This article explains how to draft a working anti-money laundering (AML) policy for a crypto business. It covers when a policy is needed, which rules apply in the EU, the UK and the US, how to run a risk assessment, which sections the policy should contain (customer checks, blockchain monitoring, sanctions, suspicious activity reports, the Travel Rule, training and record keeping), which documents accompany it and which mistakes are most common.
Checked on 10 November 2026 against the text of EU Regulations 2023/1114, 2023/1113 and 2024/1624, FCA pages, FinCEN guidance and the text of 31 CFR 1022.210. Rules differ by country and change, so confirm the position for your own model.
Does a crypto business need an AML policy
First, determine whether the company’s activities fall within the scope of AML legislation. Not every crypto company is automatically an obliged entity. Requirements depend on the services provided, the countries involved and the company’s actual role in transactions. A custodial exchange that receives and transfers cryptocurrency for customers will generally fall within AML regulation in major financial jurisdictions. The same is likely for exchange, custody and administration of crypto-assets, crypto-to-fiat conversion, crypto payment processing, transfers on behalf of customers and brokerage services.
A developer that only provides technical infrastructure and no regulated services may fall outside some regimes. Calling a platform non-custodial is not enough for an exemption, though. Its actual functions and level of control are assessed. We cover this in our articles on launching an exchange without holding customer funds and on the licence for a crypto payment gateway. Even where the law does not directly oblige a company, an AML framework may be commercially necessary, because banks, payment providers and liquidity providers require evidence of controls before a relationship begins.
The main regulatory frameworks
A policy is drafted with the law of the countries where the company operates in mind. FATF standards are an international benchmark but do not replace national law.
European Union
MiCA (Regulation 2023/1114) sets the licensing regime for crypto-asset service providers (CASPs), but MiCA authorisation and AML compliance are separate requirements. The Travel Rule for crypto-asset transfers comes from Regulation 2023/1113. The AML Regulation (AMLR, Regulation 2024/1624) applies from 10 July 2027. It treats CASPs as financial institutions, and therefore as obliged entities, and creates uniform rules across Member States. A policy should therefore be written with these requirements in mind. We explain licensing in our article on the CASP licence under MiCA.
United Kingdom
Cryptoasset businesses providing exchange or custodian wallet services must register with the FCA under the Money Laundering Regulations 2017 (MLRs) before starting business. They need a risk assessment, customer due diligence, monitoring, sanctions screening and suspicious activity reporting, and must appoint a Money Laundering Reporting Officer (MLRO) under regulation 21(3). A broader regime under FSMA is expected from 25 October 2027, and MLR registration should not be confused with the new authorisation.
United States
Companies that exchange or transmit convertible virtual currency may be money services businesses (MSBs) under the Bank Secrecy Act and subject to FinCEN. An MSB must have a written AML programme. Under 31 CFR 1022.210 it includes policies, procedures and controls, a designated compliance person, staff training and an independent review. State licences must be assessed separately, and FinCEN registration does not replace them.
Start with a business-wide risk assessment
A policy should not be drafted by copying another crypto company’s template. The starting point is a business-wide risk assessment (BWRA) that identifies money laundering and terrorist financing risks specific to your activities. The FCA expects a BWRA to assess the risks of each product, use one documented methodology and show how controls reduce risk and how residual risk is calculated. It should also cover proliferation financing.
Customer risk
Who you serve, whether individuals, companies, institutional investors, other VASPs or high-risk businesses. Corporate customers with complex structures complicate beneficial owner checks.
Geographic risk
Where customers and counterparties are and where funds come from and go. Pay particular attention to sanctioned countries and FATF listings.
Product risk
A custodial exchange, an OTC desk, a payment gateway and a non-custodial wallet provider should not apply identical controls.
Transaction risk
Volumes, frequency, values, blockchain networks and wallet types. Privacy technologies, mixers and chains of transfers through many wallets raise risk.
Delivery channel risk
Remote onboarding, third-party intermediaries and automated decisions without human involvement.
After identifying the risks, assess their likelihood and impact, list the existing controls and determine the residual risk. The assessment should describe how ratings are assigned and how often it is reviewed.
Define the risk appetite
The policy should say which customers, transactions and relationships the company accepts and which are prohibited or need extra scrutiny. For example, an exchange may reject customers subject to sanctions, prohibit transactions linked to clearly prohibited activity, restrict customers from certain countries, apply enhanced due diligence (EDD) to politically exposed persons (PEPs) and complex structures, run extra checks on funds from unhosted wallets and limit exposure to privacy coins.
A high-risk indicator does not require rejecting every customer. The company decides whether the risk can be mitigated and whether the relationship is lawful.
