{"id":9651,"date":"2026-11-09T19:08:59","date_gmt":"2026-11-09T16:08:59","guid":{"rendered":"https:\/\/legalbit.top\/en\/?p=9651"},"modified":"2026-11-09T19:17:43","modified_gmt":"2026-11-09T16:17:43","slug":"aml-policy-crypto-business","status":"publish","type":"post","link":"https:\/\/legalbit.top\/en\/aml-policy-crypto-business\/","title":{"rendered":"How to Draft an AML Policy for a Crypto Business"},"content":{"rendered":"\n<svg width=\"0\" height=\"0\" style=\"position:absolute\" aria-hidden=\"true\"><symbol id=\"i-list\" viewBox=\"0 0 24 24\"><path d=\"M9 6h11M9 12h11M9 18h11\"\/><path d=\"M4 6h.01M4 12h.01M4 18h.01\"\/><\/symbol><symbol id=\"i-user\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"8\" r=\"4\"\/><path d=\"M4 21c0-4 3.6-7 8-7s8 3 8 7\"\/><\/symbol><symbol id=\"i-ban\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M5.6 5.6l12.8 12.8\"\/><\/symbol><symbol id=\"i-layers\" viewBox=\"0 0 24 24\"><path d=\"M12 3l9 5-9 5-9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/symbol><symbol id=\"i-eye\" viewBox=\"0 0 24 24\"><path d=\"M2 12s4-7 10-7 10 7 10 7-4 7-10 7S2 12 2 12z\"\/><circle cx=\"12\" cy=\"12\" r=\"3\"\/><\/symbol><symbol id=\"i-doc\" viewBox=\"0 0 24 24\"><path d=\"M7 3h8l4 4v14H7z\"\/><path d=\"M15 3v4h4M10 12h6M10 16h6\"\/><\/symbol><symbol id=\"i-pen\" viewBox=\"0 0 24 24\"><path d=\"M4 20l4-1 11-11-3-3L5 16z\"\/><path d=\"M14 6l3 3\"\/><\/symbol><symbol id=\"i-book\" viewBox=\"0 0 24 24\"><path d=\"M4 5a2 2 0 0 1 2-2h13v16H6a2 2 0 0 0-2 2z\"\/><path d=\"M4 19V5\"\/><\/symbol><symbol id=\"i-alert\" viewBox=\"0 0 24 24\"><path d=\"M12 3l10 18H2z\"\/><path d=\"M12 10v4M12 17.5h.01\"\/><\/symbol><symbol id=\"i-bulb\" viewBox=\"0 0 24 24\"><path d=\"M9 18h6M10 21h4\"\/><path d=\"M12 3a6 6 0 0 0-3.5 10.9c.6.5 1 1.2 1 2.1h5c0-.9.4-1.6 1-2.1A6 6 0 0 0 12 3z\"\/><\/symbol><symbol id=\"i-info\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 11v5M12 8h.01\"\/><\/symbol><symbol id=\"i-coin\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M14.5 9.5c-.5-1-1.5-1.5-2.5-1.5-1.4 0-2.5.8-2.5 2s1.1 1.6 2.5 2 2.5.8 2.5 2-1.1 2-2.5 2c-1 0-2-.5-2.5-1.5M12 6.5v11\"\/><\/symbol><symbol id=\"i-clock\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 7v5l3 2\"\/><\/symbol><symbol id=\"i-globe\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M3 12h18M12 3c2.5 2.7 3.8 5.7 3.8 9s-1.3 6.3-3.8 9c-2.5-2.7-3.8-5.7-3.8-9S9.5 5.7 12 3z\"\/><\/symbol><\/svg><div class=\"lbm\"><section class=\"lbm-intro\"><div class=\"lbm-intro-main\"><p class=\"lbm-lead\">This article explains how to draft a working anti-money laundering (AML) policy for a crypto business. It covers when a policy is needed, which rules apply in the EU, the UK and the US, how to run a risk assessment, which sections the policy should contain (customer checks, blockchain monitoring, sanctions, suspicious activity reports, the Travel Rule, training and record keeping), which documents accompany it and which mistakes are most common.<\/p><p class=\"lbm-verified\">Checked on 10 November 2026 against the text of EU Regulations 2023\/1114, 2023\/1113 and 2024\/1624, FCA pages, FinCEN guidance and the text of 31 CFR 1022.210. Rules differ by country and change, so confirm the position for your own model.<\/p><ul class=\"lbm-toc\"><li><a href=\"#need\">Is a policy needed<\/a><\/li><li><a href=\"#frameworks\">Legal framework<\/a><\/li><li><a href=\"#bwra\">Risk assessment<\/a><\/li><li><a href=\"#appetite\">Risk appetite<\/a><\/li><li><a href=\"#kyc\">KYC and KYB<\/a><\/li><li><a href=\"#monitoring\">Blockchain monitoring<\/a><\/li><li><a href=\"#sanctions\">Sanctions and PEPs<\/a><\/li><li><a href=\"#sar\">Suspicious activity<\/a><\/li><li><a href=\"#travel\">The Travel Rule<\/a><\/li><li><a href=\"#internal\">Training, records, review<\/a><\/li><li><a href=\"#docs\">Accompanying documents<\/a><\/li><li><a href=\"#mistakes\">Mistakes<\/a><\/li><li><a href=\"#faq\">FAQ<\/a><\/li><\/ul><\/div><\/section>\n<section id=\"need\"><h2>Does a crypto business need an AML policy<\/h2>\n<p>First, determine whether the company&#8217;s activities fall within the scope of AML legislation. Not every crypto company is automatically an obliged entity. Requirements depend on the services provided, the countries involved and the company&#8217;s actual role in transactions. A custodial exchange that receives and transfers cryptocurrency for customers will generally fall within AML regulation in major financial jurisdictions. The same is likely for exchange, custody and administration of crypto-assets, crypto-to-fiat conversion, crypto payment processing, transfers on behalf of customers and brokerage services.