AML compliance for crypto: what US law requires

A crypto exchange in the United States runs on two ledgers. One records trades. The other records who the customers are, where their money came from, and which transfers looked wrong. The second ledger is AML compliance for crypto, and the Bank Secrecy Act decides what goes into it.

Who the rules cover

FinCEN, the Treasury bureau that enforces the Bank Secrecy Act, treats most businesses that accept and transmit crypto for customers as money transmitters, a type of money services business. Exchanges, brokers and custodial wallet providers usually fall in. A wallet app that never touches customer funds usually does not; FinCEN's 2019 guidance decides by the business model, not the label.

A new money services business must register with FinCEN within 180 days of starting and renew every two years. The penalty for skipping it is $5,000 for each violation, and every day counts as a new one. Most states add their own money transmitter licence on top, and New York has its own BitLicense.

The four parts of an AML program

The federal rule for money services businesses, 31 CFR 1022.210, asks for a written program built on four parts:

• Policies, procedures and internal controls: how the business identifies customers, files reports, keeps records and answers law enforcement.
• A compliance officer: one named person responsible for day-to-day compliance, who makes sure reports go out and the program keeps up with new rules.
• Training: staff learn their part of the program, including how to spot a suspicious transaction.
• An independent review: someone other than the compliance officer tests whether the program works, as often as the business's risk requires.

The rule also asks for a program sized to risk. A two-person kiosk operator and a national exchange both need the four parts, but not the same depth.

Knowing the customer

Identity checks come first. Before a customer trades, the exchange collects a name, date of birth, address and ID document, and screens the person against sanctions lists. Higher-risk customers get enhanced due diligence: source of funds, expected activity, sometimes a call. We explained the customer side of these checks in our piece on KYC checks.

The Travel Rule

When a customer sends $3,000 or more, the sending institution must pass along the sender's name, address and account, and what it knows about the recipient. That is the US Travel Rule. The Financial Action Task Force, which sets global standards, recommends the same for transfers from $1,000 or €1,000. For a crypto exchange the hard part is the counterparty: the exchange on the other side has to receive the data, and a self-hosted wallet has no institution behind it at all.

Suspicious activity reports

A suspicious activity report, or SAR, is the core output of the whole system. A money services business must file one when a transaction of $2,000 or more looks like money laundering, sanctions evasion or another crime. The deadline is 30 calendar days from first detecting the facts. The business keeps a copy and its evidence for five years and cannot tell the customer a report exists.

Sanctions

Sanctions screening runs alongside AML. The Office of Foreign Assets Control publishes lists of blocked people and wallet addresses, and a US business may not deal with them. In the Binance settlement of November 2023, OFAC's share alone was $968.6 million.

What failure costs

The last three years have priced weak AML programs. Binance agreed to $4.3 billion in US penalties in 2023, including $3.4 billion to FinCEN; prosecutors said it never filed a single SAR. KuCoin pleaded guilty in January 2025 for never registering with FinCEN and never filing SARs, with penalties near $300 million. OKX pleaded guilty a month later and agreed to pay more than $504 million.

“For over seven years, OKX knowingly violated anti-money laundering laws and avoided implementing required policies to prevent criminals from abusing our financial system”

— Matthew Podolsky, Acting US Attorney for the Southern District of New York, February 2025, as quoted by the DOJ · justice.gov

Stablecoin issuers joined the list in 2025: the GENIUS Act treats them as financial institutions under the Bank Secrecy Act, which we covered in our guide to stablecoin regulation.

Our count

• A year without FinCEN registration, at $5,000 a day, adds up to $1.825 million in civil penalties before any criminal charge.
• The US Travel Rule starts at three times the FATF threshold: $3,000 against $1,000.
• OKX's penalty of $504 million against more than $5 billion in suspicious transactions is roughly ten cents on the dollar.
• Binance and KuCoin paid about $4.6 billion between them over programs that, by prosecutors' account, produced zero SARs.

If you are building a crypto business in the US, the order matters: register, write the program, name the compliance officer, and only then open accounts. If you are a customer, the identity check and the occasional source-of-funds question are the visible end of the same four-part program. For a broader picture across markets, see our earlier compliance guide.

This article explains general rules and is not legal advice. For your own business, check the current text of 31 CFR Chapter X and your state's licensing rules with counsel.