Crypto Compliance in 2026: AML Regulations for Crypto Businesses
In 2026, crypto compliance is no longer a question of whether obligations apply — it is a question of which set of obligations applies to your business, where, and when. Crypto businesses now operate inside a network of concrete, dated requirements: FATF standards and the Travel Rule globally, the final MiCA transitional deadline for CASPs in the European Union, FinCEN/BSA and OFAC sanctions controls in the United States, the Financial Conduct Authority’s AML registration regime and an upcoming cryptoasset authorization regime in the United Kingdom, and the everyday operational layer of KYC/KYB, wallet screening, KYT, reporting and record-keeping.
The cost of getting this wrong is not abstract. In January 2025, the crypto derivatives exchange BitMEX pleaded guilty to wilfully violating the Bank Secrecy Act for failing to maintain an adequate AML programme, including its customer identification requirements. The U.S. Attorney’s Office imposed a $100 million criminal penalty, on top of $130 million previously assessed by the CFTC — more than $230 million in total AML-related sanctions against a single firm.
This cryptocurrency compliance guidance explains what cryptocurrency compliance actually means for crypto businesses in 2026: the global AML framework set by FATF, how the United States, the European Union and the United Kingdom implement it, and the core AML controls — Customer Due Diligence, wallet and transaction screening, sanctions, reporting — that crypto businesses are expected to operate every day.
Note: None of this information should be considered as legal, tax, or investment advice. While we’ve done our best to ensure this information is accurate at the time of publication, laws and practices may change, so please double-check it.
Global AML Framework: FATF and the Travel Rule Explained
The Financial Action Task Force (FATF) sets the international AML/CFT standards that shape national rules for virtual assets and virtual asset service providers (VASPs).
For crypto businesses, the most directly relevant requirements are customer due diligence, VASP registration or licensing, transaction monitoring and the Travel Rule — codified primarily in Recommendation 10 (Customer Due Diligence), Recommendation 15 (New Technologies/VASPs) and Recommendation 16 (Wire Transfers/Travel Rule).
In practical terms, R.15 is what brings crypto businesses into AML scope at all — through its 2019 Interpretive Note, the FATF extended AML/CFT obligations to VASPs and required jurisdictions to license or register them. R.16 is what governs the transfer information that must accompany those transactions between providers. For a deeper, structural look at how these obligations apply to virtual assets, see our overview of FATF Crypto Standards for Virtual Assets and VASPs.
The Travel Rule requires VASPs to collect and transmit required originator and beneficiary information when they send or receive qualifying virtual asset transfers between providers. FATF recommends a de minimis threshold of USD/EUR 1,000 in its Standards, but each jurisdiction sets its own. The United States applies the rule to transmittals of $3,000 or more. In the EU, the crypto Travel Rule applies under the Transfer of Funds Regulation, not under MiCA, and generally applies without a minimum transfer threshold. Canada applies CAD 1,000, Singapore SGD 1,500, and so on.
Implementation remains uneven across markets. According to FATF’s 2025 Targeted Update, 85 of 117 surveyed jurisdictions had passed legislation implementing the Travel Rule. FATF also continues to highlight risks linked to stablecoins, unhosted wallets, offshore VASPs and certain DeFi arrangements where identifiable parties exercise control or influence. Source: FATF, Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs, June 2025.
FATF also enforces its standards through Mutual Evaluations and by placing non-compliant jurisdictions on its grey or black lists, creating reputational and financial incentives to strengthen AML/CFT regimes.
Crypto AML Regulations in the United States, European Union and United Kingdom
FATF provides the international baseline, but crypto businesses must comply with the rules of each jurisdiction in which they operate or serve customers. The United States, European Union and United Kingdom apply different licensing, AML, reporting and supervisory models — and the differences are widening rather than converging.
USA Crypto Regulations
The United States applies a layered, multi-agency AML model, with the Financial Crimes Enforcement Network (FinCEN) at its centre under the Bank Secrecy Act (BSA). In practical terms, classification is functional, not nominal: a business is treated as a Money Services Business (MSB) based on what it does, not what it calls itself.
Crypto businesses that qualify as Money Transmitters — including relevant administrators or exchangers of convertible virtual currency — may be required to register with FinCEN as MSBs and comply with BSA AML, reporting and record-keeping obligations. This typically includes:
- MSB Registration: Filing the required registration with FinCEN where the business qualifies, and renewing it as prescribed.