<\/p>\n<p>A developer that only provides technical infrastructure and no regulated services may fall outside some regimes. Calling a platform non-custodial is not enough for an exemption, though. Its actual functions and level of control are assessed. We cover this in our articles on <a href=\"\/en\/non-custodial-crypto-exchange\/\">launching an exchange without holding customer funds<\/a> and on the <a href=\"\/en\/crypto-payment-gateway-licence\/\">licence for a crypto payment gateway<\/a>. Even where the law does not directly oblige a company, an AML framework may be commercially necessary, because banks, payment providers and liquidity providers require evidence of controls before a relationship begins.<\/p><\/section>\n<section id=\"frameworks\"><h2>The main regulatory frameworks<\/h2>\n<p>A policy is drafted with the law of the countries where the company operates in mind. FATF standards are an international benchmark but do not replace national law.<\/p>\n<div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><h3>European Union<\/h3><p>MiCA (Regulation 2023\/1114) sets the licensing regime for crypto-asset service providers (CASPs), but MiCA authorisation and AML compliance are separate requirements. The Travel Rule for crypto-asset transfers comes from Regulation 2023\/1113. The AML Regulation (AMLR, Regulation 2024\/1624) applies from 10 July 2027. It treats CASPs as financial institutions, and therefore as obliged entities, and creates uniform rules across Member States. A policy should therefore be written with these requirements in mind. We explain licensing in our article on the <a href=\"\/en\/casp-licence-mica\/\">CASP licence under MiCA<\/a>.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-book\"\/><\/svg><\/span><h3>United Kingdom<\/h3><p>Cryptoasset businesses providing exchange or custodian wallet services must register with the FCA under the Money Laundering Regulations 2017 (MLRs) before starting business. They need a risk assessment, customer due diligence, monitoring, sanctions screening and suspicious activity reporting, and must appoint a Money Laundering Reporting Officer (MLRO) under regulation 21(3). A broader regime under FSMA is expected from 25 October 2027, and MLR registration should not be confused with the new authorisation.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-coin\"\/><\/svg><\/span><h3>United States<\/h3><p>Companies that exchange or transmit convertible virtual currency may be money services businesses (MSBs) under the Bank Secrecy Act and subject to FinCEN. An MSB must have a written AML programme. Under 31 CFR 1022.210 it includes policies, procedures and controls, a designated compliance person, staff training and an independent review. State licences must be assessed separately, and FinCEN registration does not replace them.<\/p><\/div><\/div><\/section>\n<section id=\"bwra\"><h2>Start with a business-wide risk assessment<\/h2>\n<p>A policy should not be drafted by copying another crypto company&#8217;s template. The starting point is a business-wide risk assessment (BWRA) that identifies money laundering and terrorist financing risks specific to your activities. The FCA expects a BWRA to assess the risks of each product, use one documented methodology and show how controls reduce risk and how residual risk is calculated. It should also cover proliferation financing.<\/p>\n<ol class=\"lbm-steps\"><li><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><div><h3>Customer risk<\/h3><p>Who you serve, whether individuals, companies, institutional investors, other VASPs or high-risk businesses. Corporate customers with complex structures complicate beneficial owner checks.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><div><h3>Geographic risk<\/h3><p>Where customers and counterparties are and where funds come from and go. Pay particular attention to sanctioned countries and FATF listings.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><div><h3>Product risk<\/h3><p>A custodial exchange, an OTC desk, a payment gateway and a non-custodial wallet provider should not apply identical controls.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-coin\"\/><\/svg><\/span><div><h3>Transaction risk<\/h3><p>Volumes, frequency, values, blockchain networks and wallet types. Privacy technologies, mixers and chains of transfers through many wallets raise risk.