The regulated institution remains accountable, even when the venue itself is permissionless and may not provide a centralized compliance desk. Firms cannot outsource their obligations to the chain. Governance has to assign ownership for policy, thresholds, escalation, and evidence so the institution can defend each decision.
Who has the final decision on AML and sanctions controls?
The venue may shape how trades execute, but it does not absorb the institution’s compliance duty. When a firm permits access to permissionless trading venues, it still owns the decision framework for AML and sanctions, including who approves it, what thresholds apply, and when escalation is required. That accountability must sit with the regulated firm, not with the protocol or chain.
At a governance level, this means the institution must be able to explain why a trade was permitted, blocked, reviewed, or escalated. Ownership should be explicit for policy design, monitoring, exceptions, and recordkeeping so the firm can evidence that decisions were made under its own controls rather than delegated to an unmanned venue.
What accountability looks like when the venue is permissionless
Permissionless access removes the comfort of a centralized gatekeeper, but it does not remove the need for accountable control. Firms still need an internal decision model for customer due diligence, sanctions screening, wallet or counterparty risk assessment, and transaction review, even when the trading environment offers no native compliance workflow. The practical question is not whether the venue checks transactions, but whether the institution can justify its own acceptance of the risk.
That usually requires a clear map of responsibilities across front office, compliance, financial crime, and operations. If the decision is automated, the firm still needs a human owner for the rule set, the review queue, and the exception path. If the decision is manual, the firm still needs criteria that are consistent, documented, and auditable.
Why delegation to the chain is not a control
Outsourcing execution to a decentralized venue can create the illusion that the platform is “neutral infrastructure,” but neutrality is not the same as compliance. The institution remains responsible for the conduct of its business, which includes setting the decision boundaries that govern AML and sanctions activity. In practice, the chain cannot accept regulatory accountability on the firm’s behalf.
This is where governance matters most. The firm needs defensible thresholds for blocking, review, escalation, and evidence retention, plus a process for exceptions when the venue provides incomplete information. If those rules are vague, accountability becomes fragmented and the firm cannot show that its decisions were controlled rather than improvised.
Risk and Threat Considerations
Permissionless venues increase the risk of control drift because they can compress the time available to screen, decide, and intervene. That creates exposure to missed sanctions hits, weak customer attribution, and inconsistent escalation, especially when the venue does not provide a centralized compliance function. A regulated institution that treats the chain as the decision-maker is likely to lose both governance clarity and defensibility.
Failure mechanism: The firm relies on the venue’s decentralised design as a substitute for its own accountability, then fails to assign ownership for screening rules, escalation, and evidence. When a questioned transaction later needs justification, no one can show who made the decision or under what policy.
Impact: The institution may face regulatory findings, weak audit evidence, remediations across multiple teams, and the need to rework its control model after the fact. It also increases the chance that prohibited exposure is detected only after the trade has already cleared.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PM-9 — Risk Management Strategy | AML and sanctions decisions need an owned, documented decision strategy. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Defensible AML decisions require reviewable evidence and decision logs. | |
| Recommendation — Define ownership, thresholds, and escalation in a formal risk strategy. Log screening, review, and exception decisions so they can be audited. | ||
| ISO/IEC 27001:2022 | A.5.2 — Information security roles and responsibilities | The question turns on clear accountability for compliance decisions. |
| Recommendation — Assign named responsibility for AML and sanctions decision ownership. | ||
| CIS Controls v8 | CIS-5 — Account Management | Permissionless trading still needs controlled ownership of access and decision paths. |
| Recommendation — Document and review who may approve, escalate, or override trading decisions. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | This is a governance question about who owns regulated risk decisions. |
| Recommendation — Establish a risk strategy that defines decision ownership and escalation. | ||
Practitioner Guidance
What to verify: Confirm that one accountable owner exists for AML and sanctions decisions, and that the owner can point to the specific policy, threshold, and escalation rule used for permissionless activity. If the answer is “the venue handles it,” the control design is incomplete.
Decision rule: If the venue does not provide a centralized compliance desk, treat that as a design constraint, not a governance gap to be outsourced. Keep the institution’s own screening, review, and exception handling in scope, and make the audit trail strong enough to defend each decision later. The FATF Recommendations are the right baseline for the underlying AML control expectations, while the FinCEN guidance ecosystem is the practical reference point for US obligations.
Practitioner takeaway: Permissionless architecture may decentralize execution, but it does not decentralize regulatory accountability, the firm must own the decision, the evidence, and the escalation path.
Related resources from NHI Mgmt Group
- Who is accountable when AML decisions span onboarding, monitoring, and reporting?
- Who is accountable for AML decisions when FATF monitoring changes?
- Who is accountable for typology-based AML decisions in crypto programmes?
- Who is accountable when exchange exposure leads to sanctions or AML failures?