- Written AML Programme: A risk-based programme covering policies, internal controls, a designated compliance officer, ongoing training and independent review.
- Customer Identification and CDD: Identifying customers and conducting risk-based due diligence consistent with BSA expectations.
- Suspicious Activity Reporting: Filing SARs with FinCEN where suspicion is formed, in line with BSA thresholds and timelines.
- Recordkeeping and the Travel Rule: Maintaining records and complying with the Recordkeeping and Travel Rule requirements for qualifying transmittals of $3,000 or more.
Sanctions compliance is enforced separately by the Office of Foreign Assets Control (OFAC). Crypto businesses must screen customers, counterparties and wallet addresses against OFAC’s Specially Designated Nationals (SDN) list and other restricted lists, on a continuous basis. OFAC has designated specific wallet addresses and entire mixing services (including Tornado Cash) in recent years, and exchanges, custodians and payment processors must integrate real-time sanctions screening that keeps pace with those updates.
Depending on their activities, U.S. crypto businesses may also face securities, commodities, tax or state licensing requirements — for example, the SEC and CFTC continue to apply their respective frameworks to tokens that meet their tests, the IRS treats crypto as property for tax purposes, and over 40 states require Money Transmitter Licences with New York’s BitLicense the most demanding example. However, the core AML layer is built around FinCEN/BSA obligations and OFAC sanctions compliance.
An upcoming layer to watch is the federal stablecoin regime. In April 2026, FinCEN and OFAC issued a joint Notice of Proposed Rulemaking implementing the AML/CFT and sanctions compliance programme requirements of the GENIUS Act for permitted payment stablecoin issuers (PPSIs). The proposed rule would treat PPSIs as BSA financial institutions and, for the first time by statute, require an effective sanctions compliance programme with transaction-blocking capabilities. Because this is a proposed rule with comments due in June 2026, it should be read as an incoming federal stablecoin-issuer obligation rather than a rule already applying to all crypto businesses.
Source: FinCEN and OFAC, Joint Notice of Proposed Rulemaking on Permitted Payment Stablecoin Issuer AML/CFT and Sanctions Compliance Programme Requirements, 8 April 2026 (Federal Register, Docket No. FINCEN-2026-0100; comments due 9 June 2026).
EU Crypto Regulations
The European Union now has the most comprehensive crypto-specific regulatory framework in any major market — and 2026 is the year in which the transitional arrangements close.
In 2026, EU crypto compliance is built around four main regulatory layers: MiCA authorization for crypto-asset service providers, the Transfer of Funds Regulation and Travel Rule requirements for crypto transfers, AMLA’s new EU-level AML/CFT supervisory role, and the upcoming Anti-Money Laundering Regulation that will apply from 10 July 2027.
For crypto businesses serving EU customers, the immediate priority is MiCA authorization readiness. CASPs that continue offering services to EU clients after the end of the transitional period must hold the required MiCA authorization unless another valid exemption applies. In parallel, firms need Travel Rule controls, customer due diligence, transaction monitoring, sanctions screening, suspicious activity reporting workflows, and ICT resilience controls under DORA.
The following visual summary shows the core MiCA requirements that crypto businesses should understand in 2026.
MiCA (Regulation (EU) 2023/1114) has applied to crypto-asset service providers (CASPs) since 30 December 2024, creating a single authorization regime that replaces the patchwork of national VASP registrations. Some firms operating under national regimes benefit from transitional arrangements, but these end across the EU no later than 1 July 2026 — or earlier where a Member State applied a shorter period. After that date, a firm providing crypto-asset services to EU clients without the required MiCA authorization must cease offering those services.
MiCA is only one part of the EU compliance framework. The Transfer of Funds Regulation applies the Travel Rule to crypto-asset transfers, requiring information on originators and beneficiaries and additional controls for transfers involving self-hosted addresses. For a detailed breakdown of those transfer obligations, see our guide to the EU Crypto Travel Rule Requirements for CASPs.
