AMLBot Team

Most crypto payment gateways settle in stablecoins. So does most crypto crime. In a targeted report published on 3 March 2026, the Financial Action Task Force noted that stablecoins had grown to more than 250 in circulation by mid-2025 with a combined market capitalisation above USD 300 billion — and

The engineering team says they can build it. They already run nodes, parse transactions, and have a data pipeline. How hard can monitoring be? The answer depends on what "monitoring" actually means. If the question is "can we see blockchain transactions?" — most engineering teams with blockchain

There is no single number. A non-custodial wallet provider processing 200 low-risk retail transactions per month and a custodial exchange onboarding business clients across three jurisdictions with continuous multi-chain monitoring are both "crypto startups." Their AML compliance budgets will have almost nothing in common. The

The founder has a clear plan: build the exchange, get the cheapest license, start operating. The licensing consultant sends a proposal — $15,000 all-in, ready in three weeks, offshore jurisdiction with zero corporate tax. It looks like the fastest path to market. 18 months later, the exchange has a

On 23 April 2026, $344 million in USDT stopped moving. Tether blacklisted two addresses on Tron after several U.S. authorities passed it information about activity tied to unlawful conduct, in coordination with OFAC and other law enforcement agencies. The company said this kind of action has become a routine

Ninety-one out of 109. That is how many surveyed jurisdictions had passed legislation implementing the Crypto Travel Rule when FATF published its Seventh Targeted Update on 16 July 2026 — 83%, up from 73% a year earlier, with another 11 jurisdictions reporting that implementation is under way. Read on its

On 8 May 2026, AUSTRAC put numbers on how closely it intended to watch Australia's crypto sector: 36 over-the-counter crypto-to-cash businesses under a supervisory campaign it branded ramps and rails, and 27 local exchanges under a second campaign focused on reform readiness and governance.

A customer passes KYC. Account approved. Risk level assigned. Two weeks later, 40,000 USDC arrives in their account — from a wallet that does not belong to them. The compliance team now has a verified customer and an unverified payment. The identity check answered who opened the account. It did

The AML check returned High Risk. Stolen Funds exposure. The number is there. The category is there. And the next question is not about the score. It is: which transfer created this exposure? Is it connected to the deposit being reviewed — or to something that happened in this wallet'

Nobody migrates a KYT provider because the old one works perfectly. The decision usually follows months of frustration — coverage gaps on chains the business now supports, slow API responses during peak volume, risk categories that do not match how the compliance team actually thinks about risk, alert logic that cannot

Imagine: 3 years ago you bought ETH on an exchange using a bank transfer. You withdrew it to a hardware wallet. Later you swapped half for USDC on a DEX, bridged it to another chain, received freelance payments in the same wallet, sold some through a P2P trade, and now

Intro "My wallet was hacked." Every crypto investigation team hears this sentence multiple times a week. And in almost every case, it describes the outcome — not the diagnosis. The balance was there. The assets moved. The recipient is unknown. The transaction cannot be reversed. From the victim'

You open your wallet and something is there that was not there before. Maybe it is a token you never bought. Maybe a fraction of a dollar in a cryptocurrency you do not recognize. Maybe an NFT from a project you have never heard of. Maybe a small USDT transfer

A user checks one Ethereum address using two different blockchain analytics tools. Platform A shows Low Risk. Platform B shows Medium Risk with mixer exposure flagged. The user then sends funds from that same wallet to an exchange — and the exchange places the deposit under manual review. The blockchain is

The compliance team lowers a mixer-exposure threshold from 5% to 2%. The change goes live on Monday morning. By Wednesday, alert volume has doubled. Legitimate exchange deposits — where a centralized service wallet has tiny residual indirect exposure from thousands of unrelated users — are now entering manual review. Analysts spend

A compliance system receives an Ethereum TXID. The top-level from address belongs to a Bundler — an infrastructure operator that submits transactions to the network. The top-level to address is EntryPoint — a shared contract that coordinates smart-wallet execution. Gas is paid through a Paymaster — a separate entity sponsoring

An exchange publishes its reserve wallet addresses. The balances match the reported snapshot. An auditor or verification provider confirms control of the selected wallets. Customers can verify their inclusion in the liabilities structure through a Merkle Proof. The company announces that its reserves are transparent and fully backed. But none

A verified customer adds an external withdrawal address to their account. The platform asks the customer to sign a challenge message with the corresponding private key. The signature is valid. The address is whitelisted as "customer-owned." Months later, an investigation reveals that the wallet is a company

An investigator finds the transaction that moved stolen funds from a victim's wallet. They save a screenshot from a block explorer, copy the transaction hash into a report, build a fund-flow graph, and send the file to the client. Months later, the case reaches a lawyer or

A crypto business plans to add DEX routing to its product. The protocol is well known — it has a website, multiple security audits, substantial TVL, and a recognizable brand. The compliance team screens the protocol's main contract address and finds no sanctions match. The integration proceeds. Six months

In June 2026, a coordinated investigation supported by Eurojust and Europol shut down a crypto laundering service suspected of processing more than EUR 336 million in criminal proceeds between 2022 and 2025. Ransomware operators sent stolen assets to wallets controlled by the group and received "cleaned" funds back

On November 13, 2024, FinCEN issued alert FIN-2024-Alert004 after a sustained rise in suspicious activity reports describing deepfake media used against financial institutions. The filings, which FinCEN says began increasing in 2023 and continued through 2024, described criminals altering or creating fraudulent identity documents specifically to get past

"Securities, however represented, remain securities... economic reality trumps labels." That line from SEC Chair Paul Atkins, delivered in a November 2025 speech, became the backbone of the joint staff Statement on Tokenized Securities issued on January 28, 2026 — the most detailed regulatory signal to date that putting an