У 2025 році crypto AML compliance перестала бути back-office policy problem і стала balance-sheet risk. Regulators issued 139 penalties across sectors in the first half of 2025, totaling $1.23 billion, while average fines for non-compliant crypto businesses globally rose to $3.8 million. До 2025 року total crypto exchange AML fines already surpassed $1 billion, а OKX faced $504 million in penalties for systemic AML failures tied to more than $5 billion in suspicious transactions, according to the enforcement data in the brief. Саме це багато teams пропускають: AML більше не про те, щоб довести, що ви did KYC; це про infrastructure, яка не зламається under volume, audit pressure або cross-border scrutiny.
Ворог - не crypto itself. Ворог - compliance stack, який досі поводиться як bank's weekend batch job, тоді як crypto moves 24/7, across jurisdictions, through addresses that don't always map cleanly to named account holders. Якщо controls can't pause a transfer, trace a wallet, retain right evidence and reconcile ledger in real time, then your "program" is really just paper trail with marketing budget.
Зміст
- Чому crypto AML compliance стала balance-sheet issue
- Regulatory framework, якого реально треба дотримуватися
- Building a complete AML program beyond onboarding
- Event-driven infrastructure for real-time compliance
- Implementing Travel Rule and self-hosted wallet controls
- The DeFi and permissionless blockchain compliance gap
- Making compliance your competitive advantage
Чому crypto AML compliance стала balance-sheet issue
Fines changed the conversation. Compliance miss колись означав remediation plan, consultant deck і багато internal meetings. Тепер це може стати direct hit to cash, runway and counterparty confidence, особливо для exchanges and infrastructure providers, які не мають capital buffer великого банку.
Чому legacy AML thinking fails in crypto
Traditional AML programs were built around slower rails, clear customer-account boundaries and human review model, який assumed time to intervene. Crypto не дає такої luxury. Funds can move fast, across chains and venues, і operational burden - це не just screening a customer once, а repeated screening as behavior changes.
Тому "we have KYC" саме по собі мало що означає. Team can verify identity at signup and still miss suspicious flows, sanctions exposure або counterparty risk once customer active. Primary failure mode - treating compliance as front-door check instead of live control system.
Практичне правило: якщо compliance team learns about risky transfer only after settlement, controls too late to matter.
Enforcement trend також пояснює boardroom urgency. 2025 data in the brief shows crypto AML failure has become material operating expense, not rare legal event. Це змінює, як finance teams think about reserves, як product teams think about release gates, і як CTOs think about architecture.
Що ламається першим у production
Першим зазвичай ламається manual review queue. Потім screening stack starts producing alert backlogs. After that, finance and compliance stop trusting same transaction records, бо ledger, case system and settlement flow aren't aligned.
Саме тут infrastructure question starts to matter more than policy document. Sustainable crypto AML program має control when funds move, what evidence attached to movement and who can approve exceptions. Якщо ці controls live in separate tools, team spends more time reconciling systems than preventing risk.
Regulatory framework, якого реально треба дотримуватися
Rules vary by jurisdiction, but operating baseline surprisingly consistent. Customer due diligence, transaction monitoring, sanctions screening, recordkeeping and suspicious activity reporting show up everywhere in some form, even if local terminology changes.
FATF set the baseline
Major turning point came in 2019, when FATF extended global AML framework to virtual assets and VASPs, effectively bringing crypto intermediaries into same risk-based control logic used in traditional finance. By 2025, FATF reported that 85 of 117 jurisdictions had passed legislation implementing crypto Travel Rule, but only 1 jurisdiction was fully compliant with FATF Recommendation 15 in that assessment, which shows how wide adoption and weak execution can coexist. Practical meaning simple: rule spread fast, but implementation still varies sharply by market. FATF implementation overview
EU, UK and US converge on the same controls
In the EU, European Banking Authority says revised AML/CFT framework extends to CASPs through Regulation (EU) 2023/1113, and CASPs must be authorised, show adequate control mechanisms, and make crypto transfers traceable by including originator and beneficiary information. Same framework requires specific measures for self-hosted addresses, which means control model has to sit inside transaction workflow, not outside it. EBA crypto AML framework guidance
UK similar in structure. FCA became AML supervisor for cryptoasset businesses in January 2020, and firms that provide exchange or custody services by way of business must register and meet AML requirements, including CDD, ongoing monitoring, sanctions and PEP screening, and SAR filing. UK crypto AML obligations
In the US, FinCEN's AML program rules for money services businesses require four core elements: written internal policies, designated compliance officer, training and independent review/testing. Complete crypto AML stack also needs transaction monitoring, sanctions screening, suspicious-activity reporting and recordkeeping layered around those core program pillars. FinCEN AML program requirements
Jurisdictions differ, але operational outcome той самий. Regulated firms have to know who customer is, what transaction is doing, and whether flow makes sense before they let value move.