The supervisory architecture changed at the start of the year. On 1 January 2026, responsibility for all EU-level AML/CFT tasks moved from the European Banking Authority (EBA) to the new Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), headquartered in Frankfurt. AMLA now develops and enforces the EU’s common AML/CFT rules, coordinates the work of national Financial Intelligence Units, and will begin direct supervision of selected high-risk financial institutions from 2028.
The next major layer is the EU Anti-Money Laundering Regulation (AMLR), which introduces more harmonised AML/CFT requirements across obliged entities — including crypto-asset service providers — under a single rulebook. AMLR applies from 10 July 2027, so in 2026 it should be treated as an incoming compliance requirement rather than a rule already fully in force.
Source: EBA and AMLA, joint announcement on the completion of the AML/CFT mandate handover on 1 January 2026; Regulation (EU) 2024/1624 (AMLR), applicable from 10 July 2027.
Operational resilience is addressed in parallel under the Digital Operational Resilience Act (DORA), which sets ICT risk-management and incident-reporting obligations for financial entities, including CASPs. It is not an AML rule itself, but it sits alongside AML controls in the daily compliance picture.
UK Crypto Regulations
In the UK, crypto regulation has so far been delivered through the existing financial framework rather than a stand-alone crypto regulator. Any firm that exchanges, holds, or transfers crypto on behalf of customers must currently register with the Financial Conduct Authority (FCA) under the Money Laundering Regulations 2017 (MLRs). Registered firms must operate KYC/CDD, transaction monitoring, suspicious activity reporting and record-keeping consistent with UK AML law.
In 2026, the UK crypto regulatory framework is split across several authorities rather than handled by a single crypto regulator. The FCA is the primary authority for AML registration, financial promotions and the incoming FSMA cryptoasset authorization regime. HMRC sets the tax treatment and reporting expectations for cryptoassets. The Bank of England focuses on financial stability, systemic stablecoins and digital pound research.
The bigger change is coming. The UK is now preparing for a broader FCA cryptoasset authorization regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. The FCA has confirmed that the application gateway will be open from 30 September 2026 to 28 February 2027, with the new regime expected to come into force on 25 October 2027. Until then, relevant cryptoasset firms may still need MLR registration before beginning regulated crypto activity, and the FCA strongly encourages firms to engage early through its Pre-Application Support Service (PASS) ahead of the formal window.
Source: Financial Conduct Authority, “A New Regime for Cryptoasset Regulation” and “Cryptoassets: How the Gateway Will Operate,” published January 2026.
In practical terms, UK firms now have a clear two-stage timeline: secure or maintain MLR registration in 2026, prepare an FSMA authorization application during the gateway window, and be ready for the new conduct, custody and stablecoin-issuance standards that will apply once the regime commences in late 2027.
Core AML Compliance Requirements for Crypto Businesses
Whatever the jurisdiction, the operational layer of crypto compliance comes down to a connected set of controls: KYT, KYC/KYB, Sanctions Screening and Reporting.
Transaction Monitoring (KYT)
Know-Your-Transaction (KYT) is the crypto-native evolution of traditional transaction monitoring. An effective KYT system combines on-chain and off-chain data to assess wallet risk, trace the flow of funds, identify laundering techniques such as chain-hopping and mixer use, and detect behavioural patterns associated with structuring or layering.
For a deeper look at how these typologies combine in practice — including chain hopping, mixer use, DeFi routing and wallet fragmentation — see Layering in Crypto AML: How It Works and How to Detect It.
In practical terms, transaction monitoring should not end with a risk score. Businesses need documented alert review rules, escalation thresholds, case records and reporting procedures where suspicious activity is identified — a workflow covered in detail in our guide on How to Review and Escalate High-Risk Crypto Transaction Alerts.
Tools matter once the process is in place: AMLBot’s Crypto Transaction Monitoring Solution analyses transaction flows in real time, screening against sanctions lists, known illicit addresses and behavioural patterns that may indicate suspicious activity.
Customer Due Diligence (CDD) and Know Your Customer (KYC)
KYC and CDD are a crypto business’s first line of defence. A strong Customer Identification Programme requires the collection and verification of identifying information for all customers, and crypto businesses serving corporate clients or other VASPs need the equivalent Know Your Business (KYB) process for those relationships, including verification of Ultimate Beneficial Owners (UBOs).
