This article is educational and does not constitute legal advice. Compliance obligations depend on a business's specific activities and jurisdiction. Consult qualified counsel before designing a compliance program.
What AML and KYC Mean
AML and KYC are often named together, but they are not the same thing. AML is the whole program: the policies, monitoring systems, reporting duties, and recordkeeping a regulated business runs to keep illicit funds out of the financial system. KYC is one piece of that program. It is the customer identification and verification step that lets a business know who it is actually doing business with.
KYC answers "who is this customer?" AML answers "is this customer, and this transaction, consistent with legitimate activity, and what do we do if it is not?" A business cannot run an AML program without KYC, but KYC alone is not an AML program.
For a business handling bitcoin, the same logic applies that applies to a bank or a wire-transfer service. The asset is digital and settles on a public ledger, but the regulatory question is unchanged: does this business accept and transmit value on behalf of other people? If it does, it carries the obligations of a regulated financial institution.
The Core of a KYC Program
A KYC program collects identifying information and verifies it against reliable sources. For an individual customer, that usually means full legal name, date of birth, residential address, and a government identification number, checked against documents or trusted databases. For a business customer, it extends to ownership structure and the identity of the beneficial owners who ultimately control the entity. The goal is a verified identity attached to every account before that account can move funds.
Who Must Comply: MSBs and VASPs
In the United States, the threshold question is whether a business is a money services business (MSB). Under FinCEN's regulations at 31 CFR 1010.100, a money transmitter is a person who accepts currency, funds, or value that substitutes for currency, and transmits it to another person or location. FinCEN confirmed in its 2013 guidance that administrators and exchangers of convertible virtual currency fall within this definition, which means a Bitcoin exchange or custodial service is an MSB.
Being an MSB carries a defined set of duties. The business must register with FinCEN, maintain a written AML program, designate a compliance officer, train staff, and submit to independent review. Registration is not optional and is time-bound: a money services business must register within 180 days of beginning the regulated activity.
Outside the United States, the equivalent category is the virtual asset service provider (VASP). FATF introduced the VASP concept in 2019 when it extended its global recommendations to cover firms that exchange, transfer, safekeep, or administer virtual assets. National regulators then write the VASP definition into their own law, which is why the precise wording differs by country even though the underlying standard is shared.
| Activity | Typical classification | Core AML/KYC duties |
|---|---|---|
| Custodial exchange (buy, sell, hold customer bitcoin) | MSB / VASP | Full program: registration, KYC, monitoring, SARs, recordkeeping, sanctions screening |
| Custodial wallet provider (holds keys for users) | MSB / VASP | Full program, same as an exchange |
| Payment processor accepting bitcoin for merchants | Often MSB, fact-dependent | Program scaled to the activity; depends on whether it accepts and transmits value |
| Self-custodial wallet software (user holds keys) | Generally not an MSB | Outside the MSB program where the provider never controls funds |
Customer Identification and the CIP
A formal customer identification program, or CIP, is the regulatory backbone of KYC. The CIP rule for banks, set out at 31 CFR 1020.220, requires them to gather identifying information before opening an account, verify the customer's identity within a reasonable time, keep records of the verification, and check the customer against government lists of known or suspected terrorists or terrorist organizations. A money services business such as a Bitcoin exchange is not bound by that bank-specific rule, but it carries out equivalent customer identification through the written AML program FinCEN requires it to maintain.
This identity verification usually runs at onboarding. A new customer submits identifying details, the business verifies them documentarily or through a data provider, and only then does the account become able to deposit, trade, or withdraw. Ongoing due diligence continues after onboarding: the business updates customer information, reassesses risk as behavior changes, and applies closer scrutiny to higher-risk customers and larger transactions.
Risk-Based Programs
Compliance regimes are deliberately risk-based rather than one-size-fits-all. A business is expected to assess where its money-laundering and sanctions risk actually sits, then allocate controls accordingly. A platform serving retail customers with small balances faces a different risk profile than one serving high-value institutional accounts or operating across many jurisdictions. The risk assessment drives the depth of due diligence, the thresholds for review, and the intensity of monitoring. Regulators evaluate whether the program is reasonably designed for the risk the business actually carries.
