Anti-Money Laundering (AML) Rules Applicable to Digital Currency
Anti-money laundering rules as applied to digital currency establish the compliance obligations that govern how exchanges, wallet providers, and other intermediaries detect, report, and prevent illicit financial flows through blockchain-based assets. Federal frameworks administered by the Financial Crimes Enforcement Network (FinCEN) and reinforced by Bank Secrecy Act (BSA) requirements form the legal backbone of this regime in the United States. Understanding which entities are covered, what triggers a reporting obligation, and how digital currency's technical features create enforcement challenges is essential for any operator or compliance professional active in this space. The Digital Currency Authority home page provides broader orientation to the digital currency landscape for those approaching this topic for the first time.
Definition and scope
AML rules in the digital currency context are anchored in the Bank Secrecy Act (BSA), codified at 31 U.S.C. §§ 5311–5336, which requires financial institutions to assist government agencies in detecting and preventing money laundering. FinCEN, a bureau of the U.S. Department of the Treasury, extended BSA coverage to virtual currency administrators and exchangers through guidance issued in 2013 and reinforced in 2019 (FinCEN FIN-2019-G001).
Under FinCEN's framework, digital currency businesses that qualify as Money Services Businesses (MSBs) must:
- Register with FinCEN as an MSB
- Implement a written AML program with internal controls
- Designate a compliance officer
- Conduct ongoing employee training
- Undergo independent audits of the AML program
- File Currency Transaction Reports (CTRs) for transactions exceeding $10,000 (31 C.F.R. § 1010.311)
- File Suspicious Activity Reports (SARs) for transactions of $2,000 or more that trigger suspicion of illicit activity (31 C.F.R. § 1010.320)
The scope of "convertible virtual currency" (CVC) — FinCEN's operative term — covers assets that have an equivalent value in real currency or act as a substitute for real currency. This definition captures Bitcoin, Ether, and most exchange-traded tokens, while leaving open interpretive questions about certain governance tokens and non-fungible tokens. The fuller regulatory context for digital currency addresses how multiple agencies divide jurisdictional authority over these assets.
How it works
AML compliance for digital currency entities operates through three interlocking mechanisms: customer identification, transaction monitoring, and regulatory reporting.
Customer Identification and Know Your Customer (KYC)
The Customer Identification Program (CIP) requirement, derived from 31 C.F.R. § 1020.220, obligates covered entities to collect and verify name, date of birth, address, and an identification number for each customer before account opening. Digital currency exchanges implement this through document upload, biometric verification, and third-party identity verification services.
Transaction Monitoring
Blockchain's pseudonymous structure does not exempt CVC transactions from monitoring obligations. Compliance programs use blockchain analytics tools to flag patterns associated with mixing services, darknet markets, or structuring — deliberately breaking large amounts into smaller transactions to evade the $10,000 CTR threshold.
Travel Rule
FinCEN's Funds Travel Rule (31 C.F.R. § 1010.410) requires transmitters of funds of $3,000 or more to pass identifying information about the originator and beneficiary to the receiving institution. The Financial Action Task Force (FATF), the international standard-setting body, recommends a lower $1,000 threshold in its Recommendation 16, which has shaped proposed U.S. rulemaking on digital asset transfers.
Common scenarios
Centralized Exchange (CEX) Operations
A U.S.-domiciled exchange that converts fiat currency to Bitcoin or vice versa clearly qualifies as an MSB exchanger. It must maintain KYC records for at least 5 years (31 C.F.R. § 1010.430) and file SARs when customer withdrawal patterns suggest layering.
Peer-to-Peer (P2P) Exchangers
Individuals who buy and sell digital currency as a business — not occasionally for personal use — can qualify as MSBs under FinCEN's 2019 guidance even without a formal platform. FinCEN enforcement actions have targeted unlicensed P2P exchangers operating at volume.
Decentralized Finance (DeFi) Protocols
This is the most contested boundary in current AML enforcement. FinCEN's 2019 guidance acknowledges that "anonymizing software providers" may face obligations, but whether a smart contract protocol with no human operator constitutes a "money transmitter" remains unresolved. The Financial Action Task Force 2021 Updated Guidance introduced the concept of "VASP-like" functions that certain DeFi front-end operators may satisfy.
Mixing and Tumbling Services
Tornado Cash, a smart-contract-based mixing protocol, was sanctioned by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) in August 2022 under Executive Order 13694. This action demonstrated that AML-adjacent sanctions tools apply to on-chain infrastructure, not only to human operators.
Decision boundaries
The central compliance question is whether an entity is a "money transmitter" — a subset of MSB — under the BSA. FinCEN applies a three-part framework based on whether the entity:
- Accepts convertible virtual currency from one person
- Transmits that currency to another person or location
- Does so as a business, not solely incidentally to another service
Exchanger vs. Administrator
An exchanger trades CVC for other currencies (fiat or digital). An administrator issues a CVC and has the ability to redeem or withdraw it from circulation. Both face BSA obligations. A user who simply holds and spends their own CVC is not an MSB.
Hosted vs. Unhosted Wallets
A hosted wallet provider controls private keys on behalf of users and is treated as an MSB. An unhosted wallet — where the user controls their own private keys — does not itself trigger MSB registration, though proposed FinCEN rulemaking from December 2020 sought to impose recordkeeping requirements on exchanges receiving transfers from unhosted wallets above $3,000 (86 Fed. Reg. 2204 (Jan. 12, 2021)).
State Money Transmitter Licenses vs. Federal MSB Registration
Federal MSB registration with FinCEN is distinct from state-level money transmitter licensing. 49 states plus the District of Columbia require separate state licenses for money transmission, and the coverage definitions and thresholds vary by jurisdiction. Federal registration does not substitute for state licensing obligations.
References
- Financial Crimes Enforcement Network (FinCEN) — Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001)
- Bank Secrecy Act, 31 U.S.C. §§ 5311–5336 — via eCFR
- Financial Action Task Force (FATF) — Recommendations
- FATF — Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (2021)
- U.S. Department of the Treasury — OFAC Cyber-Related Sanctions
- FinCEN — Funds Travel Rule, 31 C.F.R. § 1010.410 (eCFR)
- [86 Fed. Reg. 2204 — FinCEN Proposed Rule on Unhosted Wallets (January 12, 2021)](https://www.federalregister.gov/documents