Crypto Exchange AML Obligations in 2024: What FinCEN Expects

Virtual currency exchanges and administrators that qualify as money services businesses under the BSA have been subject to FinCEN registration and AML program requirements since 2013. But the enforcement environment has intensified dramatically in recent years, with FinCEN, DOJ, and OFAC coordinating on enforcement actions that have resulted in multi-billion dollar penalties against major exchanges. The message from regulators is clear: the virtual currency sector is not exempt from BSA obligations, and the consequences of non-compliance are severe.

The Travel Rule is the most operationally challenging AML obligation for crypto businesses. FinCEN's Travel Rule requires that financial institutions transmitting funds of $3,000 or more collect and transmit specific information about the originator and beneficiary of the transaction. For crypto businesses, implementing the Travel Rule requires technical infrastructure to collect, transmit, and receive counterparty information - infrastructure that many smaller exchanges have not yet built.

Transaction monitoring for virtual currency presents unique challenges that don't exist in traditional finance. Blockchain transactions are pseudonymous, not anonymous - the transaction history is public, but connecting wallet addresses to real-world identities requires blockchain analytics tools and expertise. Exchanges that rely on traditional transaction monitoring approaches without blockchain-specific analytics are operating with significant blind spots in their monitoring programs.

Customer due diligence for crypto businesses must address the specific risks of the virtual currency sector: peer-to-peer transactions, mixing services, privacy coins, and cross-chain bridges are all typologies that regulators have identified as high-risk. Your CDD program must be designed to identify customers who use these services and to apply enhanced due diligence proportionate to the risk they present.

The regulatory trajectory for virtual currency is toward more oversight, not less. FinCEN has proposed rules that would extend Travel Rule requirements to lower transaction thresholds and require reporting of transactions involving unhosted wallets. Crypto businesses that are building compliance infrastructure now - rather than waiting for final rules - will be better positioned to adapt as requirements evolve. The cost of building compliance infrastructure proactively is a fraction of the cost of remediation after an enforcement action.