A risk-based approach determines the depth of due diligence. For higher-risk customers — politically exposed persons (PEPs), clients from high-risk jurisdictions, or unusually large transactions — Enhanced Due Diligence (EDD) is required, including the collection of information on source of funds and source of wealth. Onboarding is the start of the relationship, not the whole of it: CDD applies on an ongoing basis as the relationship and risk profile evolve.
In practical terms, a customer who passes identity verification can still interact with high-risk wallets, which is why KYC/KYB and KYT need to work together rather than as separate controls. We cover the interaction in our breakdown of How KYC and KYT Work Together in Crypto Compliance.
Sanctions Screening and Compliance
Crypto businesses are required to screen customers, transactions and blockchain addresses against international and national sanctions lists — OFAC, EU, UN and others. The screening must be continuous and updated as designations change, and firms must maintain detailed records of screening activity, including how potential matches were investigated, escalated and resolved.
A confirmed sanctions match may require rejection or blocking of a transaction, asset freezing and regulatory reporting, depending on the applicable sanctions regime and jurisdiction. The exact action is determined by the relevant authority’s rules, not by a single global standard.
Suspicious Activity Reporting
When an alert develops into a reasonable suspicion of money laundering, terrorist financing, sanctions evasion or other illicit activity, the business must follow the reporting procedure required in its jurisdiction and preserve the underlying records.
The specifics differ between regimes. In the United States, relevant MSBs file Suspicious Activity Reports (SARs) with FinCEN under BSA requirements, with the SAR filing thresholds and deadlines applying as U.S.-specific requirements rather than as a global standard. In the EU, equivalent reports go to national Financial Intelligence Units under the applicable AML framework. Whatever the jurisdiction, AML-related records — CDD data, transaction details and the reports themselves — should generally be retained for at least five years and remain readily accessible for regulatory audit.
How to Implement Crypto Compliance in Practice
Implementation is what turns the regulatory overview above into a working compliance programme. The sequence below works regardless of which jurisdictions you operate in — the specific obligations attach to the steps, not the other way round.
- Identify Jurisdictions and Licensing Obligations: Establish where the business operates or serves customers and which licensing, registration or authorisation regimes apply.
- Define Customer and Counterparty Onboarding Controls: Set KYC, KYB and counterparty due-diligence procedures, including UBO verification and risk-based EDD for higher-risk relationships.
- Screen Wallets and Transactions Before and During Service Delivery: Apply wallet screening at onboarding and continuous transaction monitoring throughout the relationship.
- Monitor Ongoing Activity and Investigate Alerts: Operate a documented alert-review workflow with defined thresholds and case records.
- Escalate Suspicious or Sanctioned Exposure: Trigger escalation, blocking, freezing or reporting as required by the applicable regime.
- Retain Evidence and Reporting Records: Keep CDD data, transaction records and reports retrievable for the period required by national law.
- Review Controls as Regulation and Risk Typologies Change: Refresh the programme as new rules apply (MiCA, AMLR, FCA regime, GENIUS Act stablecoin rules) and as criminal typologies evolve.
AMLBot supports crypto businesses with KYC/KYB Checks, wallet screening, Transaction Monitoring and API-based Integration into internal compliance workflows.
Conclusion: Preparing for Crypto AML Compliance in 2026 and Beyond
The 2026 picture is defined less by general rules and more by specific, dated obligations. For crypto businesses, the calendar matters as much as the framework:
- EU CASPs: Transitional arrangements end across the EU no later than 1 July 2026 — firms relying on national grandfathering must secure MiCA authorisation by that date or cease offering crypto-asset services to EU clients.
- UK Firms: The FCA cryptoasset authorisation application gateway is expected to open from 30 September 2026, with the new regime in force from 25 October 2027.
- EU AMLR: The next compliance layer applies from 10 July 2027, under AMLA’s direct rulebook for AML/CFT obligations across obliged entities.
- Globally: FATF Travel Rule implementation continues to expand unevenly, with sharper supervisory focus on stablecoins, unhosted wallets and higher-risk counterparties.
Effective crypto compliance in 2026 is the connected operation of all of these — licensing where required, KYC/KYB, Wallet Screening, Transaction Monitoring, Sanctions Controls, Reporting and Record-Keeping — documented well enough to withstand a supervisory review on the day it arrives.