One internal link that matters for product teams
Якщо business також думає про tokenized products and regulatory boundaries, adjacent issue - market structure. Саме тому teams often pair AML design with broader compliance planning. Useful reference - BroLabel MiCA explainer, especially when product and compliance teams need shared language around authorization, governance and control design.
Building a complete AML program beyond onboarding
Program that stops at signup incomplete. FATF-style preventive controls expect customer due diligence on new and existing customers, transaction recordkeeping, risk-based internal controls, enhanced due diligence in specific cases, and prompt suspicious activity reporting. Це означає, що compliance має stay active after onboarding, not just before account creation. BIS AML preventive controls
Continuous controls beat one-time verification
Practical mistake I see most often: teams build strong KYC workflow and assume they've built AML. They haven't. KYC identifies customer, AML watches behavior, screens counterparties and preserves evidence as relationship evolves.
Тому continuous monitoring має sit on same operating path as onboarding. Якщо deposit arrives from risky source, system should be able to flag it, hold it, enrich it and route it for review without asking operations to manually stitch together five tools. Workflow має бути designed for action, not just documentation.
Effective operating flow usually looks like this:
- Customer onboarding and identity capture. Collect customer data once, then reuse it across monitoring, screening and reporting instead of re-entering it in separate systems.
- Ongoing customer due diligence. Re-score customer risk as behavior changes, not just at account opening.
- Transaction monitoring. Watch deposits, confirmations and withdrawals as they happen, so alerts tied to real transfer events.
- Sanctions and PEP screening. Keep screening active continuously, бо risk exposure changes after onboarding.
- Reporting and escalation. Route suspicious activity into case workflow that supports SAR or STR filing and keeps evidence trail intact.
What good looks like in a live workflow
WebSocket events useful here because they let compliance team see transaction state changes as they happen. Deposit observed, then confirmed, then queued for withdrawal gives auditable chain of events, and each step can trigger different control decision.
Operational lesson: if case team can't tell whether transaction still pending, confirmed or released, monitoring data isn't actionable enough for production use.
Cleanest implementation happens when policy and release logic sit together. Risky transfer doesn't just generate alert, it can pause release, trigger enhanced review or block execution entirely until required checks complete. Це difference between monitoring as report and monitoring as control.
Event-driven infrastructure for real-time compliance
Batch review is wrong shape for crypto. Nightly export might work for retrospective analysis, but it's too slow for deposit chains, immediate withdrawals or automated routing through multiple systems. Real-time compliance needs event-driven infrastructure that treats every material change as observable state transition.
Why event streams matter
Useful pattern simple. Platform emits events such as deposit.observed, deposit.confirmed and withdrawal.requested, then compliance engine evaluates policy against each event before funds released. That allows risk signals to arrive at same speed as transaction, which is only timing that matters in production.
Architecture also creates better accountability across teams. Product can see where users stall. Compliance can see which rules fired. Finance can see whether ledger and settlement record still agree. Nobody has to argue over whose spreadsheet is current.
Practical implementation usually depends on three things:
- Append-only operating ledger. Immutable records make it easier to show what happened, when it happened and what decision was made.
- Reconciliation support. Finance and compliance need same source of truth, or they'll spend half their time resolving mismatches.
- Scoped API keys with role-based access controls. Separation of duties only works if same person can't both initiate and approve sensitive actions.
Internal link for wallet teams
Teams wiring this into wallet flows usually need clearer view of how wallet APIs and event streams fit together. Right starting point is BroLabel crypto wallet API overview, especially if you're connecting wallets, policy engines and ledger records in one release flow.
Technical trade-off obvious. Batch systems easier to build at first, but they create blind spots compliance teams eventually unwind. Event-driven systems take more discipline upfront, but reduce after-the-fact reconciliation and make control environment auditable by design.
