Crypto Compliance FAQ: 50 Questions Answered
This FAQ addresses the most common questions from compliance officers, legal counsel, and operations teams implementing digital asset compliance programs. Each answer provides actionable information with references to our detailed guides for deeper coverage.
General Compliance
1. What is crypto compliance?
Crypto compliance is the comprehensive set of policies, procedures, systems, and controls that digital asset businesses implement to meet regulatory obligations. It encompasses AML/KYC programs, transaction monitoring, sanctions screening, securities regulation adherence, tax reporting, and licensing requirements. See our Crypto Compliance Definitive Guide for complete coverage.
2. Which regulations apply to my crypto business?
The regulations that apply depend on your business model, the types of assets you handle, and the jurisdictions where you operate and serve customers. At minimum, most digital asset businesses must comply with AML/CFT regulations (BSA in the US, AML Directives in the EU), licensing or registration requirements, sanctions regulations, and the Travel Rule. Conduct a regulatory mapping exercise as the first step. See Getting Started with Crypto Compliance.
3. Do I need a license to operate a crypto business?
In most jurisdictions, yes. The specific licensing requirements depend on your business model and location:
- United States: FinCEN MSB registration (federal) plus state money transmitter licenses in each state where you operate. New York requires a BitLicense. Some activities may additionally require SEC or CFTC registration.
- European Union: MiCA CASP authorization from a national competent authority. A single authorization provides passporting across all 27 EU member states.
- Singapore: Payment Services Act license (SPI or MPI) from the Monetary Authority of Singapore.
- UAE: VARA licensing in Dubai or ADGM FSRA licensing in Abu Dhabi.
- Hong Kong: VASP license from the Securities and Futures Commission.
Operating without required licenses is a criminal offense in many jurisdictions and can result in penalties, asset seizure, and criminal prosecution of individuals. If you are unsure whether your activities require licensing, consult qualified legal counsel before commencing operations.
4. How much does compliance cost?
Compliance costs vary significantly by firm size. Startups typically spend $300,000-800,000 annually, mid-size exchanges $1-5 million, and large exchanges $10-50 million+. Compliance technology represents 25-40% of total spending. See Crypto Compliance Market Size & Growth for detailed benchmarks.
5. What happens if I don’t comply?
Non-compliance consequences are severe and escalating across all jurisdictions:
- Civil penalties: Ranging from thousands to billions of dollars. The Binance $4.3 billion settlement (2023) and Terraform Labs $4.5 billion SEC judgment (2024) demonstrate the scale.
- Criminal prosecution: Individuals — not just companies — face criminal charges for willful BSA violations, securities fraud, and sanctions evasion. The Binance settlement included criminal charges against the CEO.
- License revocation: Regulators can revoke or suspend operating licenses, immediately ending business operations.
- Banking access: Non-compliant firms are cut off from banking relationships, making it impossible to operate fiat on/off ramps.
- Reputational damage: Public enforcement actions permanently damage reputation with customers, counterparties, and potential acquirers.
- Personal liability: Compliance officers and senior management can face personal liability for compliance failures, including disgorgement, civil penalties, and officer-and-director bars.
The trend is clear: the cost of non-compliance far exceeds the cost of compliance. See our Enforcement Action Tracker for current enforcement data.
AML/KYC
6. What is an AML program and what must it include?
An AML program is the framework a firm uses to prevent, detect, and report money laundering. It must include written policies and procedures, a designated compliance officer, a risk assessment, customer due diligence procedures, transaction monitoring, suspicious activity reporting, training, and independent testing. See What Is AML Compliance.
7. What KYC documents do I need to collect?
At minimum: government-issued photo ID (passport, national ID, or driver’s license) and proof of address. For enhanced due diligence, you may also need source of funds documentation, employment verification, and additional identity verification. Entity customers require corporate documentation and beneficial ownership identification.
8. What is enhanced due diligence (EDD) and when is it required?
EDD is additional verification applied to high-risk customers. It is required for PEPs (Politically Exposed Persons), customers from high-risk jurisdictions (FATF grey-listed countries), customers with complex ownership structures, high-value or unusual transactions, and other situations identified as high-risk in your risk assessment.
9. How often should I re-verify customer information?
Re-verification frequency should be risk-based. High-risk customers should be reviewed at least annually. Medium-risk customers every 2-3 years. Low-risk customers every 3-5 years. Trigger-based re-verification should occur when the firm becomes aware of material changes in the customer’s circumstances.
