A compliance officer at a US exchange opens the examiner's letter. The findings repeat every cycle. Monitoring ran only at onboarding. Suspicious transaction reports were filed late. The license renewal stalled on registration gaps. AML compliance for a crypto exchange is not one task. It is a stack of five obligations a virtual asset service provider, or VASP, must run continuously. Miss any layer and the license, the banking partners, or both come under pressure.
What AML Compliance Means for a Crypto Exchange
AML compliance for a crypto exchange is the set of anti-money-laundering and counter-terrorist-financing obligations a VASP must meet to operate legally. The obligations are set by the FATF Recommendations for virtual assets and, in the United States, by FinCEN's money services business rules. The exchange owns all five layers, not just the customer check at onboarding.
A VASP is the regulatory label for any entity that exchanges, transfers, or custodies virtual assets for customers. An exchange wears that label the moment it lists a token pair. Its AML duties are not a copy of a bank's program. They sit on top of on-chain addresses and transactions that move in seconds, across chains, and often through mixers.
That speed changes the shape of the work. A bank screens a payment against a name list and a counterparty database. An exchange screens a deposit that may have passed through a mixer three hops upstream, and the exposure appears only when the fund path is traced. The customer file does not carry that signal. The chain does. This is why one of the five obligations, transaction monitoring, has no bank-side equivalent at the same speed and must read the chain itself.
This article defines the framework and stays in the what. The operational how-to, the screening workflow, and the report export live in a separate implementation walkthrough. For the global standard that defines the VASP label and its obligations, see the FATF guidance on virtual assets.
The Five Core VASP Obligations Unpacked
The framework has five obligations. Each maps to a FATF Recommendation and, for US exchanges, to a FinCEN rule. A compliance program that covers only some of them fails the exam. The first two and the last are traditional compliance infrastructure. The middle two are where on-chain data does the heavy lifting.
1. Registration and licensing. Before serving customers, an exchange must register with its competent authority. In the United States that means registering as a money services business with FinCEN and holding state money transmitter licenses. The EU MiCA regime and New York's BitLicense add their own authorization steps. Operating without registration is itself a violation, separate from any later AML failure. The GENIUS Act (Public Law 119-27), signed into law July 2025 and effective January 2027 pending FinCEN rulemaking, brings payment stablecoin issuers under the Bank Secrecy Act, so exchanges handling stablecoin flows now sit inside the same AML perimeter as the issuers themselves.
2. Customer due diligence. The exchange must identify its customers, assess their risk, and apply enhanced due diligence to higher-risk relationships. Identity verification sits inside this pillar. It confirms who the customer claims to be. It does not see the transaction. A customer can pass onboarding and still send a deposit whose funds originated at a mixer, because identity and fund flow are different objects.
3. Transaction monitoring. The exchange must monitor ongoing activity for suspicious patterns. In crypto this means screening the addresses it interacts with and the transactions that touch its wallets, not just the customer file. Risk moves after onboarding, so the monitoring must be continuous and real time. An address cleared on Monday can be linked to illicit activity by Thursday, and a Friday deposit can carry funds that were clean three hops back and contaminated at the source.
4. Suspicious transaction reporting. When monitoring flags activity that looks like money laundering or terrorist financing, the exchange must file a report. In the United States the filing is a suspicious activity report. Other jurisdictions call it a suspicious transaction report. In the United States, the SAR filing window is 30 calendar days from initial detection (up to 60 if the suspect is unidentified). Other jurisdictions run tighter—Hong Kong requires filing within 24 hours. The report must carry enough evidence to satisfy an examiner.