KYC and KYB procedures
The policy should explain how the company identifies and verifies customers before a relationship begins and when further verification is needed. See our article on KYC and KYB for payment providers for how the checks work.
Individuals (KYC)
Name, date of birth, address, nationality, document verification, sanctions and PEP screening, and the purpose and nature of the relationship. Depending on risk, occupation, source of funds and source of wealth are requested.
Legal entities (KYB)
Registration documents, registered address and place of business, directors and representatives, shareholding structure, ultimate beneficial owners (UBOs), activities and expected volumes, and licences. This matters most when onboarding other crypto businesses, payment providers, OTC brokers and high-risk sectors.
Classification of customers as low, medium or high risk should rest on a documented methodology, not on individual employees’ judgment. Higher-risk customers get EDD, meaning extra source of funds checks, management approval and more frequent reviews.
Blockchain transaction monitoring
Banks watch transfers and account activity. A crypto business must also analyse blockchain transactions. The policy should explain how the company spots suspicious movements and what happens when a risk is found. Blockchain analytics tools can help find links to sanctioned addresses, darknet marketplaces, ransomware wallets, stolen funds, mixers, fraudulent schemes, high-risk exchanges and terrorist financing.
Screening should not be reduced to checking an address against a blacklist. Patterns of behaviour also matter. Warning signs include rapid movement of funds through many wallets, fragmentation of large transactions, sudden changes in normal behaviour, frequent deposits followed by immediate withdrawals, transactions inconsistent with the declared source of funds and repeated contact with high-risk services.
The policy sets out the process, while alert thresholds, investigation steps and escalation go into a separate procedure. That procedure also explains how automated alerts are reviewed, how false positives are closed and when a transaction is suspended or rejected. Exposure to a high-risk wallet does not by itself show that the customer is involved in crime. The decision takes into account the nature, recency and extent of the exposure and the available evidence.
Sanctions and politically exposed persons
Sanctions and PEP screening are built into both onboarding and ongoing monitoring. The policy identifies the sanctions regimes that apply given the countries of operation and international obligations. Screening covers customers, beneficial owners, directors, representatives and transaction counterparties. For crypto businesses wallet screening matters too, because addresses may be linked to designated persons.
For a potential match the policy provides for review of the match, escalation of confirmed and suspected cases, blocking of transactions where the law requires, freezing of assets and mandatory reports to authorities. PEPs get a separate risk assessment. Depending on the law, EDD may include senior management approval, establishing the source of wealth and funds and enhanced monitoring. The policy also describes how screening databases are updated and how sanctions list changes reach the systems.
Suspicious activity reporting
The policy must set out how employees identify, escalate and report suspicious activity. For example, an employee notices an unusual transaction or receives an analytics alert, and the case goes to the compliance team or the MLRO. The MLRO assesses the information and decides whether a suspicious transaction report (STR) or suspicious activity report (SAR) must be filed.
What to describe
How staff report internally, who investigates, what information and evidence is collected, who decides on an external report, which authority receives it and what happens to the customer relationship and transactions afterwards.
Tipping-off
Employees must know that telling a customer about a report may be prohibited. Deadlines and procedures differ between countries and should be reflected in the procedures rather than replaced with one universal rule.
The Travel Rule
The Travel Rule belongs in the AML framework, especially where the company provides regulated transfer services. Under Regulation 2023/1113, CASPs must ensure that originator and beneficiary information accompanies qualifying crypto-asset transfers. The policy records the commitment to comply, and a separate procedure covers the practical steps. These include collecting and transmitting data, verifying it where required, handling transfers involving self-hosted addresses, identifying missing information, escalating non-compliant transfers and keeping records. We explain this in our article on the Travel Rule for crypto businesses.
Training, record keeping and independent review
Training
Employees receive training suited to their role. It covers AML basics, KYC and KYB procedures, indicators of suspicious activity, sanctions and PEPs, escalation and tipping-off. Compliance staff and senior management need more specialised training. Keep records of sessions and attendance.
Record keeping
The policy defines which records are kept, how they are stored and who can access them. These include identification documents, KYB and UBO records, risk assessments, transaction records, analytics reports, investigation files, SAR or STR decisions and training records. Under Article 77 of the AMLR records are kept for five years after the end of the relationship or occasional transaction, and a competent authority may require retention for up to five more years.
Independent review
The framework is tested periodically and independently to see whether procedures work, monitoring rules are effective and weaknesses have been fixed. For US MSBs this is one element of the programme under 31 CFR 1022.210. The reviewer may be an employee but not the designated compliance person. The scope is proportionate to risk.