10. What is the difference between CDD and EDD?
CDD (Customer Due Diligence) is the standard verification applied to all customers — identity verification, risk scoring, and basic background checks. EDD (Enhanced Due Diligence) is additional verification for high-risk customers, including source of funds documentation, senior management approval, more frequent monitoring, and additional identity verification measures.
Transaction Monitoring
11. What blockchain analytics platform should I use?
The three market leaders are Chainalysis, TRM Labs, and Elliptic. Chainalysis is the market leader with the largest attribution database. TRM Labs offers competitive pricing and modern architecture. Elliptic is strong in Europe. See Chainalysis vs. Elliptic vs. TRM Labs.
12. How do I set transaction monitoring thresholds?
Thresholds should be based on your risk assessment, customer segmentation, and transaction patterns. Start with industry-standard rules and tune based on operational experience:
- Value thresholds: Alert on individual transactions above a defined amount (e.g., $10,000 for standard customers, lower for high-risk customers)
- Velocity rules: Alert when a customer conducts more than a defined number of transactions within a time period
- Structuring detection: Alert on patterns of transactions just below reporting thresholds
- Jurisdiction rules: Alert on transactions involving high-risk jurisdictions
- Blockchain exposure rules: Alert on transactions with direct or indirect exposure to darknet markets, mixers, sanctioned addresses, or other high-risk categories (configured through your blockchain analytics platform)
- Behavioral deviation: Alert when a customer’s activity deviates significantly from their established pattern
Expect high false positive rates initially — industry averages are 80-95%. Plan for ongoing rule tuning and optimization starting within the first month of operation.
13. What is a false positive rate and what is acceptable?
A false positive rate is the percentage of monitoring alerts that, upon investigation, do not represent genuinely suspicious activity. Industry average false positive rates for crypto transaction monitoring range from 80-95%. While there is no regulatory standard for an acceptable rate, excessively high rates indicate inefficient monitoring, and excessively low rates may indicate insufficient monitoring.
14. How quickly must I review transaction monitoring alerts?
There is no universal regulatory requirement for alert review speed, but best practices include reviewing high-priority alerts (sanctions hits, high-risk exposure) within 4 hours, standard alerts within 24-48 hours, and low-priority alerts within 5 business days. Document your SLAs and demonstrate adherence.
15. What is transaction monitoring for DeFi?
DeFi transaction monitoring tracks customer interactions with decentralized protocols, including exposure to unregulated or high-risk protocols, cross-chain bridge activity, and complex DeFi transaction patterns. This is an emerging area where monitoring capabilities are still developing.
Travel Rule
16. What is the Travel Rule?
The Travel Rule (FATF Recommendation 16) requires VASPs to exchange originator and beneficiary information for crypto transfers above applicable thresholds. See What Is the Travel Rule and our Crypto Travel Rule Compliance Guide.
17. What is the Travel Rule threshold?
Thresholds vary by jurisdiction: USD/EUR 1,000 in most EU jurisdictions, $3,000 in the US, SGD 1,500 in Singapore. Some jurisdictions apply zero-threshold requirements.
18. What data must be transmitted under the Travel Rule?
Originator: full name, account number, and at least one of physical address, national ID, customer ID number, or date/place of birth. Beneficiary: full name and account number.
19. How do I comply with the Travel Rule for unhosted wallets?
When a customer transfers to or from a self-hosted wallet, the standard VASP-to-VASP exchange cannot occur. Requirements vary by jurisdiction — some require collecting beneficiary information from the customer, others apply enhanced due diligence, and some set transaction limits for unhosted wallet transfers.
20. What Travel Rule technology should I use?
Notabene is the market leader with the largest VASP network. Other options include Sygna and TRISA. Choose the platform with the largest network coverage in your primary jurisdictions.
Sanctions
21. What sanctions lists must I screen against?
At minimum: OFAC SDN list (US), EU Consolidated Sanctions List (EU), and UN Security Council Sanctions List. Additional lists depend on your jurisdictions of operation. OFAC has published cryptocurrency addresses on the SDN list.
22. Is sanctions compliance strict liability?
Yes. There is no intent requirement and no de minimis exception for sanctions violations. Any transaction involving a sanctioned person, entity, or jurisdiction violates sanctions regulations regardless of whether the firm knew about the sanctions nexus.