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><div><h3>Delivery channel risk<\/h3><p>Remote onboarding, third-party intermediaries and automated decisions without human involvement.<\/p><\/div><\/li><\/ol>\n<p>After identifying the risks, assess their likelihood and impact, list the existing controls and determine the residual risk. The assessment should describe how ratings are assigned and how often it is reviewed.<\/p><\/section>\n<section id=\"appetite\"><h2>Define the risk appetite<\/h2>\n<p>The policy should say which customers, transactions and relationships the company accepts and which are prohibited or need extra scrutiny. For example, an exchange may reject customers subject to sanctions, prohibit transactions linked to clearly prohibited activity, restrict customers from certain countries, apply enhanced due diligence (EDD) to politically exposed persons (PEPs) and complex structures, run extra checks on funds from unhosted wallets and limit exposure to privacy coins.<\/p>\n<div class=\"lbm-co soft\"><span class=\"lbm-ico\"><svg><use href=\"#i-info\"\/><\/svg><\/span><div><b>Risk-based does not mean refusing<\/b><p>A high-risk indicator does not require rejecting every customer. The company decides whether the risk can be mitigated and whether the relationship is lawful.<\/p><\/div><\/div><\/section>\n<section id=\"kyc\"><h2>KYC and KYB procedures<\/h2>\n<p>The policy should explain how the company identifies and verifies customers before a relationship begins and when further verification is needed. See our article on <a href=\"\/en\/kyc-kyb-payment-providers\/\">KYC and KYB for payment providers<\/a> for how the checks work.<\/p>\n<div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Individuals (KYC)<\/h3><p>Name, date of birth, address, nationality, document verification, sanctions and PEP screening, and the purpose and nature of the relationship. Depending on risk, occupation, source of funds and source of wealth are requested.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>Legal entities (KYB)<\/h3><p>Registration documents, registered address and place of business, directors and representatives, shareholding structure, ultimate beneficial owners (UBOs), activities and expected volumes, and licences. This matters most when onboarding other crypto businesses, payment providers, OTC brokers and high-risk sectors.<\/p><\/div><\/div>\n<p>Classification of customers as low, medium or high risk should rest on a documented methodology, not on individual employees&#8217; judgment. Higher-risk customers get EDD, meaning extra source of funds checks, management approval and more frequent reviews.<\/p><\/section>\n<section id=\"monitoring\"><h2>Blockchain transaction monitoring<\/h2>\n<p>Banks watch transfers and account activity. A crypto business must also analyse blockchain transactions. The policy should explain how the company spots suspicious movements and what happens when a risk is found. Blockchain analytics tools can help find links to sanctioned addresses, darknet marketplaces, ransomware wallets, stolen funds, mixers, fraudulent schemes, high-risk exchanges and terrorist financing.<\/p>\n<p>Screening should not be reduced to checking an address against a blacklist. Patterns of behaviour also matter. Warning signs include rapid movement of funds through many wallets, fragmentation of large transactions, sudden changes in normal behaviour, frequent deposits followed by immediate withdrawals, transactions inconsistent with the declared source of funds and repeated contact with high-risk services.<\/p>\n<p>The policy sets out the process, while alert thresholds, investigation steps and escalation go into a separate procedure. That procedure also explains how automated alerts are reviewed, how false positives are closed and when a transaction is suspended or rejected. Exposure to a high-risk wallet does not by itself show that the customer is involved in crime. The decision takes into account the nature, recency and extent of the exposure and the available evidence.<\/p><\/section>\n<section id=\"sanctions\"><h2>Sanctions and politically exposed persons<\/h2>\n<p>Sanctions and PEP screening are built into both onboarding and ongoing monitoring. The policy identifies the sanctions regimes that apply given the countries of operation and international obligations. Screening covers customers, beneficial owners, directors, representatives and transaction counterparties. For crypto businesses wallet screening matters too, because addresses may be linked to designated persons.