Compliance & Enforcement

This section provides regulator-grade guidance on anti-money laundering (AML), know-your-customer (KYC), Travel Rule compliance, transaction monitoring, sanctions screening, and enforcement actions relevant to institutional crypto custodians. It draws on verified data from FATF assessments, national regulatory frameworks, and enforcement case records through early 2026. It synthesizes the AML/KYC (t6) and enforcement dimensions across all 20 jurisdictions in this research: the Americas (

United States,

Brazil,

Canada,

Bermuda,

Cayman Islands); Asia-Pacific (

Australia,

Hong Kong,

Japan,

Singapore,

South Korea); Europe (

European Union,

France,

Germany,

Switzerland,

United Kingdom,

Liechtenstein,

Luxembourg); and the Middle East & Africa group (Gibraltar,

Bahrain,

UAE).

1. FATF Travel Rule for Custodians

1.1 What the Travel Rule Requires for Custody Providers

FATF Recommendation 16 (the "Travel Rule"), as extended to virtual assets by the June 2019 Interpretive Note to Recommendation 15, requires Virtual Asset Service Providers (VASPs)---including custodians---to obtain, hold, and transmit originator and beneficiary information for virtual asset transfers. Specifically, custodians acting as ordering institutions must collect and transmit:

• Originator information: Name, account number (e.g., wallet address), and either physical address, national identity number, customer identification number, or date and place of birth.
• Beneficiary information: Name and account number (e.g., wallet address).

The beneficiary VASP/custodian must obtain and hold this information and make it available to authorities on request. Both sides must implement risk-based procedures to identify and handle transfers with incomplete information.

Source: FATF Recommendation 16 and Interpretive Note to Recommendation 15

1.2 Global Implementation Status: 85 of 117 Jurisdictions

According to the FATF 2025 Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs (published March 2025):

• 85 of 117 jurisdictions (excluding those that prohibit or plan to prohibit VASPs) have passed legislation implementing the Travel Rule, up from 65 in 2024.
• Of those 85 jurisdictions, 59% (50 jurisdictions) have yet to take enforcement or supervisory action related to Travel Rule compliance.
• Only 29% of 138 assessed jurisdictions are largely compliant with Recommendation 15 overall (up from 25% in 2024).
• 49% remain only partially compliant, and non-compliance dropped from 25% to 21%.
• These jurisdictions constitute approximately 98% of the global VA market by volume.

All 20 jurisdictions covered in this research have implemented (or, in Australia's case, committed to implementing) the Travel Rule, placing this cohort firmly within the compliant majority. They span the full threshold spectrum, from zero-threshold regimes (EU, Switzerland, Japan, Hong Kong) to the FATF-recommended EUR 1,000 tier (Germany, Liechtenstein, Luxembourg, Gibraltar, UK cross-border) and the higher U.S. $3,000 floor.

Source: FATF 2025 Targeted Update on VA/VASPs; 21 Analytics FATF Travel Rule Status 2026

1.3 Thresholds by Jurisdiction

Travel Rule thresholds vary significantly across jurisdictions, creating compliance complexity for custodians operating across borders. The table below mirrors the verified per-jurisdiction AML/KYC facts for all 20 jurisdictions:

Sources: InnReg Crypto Travel Rule Guide 2026; Notabene Global Regulations Map; 21 Analytics South Korea Travel Rule; per-jurisdiction research cited in the regulation files linked above.

1.4 Technical Solutions for Travel Rule Compliance

Four primary messaging protocols and platforms have emerged to facilitate Travel Rule data exchange between custodians and VASPs:

TRISA (Travel Rule Information Sharing Alliance)

• Open-source, peer-to-peer protocol using mTLS for secure data exchange.
• Operated by the Global Digital Finance (GDF) consortium.
• Interoperable with TRP/OpenVASP and Sygna Bridge.
• Designed with regulators in mind; offers a regulator portal for supervision.

OpenVASP / TRP (Travel Rule Protocol)

• Fully decentralized, open-source protocol maintained by the OpenVASP Association.
• Uses an Ethereum-based identity layer for VASP discovery.
• Achieved interoperability with TRISA in November 2023.

Sygna Bridge (CoolBitX)

• API-based messaging service supporting over 3,000 virtual assets.
• Interoperable with TRISA members.
• Strong adoption in Asia-Pacific markets.

