An AML programme for a crypto business, wherever it operates, follows the same building blocks set by the FATF standards: a documented risk assessment of the business, customer due diligence with enhanced checks for higher risks, ongoing transaction monitoring including on-chain analysis, sanctions screening, Travel Rule procedures, suspicious activity reporting, record keeping, staff training and an independent audit. Senior management must approve it and a qualified compliance officer must run it. National rules add specific details, but a programme built on these components will meet the core expectations of regulators, banks and counterparties.
1. Risk assessment first
The FATF requires a risk-based approach (Recommendation 1). The business-wide risk assessment identifies risks by client type, geography, products (custody, swaps, privacy coins, DeFi access), delivery channels and on-chain exposure, evaluates the controls in place and sets the risk appetite. Update it at least once a year and whenever the business changes. Client risk scoring then applies the same criteria to each relationship.
2. Customer due diligence
Customer due diligence (Recommendation 10) means identifying and verifying the client, identifying beneficial owners of companies, understanding the purpose of the relationship and monitoring it over time. Enhanced due diligence applies to higher risks: politically exposed persons (Recommendation 12), high-risk countries, complex structures and large or unusual flows, where source of funds and source of wealth must be documented. National rules decide details such as the documents accepted or, in Switzerland, the forms used to record beneficial owners.
3. Monitoring, sanctions and the Travel Rule
- Transaction monitoring: on-chain KYT on deposits and withdrawals plus behavioural monitoring of the account, with documented rules and alert handling.
- Sanctions screening of clients and wallet addresses at onboarding and on an ongoing basis, against the lists that apply to you and those your banks and counterparties expect.
- Travel Rule procedures (Recommendation 16), including counterparty due diligence and self-hosted wallet checks.
4. Reporting and record keeping
Staff need a clear route to escalate unusual activity, and the compliance officer decides whether to file a suspicious transaction report with the financial intelligence unit (Recommendation 20), for example MROS in Switzerland or the UIF in Italy. Records of identification, transactions and analyses must be kept for at least five years under the FATF standard (Recommendation 11); some countries require longer, such as ten years in Switzerland.
5. Governance, training and independent audit
The board or senior management approves the programme and receives regular reports (Recommendation 18). All staff receive training suited to their role, with attendance records. Outsourcing to KYC or analytics providers is allowed, but responsibility stays with the firm. An independent audit tests the programme, and auditors look for evidence: files showing the procedures were applied, alerts closed with reasons and a risk assessment that matches the real client base. A template programme without that evidence is the most common finding.
How Advisorn helps
Advisorn drafts AML policies, risk assessments and procedures based on the FATF standards and adapted to your business and the countries where you operate. It also reviews existing programmes before audits, licence applications or bank due diligence.
FATF Recommendations 1, 10, 11, 12, 15, 16, 18 and 20; FATF Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (October 2021). Examples of national rules: Swiss AMLA and SRO regulations; Directive (EU) 2015/849 as amended and Regulation (EU) 2024/1624 (EU); UK Money Laundering Regulations 2017.
Updated November 2026 · General information, not legal or tax advice on your specific case.