5. Record-keeping. The exchange must retain the records that prove it ran the first four obligations. Under the US Bank Secrecy Act that means keeping CDD files, monitoring logs, and filed reports for five years. Examiners treat missing records as a missing control. The retention period outlives the customer relationship, so the logs must be auditable long after the wallet is gone.
| # | VASP Obligation | Regulatory Basis | On-Chain Monitoring Coverage |
|---|---|---|---|
| 1 | Registration & licensing | FinCEN MSB (31 CFR Ch. X), state MTL, EU MiCA, NY BitLicense | Institution (counsel) |
| 2 | Customer due diligence (identity) | FATF Rec 10 (CDD) | Institution (CDD vendor) |
| 3 | Transaction monitoring | FATF Rec 10 (ongoing CDD) + Rec 15 (RBA for VASPs) + Rec 20 (STR) | Phalcon Compliance: KYA + KYT |
| 4 | Suspicious transaction reporting | FinCEN SAR / STR | Phalcon Compliance: STR export across multiple key jurisdictions |
| 5 | Record-keeping | BSA 5-year retention | Phalcon Compliance screening log feeds it |
The five obligations are the VASP view. They describe what the exchange must do. They differ from an AML program's internal pillars, which cover policies, a designated compliance officer, training, independent audit, and the CDD program itself. That program view is a separate question for a separate read. Here the lens stays on the obligations the exchange must discharge.
Landing the Transaction Monitoring Pillar
Of the five obligations, transaction monitoring and suspicious transaction reporting are the two that depend on on-chain data an exchange cannot read with bank tooling. Phalcon Compliance covers these two pillars with KYA and KYT. It does not provide CDD identity verification, registration or licensing advice, or record-keeping infrastructure. The scope is the monitoring and screening layer.
KYA, or Know Your Address, screens a wallet address for AML and CFT risk using a labeled address database and the interaction graph around it. KYT, or Know Your Transaction, screens each token transfer inside a transaction, traces the fund path in the deposit or withdrawal direction, and assigns a risk level. Together they answer two different questions. KYA answers what the address is. KYT answers what the transaction does.
The risk engine behind both screens uses 17 risk indicators, from Sanctioned and Terrorist Financing to Mixing, Ransomware, and FATF Grey List Jurisdiction. Every screened address or transfer lands in one of six risk levels, from Critical down through High, Medium, Low, and Informational to No Risk. The levels are configurable, so a team maps each tier to its own internal policy and risk appetite. Default engines based on FATF guidance ship out of the box and can be edited to match the exchange's risk-based approach.
When a screen flags a transfer, an alert fires through the team's chosen channels. The analyst confirms the exposure and exports a suspicious transaction report for that transfer, with the deposit or withdrawal direction specified at screening time. That report is aligned with major regulatory jurisdictions and can be exported through a region-specific template for direct filing. The exported STR is the reporting pillar's evidence. The screening log feeds the record-keeping pillar. One tool closes two obligations.
The three pillars BlockSec does not cover are traditional compliance infrastructure. An exchange sources registration from counsel, identity verification from a CDD vendor, and record retention from a records system. The monitoring and reporting pillars are where on-chain native tooling earns its place, because the data those pillars must act on lives on the chain. For the operational walkthrough of how KYT runs across an exchange transaction lifecycle, see the KYT Compliance guide.
From Framework to Action
A definition is the entry point, not the destination. Once a compliance team can name the five VASP obligations, the next step is to run them. Two paths help. To read the full AML compliance framework and the platform behind the monitoring pillar, visit Phalcon Compliance. To move from definition to deployment at an exchange, follow the KYT compliance for crypto exchanges implementation guide.
North American exchanges should weigh the FinCEN MSB registration and state money transmitter license layer first, since operating without it is a standalone violation. The monitoring and reporting pillars come next, and they are the ones that scale with on-chain volume.
→ Book a Phalcon Compliance demo and run the monitoring pillar on your exchange workflow: Book a demo
Frequently Asked Questions
What is AML compliance for a crypto exchange? It is the set of five VASP obligations an exchange must run continuously: registration and licensing, customer due diligence, transaction monitoring, suspicious transaction reporting, and record-keeping.
Are the five VASP obligations the same as an AML program's five pillars? No. The VASP obligations are what the exchange must do. The AML program pillars are how its compliance department is built. This article covers the obligations.
Does KYC count as a separate obligation? No. Identity verification is the step inside the customer due diligence pillar. It confirms who the customer is. It does not screen the transaction.
Which obligations does on-chain monitoring cover? Transaction monitoring and suspicious transaction reporting. Address and transaction screening read the chain, and the exported STR is the report.
How long must a US exchange keep AML records? Five years under the Bank Secrecy Act. The retention covers CDD files, monitoring logs, and filed reports.