Notabene

• Full-service Travel Rule compliance platform integrating multiple protocols: TRP, OpenVASP, TRUST, Sygna Bridge, TRISA, Shyft, Netki, and VerifyVASP.
• Acts as a protocol-agnostic aggregation layer.
• Provides counterparty VASP discovery and due diligence tools.

Sources: TRISA Regulators Guide; OpenVASP TRISA-TRP Interoperability Announcement; Notabene Travel Rule Messaging Protocols

1.5 The Sunrise Problem

The "sunrise problem" refers to the staggered global implementation of the Travel Rule, creating compliance asymmetries when custodians in compliant jurisdictions transact with counterparties in non-compliant jurisdictions.

Scale of the problem:

• As of the 2024 FATF survey, 54% of jurisdictions (73 of 135) had not taken any action to implement the Travel Rule.
• 75% of jurisdictions were only partially compliant or non-compliant as of July 2024.
• Only 35 jurisdictions had enacted specific regulations, with 27 in the process of adopting them.

Practical consequences for custodians:

• Compliant custodians cannot fulfill their obligation to transmit originator/beneficiary data when the counterparty VASP has no system to receive it.
• 7.8% of VASPs surveyed only permit transactions if they can send a Travel Rule message to the beneficiary VASP; 12% require a response before processing.
• Smaller VASPs and startups face disproportionate compliance costs navigating inconsistent requirements.
• Regulatory arbitrage risk: VASPs may relocate to non-implementing jurisdictions to avoid compliance costs.
• Even among the 20 jurisdictions covered here, phased and graduated approaches (Brazil's three-phase rollout to Feb 2028; Australia's not-yet-in-force commitment) create transitional sunrise effects until parity with the zero/EUR 1,000-threshold cohort is reached.

FATF response: The FATF has signaled continued escalation of public pressure on lagging jurisdictions, including potential grey-listing. The June 2025 Best Practices for Travel Rule Supervision guidance document provides supervisory frameworks for jurisdictions building enforcement capacity.

Sources: Notabene Sunrise Issue Explainer; Blockpass Travel Rule Sunrise Issue; FATF Best Practices Travel Rule Supervision June 2025

2. Transaction Monitoring

2.1 AML/KYC and Blockchain Analytics Requirements by Jurisdiction

Regulators increasingly expect---and in some cases mandate---that crypto custodians employ blockchain analytics tools for transaction monitoring, sanctions screening, and risk assessment. The table below mirrors the verified AML/KYC regime (t6) for all 20 jurisdictions:

Sources: FinCEN Cryptocurrency Regulation; BaFin Requirements for Crypto Asset Services; Jones Day MiCA and AMLR Analysis; per-jurisdiction research cited in the regulation files linked above.

2.2 Blockchain Analytics Tools: Regulatory Expectations

Three dominant platforms serve the institutional custody market, each with distinct regulatory positioning:

Chainalysis

• Market leader with the largest attribution database covering sanctioned entities, darknet markets, ransomware operators, and known illicit wallets.
• Used by over 100 government agencies globally, including the U.S. IRS-CI, FBI, DEA, and Europol.
• Products: Chainalysis Reactor (investigation), KYT (Know Your Transaction for real-time monitoring), Kryptos (risk scoring).
• Regulatory credibility stems from deep government relationships and extensive law enforcement partnerships.

Elliptic

• Strong EU/MiCA compliance positioning; adopted by Bitget in 2025 specifically for MiCA and Travel Rule compliance.
• Products: Navigator (transaction screening), Lens (investigation), Discovery (VASP due diligence).
• Entity-level risk assessment and tuned detection models minimize false positives.
• Cross-chain analytics covering 40+ blockchains.

TRM Labs

• Machine-learning-based approach that evolves detection capabilities without waiting for attribution database updates.
• Achieved FedRAMP High authorization in December 2024---the most stringent federal security certification for cloud services---enabling deployment for mission-critical U.S. federal operations.
• Products: TRM Forensics (investigation), TRM Transaction Monitoring, TRM Sanctions Screening.
• Strong positioning for government and institutional clients requiring sovereign-grade security.

Regulatory expectations: While no jurisdiction explicitly mandates a specific analytics vendor, regulators expect custodians to demonstrate:

1. Real-time or near-real-time transaction screening against sanctions lists and known illicit addresses.
2. Risk scoring of counterparties and transaction patterns.
3. Documented investigation and SAR/STR filing workflows triggered by alerts.
4. Regular model validation and coverage reviews.

