Crypto Gloss

AML in Crypto

Anti-money laundering (AML) refers to laws, procedures, and controls intended to detect and prevent the concealment of criminal proceeds. In crypto, AML commonly overlaps with counter-terrorist financing, sanctions screening, and other financial-crime controls. The rules do not attach automatically to every coin, protocol, or person who owns a wallet: duties depend on the activity, the organization’s role, and the law in each jurisdiction.

How AML Controls Work

A regulated crypto business may be required to identify customers, assess risk, monitor activity, keep records, screen against sanctions lists, and report specified suspicious activity to the relevant authority. The exact controls and reporting thresholds differ by country and by business model. A wallet risk label or an automated alert is a prompt for review, not by itself proof that a person committed a crime.

The Financial Action Task Force (FATF) sets international recommendations; countries implement them through their own laws. In its July 2026 update, FATF reported that 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule, while 11 more said implementation was under way. That is a snapshot of surveyed jurisdictions, not a single worldwide rule with identical thresholds.

The Travel Rule

The Travel Rule requires covered financial institutions or virtual asset service providers (VASPs) to pass specified information about the sender and recipient to one another for covered transfers. Its legal scope, threshold, and technical implementation depend on local rules. FATF recommendations are not directly interchangeable with every country’s legislation, so a statement such as “all crypto transfers above one global amount trigger the rule” is misleading.

Examples of Local AML Rules

In the United States, FinCEN applies Bank Secrecy Act requirements to certain businesses handling convertible virtual currency. Its guidance analyzes business models and activities; it does not say that every crypto user or every software protocol has the same obligations. Classification can depend on what a person or business actually does and on applicable exceptions.

Blockchain Analytics: Helpful, but Limited

On transparent blockchains, investigators and compliance teams can follow public transaction flows and use clustering tools to suggest links between addresses. Those links are inferences, and labels can be incomplete or revised as new evidence appears. An address is not automatically the same thing as a known person, and a risk score should not be treated as a legal finding.

Commercial crime reports also describe estimates, not a complete count of all crime. For example, Chainalysis’s 2026 report estimated at least $154 billion received by identified illicit addresses in 2025, while estimating that illicit activity remained below 1% of attributed crypto transaction volume. The report says its totals are a lower bound that can rise when more addresses are identified; the figures reflect the company’s methods and should be read with those limits in mind.

AML, DeFi, and Privacy

Whether a particular exchange, intermediary, developer, or protocol operator has AML duties is a legal question tied to its functions and jurisdiction. The fact that software is decentralized does not settle the analysis, and the word “DeFi” does not create one universal exemption. Privacy tools and privacy-focused networks can also limit what outside observers can infer from public data, while regulated services may still have separate customer and reporting obligations.

Tornado Cash and Changing Sanctions Status

The old claim that Tornado Cash remains under U.S. economic sanctions is outdated. On March 21, 2025, the U.S. Treasury announced that it had removed those sanctions. That U.S. action does not determine the legal status of every related person, transaction, or service under other laws or in other countries; sanctions and court developments need to be checked by date and jurisdiction.

Common Misconceptions

“Crypto is anonymous, so transactions cannot be traced.” Many public blockchains expose transaction histories, but addresses are pseudonymous and attribution requires evidence. Some systems also reveal less transaction detail than transparent chains.

“AML rules apply identically to everyone in crypto.” Requirements differ by jurisdiction and role. A regulated exchange, an individual customer, and a software developer do not automatically share the same legal duties.

“An analytics flag proves wrongdoing.” Screening tools can support investigation, but a label or score is not conclusive evidence about a person or the origin of funds.

“Tornado Cash is still sanctioned by the United States.” Treasury removed its economic sanctions in March 2025. The change is specific to that U.S. sanctions action and should not be generalized into a ruling on every legal issue.

Social Media Sentiment

A September 2026 r/Monero discussion about fake crypto AML-checker sites focused on wallet-drainer risks, privacy limits, and how users should assess screening requests. The thread had modest engagement and represents one community discussion, not overall crypto opinion; its practical concern was that a basic address check should not require connecting a wallet, signing a transaction, or revealing recovery credentials.

Last updated: 2026-10

Related Terms

  • KYC — identity checks that may form one part of a regulated customer due-diligence program.
  • Travel Rule — a requirement for covered service providers to exchange transfer information.
  • Privacy Coin — a crypto asset designed to limit public visibility into transaction details.

See Also

Sources