<\/p>\n<p>For a potential match the policy provides for review of the match, escalation of confirmed and suspected cases, blocking of transactions where the law requires, freezing of assets and mandatory reports to authorities. PEPs get a separate risk assessment. Depending on the law, EDD may include senior management approval, establishing the source of wealth and funds and enhanced monitoring. The policy also describes how screening databases are updated and how sanctions list changes reach the systems.<\/p><\/section>\n<section id=\"sar\"><h2>Suspicious activity reporting<\/h2>\n<p>The policy must set out how employees identify, escalate and report suspicious activity. For example, an employee notices an unusual transaction or receives an analytics alert, and the case goes to the compliance team or the MLRO. The MLRO assesses the information and decides whether a suspicious transaction report (STR) or suspicious activity report (SAR) must be filed.<\/p>\n<div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>What to describe<\/h3><p>How staff report internally, who investigates, what information and evidence is collected, who decides on an external report, which authority receives it and what happens to the customer relationship and transactions afterwards.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><h3>Tipping-off<\/h3><p>Employees must know that telling a customer about a report may be prohibited. Deadlines and procedures differ between countries and should be reflected in the procedures rather than replaced with one universal rule.<\/p><\/div><\/div><\/section>\n<section id=\"travel\"><h2>The Travel Rule<\/h2>\n<p>The Travel Rule belongs in the AML framework, especially where the company provides regulated transfer services. Under Regulation 2023\/1113, CASPs must ensure that originator and beneficiary information accompanies qualifying crypto-asset transfers. The policy records the commitment to comply, and a separate procedure covers the practical steps. These include collecting and transmitting data, verifying it where required, handling transfers involving self-hosted addresses, identifying missing information, escalating non-compliant transfers and keeping records. We explain this in our article on the <a href=\"\/en\/travel-rule-crypto\/\">Travel Rule for crypto businesses<\/a>.<\/p><\/section>\n<section id=\"internal\"><h2>Training, record keeping and independent review<\/h2>\n<div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-book\"\/><\/svg><\/span><h3>Training<\/h3><p>Employees receive training suited to their role. It covers AML basics, KYC and KYB procedures, indicators of suspicious activity, sanctions and PEPs, escalation and tipping-off. Compliance staff and senior management need more specialised training. Keep records of sessions and attendance.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>Record keeping<\/h3><p>The policy defines which records are kept, how they are stored and who can access them. These include identification documents, KYB and UBO records, risk assessments, transaction records, analytics reports, investigation files, SAR or STR decisions and training records. Under Article 77 of the AMLR records are kept for five years after the end of the relationship or occasional transaction, and a competent authority may require retention for up to five more years.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>Independent review<\/h3><p>The framework is tested periodically and independently to see whether procedures work, monitoring rules are effective and weaknesses have been fixed. For US MSBs this is one element of the programme under 31 CFR 1022.210. The reviewer may be an employee but not the designated compliance person. The scope is proportionate to risk.<\/p><\/div><\/div><\/section>\n<section id=\"docs\"><h2>Which documents accompany an AML policy<\/h2>\n<p>A common mistake is to treat the AML policy as a standalone document. In practice a complete framework consists of linked documents. The FCA expects applicants for registration to provide a comprehensive AML framework, meaning both policies and detailed operating procedures. The documents should explain how the chosen third-party tools work and how they are configured for the firm&#8217;s risks.