Sources: Chainalysis 2025 Crypto Regulatory Round-Up; Elliptic Blockchain Analytics; TRM Labs FedRAMP Authorization; Allium Top Blockchain Intelligence Platforms 2025

2.3 Sanctions Screening

Crypto custodians must screen transactions against multiple sanctions regimes simultaneously. The verified per-jurisdiction sanctions obligations are summarized below:

OFAC (United States)

• Sanctions administered by the Office of Foreign Assets Control, U.S. Department of the Treasury.
• Enforced on a strict liability basis---custodians can face civil penalties even without knowledge they transacted with a sanctioned party.
• As of 2025, OFAC has sanctioned 57 individuals and entities specifically for illicit crypto activities.
• OFAC penalties imposed on crypto businesses totaled $430 million in 2024, a 40% increase over 2023.
• 76% of crypto exchanges operating in the U.S. reported full OFAC compliance as of March 2025.
• Notable sanctioned entities: Garantex (re-designated March 2025, along with successor Grinex), SUEX, Chatex, Bitpapa, NetEx24, AWEX, Cryptex.
• The GENIUS Act 2025 extends BSA/sanctions compliance obligations to payment stablecoin issuers.
• Tornado Cash precedent: In March 2025, Treasury withdrew sanctions on Tornado Cash following the Fifth Circuit's November 2024 ruling that OFAC exceeded its statutory authority in sanctioning immutable smart contracts. This ruling has implications for how custodians assess protocol-level vs. entity-level sanctions risk.

EU Consolidated Sanctions List

• CASPs under MiCA must screen against the EU Consolidated List in real time. EEA members (
  Liechtenstein) apply the same regime via the EEA Agreement.
• EBA Guidelines on Restrictive Measures apply since December 30, 2025.
• Transfers involving sanctioned addresses must be frozen.
• MiCA penalties for sanctions violations: up to EUR 5,000,000 or 3-12.5% of total annual turnover.

National sanctions regimes (Europe & EEA)

• Switzerland: SECO sanctions plus EU/UN alignment; stablecoin issuers must implement blacklist/freeze-and-block capability; SARs to MROS.
• United Kingdom: OFSI/UK Sanctions List screening; FATF-aligned (Recommendations 15 and 16, risk-based approach).
• France: asset-freezing-order compliance procedures; SARs to TRACFIN.
• Luxembourg and
  Liechtenstein: EU/EEA sanctions screening and record-keeping.
• Gibraltar: sanctions screening required; SAR to the GFIU (post-Brexit, outside the EU sanctions regime but FATF-aligned).

Middle East & Africa and other regimes

• Bahrain: ongoing sanctions screening against applicable lists; member of MENAFATF, cooperates on cross-border enforcement.
• UAE: sanctions compliance under federal AML/CFT and ADGM Sanctions Rules; VARA marketing regulations (Oct 2024) carry penalties up to AED 10 million for non-compliance.

Asia-Pacific and Americas national regimes

• Japan: transaction monitoring; STRs to JAFIC; 7-year retention.
• Hong Kong: sanctions screening; CDD; enhanced DD for high-risk; STRs to JFIU.
• Singapore: transaction monitoring; STRs to the Suspicious Transaction Reporting Office; agent due diligence (from 4 Apr 2024).
• South Korea: transaction monitoring; STRs to KoFIU; minors prohibited, foreign individuals restricted on won on-ramp.
• Australia: SMRs, TTRs, IFTIs reporting; transaction monitoring; 7-year retention.
• Brazil and
  Cayman Islands: UN/local sanctions screening;
  Canada: sanctions/AML obligations under PCMLTFA;
  Bermuda: international sanctions in effect screened (scored highest in CFATF Mutual Evaluation 2020).

UN Sanctions Lists

• All UN member states are obligated to implement UN Security Council sanctions.
• Custodians must screen against the UN Consolidated List, particularly relevant for DPRK-related designations (crypto theft by Lazarus Group).