Sanctions Screening and OFAC
Separate from the BSA, every U.S. business must comply with the sanctions administered by the Office of Foreign Assets Control (OFAC). OFAC maintains lists of sanctioned individuals, entities, and jurisdictions, including the Specially Designated Nationals (SDN) list. Transacting with a sanctioned party can expose a business to civil or criminal liability, and OFAC has stated that its sanctions apply to transactions in digital assets the same way they apply to transactions in traditional currency.
For a Bitcoin business, sanctions screening has two layers. The first is screening customers at onboarding and on an ongoing basis against the SDN and other restricted-party lists, which overlaps with the CIP. The second is screening transactions and, where feasible, the blockchain addresses involved, because OFAC has added specific bitcoin and other digital-asset addresses to the SDN list. A business that identifies a match is generally required to block or reject the transaction and report it to OFAC. Authoritative program information is published on OFAC's sanctions programs page.
Suspicious Activity Reporting (SARs)
Detecting and reporting suspicious activity is the part of an AML program that turns monitoring into action. Under 31 CFR 1022.320, a money services business must file a suspicious activity report (SAR) with FinCEN when it knows, suspects, or has reason to suspect that a transaction of $2,000 or more involves funds from illegal activity, is designed to evade BSA requirements, has no apparent lawful purpose, or is being used to facilitate criminal activity.
A SAR is confidential. The regulation prohibits the business from notifying the customer or any person involved that a report was filed. Reports are submitted through FinCEN's BSA E-Filing system, and the business must keep a copy and supporting documentation for five years from the filing date.
Transaction monitoring is what surfaces the activity that may warrant a SAR. A Bitcoin business typically watches for patterns such as structuring deposits to stay under reporting thresholds, rapid movement of funds through many accounts, transactions connected to addresses with a history of illicit use, and behavior inconsistent with the customer's stated profile. Identifying these patterns is where blockchain analysis and the public nature of the ledger can support, rather than hinder, a compliance program.
Recordkeeping Requirements
A regulated business must retain the records that let regulators and investigators reconstruct activity after the fact. The BSA framework requires money services businesses to keep records of customer identification, transaction details, SAR filings, and the funds-transfer information that supports investigations.
One recordkeeping rule is often confused with a separate obligation. The recordkeeping rule at 31 CFR 1010.410 requires financial institutions to obtain and retain originator and beneficiary information for transmittals of funds of $3,000 or more, and to pass certain of that information to the next institution in the chain. That pass-along duty is the United States version of what is internationally called the travel rule. It is a distinct topic with its own operational challenges, covered in the companion article What Is the Crypto Travel Rule?
The FATF VASP Framework Globally
FATF is the intergovernmental body that sets the global anti-money-laundering standard. Its recommendations are not law in themselves; they are standards that member jurisdictions commit to implement, and FATF assesses each country's compliance through mutual evaluations. A poor evaluation can land a country on a monitoring list, which is why national regulators treat the standards seriously.
In 2019 FATF updated Recommendation 15 and its interpretive note to bring virtual asset service providers into scope. Under the updated standard, countries should license or register VASPs, subject them to supervision, and require them to apply customer due diligence, recordkeeping, and reporting comparable to other financial institutions. FATF also extended Recommendation 16, the wire-transfer standard, to virtual asset transfers, which is the origin of the travel rule for digital assets.
The practical consequence is a patchwork. Because each jurisdiction writes the FATF standard into its own statutes on its own timeline, a business operating across borders faces overlapping and sometimes inconsistent definitions, thresholds, and registration regimes. A firm cannot assume that meeting the rules in one country satisfies the rules in another.
Custodial Businesses vs. Self-Custodial Software Providers
The single most important distinction in Bitcoin AML is who controls customer funds. Nearly every obligation described above attaches to businesses that accept and transmit value on behalf of others. A business that takes custody of a customer's bitcoin is exercising control over that value, and that control is what triggers MSB status and the full compliance program.