Key Takeaways
- FATF Baseline: FATF remains the global standard for VASP AML/CFT controls, while Travel Rule implementation remains uneven — 85 of 117 surveyed jurisdictions have passed Travel Rule legislation as of the June 2025 Targeted Update.
- EU MiCA Deadline: CASPs relying on transitional arrangements must prepare for the final MiCA deadline of 1 July 2026.
- EU Supervisory Shift: AMLA has assumed EU-level AML/CFT responsibilities from 1 January 2026, while AMLR becomes applicable from 10 July 2027.
- UK Transition: FCA AML registration remains relevant ahead of the broader cryptoasset authorisation regime expected in October 2027.
- Operational Layer: Effective crypto compliance requires connected KYC/KYB, wallet screening, transaction monitoring, sanctions controls, reporting and record-keeping.
Key Takeaways
- FATF’s Travel Rule is now enforced in 99+ countries, shaping the foundation for cross-border crypto compliance.
- MiCA and AMLR have created the first unified regulatory framework for the EU’s crypto market.
- U.S. firms must comply with FinCEN (BSA), SEC/CFTC, OFAC, and IRS requirements across federal and state levels.
- Compliance Automation, from KYC/KYB to KYT, is essential for scalability and risk control.
- AMLBot delivers full-stack AML/KYC/KYT coverage across jurisdictions, helping crypto businesses stay audit-ready and regulator-compliant.
AMLBot Team
AMLBot Team
AMLBot Team
AMLBot Team
FAQ
What Is Crypto AML Compliance?
Crypto AML Compliance is the process of preventing crypto services from being used for Money Laundering, Terrorist Financing, sanctions evasion and other illicit activity. It typically includes customer checks, wallet and transaction risk analysis, monitoring, reporting and record-keeping.
Why Do Crypto Businesses Need AML Compliance?
Crypto businesses may receive or transfer funds connected to scams, hacks, sanctions, darknet markets, mixers or other high-risk sources. AML controls help identify these risks, meet regulatory requirements and reduce exposure to illicit funds.
Which Crypto Businesses Are Affected by AML Regulations?
AML requirements may apply to exchanges, custodial wallet providers, crypto payment services, OTC desks, brokers, CASPs, VASPs and other businesses that transfer, store or manage crypto assets for customers. Classification is functional — based on what the business does — rather than how it labels itself.
What Are the Main AML Requirements for Crypto Businesses?
Common requirements include Customer Due Diligence, KYC/KYB, sanctions screening, wallet screening, transaction monitoring, suspicious activity reporting, Travel Rule compliance and maintaining records for audits or regulatory review.
What Is the Difference Between KYC and KYT in Crypto Compliance?
KYC identifies and verifies the customer. KYT analyses crypto transactions and wallet exposure to identify risks linked to illicit sources or suspicious fund movements. Crypto businesses often need both because a verified customer can still interact with risky crypto assets.
What Is Wallet Screening in Crypto AML?
Wallet screening is the process of checking a crypto address for exposure to high-risk sources such as sanctions, stolen funds, scams, darknet markets or mixers. It helps businesses assess risk before accepting or processing crypto assets.
What Is Crypto Transaction Monitoring?
Crypto transaction monitoring is the ongoing analysis of transfers and wallet activity to detect suspicious patterns, changing risk exposure or activity that may require review, escalation or reporting.
What Is the Crypto Travel Rule?
The Crypto Travel Rule requires applicable crypto businesses to collect and transmit required information about the originator and beneficiary of certain crypto transfers. The exact implementation depends on the jurisdiction — thresholds and required fields vary between the EU, the United States, the United Kingdom and other markets.
How Do FATF, MiCA and National AML Rules Relate to Crypto Businesses?
FATF sets international AML/CFT standards for virtual assets and service providers. Regional and national frameworks — such as EU rules under MiCA and the Transfer of Funds Regulation, or U.S. requirements under FinCEN and the BSA — translate those principles into binding obligations for businesses.
How Can Crypto Businesses Manage AML Risk in Practice?
Crypto businesses typically combine customer verification, wallet screening, transaction monitoring, sanctions controls, alert investigation, reporting procedures and record-keeping in a risk-based compliance process, refreshed as regulation and criminal typologies evolve.