Sources: OFAC Sanctions and Digital Assets - Global Legal Insights; Chainalysis OFAC Sanctions Tracker; Venable - Treasury Lifts Sanctions on Tornado Cash; CoinLaw OFAC Statistics 2025; EU Sanctions and Cryptocurrency Compliance 2026

2.4 Unhosted Wallet Risk Assessment

Transfers to and from unhosted (self-hosted, non-custodial) wallets present elevated AML/CFT risk because the counterparty is not subject to AML obligations. Key regulatory frameworks:

Germany --- GwG Section 15a

• Effective 2025, obliged entities must assess whether transfers from or to unhosted wallets present increased money laundering risk.
• BaFin expects CASPs to use blockchain analytics tools and apply enhanced scrutiny.
• For amounts exceeding EUR 1,000, CASPs must verify ownership of the wallet, typically through cryptographic proof (e.g., message signing).
• BaFin's July 2025 Interpretation and Application Guidance confirmed that self-declaration does not qualify as adequate ownership verification.

European Union --- MiCA / Transfer of Funds Regulation

• Under the TFR, transfers to/from unhosted wallets exceeding EUR 1,000 require the CASP to verify the wallet is owned or controlled by its customer.
• CASPs must conduct enhanced due diligence and document risk assessments for all unhosted wallet interactions.
• No outright ban on unhosted wallet transfers, but regulatory friction is significant. The same TFR obligation applies across EU and EEA members (
  France,
  Luxembourg,
  Liechtenstein).

Liechtenstein --- DDA/SPG triggers

• EDD triggers include crypto-asset transfers above EUR 1,000 and occasional transactions exceeding CHF 15,000.

United States

• FinCEN proposed (but did not finalize) a rule requiring reporting of transactions over $10,000 involving unhosted wallets.
• Current BSA obligations require SARs for suspicious unhosted wallet activity regardless of threshold.

For the remaining jurisdictions, unhosted-wallet ownership-verification thresholds at the granularity of the German/EU model are NOT VERIFIED in the per-jurisdiction matrix; they rely on general risk-based CDD/EDD and transaction monitoring rather than a codified numeric ownership-verification rule.

Sources: BaFin Requirements for Crypto Asset Services; Germany Blockchain Laws 2026 - Global Legal Insights; Self-Hosted Wallets Under EU Law; Elliptic Hosted vs Unhosted Wallets

3. Notable Enforcement Actions Against Custodians and VASPs

3.1 Americas

Sources: FinCEN Binance Settlement; DOJ OKX Press Release; SEC Terraform Labs Settlement; SEC Coinbase Dismissal; Sidley Austin - Galois Capital Settlement; per-jurisdiction research cited in the Canada and Cayman Islands regulation files.

3.2 Europe

Aggregate EU enforcement under MiCA: Over EUR 540 million in penalties issued through 2024, with full enforcement underway since December 30, 2024. The most common violations were:

• 47% --- Inadequate AML and KYC procedures
• 19% --- Failure to implement adequate custodial arrangements for safeguarding client assets
• Remaining --- Operational resilience, governance, and disclosure failures

Note on register removals (not enforcement): The AMF's 2 April 2026 removal of several entities from the French DASP register --- including Coinbase Europe Limited --- was a voluntary withdrawal (client migration to the Luxembourg affiliate,

Luxembourg-authorized Coinbase Luxembourg S.A.), not an enforcement sanction. For

Liechtenstein, no crypto-custody enforcement action is recorded in the matrix; the regime is event-driven for TVTG providers and supervised under MiCAR/DORA for CASPs.

Source: CoinLaw MiCA Non-Compliance Statistics 2025; per-jurisdiction research cited in the Germany, France, UK, Luxembourg, and Liechtenstein regulation files.

3.3 Asia-Pacific

For

Japan and

South Korea, the matrix records intensified supervisory oversight (FSA inspections; FSC/FSS market surveillance and cold-storage compliance) rather than discrete named penalty actions in the current window.

3.4 Middle East & Africa

For

Bahrain and Gibraltar (grouped in this region in the matrix), no discrete AML penalty action is recorded in the current window; Bahrain's framework is characterized by measured enforcement, and Gibraltar supervises DLT Providers on par with banks via periodic returns and inspections.