<\/p>\n<div class=\"lbm-cmp\"><table><thead><tr><th><\/th><th>Purpose<\/th><\/tr><\/thead><tbody>\n<tr><th scope=\"row\">AML\/CTF policy<\/th><td>Overall framework and principles<\/td><\/tr>\n<tr><th scope=\"row\">Business-wide risk assessment<\/th><td>Money laundering and terrorist financing risks<\/td><\/tr>\n<tr><th scope=\"row\">Customer risk methodology<\/th><td>Risk classification criteria<\/td><\/tr>\n<tr><th scope=\"row\">KYC and KYB procedure<\/th><td>Customer identification and verification<\/td><\/tr>\n<tr><th scope=\"row\">EDD procedure<\/th><td>Extra checks for high-risk customers<\/td><\/tr>\n<tr><th scope=\"row\">Sanctions and PEP policy<\/th><td>Screening and escalation<\/td><\/tr>\n<tr><th scope=\"row\">Monitoring procedure<\/th><td>Blockchain and fiat controls<\/td><\/tr>\n<tr><th scope=\"row\">Suspicious activity procedure<\/th><td>Internal escalation and external reports<\/td><\/tr>\n<tr><th scope=\"row\">Travel Rule procedure<\/th><td>Originator and beneficiary information<\/td><\/tr>\n<tr><th scope=\"row\">Record retention policy<\/th><td>Storage and retention periods<\/td><\/tr>\n<tr><th scope=\"row\">Training policy<\/th><td>Training requirements<\/td><\/tr>\n<tr><th scope=\"row\">Outsourcing policy<\/th><td>Third-party compliance providers<\/td><\/tr>\n<\/tbody><\/table><\/div>\n<p>The exact set depends on the activities and obligations. An exchange with custody needs more controls than a software-only provider.<\/p><\/section>\n<section id=\"mistakes\"><h2>Common mistakes when drafting a policy<\/h2>\n<ol class=\"lbm-steps\"><li><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><div><h3>Generic templates<\/h3><p>A policy copied from another exchange does not reflect the risks of your products, customers and transaction flows.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><div><h3>Confusing policy with procedures<\/h3><p>Statements such as &#8220;the company monitors all transactions&#8221; mean nothing without explaining how it is done, who reviews alerts and how escalation works.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><div><h3>Over-relying on tools<\/h3><p>Blockchain analytics and KYC providers help but cannot replace your own risk assessment, decisions and oversight.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><div><h3>Undefined responsibilities<\/h3><p>Employees must know who handles onboarding, who investigates alerts and who decides on suspicious activity.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><div><h3>Ignoring ongoing monitoring<\/h3><p>Checks do not stop after onboarding. Profiles and transactions are reviewed throughout the relationship.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><div><h3>Not updating the policy<\/h3><p>A document written before a new product launches stops fitting once new blockchains, OTC services, fiat settlements or customer categories are added.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><div><h3>Inconsistent documents<\/h3><p>The policy, risk assessment and procedures should describe the same model and controls. Contradictions raise concerns in regulatory reviews and partner due diligence.<\/p><\/div><\/li><\/ol>\n<figure class=\"lbm-pull\"><q>The quality of an AML policy is measured not by the number of pages but by whether the company can show that its procedures work in practice.<\/q><cite>The LegalBit team<\/cite><\/figure><\/section>\n<section id=\"checklist\"><h2>How to prepare the policy, a practical order<\/h2>\n<ol class=\"lbm-steps\"><li><span class=\"lbm-ico\"><svg><use href=\"#i-list\"\/><\/svg><\/span><div><h3>Describe the business<\/h3><p>Products, services and countries. Decide whether you are an obliged entity.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><div><h3>Run the BWRA and set risk appetite<\/h3><p>Document the risk assessment and the accepted and prohibited customers.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><div><h3>Define the checks<\/h3><p>KYC, KYB, CDD and EDD, plus sanctions, PEP and wallet screening.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><div><h3>Set up monitoring<\/h3><p>Scenarios, investigation and the suspicious activity reporting process.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-book\"\/><\/svg><\/span><div><h3>Appoint the responsible person<\/h3><p>An MLRO or other officer where required, and document internal escalation.