23. What happens if I detect a sanctions hit?
For OFAC: block the transaction, freeze the funds, file a blocking report with OFAC within 10 business days, and do not release the funds without OFAC authorization. For other sanctions regimes, follow the applicable procedures for your jurisdiction.
24. How often should I update my sanctions screening lists?
Sanctions lists should be updated within 24 hours of any changes published by the issuing authority. OFAC updates occur frequently and sometimes without advance notice. Automated list update processes are essential.
25. Does the Tornado Cash designation affect my compliance obligations?
Yes. OFAC’s designation of Tornado Cash smart contract addresses as SDN entries means that any transaction involving those addresses is a sanctions violation. Your screening systems must include cryptocurrency addresses published on the SDN list.
Suspicious Activity Reporting
26. When must I file a SAR?
File a SAR when the firm knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, lacks a lawful purpose, or involves the use of the financial institution to facilitate criminal activity, and the transaction is $5,000 or more. See What Is a Suspicious Activity Report.
27. What is the SAR filing deadline?
30 calendar days from the date of initial detection. If no suspect is identified, the deadline extends to 60 days while the firm conducts additional investigation.
28. Can I tell my customer about a SAR?
No. SAR confidentiality is a legal requirement. Disclosing SAR existence or content to the subject of the SAR is a federal crime (SAR tipping prohibition).
29. What should a SAR narrative include?
The narrative must describe the who, what, when, where, and why of the suspicious activity. Include specific facts: transaction amounts, dates, wallet addresses, customer identification, and the reason the activity is suspicious. Avoid conclusory statements without supporting facts.
30. How many SARs should I be filing?
There is no “right” number, but filing rates that are dramatically lower than peer institutions may indicate an inadequate monitoring program. FinCEN tracks filing volumes by institution size and type.
Securities Compliance
31. How do I know if my token is a security?
Apply the Howey test — an investment contract (security) exists when there is:
- An investment of money — Any form of consideration, including cryptocurrency
- In a common enterprise — Investors’ funds are pooled or their fortunes are tied to the efforts of the promoter
- With a reasonable expectation of profit — The purchaser expects financial returns
- Derived from the efforts of others — Returns depend on the work of a centralized team or third party
Tokens that are almost certainly securities include equity tokens, revenue-sharing tokens, tokens marketed as investments, and fund tokens. Tokens in a gray area include governance tokens, staking tokens with yield, and tokens with both utility and investment characteristics. The conservative approach is to treat any token with investment characteristics as a security unless a definitive legal analysis concludes otherwise. When in doubt, consult qualified securities counsel. See Investing in Security Tokens Compliance.
32. What exemptions are available for security token offerings?
The most common exemptions are Regulation D (506(b) and 506(c)), Regulation A+ (Tier 1 and Tier 2), Regulation S (offshore), and Regulation CF (crowdfunding). Each has different requirements for investor qualification, offering amount, and ongoing reporting.
33. Do I need a broker-dealer for my token offering?
In most cases, yes. If third parties are soliciting investors, handling investor funds, or facilitating token sales for compensation, broker-dealer involvement is required. The issuer exemption is narrow.
MiCA Compliance
34. What is MiCA?
MiCA (Markets in Crypto-Assets Regulation) is the EU’s comprehensive regulatory framework for crypto assets, applicable since December 30, 2024. It requires CASP authorization for all crypto asset services in the EU. See MiCA Compliance.
35. How long does MiCA CASP licensing take?
3-12 months depending on the National Competent Authority and the completeness of the application. See MiCA CASP Licensing Complete Guide.
36. What are the MiCA capital requirements?
Minimum capital ranges from EUR 50,000 to EUR 150,000 depending on the services provided. NCAs may require higher capital based on risk profile.
37. Does a MiCA license give me access to all EU countries?
Yes. MiCA provides a passporting mechanism that allows authorized CASPs to operate across all 27 EU member states under a single authorization.
Regional Compliance
38. What are the UAE compliance requirements?
The UAE has three regulatory frameworks: VARA (Dubai), ADGM FSRA (Abu Dhabi), and SCA (federal). Each requires licensing and comprehensive AML/CFT compliance. See UAE Crypto Compliance Requirements.
