflow
WebSocket events are useful here because they let the compliance team see transaction state changes as they happen. A deposit that is observed, then confirmed, then queued for withdrawal gives you an auditable chain of events, and each step can trigger a different control decision.
Operational lesson: if the case team can't tell whether a transaction is still pending, confirmed, or released, your monitoring data isn't actionable enough for production use.
I've seen the cleanest implementation when policy and release logic sit together. A risky transfer doesn't just generate an alert, it can pause the release, trigger enhanced review, or block execution entirely until the required checks are complete. That's the difference between monitoring as a report and monitoring as a control.
Event-Driven Infrastructure for Real-Time Compliance
Batch review is the wrong shape for crypto. A nightly export might work for retrospective analysis, but it's too slow for deposit chains, immediate withdrawals, or automated routing through multiple systems. Real-time compliance needs event-driven infrastructure that treats every material change as an observable state transition.
Why event streams matter
The useful pattern is simple. The platform emits events such as deposit.observed, deposit.confirmed, and withdrawal.requested, then the compliance engine evaluates policy against each event before funds are released. That allows risk signals to arrive at the same speed as the transaction, which is the only timing that matters in production.
This architecture also creates better accountability across teams. Product can see where users stall. Compliance can see which rules fired. Finance can see whether the ledger and settlement record still agree. Nobody has to argue over whose spreadsheet is current.
A practical implementation usually depends on three things:
- An append-only operating ledger. Immutable records make it easier to show what happened, when it happened, and what decision was made.
- Reconciliation support. Finance and compliance need the same source of truth, or they'll spend half their time resolving mismatches.
- Scoped API keys with role-based access controls. Separation of duties only works if the same person can't both initiate and approve sensitive actions.
Internal link for wallet teams
Teams that are wiring this into wallet flows usually need a clearer view of how wallet APIs and event streams fit together. The right starting point is BroLabel's crypto wallet API overview, especially if you're connecting wallets, policy engines, and ledger records in one release flow.
The technical trade-off is obvious. Batch systems are easier to build at first, but they create blind spots that compliance teams eventually have to unwind. Event-driven systems take more discipline upfront, but they reduce after-the-fact reconciliation and make the control environment auditable by design.
Implementing Travel Rule and Self-Hosted Wallet Controls
The Travel Rule is where a lot of crypto teams get stuck, because the control requirements change depending on the transfer path. Under EU transfer rules, CASPs must verify control of unhosted self-hosted wallets for transactions above €1,000, while Travel Rule compliance applies to CASP-to-CASP transfers with no minimum threshold. That creates a split between wallet ownership checks and information-sharing obligations, and the software has to handle both cleanly. EU transfer rules and wallet verification
Build the control into the signing flow
The safest pattern is to connect compliance checks directly to transaction release. If a self-hosted wallet needs ownership verification, the wallet should not reach signing until the required checks pass. If a counterparty CASP is involved, originator and beneficiary data should move with the transfer before release, not after.
MPC signing with a client-controlled Co-Signer is useful here because it lets the platform enforce policy without centralizing custody keys. BroSettlement's DKG/MPC 2-of-3 signing model is one example of that pattern, especially when the signing policy needs to block release until identity, wallet ownership, or Travel Rule checks are complete. BroLabel also offers Travel Rule and AML screening workflows as part of its wallet and settlement stack, which is relevant when compliance has to sit inside the transaction path rather than in a separate review queue.
Edge cases that need explicit handling
The hardest failures are the ones teams try to solve informally. Partial counterparty data, delayed responses from another CASP, and jurisdiction mismatches all need a documented path.
- Partial data: hold the transfer until the minimum required originator or beneficiary fields are complete.
- Counterparty non-compliance: escalate to risk review and preserve the reason for the hold.
- Cross-border variation: apply the stricter control when rules differ and document why that path was chosen.
Practical rule: if a transaction can bypass wallet verification by moving through a second system, your control design has a loophole, not a workflow.
The internal link teams usually need here is BroLabel's Travel Rule implementation overview, because the implementation challenge isn't the concept, it's making data collection, signing policy, and audit trails line up in production.
The DeFi and Permissionless Blockchain Compliance Gap
There's no honest way to talk about crypto AML compliance without admitting that some parts of the ecosystem sit outside a traditional account-holder perimeter. BIS notes that old AML models built around trusted intermediaries are less effective on permissionless blockchains, and that compliance has shifted toward edge enforcement at regulated off-ramps rather than the network itself. BIS on permissionless blockchain AML gaps
What the regulated perimeter can and can't do
That doesn't mean regulated firms are powerless. It means they can only control what passes through them. Once funds move to self-hosted wallets, peer-to-peer rails, or DeFi protocols, attribution gets harder and the evidence trail becomes less complete.
The regulatory answer in the EU still leans heavily on CASPs to collect originator and beneficiary information and apply special measures for self-hosted addresses. That helps at the point of transfer, but it doesn't fully solve attribution once funds move beyond the regulated entity. The control design has to reflect that limit instead of pretending it doesn't exist.
How to work within the gap
The right approach is risk-based, not magical. Flag unknown counterparties, escalate high-risk patterns, and document the basis for each decision. If a transfer touches a permissionless venue, the team should be able to show which controls ran, what evidence was available, and where the perimeter stopped.
That's also where product teams need to stay disciplined. If the platform interacts with DeFi, the compliance team should know exactly which parts are under control and which parts are only observable from the edge. Anything else creates a false sense of assurance, which is usually more dangerous than a visible limitation.
Making Compliance Your Competitive Advantage
The firms that treat AML as infrastructure, not overhead, usually end up with a cleaner operating model. Their onboarding is faster because verification is embedded. Their audit responses are simpler because the evidence is already in the ledger. Their partner reviews go better because they can explain controls without improvising.
What institutional readiness looks like
The strongest signal is not a slide deck. It's a system where controls are already wired into execution.
- MPC threshold signing with a client-controlled Co-Signer keeps custody from becoming a single point of failure.
- Real-time event streaming gives compliance and operations the same live view of transaction state.
- Append-only ledgers with reconciliation support make it easier to defend records during review.
- Scoped API keys and role-based access controls enforce separation of duties in production, not just in policy.
That combination is hard to replicate quickly. Competitors can copy a checklist. They can't copy a mature control fabric without changing how their product, finance, and engineering teams work together.
Compliance becomes a moat when it lowers friction for legitimate users and raises friction for bad actors at the same time.
BroLabel fits this operating model as one infrastructure option because its stack combines embedded MPC wallets, real-time WebSocket events, an immutable operating ledger, and AML screening workflows in a single API-first environment. That kind of design matters when the goal isn't just to pass an audit, but to keep the business governable as volume and jurisdictional scope grow.
If you're designing or rebuilding crypto AML compliance, BroLabel can help you connect signing policy, ledger evidence, wallet flows, and real-time controls in one operating model. Visit BroLabel to see how its infrastructure supports MPC wallets, audit trails, and compliance workflows that are built for production, not just policy reviews.