Implementing Travel Rule and self-hosted wallet controls
Travel Rule is where many crypto teams get stuck, because control requirements change depending on transfer path. Under EU transfer rules, CASPs must verify control of unhosted self-hosted wallets for transactions above EUR 1,000, while Travel Rule compliance applies to CASP-to-CASP transfers with no minimum threshold. Це створює split between wallet ownership checks and information-sharing obligations, and software has to handle both cleanly. EU transfer rules and wallet verification
Build the control into the signing flow
Safest pattern - connect compliance checks directly to transaction release. Якщо self-hosted wallet needs ownership verification, wallet should not reach signing until required checks pass. Якщо counterparty CASP involved, originator and beneficiary data should move with transfer before release, not after.
MPC signing with client-controlled Co-Signer useful here because it lets platform enforce policy without centralizing custody keys. BroSettlement's DKG/MPC 2-of-3 signing model is one example of that pattern, especially when signing policy needs to block release until identity, wallet ownership or Travel Rule checks complete. BroLabel also offers Travel Rule and AML screening workflows as part of wallet and settlement stack, which is relevant when compliance has to sit inside transaction path rather than separate review queue.
Edge cases that need explicit handling
Hardest failures are ones teams try to solve informally. Partial counterparty data, delayed responses from another CASP and jurisdiction mismatches all need documented path.
- Partial data: hold transfer until minimum required originator or beneficiary fields complete.
- Counterparty non-compliance: escalate to risk review and preserve reason for hold.
- Cross-border variation: apply stricter control when rules differ and document why that path was chosen.
Практичне правило: якщо transaction can bypass wallet verification by moving through second system, your control design has loophole, not workflow.
Internal link teams usually need here is BroLabel Travel Rule implementation overview, because implementation challenge isn't concept, it's making data collection, signing policy and audit trails line up in production.
The DeFi and permissionless blockchain compliance gap
There is no honest way to talk about crypto AML compliance without admitting that some parts of ecosystem sit outside traditional account-holder perimeter. BIS notes that old AML models built around trusted intermediaries are less effective on permissionless blockchains, and compliance has shifted toward edge enforcement at regulated off-ramps rather than network itself. BIS on permissionless blockchain AML gaps
What the regulated perimeter can and can't do
That doesn't mean regulated firms powerless. It means they can only control what passes through them. Once funds move to self-hosted wallets, peer-to-peer rails or DeFi protocols, attribution gets harder and evidence trail becomes less complete.
Regulatory answer in EU still leans heavily on CASPs to collect originator and beneficiary information and apply special measures for self-hosted addresses. That helps at point of transfer, but doesn't fully solve attribution once funds move beyond regulated entity. Control design has to reflect that limit instead of pretending it doesn't exist.
How to work within the gap
Right approach is risk-based, not magical. Flag unknown counterparties, escalate high-risk patterns and document basis for each decision. Якщо transfer touches permissionless venue, team should be able to show which controls ran, what evidence was available and where perimeter stopped.
That's where product teams need discipline. Якщо platform interacts with DeFi, compliance team should know exactly which parts under control and which parts only observable from edge. Anything else creates false sense of assurance, usually more dangerous than visible limitation.
Making compliance your competitive advantage
Firms that treat AML as infrastructure, not overhead, usually end up with cleaner operating model. Their onboarding faster because verification embedded. Their audit responses simpler because evidence already in ledger. Their partner reviews go better because they can explain controls without improvising.
What institutional readiness looks like
Strongest signal is not slide deck. It's system where controls already wired into execution.
- MPC threshold signing with a client-controlled Co-Signer keeps custody from becoming single point of failure.
- Real-time event streaming gives compliance and operations same live view of transaction state.
- Append-only ledgers with reconciliation support make it easier to defend records during review.
- Scoped API keys and role-based access controls enforce separation of duties in production, not just policy.
That combination hard to replicate quickly. Competitors can copy checklist. They can't copy mature control fabric without changing how product, finance and engineering teams work together.
Compliance becomes moat when it lowers friction for legitimate users and raises friction for bad actors at same time.
BroLabel fits this operating model as one infrastructure option because its stack combines embedded MPC wallets, real-time WebSocket events, immutable operating ledger and AML screening workflows in single API-first environment. Такий design matters when goal isn't just pass audit, but keep business governable as volume and jurisdictional scope grow.
Якщо ви designing or rebuilding crypto AML compliance, BroLabel can help connect signing policy, ledger evidence, wallet flows and real-time controls in one operating model. Відкрийте BroLabel, щоб побачити, як infrastructure supports MPC wallets, audit trails and compliance workflows built for production, not just policy reviews.