3.5 Custodian-Specific Failure Case Studies

Prime Trust LLC (Nevada-chartered trust company, United States) provides a cautionary case study in custodian operational and compliance failure:

• June 2023: Nevada Financial Institutions Division filed to place Prime Trust into receivership and freeze all operations, days after BitGo withdrew its acquisition bid.
• July 2023: Court granted receivership order. John Guedry (former CEO, Bank of Nevada) appointed as receiver.
• Financial shortfall: Prime Trust owed clients $85M+ in fiat (held only ~$3M) and $69.5M in crypto (held ~$68.6M).
• Root cause: After migrating to Fireblocks in 2019, Prime Trust lost access to legacy wallets containing tens of millions in customer crypto (discovered December 2021). Rather than disclosing the loss, management used customer fiat funds to purchase replacement crypto---commingling and misappropriating client assets.
• Regulatory failures: Inadequate internal controls, asset segregation violations, failure to disclose material losses to regulators or clients.

Bittrex Global (Bermuda) Ltd (Class F DABA licensee) illustrates the opposite outcome: in 2024 it ceased operations through an orderly exit, demonstrating the value of

Bermuda's mandatory wind-down framework (Digital Asset Business Amendment Act 2024) in protecting client assets without the disorderly collapse seen at Prime Trust.

Sources: CoinDesk - Nevada Places Prime Trust Into Receivership; Nevada FID Press Release; per-jurisdiction research cited in the Bermuda regulation file.

4. Comparative Jurisdiction Table

The table below mirrors the verified AML/KYC and enforcement facts (t6 + enforcement) for all 20 jurisdictions:

Sources: Compiled from jurisdiction-specific research cited throughout this document. See Licensing Frameworks for detailed licensing requirements by jurisdiction.

5. What Works / What Does Not Work

What Works

1. Zero-threshold Travel Rule implementation (EU, Japan, Switzerland, UK)

• Eliminates smurfing (structuring transactions below thresholds).
• Provides complete transaction traceability for law enforcement.
• South Korea's decision to retain a low KRW 1,000,000 threshold (and earlier discussion of moving toward zero) reflects the same anti-smurfing rationale.
• Evidence: Jurisdictions with zero thresholds report more actionable intelligence for investigations.

2. Technology-neutral, outcome-based custody requirements

• Hong Kong SFC's ASPIRe roadmap (February 2025) signals a shift from prescriptive "98% cold storage" rules toward outcome-based safeguarding standards.
• Principles-based regimes (Gibraltar's ten-principle DLT framework,
  Switzerland's outcome-based FINMA guidance) allow custodians to adopt emerging technologies (MPC, HSM, multi-sig) without regulatory lag.

3. Interoperable Travel Rule messaging protocols

• The TRISA-TRP interoperability achievement (November 2023) and Notabene's multi-protocol aggregation demonstrate that technical interoperability is achievable.
• Reduces compliance friction for custodians operating across multiple jurisdictions.

4. Strict liability for sanctions violations (OFAC model)

• Creates strong incentives for proactive compliance investment.
• 76% OFAC compliance rate among U.S.-operating exchanges demonstrates deterrent effect.

5. Harmonized, single-market frameworks (MiCA across the EU/EEA)

• MiCA eliminates regulatory arbitrage within the EU's 27 member states, extended to EEA members (
  Liechtenstein) via the EEA Agreement.
• A single licensing passport reduces compliance costs for pan-European custodians;
  Luxembourg and
  Liechtenstein illustrate the passporting model (Coinbase Luxembourg; Bank Frick's 30-EEA-state passport).
• Clear penalty structure (up to EUR 5M or percentage of turnover) provides certainty.

6. Mandatory wind-down frameworks (

Bermuda)

• Bermuda's Digital Asset Business Amendment Act 2024 mandatory wind-down plans enabled Bittrex Global (Bermuda)'s orderly 2024 exit, contrasting sharply with Prime Trust's disorderly collapse.

What Does Not Work

1. Jurisdictional fragmentation and the sunrise problem

• 54% of jurisdictions had taken no Travel Rule action as of 2024.
• Creates compliance dead zones where custodians cannot fulfill Travel Rule obligations.
• Enables regulatory arbitrage: VASPs relocate to non-implementing jurisdictions.

2. High thresholds (e.g., U.S. $3,000)

• The
  United States' $3,000 threshold (vs. FATF-recommended $1,000) creates a gap exploitable by structuring; the proposed reduction to $250 for cross-border CVC would partly close it.
• Inconsistency with EU/UK/Japan zero-threshold approaches creates cross-border friction.

3. Enforcement without clear rules (regulation by enforcement)

• The SEC's 2023 Coinbase action (subsequently dismissed in February 2025) exemplified the costs of enforcement-first, rulemaking-later approaches.
• Creates legal uncertainty that chills institutional participation and drives activity offshore.

