Cryptocurrency businesses should build risk based AML programs now, rather than wait for final local rules. The practical starting point is KYC, enhanced due diligence, transaction monitoring, sanctions screening, and clear customer controls for prohibited activity. Firms should also be ready to file detailed suspicious transaction reports and adapt quickly as regulators translate FATF guidance into domestic requirements.
Prepare the AML operating model before the rulebook is final
For cryptocurrency businesses, the key mistake is to treat FATF as a future compliance event instead of an operating model change. FATF-style expectations usually translate into ongoing customer due diligence, transaction monitoring, sanctions controls, and auditable escalation paths, so firms should build those capabilities now and leave room to tighten thresholds and reporting workflows as domestic rules land.
That approach matters because virtual asset businesses often face faster customer onboarding, cross-border activity, and higher exposure to rapid movement of funds than traditional institutions. A risk based program gives compliance teams a defensible way to set stronger controls for higher risk customers, products, geographies, and transaction patterns without waiting for perfect local drafting.
Well-designed preparation also improves the quality of downstream reporting. If transaction alerts, case notes, and source-of-funds checks are structured from the outset, the business can adapt to local suspicious transaction reporting formats with less rework and lower operational disruption when regulators move from policy guidance to enforceable obligations.
Build controls that are flexible enough to absorb local implementation
The practical design challenge is not whether AML controls exist, but whether they can be tuned quickly when a jurisdiction changes customer due diligence thresholds, recordkeeping expectations, or reporting triggers. Businesses should therefore use control settings, workflow ownership, and case management rules that can be adjusted by jurisdiction rather than hard coding one global interpretation of FATF.
A useful benchmark is to separate non negotiable controls from configurable ones. Identity verification standards, prohibited activity rules, sanctions screening, and alert handling should be consistently governed, while risk scoring, monitoring thresholds, escalation timers, and local report content can be adapted as national regulators refine the rules.
That flexibility is especially important for businesses operating across exchanges, custodians, payment flows, and wallet services. The stronger the product mix and the broader the customer base, the more likely one country’s final rule will differ materially from another’s, so the AML program should be ready for jurisdiction specific overlays rather than a single monolithic policy.
One relevant operating reality is that many organisations still struggle with basic control visibility and lifecycle discipline around sensitive access paths. NHI Mgmt Group’s Ultimate Guide to Non-Human Identities notes that 96% of organisations store secrets outside secrets managers in vulnerable locations, which is a reminder that AML tooling, monitoring access, and reporting pipelines need the same kind of control discipline as the compliance process itself.
What should be ready on day one, and what should stay adaptable
Crypto firms do not need to guess every final local rule, but they do need a ready baseline. The day one baseline should include customer due diligence for onboarding and refresh events, sanctions and watchlist screening, transaction monitoring tuned to virtual asset typologies, escalation paths for higher risk accounts, and a reporting process that can produce evidence quickly if supervisors ask how alerts were triaged.
What to verify: Check that every material product and jurisdiction has an owner, a documented risk rationale, and a monitoring rule set that can be changed without a full platform redesign. If the business cannot explain why a rule exists, who approves exceptions, and how suspicious activity is preserved for review, it is not ready for supervision.
Decision rule: If a control affects customer acceptance, asset movement, or reportability, treat it as a governance control now rather than a future policy choice. If it only affects thresholds or form fields, keep it configurable so the local rule can be adopted quickly without disrupting the whole AML program.
Practitioner takeaway: The best preparation is to make AML capability modular, risk based, and evidence rich, so local rule finalisation changes the settings, not the substance, of how the business detects, escalates, and reports suspicious activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the technical controls, while PCI DSS v4.0 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | Control 6 — Access Control Management | Crypto AML depends on controlling who can approve, view, and change customer-risk workflows. |
| Control 8 — Audit Log Management | Monitoring, escalation, and suspicious reporting depend on durable audit evidence. | |
| Control 15 — Service Provider Management | Virtual asset firms often depend on third-party screening, analytics, and custody services. | |
| Recommendation — Restrict AML case and sanctions-system access to approved roles and review exceptions regularly. Collect and retain alert, case, and reporting logs so investigators can reconstruct decisions. Assess third-party AML and screening providers before relying on them for compliance operations. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | FATF-style AML readiness requires aligning controls to products, jurisdictions, and risk appetite. |
| PR.AA-01 — Identities and Credentials | Customer due diligence and access controls rely on trustworthy identity proofing and account integrity. | |
| DE.CM-01 — Continuous Monitoring | Transaction monitoring is central to detecting suspicious patterns in virtual asset activity. | |
| Recommendation — Define the business and regulatory context before setting AML control scope and priorities. Verify identities and credentialed access before allowing high-risk financial activity. Monitor transactions continuously and tune detection logic as risk patterns evolve. | ||
| PCI DSS v4.0 | 10.2 — Audit Logs and Monitoring | AML programs need traceable records of access, review, and alert disposition. |
| 12.5 — Targeted Risk Analysis | Risk based AML programs depend on periodic analysis of products, customers, and jurisdictions. | |
| Recommendation — Log key compliance actions and retain evidence for review and investigation. Perform targeted risk analysis whenever product, geography, or transaction risk changes. | ||
| NIST SP 800-63 | IAL — Identity Assurance Levels | KYC and customer due diligence depend on the strength of identity proofing. |
| Recommendation — Set identity proofing strength to match the customer risk and transaction exposure. | ||
Related resources from NHI Mgmt Group
- How should organisations structure cryptocurrency compliance when securities, tax, and AML rules overlap in the same workflow?
- How should businesses operating in Canada structure an AML compliance program to keep pace with changing rules in 2025?
- How should financial services teams prepare AI governance for CFPB scrutiny before rules harden further?
- How should security teams prepare data access governance before enabling GenAI tools?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
