How to Build a Crypto AML Program That Passes Regulatory Examination

The Five Pillars of a Crypto AML Program

Every AML program, regardless of the framework (BSA, AMLD, MiCA), rests on five pillars. For crypto firms, each pillar has specific characteristics that distinguish it from traditional financial institution AML.

Pillar 1: AML/CFT Compliance Officer

The compliance officer is the individual responsible for the design, implementation, and day-to-day operation of the AML program. For crypto firms, the compliance officer must understand both traditional AML methodology and the specific risk characteristics of digital assets.

This is not a ceremonial appointment. The compliance officer must have authority to make decisions without business-side override, direct access to the board or senior management, adequate budget and resources, and the expertise to understand blockchain analytics, on-chain transaction patterns, and crypto-specific money laundering typologies.

The examiner's first question is often: 'Who is your BSA officer, and what is their background?' If the answer is 'our general counsel handles it part-time' or 'we outsource to a consultant,' that is an immediate red flag. The compliance officer should be a dedicated role with appropriate seniority and independence.

Pillar 2: Internal Controls

Internal controls are the policies, procedures, and systems that implement the AML program. For crypto firms, internal controls span customer identification and verification (KYC), customer due diligence (CDD) and enhanced due diligence (EDD), transaction monitoring, sanctions screening, suspicious activity reporting, and record keeping.

The effectiveness standard changes how internal controls are evaluated. Under the old standard, an examiner verified that controls existed. Under the new standard, an examiner evaluates whether controls produce outcomes. For example, a sanctions screening control is traditionally evaluated by confirming that the firm screens against OFAC, EU, UN, and relevant national lists. Under the effectiveness standard, the examiner additionally evaluates the screening system's false positive rate, the average time to resolve true matches, the number of matches that resulted in account restrictions or SARs, and whether any sanctioned entities were identified through means other than the screening system.

The practical implication is that your internal controls must produce data that demonstrates their effectiveness. If your transaction monitoring system generates 5,000 alerts per month but only 3 result in SAR filings, the examiner will ask whether the system is miscalibrated or whether the investigation process is inadequate.

Pillar 3: Independent Testing

Independent testing — internal audit or external review — verifies that the AML program is functioning as designed. For crypto firms, independent testing should cover a sample of customer accounts, a sample of transaction monitoring alerts, a review of SAR filing decisions, a review of sanctions screening results, and a test of the training program's effectiveness.

The testing function must be genuinely independent — it cannot be performed by the same team that operates the AML program. For smaller crypto firms that cannot maintain a separate internal audit function, external testing by a qualified firm is an acceptable alternative.

Pillar 4: Customer Due Diligence

CDD for crypto firms must be risk-based — applying different levels of scrutiny based on the risk characteristics of each customer. The risk factors specific to crypto include the customer's source of funds (on-chain vs. fiat, exchange-to-exchange vs. DeFi-to-exchange), geographic location, transaction patterns, PEP status, and involvement in high-risk activities (privacy coins, mixers, cross-chain bridges).

CDD is not a one-time event. Ongoing due diligence — periodic review of customer risk profiles and transaction patterns — is essential for detecting customers whose risk profile changes after onboarding. The effectiveness standard evaluates whether CDD actually identifies high-risk customers and whether they receive appropriate enhanced measures. If your CDD process assigns 95% of customers to the 'low risk' category, the examiner will question whether the risk methodology is adequately discriminating.

Pillar 5: Ongoing Training

Training must be role-specific and current. Front-line customer service staff need different training than compliance analysts, who need different training than senior management. All training must be documented — who attended, what was covered, and when it occurred.

For crypto firms, training must cover crypto-specific typologies (layering through DeFi protocols, using mixers, cross-chain laundering), the firm's specific transaction monitoring rules and alert types, SAR narrative writing for crypto transactions, and regulatory updates.

The Effectiveness Metrics That Matter

Under the new standard, you need to track and present the following metrics:

Detection metrics: Number of alerts generated by source (transaction monitoring, sanctions screening, referrals), alert-to-investigation conversion rate, investigation-to-SAR conversion rate, average investigation time, and backlog age.

Quality metrics: SAR narrative completeness scores, the percentage of SARs that result in law enforcement follow-up, and the number of SARs filed proactively vs. reactively.

Verification metrics: KYC completion rate across your user base (must be 100% for active users), false acceptance rate, false rejection rate, and the average time from account opening to full KYC completion.

Sanctions metrics: Number of true positive matches vs. false positive matches, average time to resolve matches, and the number of OFAC blocking reports filed.

These metrics must be reported to the board regularly — quarterly at minimum — and trends must be analyzed.

The Examination Preparation Checklist

AML/CFT compliance officer appointed with adequate authority, independence, and resources. Written AML/CFT policies and procedures covering all five pillars. Risk assessment document identifying specific risks relevant to your business. Customer risk rating methodology with documented criteria. Transaction monitoring system with documented rules and tuning rationale. Sanctions screening system covering OFAC, EU, UN, and relevant national lists.

SAR/STR filing procedures with documented timelines and quality standards. Record retention system meeting minimum 5-year requirements. Independent testing program with recent report. Training program with role-specific content and documented attendance. Board/senior management reporting with quarterly compliance metrics. Effectiveness metrics tracked and trended over time. KYC completion rate at 100% for active user base. Documented evidence of program updates in response to regulatory changes.