Cryptoasset AML and Financial Crime Risk

Map the service and the points of exposure

Risk depends on the activity and operating model, not simply on the fact that a digital asset is involved. An initial discussion can examine exchanges between cryptoassets and fiat, crypto-to-crypto activity, custody or wallet services, transfers, brokerage, issuance, and the firm's role in a wider group or network. It can map customer types, counterparties, products, jurisdictions, custody arrangements, use of third parties and the points where activity moves between on-chain and conventional financial services.

For customer and counterparty controls, relevant questions include how the firm understands the purpose and expected pattern of a relationship, identifies beneficial ownership or control where relevant, considers jurisdictional exposure, and responds when information is incomplete or inconsistent. Transaction questions can include how on-chain and off-chain information is brought together, what activity is visible to the firm, how exceptions are reviewed, and how escalation and record keeping operate. The evidence and control expectations depend on the relevant legal perimeter and country.

Consider custody, transfers and fiat gateways together

Custody or control of assets and private keys affects what actions an organisation can take, what information it can access, and where a customer or counterparty interacts with other services. Fiat on- and off-ramps connect digital-asset activity to banks, payment firms or other intermediaries; these hand-offs can create different information and monitoring responsibilities. Cross-border operations add questions about where the service is provided, how jurisdictions apply their rules, and what the firm can know about foreign providers or counterparties.

FATF's current virtual-asset work notes that jurisdictional implementation remains uneven and highlights risk assessment, cross-border activity and links with traditional financial sectors. It provides an international framework, while national laws determine the obligations that apply to a particular business. An initial discussion can help identify which products, flows and control questions need further analysis without treating one country's approach as universal.

• Business model, customer groups, counterparties and jurisdictions
• Custody, wallet, transfer and exchange functions, including third parties
• Fiat entry and exit points and relevant on-chain/off-chain data
• How monitoring, review, escalation and records connect across the service

UK context and experience

In the UK, certain cryptoasset exchange and custodian wallet activities fall within the Money Laundering Regulations registration regime. FCA registration under those rules concerns the in-scope AML regime; it is not a general approval of a firm's products, services or overall conduct. The FCA says a new regulatory regime for cryptoasset firms starts on 25 October 2027, so the relevant framework and transition should be checked against the firm's activities and current FCA information. A firm's registration position depends on its specific activities and should be confirmed with appropriately qualified advisers.

Trevor Barritt spoke at a Z/Yen webinar on cryptocurrency risk on 27 October 2020. The session covered controls and technology for crypto exchanges, KYC and AML.