Crypto / VASP AML

1. Definition #

Crypto AML is the process of assessing ML/TF/PF risk from virtual assets, wallet flows, exchanges, VASPs, token transfers, on-chain exposure and fiat on/off ramps.

2. Why It Matters #

Virtual assets can move quickly across geographies and may involve pseudonymous wallets, unregulated VASPs, high-risk services or sanctioned addresses.

3. Common Triggers and Use Context #

• Customer is a VASP or crypto business.
• Customer source of funds includes crypto.
• Transaction involves wallet address, exchange, broker or OTC desk.
• Customer receives/sends virtual assets.
• Blockchain tool identifies high-risk exposure.
• Transfer requires Travel Rule analysis under implementation policy.

4. Source Basis #

• SRC-FATF-001: Recommendation 15 and related preventive measures.
• SRC-FATF-003: FATF virtual assets/VASP guidance.
• Jurisdiction layer: VASP licensing, Travel Rule scope and transaction thresholds are jurisdiction-specific. Verify them in current primary law, regulator guidance and the Regulation Map before operational use.

5. Practitioner workflow: VASP customer #

1. Identify VASP activity type: exchange, transfer, custody, brokerage, issuance, payment, other.
2. Verify licensing/registration status where required by the institution-specific policy.
3. Identify ownership, management and controllers.
4. Review AML/CFT policy, sanctions controls and Travel Rule controls if available.
5. Screen VASP, UBOs, directors and key wallets if available.
6. Check adverse media, enforcement and regulatory warnings.
7. Assess geography, customer base and product risk.
8. Produce VASP due diligence memo.

6. Practitioner workflow: crypto source of funds #

1. Identify wallet addresses and transaction hashes where available.
2. Identify asset, network and transfer path.
3. Check exposure using approved blockchain analytics tool if available.
4. Identify exchange/on-ramp/off-ramp.
5. Ask for evidence of acquisition where appropriate.
6. Assess whether crypto source is consistent with customer profile.
7. Escalate high-risk exposure.

7. High-risk crypto exposure examples #

• Sanctioned address or sanctioned exchange exposure.
• Mixer/tumbler exposure.
• Darknet market exposure.
• Ransomware, scam, fraud or stolen funds cluster exposure.
• Unlicensed exchange used as main source of funds.
• Wallet layering with no economic rationale.
• Rapid movement through multiple wallets before conversion to fiat.

8. Evidence to collect #

• Wallet addresses.
• Transaction hashes.
• Network/chain name.
• Exchange/VASP account statements if available.
• Blockchain analytics report or screenshot.
• Source of crypto acquisition evidence.
• VASP licensing evidence.
• Travel Rule data where applicable.

9. Decision matrix #

10. Output Pattern #

# Crypto AML Memo

Subject: [customer/VASP/wallet/transaction]
Activity type: [VASP/customer SOF/transfer]
Licensing status: [verified/unverified/not applicable]
Wallets/transactions reviewed: [list]
Blockchain exposure: [summary]
Sanctions exposure: [summary]
Travel Rule context: [if applicable]
Source of funds: [assessment]
Risk rating: [low/medium/high/critical]
Recommendation: [proceed/EDD/escalate/decline]
Source basis: SRC-FATF-001; SRC-FATF-003

11. Obfuscation, higher-risk services and attribution limits#

A crypto review should distinguish what the evidence shows from what it only suggests.

Relevant review dimensions include:

• whether the customer controls the wallet;
• whether counterparties are hosted, unhosted, regulated, offshore or otherwise higher risk;
• rapid movement across assets, chains or services;
• use of services designed or commonly used to reduce traceability;
• sanctions, fraud, theft or other adverse exposure;
• gaps between blockchain activity, exchange records and the claimed SoF;
• reliability and date of any wallet-attribution data.

Do not treat analytics labels as verified identity. Record attribution confidence, source limitations and the point at which specialist or MLRO review is required. Use Source of Wealth and Source of Funds for the canonical plausibility method.