A provider of self-custodial wallet software is in a different position. When the user holds their own keys, the software developer never accepts, holds, or transmits the user's value. FinCEN addressed this directly in its 2019 guidance, which distinguishes "hosted wallets," where a third party controls customer funds, from "unhosted wallets," where the user controls the funds. The guidance states plainly that an anonymizing software provider is not a money transmitter, relying on the regulatory exemption for persons who only provide "the delivery, communication, or network access services used by a money transmitter to support money transmission services."
The reasoning generalizes to self-custodial wallets and similar self-custody tooling: a publisher of software that lets users transact for themselves, without the publisher ever taking control of value, is supplying a tool rather than performing money transmission. Control of customer funds is the dividing line, and the type of asset does not change it. This distinction is why self-custody software and custodial services sit on opposite sides of the regulatory boundary, a difference explored further in What Are the Differences Between KYC and Non-KYC Bitcoin?
This is also the line that matters for institutions choosing how to hold bitcoin. A firm that relies on a regulated custodian inherits that custodian's compliance posture. A firm that takes self-custody, holding its own keys through hardware and policy controls, takes on the operational responsibility itself but does not become a money transmitter merely by securing its own treasury. For an overview of the custody models available, see What Is a Qualified Custodian? and How Do Businesses and Institutions Take Custody of Bitcoin?
A Compliance Self-Assessment
A business evaluating whether it carries AML obligations, or assessing the maturity of an existing program, can work through a set of plain questions. These are evaluation criteria, not a substitute for legal advice.
- Control of funds: Does the business accept and transmit customer value, or take custody of customer bitcoin? If yes, MSB or VASP obligations very likely apply.
- Registration: If the business is an MSB, is it registered with FinCEN, and was the registration filed within the 180-day window?
- Customer identification: Is there a documented CIP that verifies identity before accounts can move funds, with ongoing due diligence after onboarding?
- Sanctions screening: Are customers and, where feasible, transactions and addresses screened against OFAC's SDN and other restricted-party lists?
- Suspicious activity: Is there transaction monitoring capable of surfacing suspicious patterns, and a process to file SARs confidentially and on time?
- Recordkeeping: Are identification, transaction, and funds-transfer records retained for the required periods, including travel-rule information for qualifying transfers?
- Jurisdictional coverage: If the business operates across borders, does the program account for each jurisdiction's VASP rules rather than assuming one country's regime covers all?
Each "yes" reflects a control a regulator would expect a custodial business to have. Each "no" marks a gap worth closing ahead of the moment a regulator or a partner bank asks about it.
Frequently Asked Questions
What is the difference between AML and KYC?
AML (anti-money laundering) is the full program of laws and controls a business uses to detect and prevent illicit finance. KYC (know your customer) is one component of an AML program: the process of identifying and verifying customers. Every KYC step serves the broader AML obligation, but AML also covers monitoring, sanctions screening, reporting, and recordkeeping.
Do Bitcoin businesses have to register with FinCEN?
A business that accepts and transmits bitcoin on behalf of customers generally qualifies as a money services business and must register with FinCEN within 180 days of starting that activity, under 31 CFR 1022.380. Exchanges and custodial wallet providers typically register. A developer who only publishes self-custodial wallet software does not, because that person never controls customer value.
Does a self-custodial wallet provider need to do KYC?
FinCEN's 2019 guidance states that an anonymizing software provider, and by extension a provider of self-custodial wallet software, is not a money transmitter. The exemption applies because the user holds their own keys and the software never accepts or transmits value. Without that control over funds, the KYC and registration obligations that apply to custodial businesses do not attach.
What is a suspicious activity report?
A suspicious activity report, or SAR, is a confidential filing a money services business submits to FinCEN when it detects a transaction that may involve illicit funds. Under 31 CFR 1022.320, money services businesses must file a SAR for qualifying transactions of $2,000 or more, and the customer may not be told that a report was filed.
What is the FATF VASP framework?
The Financial Action Task Force sets global anti-money-laundering standards. In 2019 it extended its recommendations to virtual asset service providers (VASPs), requiring countries to license or register exchanges and custodians and apply customer due diligence, recordkeeping, and the travel rule. National regulators then implement these standards in local law.