What Is AML in Crypto and Why It Matters

AML (anti-money laundering) in crypto is the set of laws, internal controls and monitoring systems that crypto exchanges and other service providers use to stop criminal money from moving through their platforms. It decides who a provider accepts as a customer, which transactions it screens or holds, and what it must report to the authorities. For ordinary users, AML is the reason a deposit can be delayed, a withdrawal questioned or an account restricted.

Key takeaways

• AML is a legal obligation for regulated crypto-asset service providers in the UK, the EU, the US, South Africa and most other major markets.
• KYC is one part of AML: it establishes who you are, while AML monitoring follows what you do for as long as the account is open.
• Exchanges screen both their customers and the blockchain history of the crypto they receive and send.
• A flagged transaction can be held for days or weeks, and the law may stop the provider from telling you exactly why.
• You can reduce the chance of problems by keeping records of where your funds come from and avoiding high-risk counterparties.

What is AML in crypto, compared with AML in banking? The goal is the same, but the risks are different. Crypto moves across borders in minutes, wallet addresses are not tied to names on the blockchain, and funds can be passed through mixers, privacy coins or cross-chain bridges to hide their origin. Anti-money laundering in crypto therefore combines traditional customer checks with tools that analyse the blockchain itself. Since 2019, the Financial Action Task Force (FATF) has required countries to apply AML rules to virtual asset service providers, so AML crypto obligations now cover exchanges, brokers and custodial wallet providers alike.

An exchange's AML programme is made up of several controls that work together, not just transaction monitoring:

The written rules that set out how each control works are the provider's crypto AML policies. They are approved by senior management, overseen by a money laundering reporting officer (MLRO) or equivalent, and reviewed by regulators and auditors.

Monitoring runs on two levels at once. Off-chain, the exchange watches how you use your account: how often you deposit and withdraw, from which countries you log in and whether your activity matches what you said when you opened the account. On-chain, blockchain analytics tools check the history of every incoming and outgoing transfer, including whether the funds have passed through addresses linked to illicit activity, either directly or through several intermediate wallets.

Typical red flags, many of which the FATF has published in its guidance on virtual assets, include:

• deposits that can be traced to hacks, scams, ransomware, darknet markets or sanctioned addresses;
• funds that have recently passed through a mixer or been converted through several assets or blockchains in quick succession;
• many small transfers that appear designed to stay under reporting or review thresholds;
• activity far larger than the customer's stated income or purpose;
• accounts that receive funds from many unrelated people and pass them on quickly, a pattern typical of money mules.

Each transfer receives a risk score. Low-risk activity goes through automatically; medium-risk activity may be paused for a quick review; high-risk cases go to the compliance team and, where needed, the MLRO, who decides whether to report them.

KYC and AML are often mentioned together, but they are not the same thing. KYC is a part of AML: before an exchange can judge whether your activity is unusual, it needs to know who you are and what activity to expect. For a full answer to the question "what is KYC?", see our separate guide to identity verification.

The two depend on each other. Without accurate identity data, monitoring has no baseline to compare against; without ongoing monitoring, a verified account could still be used to move criminal funds.

Crypto AML regulations differ in detail, but most are built on the FATF standards, and the direction is the same everywhere: more checks, more information shared between providers and fewer anonymous accounts.

In the EU, the Travel Rule applies to transfers between crypto-asset service providers regardless of the amount. From 10 July 2027, the AML Regulation will prohibit providers from maintaining anonymous crypto-asset accounts, and the new EU Anti-Money Laundering Authority (AMLA) in Frankfurt is due to start directly supervising a group of high-risk cross-border financial firms, which can include crypto-asset service providers, from 2028. In the UK, cryptoasset firms must be registered with the Financial Conduct Authority for AML purposes and report suspicions to the National Crime Agency.

These rules matter most where crypto meets the banking system. A provider that lets customers exchange crypto to fiat and withdraw the money to a bank account has to satisfy both its own regulator and the banks it works with, so its checks at that point are usually the strictest.

When a transfer is flagged, the provider usually holds it and reviews the case. You may be asked to explain where the funds came from, what the payment is for or how you know the other party, and to back this up with documents such as bank statements, payslips, invoices or records from another exchange.

The review normally ends in one of four ways: the transfer is released; it is rejected or returned; the account is limited or closed; or the provider files a suspicious activity report. These outcomes are not mutually exclusive.

Two legal points explain why some reviews take a long time and come with little explanation:

• Tipping off. In the UK, it is a criminal offence under the Proceeds of Crime Act 2002 for a firm in the regulated sector to disclose that a suspicious activity report has been made if doing so could prejudice an investigation. EU law contains a similar prohibition. Support staff may therefore be unable to tell you why your funds are held.
• Consent requests. In the UK, a firm that suspects funds may be criminal property can ask the National Crime Agency for a defence against money laundering before releasing them. The agency has seven working days to respond, and if it refuses, a moratorium period of 31 days follows, which a court can extend up to a maximum of six months.

If your transfer is held, answer requests promptly and completely, provide documents rather than explanations alone, and keep all communication within the provider's official channels.

Most crypto AML risks for individuals come from the funds they receive, not from anything they intend to do wrong.

The most common situations are:

• Receiving tainted funds. Crypto bought through a peer-to-peer trade, received as payment or sent by a stranger may have passed through a hack or scam earlier in its history. When you deposit it, the exchange may freeze it.
• Using mixers or privacy tools. Even if your reason is privacy rather than crime, funds that have recently passed through a mixer are treated as high-risk by most regulated exchanges.
• Sanctions exposure. Interacting with an address on a sanctions list can lead to rejected transfers or a closed account.
• Becoming a money mule. Offers of easy money for "processing payments" through your exchange account are a common recruitment method for laundering schemes. Taking part can expose you to criminal investigation.
• Unregistered services. Platforms that ignore AML rules are more likely to be shut down or cut off by banks, sometimes with customer funds still inside.

This crypto AML checklist helps you avoid most of the problems described above:

• Keep records that show where your money came from, such as salary statements, sale contracts or tax returns, and keep your exchange transaction history.
• Make sure the details you give at sign-up are accurate and update them if your situation changes.
• Avoid receiving crypto from anonymous peer-to-peer counterparties, and be careful with mixers and other anonymity tools.
• Do not split large transfers into many small ones to avoid checks. This can itself look suspicious.
• Never let anyone else use your account or move money through it on their behalf.
• Respond to information requests from your provider quickly and with documents.
• Check that a provider is registered or licensed in your country before you use it.

AML controls are designed to keep criminal money out of the financial system, but they also reduce several risks for ordinary customers. Exchanges with strong monitoring are better placed to spot scams, flag payments to known fraud addresses and freeze stolen funds after a hack, which can help victims recover at least part of their losses.

They also make the platform more stable. Providers that ignore AML rules risk fines, loss of their registration or licence and sudden withdrawal of banking services. When that happens, customers may find withdrawals suspended or accounts closed at short notice. A provider with sound compliance is less exposed to that kind of disruption.

AML compliance has limits. It does not insure your assets, protect you from price falls or replace a compensation scheme. It lowers some risks; it does not remove them.

This article is for general educational purposes and does not constitute financial, investment, legal or tax advice. Cryptoassets are high-risk, their value can fall to zero, and transfers are generally irreversible. In the UK, cryptoassets are generally not protected by the FSCS, and you may not be able to complain to the Financial Ombudsman Service; in the EU, they are not covered by deposit guarantee schemes. Rules on cryptoasset services differ by country, so check whether any provider you use is authorised to serve customers where you live.