4. Inadequate supervision of Travel Rule compliance

• 59% of jurisdictions with Travel Rule legislation have taken no supervisory or enforcement action.
• Legislation without supervision is effectively non-implementation.

5. Self-declaration for unhosted wallet ownership

• BaFin's July 2025 guidance explicitly rejected self-declaration as adequate proof of wallet ownership.
• Cryptographic proof (message signing) is the emerging minimum standard.
• Brazil's Phase 1 Travel Rule rollout (Feb 2026--Feb 2027), which allows self-declarations, illustrates the transitional weakness this guidance warns against.

6. Prescriptive technology requirements

• Mandating specific storage ratios (e.g., 98% cold storage) without flexibility for new custody technologies constrains innovation.
• Outcome-based standards (e.g., "demonstrate asset segregation and recoverability") are more durable.

6. Recommended Framework: Compliance Program Minimum Standards

Based on enforcement patterns and regulatory expectations across the 20 jurisdictions, the following minimum standards are recommended for institutional crypto custodian compliance programs:

6.1 AML/KYC Program

6.2 Transaction Monitoring

6.3 Travel Rule Compliance

6.4 Governance and Oversight

7. Decision Matrix: Regulatory Approach Selection

This decision matrix assists policymakers in selecting the appropriate regulatory approach for AML/compliance enforcement based on jurisdictional context:

7.1 Travel Rule Threshold Selection

START
  |
  v
Does your jurisdiction have significant cross-border
crypto flows with EU/UK/Japan?
  |
  YES --> Adopt EUR 0 / zero threshold
  |         (Harmonization reduces friction;
  |          eliminates smurfing)
  |
  NO --> Is structuring/smurfing a documented
         concern in your jurisdiction?
           |
           YES --> Adopt EUR 0 / zero threshold
           |
           NO --> Adopt FATF minimum (USD/EUR 1,000)
                  with plan to reduce over 2 years

7.2 Enforcement Model Selection

7.3 Blockchain Analytics Mandate

7.4 Sanctions Screening Framework

7.5 Unhosted Wallet Policy

START
  |
  v
Does your jurisdiction permit CASP-to-unhosted
wallet transfers?
  |
  YES --> Require risk assessment for all
  |       unhosted wallet interactions
  |         |
  |         v
  |       Set ownership verification threshold
  |       (Recommended: EUR 1,000 or equivalent)
  |         |
  |         v
  |       Mandate cryptographic proof of ownership
  |       (NOT self-declaration)
  |         |
  |         v
  |       Require blockchain analytics risk scoring
  |       for all unhosted wallet addresses
  |
  NO --> Document prohibition clearly;
         enforce at CASP level;
         provide guidance on edge cases
         (e.g., DeFi protocol interactions)

Verification Notes

This document was refreshed on 2026-06-04 to integrate five new jurisdictions (

Bermuda,

Cayman Islands,

Liechtenstein,

Luxembourg, Gibraltar) alongside the existing 15, bringing the total to 20 jurisdictions. All per-jurisdiction AML/KYC (t6) and enforcement facts mirror the canonical crypto-custody fact matrix (the verified source of truth); no fact has been introduced that is not present in the matrix or the prior verified version of this file, and items the matrix records as NOT VERIFIED are reflected honestly. The "X of N" aggregates (e.g., 85 of 117; 29% of 138) are FATF-published figures, not derived from the 20-jurisdiction cohort. The underlying primary-source web research for the original 15 jurisdictions was conducted on March 18, 2026; the new jurisdictions and corrections (e.g., U.S. SAB 121 rescission via SAB 122, GENIUS Act extension of BSA/sanctions to stablecoin issuers, Paxful $3.5M FinCEN + $4M DOJ figures, AMF/Coinbase Europe register removal characterized as a voluntary withdrawal rather than a sanction) reflect the matrix as of the 2026-06-04 refresh. The following primary and secondary sources were consulted (no Wikipedia, Reddit, Quora, X/Twitter, or Medium sources are cited):

