AML Compliance for Digital Assets and NFTs: The 2023 Regulatory Picture

The digital asset sector has been grappling with AML compliance obligations since FinCEN's 2013 guidance established that virtual currency exchangers and administrators qualify as money services businesses under the BSA. In the decade since, the sector has grown dramatically in scale and complexity - and the regulatory framework has struggled to keep pace. The 2023 regulatory picture for digital assets is one of increasing enforcement, expanding obligations, and significant uncertainty about how existing rules apply to new technologies.

NFTs - non-fungible tokens - present a specific AML challenge that regulators are actively working to address. High-value NFT transactions have been used to launder money through a process analogous to art market money laundering: purchasing NFTs with illicit funds and selling them to create the appearance of legitimate income. FinCEN has signaled that NFT platforms may be subject to BSA obligations depending on the nature of their activities, and the agency is actively studying the sector.

DeFi - decentralized finance - protocols present the most challenging AML compliance questions in the digital asset space. DeFi protocols are designed to operate without centralized intermediaries, which creates fundamental questions about who bears BSA compliance obligations when there is no identifiable operator. FinCEN has taken the position that DeFi protocols with identifiable operators are subject to BSA requirements, but the application of this position to specific protocols remains contested.

The enforcement environment for digital assets in 2023 has been characterized by large penalties and multi-agency coordination. Several major exchanges and payment processors have faced enforcement actions that resulted in penalties ranging from tens of millions to billions of dollars. The common thread across these actions is a failure to implement adequate transaction monitoring and customer due diligence - specifically, a failure to identify and report suspicious activity involving high-risk customers and jurisdictions.

For digital asset businesses navigating this environment, the practical approach is to implement the most robust compliance program your business model allows, document your compliance activities thoroughly, and engage proactively with regulators when you have questions about how existing rules apply to your specific activities. The regulatory environment is evolving rapidly, and businesses that are building compliance infrastructure now will be better positioned to adapt as requirements become clearer.