The Short Answer
VASP AML is the anti money laundering duty set that attaches to a virtual asset service provider. Know your customers, monitor their transactions, keep the records, report suspicious activity, and pass travel rule information with transfers. The list is short. The daily work is not, and it lands in two places: the alert queue and the files an examiner reads. The VASP compliance hub collects the related guides.
That split is the honest shape of the job. Licensing is a gate you pass once; AML is a practice you run every day. The difference between a calm compliance team and a drowning one is rarely the rulebook they answer to. It is how they handle the queue and whether their decisions left a trail.
This page covers the duty set in compact form, then spends its depth on the two places the work actually goes: what examiners ask, and why the alert queue eats the week.
What VASP AML Covers
Five areas make up the framework; the specific requirements and effective dates depend on applicable local law. Customer diligence identifies who you serve. Ongoing monitoring watches what moves. Record keeping keeps the evidence retrievable. Suspicious activity reporting hands the serious cases to the authorities. The travel rule passes identifying information with transfers. Each is a sentence here and a practice elsewhere.
Customer diligence, usually called KYC, is the duty of identifying customers and rating their risk: documents, checks, beneficial ownership for entities, and a risk tier that drives attention. This page treats it as a duty to understand, because the screening side of this site's tooling, addresses and transactions rather than identity documents, sits beside it, not inside it.
Ongoing monitoring has daily weight. The FATF standards provide the international AML baseline. A risk-based monitoring programme should assess the sources and paths of funds relevant to the business, including exposure involving bridges, decentralised exchanges and mixing services, without treating each pattern as proof of wrongdoing.
Record keeping is unglamorous and decisive. Transactions, decisions, alerts, sign offs, kept retrievable for the period the rulebook sets, so that questions asked years later can be answered from records rather than memory.
Suspicious activity reporting, filed as STR or SAR depending on the jurisdiction, is the duty where the whole program either proves itself or does not. Recognizing the case that crosses the line, documenting why, and filing within the deadline.
The travel rule, passing originator and beneficiary information between VASPs on transfers, gets one line here because it gets a whole guide: the travel rule for VASPs.
The set at a glance:
| Duty | What it asks | Where the work lands |
|---|---|---|
| Customer diligence (KYC) | Identify customers and rate their risk | Onboarding, then periodic refresh |
| Ongoing monitoring | Watch transactions, cross chain exposure included | Daily, in the alert queue |
| Record keeping | Keep decisions and evidence retrievable | Continuously, written by the workflow |
| Suspicious activity reporting | File STR or SAR on cases that cross the line | Rare but deadline bound |
| Travel rule | Exchange originator and beneficiary data on transfers | Per transfer, with the other VASP |
Two boundaries on this section. The mapping of each duty to the tooling that carries it, with a build order for lean teams, is its own published checklist on this site, the VASP compliance checklist. This page does not repeat its tables. And the country by country comparison of AML duties belongs to a longer jurisdictional treatment this site keeps separately; what travels across borders is the shape of the set above, not the thresholds inside it.
For the related licensing and compliance guides, see the VASP compliance hub.
What Examiners Actually Ask
Examination preparation centres on three questions: does a written policy exist, was it executed, and can the team explain its decisions. Risk-rating evidence and recorded reasons help staff reconstruct the reasoning behind an alert rather than relying on memory.
The first question is table stakes. A written program, approved, dated, versioned, naming duties, thresholds, and owners. Most licensed VASPs pass it.
The second is where substance starts: policy said monitor, so show the alerts, dispositions, and escalation trail; policy said annual reviews, so show the reviews. Execution evidence is the difference between a program and a document, and United States supervisors, whose expectations FinCEN publishes, typically read files this way.
The third decides the tone of an exam. Walk an examiner through one alert: what triggered it, what the risk score rested on, why it was closed. A team that can do that for any alert has a program; a team that needs to reconstruct it has an exposure, and it surfaces when it is most expensive.
The practical defense is built before the exam: audit logs that record what was seen and decided, exports that package the evidence, and risk rating files that show their own reasoning. Tooling categories, not brand names, are the right level for this page.
Where the Daily Work Goes
False positives consume analyst time and can crowd genuine risks out of the alert queue. Their rate varies with the rules, customer mix and operating context; there is no single proportion this guide can substantiate. Managing the workload requires measurement and a repeatable triage method.
Broad rules can reduce the chance of missing suspicious activity while producing more alerts on legitimate traffic. Measure the trade-off using your own reviewed samples and record why thresholds changed; do not substitute an anonymous industry figure for evidence from your programme.
The method side has three moves, each a discipline rather than a purchase. A triage desk, one queue worked in priority order, so the severe alerts are never waiting behind the routine. Direction rule tuning, rules fitted to the business's actual shape, because the same rule set on an exchange and a payments platform produces completely different noise. And a whitelist, addresses checked and trusted and suppressed from repeat firing, with an owner and a review date, because whitelists age badly when left alone.
None of that is a claim that any tool makes the problem vanish. It is the opposite: the queue is permanent, and the skill is spending its hours on the alerts that deserve them. The playbook version of this section, thresholds, whitelist governance, severity routing, and how to measure whether tuning worked, is its own guide: how to reduce false positives.
Building the Tool Stack for the List
Phalcon Compliance supports the onchain workflow with address and transaction screening over 600M+ labeled addresses and 200+ risk signals across 17 risk indicator categories (per BlockSec). Its risk engines support rules for 27+ jurisdictions. STR draft exports currently cover Hong Kong and Singapore, separately from that rule coverage, with audit logs and screening exports supporting review. The institution makes reporting decisions and submits reports. Registering brings three free checks a month.
Those numbers are the coverage list, not the argument. The argument is structural: the duty set expects evidence, and evidence comes from a system that records what it saw. The checklist linked earlier maps each duty to its tooling category in build order.
Three adjacent questions each have a deeper page. Whether transaction screening is a legal must for a VASP at all, the necessity argument in full, is answered in is KYT required for VASP compliance. The transaction monitoring guide covers the operational workflow, including deposit and withdrawal checks and the alert queue. And the map from definition to license to duties to daily work is the VASP compliance hub.