39. What is required for Singapore MAS licensing?
A Payment Services Act license (SPI or MPI), comprehensive AML/CFT framework compliant with PSN02, Singapore-resident CEO and compliance officer, and compliance with MAS Technology Risk Management Guidelines. See Singapore MAS Compliance Requirements.
40. How do I choose between jurisdictions for licensing?
Consider market access, regulatory costs, tax treatment, passporting availability, talent pool, and business environment. See UAE vs. Singapore Compliance and MiCA vs. US Compliance Requirements.
Compliance Technology
41. What is the minimum compliance technology stack?
At minimum: a KYC/identity verification platform, a blockchain analytics/transaction monitoring platform, and sanctions screening capability. See Compliance Technology Infrastructure.
42. How much does compliance technology cost?
Startups: $100,000-400,000/year. Mid-size exchanges: $500,000-1.5 million/year. Large exchanges: $2-7 million+/year. See Compliance Platform Pricing Comparison.
43. Should I build or buy compliance technology?
Buy for core compliance functions (blockchain analytics, KYC) where vendor expertise and regulatory acceptance are critical. Build custom integrations, workflows, and reporting that tie vendor platforms together. See Manual vs. Automated Compliance.
44. How do I reduce false positive rates?
Tune monitoring rules based on operational data, implement risk-based alert prioritization, use AI-assisted alert triage, segment customers for more targeted monitoring rules, and regularly review and retire underperforming rules.
45. When should I transition from manual to automated compliance?
When customer volume exceeds 500-1,000 for KYC, or when transaction monitoring generates more than 50 alerts per week. Manual compliance at volume is itself a regulatory risk.
Compliance Program Management
46. How do I prepare for a regulatory examination?
Examination preparation should be a continuous state, not a pre-examination sprint. Maintain the following documentation ready for examination at all times:
- Current enterprise-wide risk assessment (reviewed and approved within the last 12 months)
- Current policies and procedures manual with evidence of review dates
- Compliance training records for all employees showing completion dates and topics covered
- Independent testing reports from the most recent review, with remediation status for any findings
- SAR filing records with complete investigation files
- Transaction monitoring rule documentation including performance metrics (alert volumes, disposition rates, false positive rates)
- Board and senior management compliance reporting for the past 12 months
- Customer risk distribution data showing CDD and EDD application
Conduct quarterly self-assessments using the FFIEC BSA/AML Examination Manual as a framework to identify and address gaps before examiners find them. See Advanced AML Compliance Implementation.
47. How often should I update my risk assessment?
At least annually, and whenever there are material changes to the business — new products, new markets, significant changes in customer base, or significant regulatory developments.
48. What qualifications should my compliance officer have?
AML/CFT compliance experience in financial services (digital asset experience strongly preferred), professional certifications (CAMS, CFCS), understanding of blockchain technology, and knowledge of applicable regulatory frameworks. The CCO should report directly to the CEO or board with independent authority.
49. How do I measure compliance program effectiveness?
Track alert volumes and disposition rates, SAR filing volumes and quality, false positive rates, investigation cycle times, training completion rates, independent testing results, and regulatory examination outcomes. See How to Build a Crypto Compliance Program.
50. Where can I find ongoing compliance guidance?
Tokenization Compliance provides continuous coverage of crypto compliance developments through multiple channels:
- Weekly Intelligence Briefings: Subscribe to our newsletter for regulatory updates, enforcement alerts, and implementation insights delivered to your inbox.
- Comprehensive Guides: Our Crypto Compliance Definitive Guide and How to Build a Crypto Compliance Program provide complete implementation frameworks.
- Compliance Glossary: The A-Z Compliance Glossary defines key terminology and concepts.
- Intelligence Briefs: Our intelligence briefs provide timely analysis of regulatory developments, enforcement actions, and market trends.
- Technology Analysis: The Compliance Vendor Comparison Dashboard and Compliance Platform Pricing Comparison support technology procurement decisions.
- Premium Intelligence: For institutional-grade analysis, our Premium Compliance Intelligence service provides daily briefings and custom analysis.
Additionally, compliance professionals should monitor regulatory publications from their primary regulators (FinCEN, SEC, ESMA, MAS, etc.), participate in industry working groups and associations, and maintain relationships with qualified legal counsel who specialize in digital asset regulation.
This FAQ is updated regularly to reflect regulatory changes and new compliance developments. Last updated March 2026. The information provided does not constitute legal advice. Consult qualified legal counsel for jurisdiction-specific compliance determinations.