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><div><h3>Cover training, records and review<\/h3><p>Training, record keeping, independent testing and review of third-party providers.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><div><h3>Approve and review<\/h3><p>Management approves the document and staff are informed. Review it when the business, the law or the risk profile changes.<\/p><\/div><\/li><\/ol><\/section>\n<section id=\"faq\"><h2>Frequently asked questions<\/h2><div class=\"lbm-faq\"><details><summary>Is an AML policy mandatory for every crypto company?<\/summary><p>No. The obligation depends on the activities and countries. VASPs, CASPs and money transmitters generally have direct AML obligations. Other companies may still need a policy for banks and partners.<\/p><\/details><details><summary>Can I use a template AML policy for my exchange?<\/summary><p>A template can give a structure, but it must be adapted to your products, customers, countries and transaction flows. Generic documents that do not describe real controls may be insufficient.<\/p><\/details><details><summary>Who is responsible for AML in a crypto business?<\/summary><p>Responsibility generally rests with the company and its management. Depending on the country, an MLRO or designated AML officer may also be needed to oversee day-to-day compliance and suspicious activity reporting.<\/p><\/details><details><summary>How often should an AML policy be updated?<\/summary><p>There is no universal period. The policy is reviewed regularly and whenever the business, the law or the risk profile changes materially. Annual review is a common baseline, and higher-risk businesses may need it more often.<\/p><\/details><details><summary>Does a non-custodial business need an AML policy?<\/summary><p>Not necessarily. A non-custodial service that only provides technical services may fall outside some regimes. That status alone does not exclude regulation if the company performs covered functions or retains control over transactions.<\/p><\/details><\/div>\n<p class=\"lbm-more\"><b>See also: <\/b><a href=\"\/en\/kyc-kyb-payment-providers\/\">KYC and KYB for Payment Providers<\/a>; <a href=\"\/en\/travel-rule-crypto\/\">Travel Rule for Crypto Businesses<\/a>; <a href=\"\/en\/non-custodial-crypto-exchange\/\">How to Launch a Crypto Exchange Without Holding Customer Funds<\/a>; <a href=\"\/en\/crypto-payment-gateway-licence\/\">Do You Need a Licence for a Crypto Payment Gateway<\/a>. Services: <a href=\"\/en\/regulatory-and-compliance\/\">Licensing, compliance and AML\/KYC<\/a>.<\/p>\n<div class=\"lbm-src\"><details><summary><b>Primary sources<\/b><small>7 documents<\/small><\/summary><ul><li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2023\/1114\/oj\/eng\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2023\/1114 on markets in crypto-assets (MiCA)<\/a><\/li><li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1624\/oj\/eng\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2024\/1624 on the prevention of the use of the financial system for money laundering<\/a><\/li><li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2023\/1113\/oj\/eng\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2023\/1113 on information accompanying transfers of funds and certain crypto-assets<\/a><\/li><li><a href=\"https:\/\/www.fca.org.uk\/firms\/cryptoassets\/application-registration\" target=\"_blank\" rel=\"noopener\">FCA, Cryptoassets, what we expect to see in your application for registration<\/a><\/li><li><a href=\"https:\/\/www.fca.org.uk\/firms\/financial-crime\/money-laundering-terrorist-financing\/cryptoassets-aml-ctf-regime\" target=\"_blank\" rel=\"noopener\">FCA, Cryptoassets, AML\/CTF regime<\/a><\/li><li><a href=\"https:\/\/www.fincen.gov\/system\/files\/2019-05\/FinCEN%20CVC%20Guidance%20FINAL.pdf\" target=\"_blank\" rel=\"noopener\">FinCEN, Guidance FIN-2019-G001 on convertible virtual currency<\/a><\/li><li><a href=\"https:\/\/www.ecfr.gov\/current\/title-31\/subtitle-B\/chapter-X\/part-1022\/subpart-B\/section-1022.210\" target=\"_blank\" rel=\"noopener\">31 CFR 1022.210, Anti-money laundering programs for money services businesses<\/a><\/li><\/ul><\/details><\/div><\/section>\n<p class=\"lbm-verified\">This material is general information and is not legal advice. Facts checked on 10 November 2026. Rules and deadlines change, so check the official requirements for your model and target markets before implementation.