FATF Travel Rule and Implementation

1. FATF 2025 Targeted Update on VA/VASPs --- Verified: 85/117 jurisdictions implementing Travel Rule; 29% largely compliant with R.15; 59% have not taken enforcement action.
2. FATF 2025 Targeted Update PDF --- Verified: Implementation statistics and compliance gaps.
3. 21 Analytics FATF Travel Rule Status 2026 --- Verified: 73% of countries have made it law by January 2026.
4. InnReg Crypto Travel Rule Guide 2026 --- Verified: Threshold comparisons across jurisdictions.
5. Notabene Regulations Map --- Verified: Global Travel Rule adoption status.
6. 21 Analytics South Korea Travel Rule --- Verified: South Korea KRW 1,000,000 threshold.
7. Blockpass Travel Rule Sunrise Issue --- Verified: Sunrise problem description and statistics.
8. FATF Best Practices Travel Rule Supervision June 2025 --- Verified: Supervisory guidance publication.

Blockchain Analytics and Transaction Monitoring

1. Chainalysis 2025 Regulatory Round-Up --- Verified: Regulatory trends and enforcement data.
2. Elliptic Blockchain Analytics --- Verified: Product capabilities and MiCA compliance positioning.
3. TRM Labs FedRAMP Authorization --- Verified: FedRAMP High authorization December 2024.
4. BaFin Requirements for Crypto Asset Services --- Verified: GwG Section 15a requirements and BaFin expectations.

Sanctions Screening

1. OFAC Sanctions and Digital Assets - Global Legal Insights --- Verified: Strict liability enforcement, Garantex sanctions.
2. Chainalysis OFAC Sanctions Tracker --- Verified: 57 sanctioned individuals/entities.
3. CoinLaw OFAC Statistics 2025 --- Verified: $430M in penalties (2024); 76% exchange compliance rate.
4. Venable - Treasury Lifts Sanctions on Tornado Cash --- Verified: March 2025 Tornado Cash sanctions withdrawal.

Enforcement Actions

1. FinCEN Binance Settlement --- Verified: $3.4B FinCEN penalty; $4.3B total DOJ package.
2. DOJ OKX Press Release --- Verified: $504M penalty; February 2025.
3. SEC Terraform Labs Settlement --- Verified: $4.47B settlement; June 2024 jury verdict.
4. SEC Coinbase Dismissal --- Verified: February 27, 2025 dismissal.
5. CoinDesk - Prime Trust Receivership --- Verified: $85M+ fiat shortfall; receivership June-July 2023.
6. CoinLaw MiCA Non-Compliance Statistics 2025 --- Verified: EUR 540M+ in MiCA penalties; 47% AML/KYC violations.
7. Sidley Austin - Galois Capital SEC Settlement --- Verified: Custody Rule violation settlement September 2024.

Unhosted Wallets

1. Germany Blockchain Laws 2026 - Global Legal Insights --- Verified: GwG amendments incorporating MiCAR terms.
2. Self-Hosted Wallets Under EU Law --- Verified: EU TFR ownership verification requirements.
3. Elliptic Hosted vs Unhosted Wallets --- Verified: Compliance risks and regulatory expectations.

Travel Rule Technical Solutions

1. TRISA Regulators Guide --- Verified: Protocol architecture and regulator tools.
2. OpenVASP TRISA-TRP Interoperability --- Verified: November 2023 interoperability.
3. Notabene Travel Rule Messaging Protocols --- Verified: Multi-protocol integration.

Regional Regulation

1. Jones Day MiCA and AMLR Analysis --- Verified: EU regulatory landscape under MiCA and AMLR.
2. Grant Thornton Crypto Compliance 2026 --- Verified: 2026 compliance outlook.
3. Sumsub Global Crypto Regulations 2026 --- Verified: Global regulatory developments.

New-Jurisdiction and Cross-Country Source of Truth

1. Crypto-custody fact matrix (canonical, internal) --- Verified: per-jurisdiction t6 (AML/KYC, Travel Rule, sanctions) and enforcement facts for all 20 jurisdictions, including the five newly integrated jurisdictions (Bermuda DABA/POCA 1997 + AML/ATF Regulations 2008 and CFATF membership; Cayman Islands AMLRs Part XA Travel Rule and Gate.io public notice; Liechtenstein DDA/SPG and EU TFR via EEA; Luxembourg AML/CFT Law of 12 Nov 2004 and Coinbase Luxembourg authorisation; Gibraltar POCA 2015 (Transfer of Virtual Assets) Regs 2021 EUR 1,000 threshold and KuCoin/UAE comparison). See the linked per-jurisdiction regulation pages for full citations.