Key takeaways
- Compliance is a system of controls, not a single check at sign-up.
- Most regimes share the same core: know your customer, screen for sanctions, monitor activity, report suspicions and keep records.
- A risk-based approach scales effort to the actual risk of each customer, product and jurisdiction.
- Governance matters as much as tooling: someone senior must own the program and be accountable for it.
Every business that moves money carries a responsibility to keep that money away from criminals, sanctioned parties and terrorist financing. For companies working with digital assets, that responsibility is the same, but the tools and the risks look different. Transactions settle in minutes, cross borders by default and are recorded on public ledgers that anyone can inspect.
This guide walks through the building blocks of a modern compliance program for a business that touches digital assets, and how they fit together.
Start with a risk assessment
Regulators across major jurisdictions expect a risk-based approach, a principle set out in the Financial Action Task Force (FATF) Recommendations that most national anti-money laundering (AML) laws follow. Instead of applying identical checks to everyone, a business identifies where its real risks are and puts its strongest controls there.
A useful risk assessment looks at four dimensions:
- Customers: individuals or businesses, their industries, ownership structures and where they are based.
- Products and services: what a customer can do, how fast value moves, and whether it can leave the platform to unhosted wallets.
- Geography: the jurisdictions involved, including those subject to sanctions or identified by FATF as having strategic AML weaknesses.
- Delivery channels: whether onboarding is fully remote, and whether third parties introduce customers.
The assessment should be written down, reviewed at least annually and updated whenever the business launches a product or enters a market.
Know your customer, and your business customer
Customer due diligence (CDD) is the foundation. For individuals this usually means collecting and verifying identity information (often called KYC). For businesses it means know your business (KYB): confirming the company exists, understanding what it does, and identifying the people who own or control it, known as beneficial owners.
In practice, KYB often involves documents such as a business license or certificate of incorporation, a tax identification number, proof of a bank account, and identity and address verification for the people behind the business. On BitInvoices, for example, businesses can explore the product in sandbox mode, but must submit their business license, tax ID, bank account proof, personal ID and proof of address before accepting live payments.
Higher-risk relationships call for enhanced due diligence: more documentation, source-of-funds questions and closer monitoring. Due diligence is also not a one-time event. Customer information should be refreshed periodically and whenever something material changes.
Screen against sanctions lists
Sanctions are legal prohibitions, and in many jurisdictions they apply on a strict liability basis: dealing with a sanctioned party can be a violation even without intent. A compliance program screens customers and their beneficial owners against relevant lists, such as those maintained by the US Office of Foreign Assets Control (OFAC), the United Nations, the European Union and the UK.
For digital assets, screening extends to wallet addresses. Authorities have added specific blockchain addresses to sanctions lists, and blockchain analytics tools can flag when funds originate from, or are headed to, addresses associated with sanctioned entities or illicit activity.
Monitor transactions continuously
Onboarding checks tell you who a customer is. Transaction monitoring tells you whether their activity makes sense. Monitoring combines rules (for example, unusual volumes, rapid movement of funds in and out, or structuring just below reporting thresholds) with blockchain analytics that trace where funds have been.
Public ledgers are an advantage here: every movement leaves a permanent trail. The challenge is interpreting it well, which means tuning alerts to the business's actual risk profile and making sure a trained person reviews what the system flags.
Report suspicious activity
When monitoring or investigation reveals activity that may involve money laundering or other crimes, regulated businesses must file a report with the relevant financial intelligence unit, such as FinCEN in the United States. These reports are confidential, and in many jurisdictions it is an offence to tip off the customer that a report has been made.
Comply with the Travel Rule
When regulated businesses transfer digital assets between each other, many jurisdictions require them to send identifying information about the originator and beneficiary alongside the transfer. This is the Travel Rule, and it has become one of the most operationally demanding parts of crypto compliance. We cover it in detail in The Travel Rule, explained.
Keep records you can rely on
Most AML regimes require businesses to keep customer due diligence records and transaction records for a set period, commonly five years or more. Good record keeping is also what makes every other control credible: auditors, examiners and banking partners will want to see evidence, not assurances.
Records are most useful when they cannot be quietly changed. Immutable reports and on-chain references, such as storing the transaction hash, addresses and confirmations alongside each payment, make reconstruction straightforward.
Governance, training and independent testing
Controls only work if someone owns them. A credible program has:
- A designated compliance officer with the authority, resources and independence to do the job.
- Written policies and procedures that staff can actually follow.
- Training tailored to each role, refreshed regularly.
- Independent testing, such as an internal audit or external review, to check the program works as designed.
- Board or senior management oversight, with regular reporting on risks and incidents.
Compliance as a product decision
The most effective compliance programs are designed in, not bolted on. Decisions such as which jurisdictions to serve, which assets to support, whether to allow transfers to unhosted wallets and how onboarding flows work all shape a business's risk. Making those decisions with compliance at the table from the start produces products that are both safer and easier to scale.
This article is general information, not legal, tax or financial advice. Laws and regulatory guidance change frequently and vary by jurisdiction; it reflects our understanding at the time of writing. Seek qualified advice before acting on it.