<\/p><\/div>\n\n\n\n<div class=\"lb-ac\"><h2>This is what we do<\/h2><p>We help crypto and fintech businesses with AML and KYC policies, CASP and VASP licensing and compliance procedures.<\/p><ul><li><a href=\"\/en\/crypto-legal-services\/\">Legal services for crypto projects<\/a><\/li><li><a href=\"\/en\/regulatory-and-compliance\/\">Licensing, compliance and AML\/KYC<\/a><\/li><\/ul><\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"BlogPosting\", \"headline\": \"How to Draft an AML Policy for a Crypto Business\", \"description\": \"How to draft a working AML policy for a crypto business. Requirements in the EU, UK and US, risk assessment, KYC and KYB, blockchain monitoring, sanctions, suspicious activity reports and the accompanying documents.\", \"url\": \"https:\/\/legalbit.top\/en\/aml-policy-crypto-business\/\", \"mainEntityOfPage\": \"https:\/\/legalbit.top\/en\/aml-policy-crypto-business\/\", \"datePublished\": \"2026-11-10\", \"dateModified\": \"2026-11-10\", \"inLanguage\": \"en\", \"image\": \"https:\/\/legalbit.top\/wp-content\/uploads\/2026\/11\/shield_compliance_16x9.webp\", \"author\": {\"@type\": \"Organization\", \"name\": \"LegalBit\", \"url\": \"https:\/\/legalbit.top\/\"}, \"publisher\": {\"@type\": \"Organization\", \"name\": \"LegalBit\", \"url\": \"https:\/\/legalbit.top\/\"}}<\/script>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is an AML policy mandatory for every crypto company?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. The obligation depends on the activities and countries. VASPs, CASPs and money transmitters generally have direct AML obligations. Other companies may still need a policy for banks and partners.\"}}, {\"@type\": \"Question\", \"name\": \"Can I use a template AML policy for my exchange?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"A template can give a structure, but it must be adapted to your products, customers, countries and transaction flows. Generic documents that do not describe real controls may be insufficient.\"}}, {\"@type\": \"Question\", \"name\": \"Who is responsible for AML in a crypto business?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Responsibility generally rests with the company and its management. Depending on the country, an MLRO or designated AML officer may also be needed to oversee day-to-day compliance and suspicious activity reporting.\"}}, {\"@type\": \"Question\", \"name\": \"How often should an AML policy be updated?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"There is no universal period. The policy is reviewed regularly and whenever the business, the law or the risk profile changes materially. Annual review is a common baseline, and higher-risk businesses may need it more often.\"}}, {\"@type\": \"Question\", \"name\": \"Does a non-custodial business need an AML policy?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Not necessarily. A non-custodial service that only provides technical services may fall outside some regimes. That status alone does not exclude regulation if the company performs covered functions or retains control over transactions.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>How to draft a working AML policy for a crypto business. Requirements in the EU, UK and US, risk assessment, KYC and KYB, blockchain monitoring, sanctions, suspicious activity reports and the accompanying documents.<\/p>\n","protected":false},"author":1,"featured_media":9653,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[82,68],"tags":[],"post_folder":[],"class_list":["post-9651","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance-and-aml","category-crypto"],"acf":[],"_links":{"self":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/9651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/comments?post=9651"}],"version-history":[{"count":9,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/9651\/revisions"}],"predecessor-version":[{"id":9662,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/9651\/revisions\/9662"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media\/9653"}],"wp:attachment":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media?parent=9651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/categories?post=9651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/tags?post=9651"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/post_folder?post=9651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}