AML software for crypto businesses

• Pseudonymous counterparties: a wallet address says nothing about who controls it, so a transfer can reach or come from a designated person without a name ever appearing.
• Speed and finality: transfers settle quickly and are hard to reverse, so a check that runs after the transfer is usually too late.
• Cross-border by default: customers, counterparties and other service providers can sit in any jurisdiction, each with its own sanctions exposure.
• Remote onboarding at volume: sign-ups arrive in bursts, which attracts bots, synthetic identities and money mule accounts.
• Designated addresses: some sanctions designations name wallet addresses alongside the people and entities behind them.
• Other service providers: transfers to and from other exchanges and custodians mean the business has to know who those counterparties are too.

1. 1

   Stop abuse before onboarding

   Checks on email, phone, IP and sign-up behaviour filter out bots, disposable identities and repeated sign-ups before an identity check is paid for.

2. 2

   Know the customer

   Identity verification for individuals, and KYB with beneficial ownership for business customers such as trading firms and other service providers.

3. 3

   Screen people, companies and wallets

   Sanctions and PEP screening of customers and their owners at onboarding, and screening of deposit and withdrawal addresses against sanctions designations before funds are credited or sent.

4. 4

   Exchange travel rule information

   Collecting and passing on originator and beneficiary information with transfers between service providers, where the applicable rules require it, usually through a dedicated travel rule messaging solution.

5. 5

   Monitor and report

   Re-screening when lists change, monitoring activity for patterns that do not fit the customer, and reporting suspicious activity to the financial intelligence unit.

FATF Recommendation 15 requires virtual asset service providers to be licensed or registered, supervised, and to apply the same preventive measures as other financial institutions, including customer due diligence (Recommendation 10), PEP measures (Recommendation 12) and suspicious transaction reporting (Recommendation 20). The wire transfer rules of Recommendation 16, known as the travel rule, apply to virtual asset transfers as well.

In the EU, crypto-asset service providers are authorised under the Markets in Crypto-Assets Regulation, while their anti-money laundering duties come from the EU anti-money laundering framework and the travel rule from the Transfer of Funds Regulation. In the UK, cryptoasset businesses register with the FCA under the Money Laundering Regulations 2017. In the US, FinCEN treats many exchangers and administrators of convertible virtual currency as money transmitters under the Bank Secrecy Act. Sanctions apply throughout, and OFAC designations can list digital currency addresses.

• Wallet screening: addresses checked against sanctions designations, with the entity behind the address shown rather than a bare yes or no.
• Real-time API: screening that sits inline in onboarding, deposit and withdrawal flows without holding them up.
• Explainable matches: every alert shows which list, which record and which name or identifier matched, so analysts can clear namesakes quickly.
• Business customers: KYB that reaches beneficial owners and applies ownership rules such as the OFAC 50 Percent Rule.
• Fraud signals before onboarding: cheap checks that stop bots and multi-accounting before identity verification costs are incurred.
• Fit with the rest of the stack: the travel rule, blockchain analytics and transaction monitoring are usually separate tools, so screening has to connect to them cleanly.