Crypto AML compliance for banks: rules and roles

In seven weeks of 2025, US bank regulators took down the gate that kept most banks out of crypto. The anti-money laundering rules stayed in place. Crypto AML compliance for banks is what fills the space between those two facts: the checks a bank runs when it holds crypto for clients, banks an exchange or touches a stablecoin, and the people who run them.

What changed in 2025

• 7 March: the OCC issued Interpretive Letter 1183. National banks may again offer crypto custody, hold stablecoin reserves and run blockchain nodes without asking for supervisory non-objection first.
• 28 March: the FDIC replaced its prior-notification rule with FIL-7-2025, so the banks it supervises can take on permissible crypto activities without prior approval.
• 24 April: the Federal Reserve withdrew SR 22-6 and SR 23-8, its notification and non-objection letters.

“will instead monitor banks' crypto-asset activities through the normal supervisory process”

— Federal Reserve Board, statement withdrawing crypto guidance, 24 April 2025, as reported by The Block · theblock.co

In July 2025 the GENIUS Act added stablecoins to the picture. It brings payment stablecoin issuers, including bank subsidiaries, under the Bank Secrecy Act. Our guide to the GENIUS Act covers the details.

What the bank's program must include

A national bank's Bank Secrecy Act program rests on the same frame whether the money is dollars or tokens. Under 12 CFR 21.21 it must be written and approved by the board, and include:

• internal controls;
• independent testing;
• one or more people who coordinate and monitor day-to-day compliance;
• training for the staff who need it;
• a customer identification program.

Crypto changes what goes inside each part. Three common situations show how.

When a crypto exchange opens an account at the bank, the bank becomes the exchange's gateway to dollars. It has to understand the exchange's own AML program, its licences and the risk of its customers, because suspicious money that passes through the exchange then passes through the bank.

When the bank holds crypto for clients, every deposit to a custody wallet can carry history. The bank needs wallet screening, the same blockchain analytics an exchange uses, to know whether a deposit came from a mixer, a hack or a sanctioned address.

When the bank holds stablecoin reserves or issues a token through a subsidiary, sanctions screening and the ability to freeze tokens become part of the job.

The compliance officer

Every AML program in the US has a named person at its centre. For a money services business such as a crypto exchange, 31 CFR 1022.210 says that person must make sure reports are filed, records kept, the program updated for new rules and staff trained. The rule also bars that person from running the independent review of their own program.

The working day of an AML compliance officer at a crypto exchange follows from that list: approving or escalating alerts the analysts could not close, signing off on suspicious activity reports, answering examiners, checking that the Travel Rule data really reaches counterparty exchanges, and deciding when a customer is too risky to keep. In a bank that serves crypto clients, the BSA officer does the same work with a longer list of products.

Crypto AML compliance jobs

Compliance is a large profession, and crypto is one corner of it. The BLS counted about 418,000 compliance officer jobs in the US in 2024, with a median pay of $78,420 in May 2024. The top 10% earned more than $130,030, and the bureau expects employment to grow 3% from 2024 to 2034.

Crypto firms hire along a ladder: KYC analysts who review documents, transaction monitoring and investigations analysts who work alerts, blockchain investigators who trace funds on-chain, and compliance officers who own the program. Many employers ask for the CAMS certificate from ACAMS, and blockchain analytics vendors run their own certifications. Experience with on-chain tracing tools is what separates a crypto compliance CV from a bank one.

Banks now hiring for crypto custody need both halves: people who know the Bank Secrecy Act and people who can read a transaction graph. Ex-Barclays chief Bob Diamond has argued the GENIUS Act helps banks more than it burdens them, and the hiring above is part of the cost that argument has to cover.

Our count

• Three regulators changed course in 48 days, from the OCC on 7 March to the Fed on 24 April 2025.
• A bank's program under 12 CFR 21.21 has five required elements; a money services business under 31 CFR 1022.210 has four. The bank adds board approval and a customer identification program.
• The top 10% of compliance officers earn about 1.66 times the median.
• BLS projects about 12,300 new compliance officer jobs over ten years, roughly 1,230 a year across all industries.

If you work at a bank weighing a crypto product, start with the question the rules ask first: who in your organisation owns the AML risk of that product, and do they have the tools to see on-chain history. If you want a job in this field, a KYC or monitoring analyst role at an exchange is the most common way in.

This article describes general US requirements and labour data and is not legal or career advice. Check current regulator guidance and job listings for your situation.