Which documents accompany an AML policy
A common mistake is to treat the AML policy as a standalone document. In practice a complete framework consists of linked documents. The FCA expects applicants for registration to provide a comprehensive AML framework, meaning both policies and detailed operating procedures. The documents should explain how the chosen third-party tools work and how they are configured for the firm’s risks.
| Purpose | |
|---|---|
| AML/CTF policy | Overall framework and principles |
| Business-wide risk assessment | Money laundering and terrorist financing risks |
| Customer risk methodology | Risk classification criteria |
| KYC and KYB procedure | Customer identification and verification |
| EDD procedure | Extra checks for high-risk customers |
| Sanctions and PEP policy | Screening and escalation |
| Monitoring procedure | Blockchain and fiat controls |
| Suspicious activity procedure | Internal escalation and external reports |
| Travel Rule procedure | Originator and beneficiary information |
| Record retention policy | Storage and retention periods |
| Training policy | Training requirements |
| Outsourcing policy | Third-party compliance providers |
The exact set depends on the activities and obligations. An exchange with custody needs more controls than a software-only provider.
Common mistakes when drafting a policy
Generic templates
A policy copied from another exchange does not reflect the risks of your products, customers and transaction flows.
Confusing policy with procedures
Statements such as “the company monitors all transactions” mean nothing without explaining how it is done, who reviews alerts and how escalation works.
Over-relying on tools
Blockchain analytics and KYC providers help but cannot replace your own risk assessment, decisions and oversight.
Undefined responsibilities
Employees must know who handles onboarding, who investigates alerts and who decides on suspicious activity.
Ignoring ongoing monitoring
Checks do not stop after onboarding. Profiles and transactions are reviewed throughout the relationship.
Not updating the policy
A document written before a new product launches stops fitting once new blockchains, OTC services, fiat settlements or customer categories are added.
Inconsistent documents
The policy, risk assessment and procedures should describe the same model and controls. Contradictions raise concerns in regulatory reviews and partner due diligence.
The quality of an AML policy is measured not by the number of pages but by whether the company can show that its procedures work in practice.The LegalBit team
How to prepare the policy, a practical order
Describe the business
Products, services and countries. Decide whether you are an obliged entity.
Run the BWRA and set risk appetite
Document the risk assessment and the accepted and prohibited customers.
Define the checks
KYC, KYB, CDD and EDD, plus sanctions, PEP and wallet screening.
Set up monitoring
Scenarios, investigation and the suspicious activity reporting process.
Appoint the responsible person
An MLRO or other officer where required, and document internal escalation.
Cover training, records and review
Training, record keeping, independent testing and review of third-party providers.
Approve and review
Management approves the document and staff are informed. Review it when the business, the law or the risk profile changes.
Frequently asked questions
Is an AML policy mandatory for every crypto company?
No. The obligation depends on the activities and countries. VASPs, CASPs and money transmitters generally have direct AML obligations. Other companies may still need a policy for banks and partners.
Can I use a template AML policy for my exchange?
A template can give a structure, but it must be adapted to your products, customers, countries and transaction flows. Generic documents that do not describe real controls may be insufficient.
Who is responsible for AML in a crypto business?
Responsibility generally rests with the company and its management. Depending on the country, an MLRO or designated AML officer may also be needed to oversee day-to-day compliance and suspicious activity reporting.
How often should an AML policy be updated?
There is no universal period. The policy is reviewed regularly and whenever the business, the law or the risk profile changes materially. Annual review is a common baseline, and higher-risk businesses may need it more often.
Does a non-custodial business need an AML policy?
Not necessarily. A non-custodial service that only provides technical services may fall outside some regimes. That status alone does not exclude regulation if the company performs covered functions or retains control over transactions.
See also: KYC and KYB for Payment Providers; Travel Rule for Crypto Businesses; How to Launch a Crypto Exchange Without Holding Customer Funds; Do You Need a Licence for a Crypto Payment Gateway. Services: Licensing, compliance and AML/KYC.
Primary sources7 documents
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA)
- Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets
- FCA, Cryptoassets, what we expect to see in your application for registration
- FCA, Cryptoassets, AML/CTF regime
- FinCEN, Guidance FIN-2019-G001 on convertible virtual currency
- 31 CFR 1022.210, Anti-money laundering programs for money services businesses
This material is general information and is not legal advice. Facts checked on 10 November 2026. Rules and deadlines change, so check the official requirements for your model and target markets before implementation.
This is what we do
We help crypto and fintech businesses with AML and KYC policies, CASP and VASP licensing and compliance procedures.
