AML/KYC Compliance & Enforcement

1. Global Landscape -- AML/Compliance Models for Crypto Payments

1.1 The Convergence Imperative

The anti-money laundering and know-your-customer (AML/KYC) framework for crypto payment providers is converging globally around the FATF standards established in Recommendation 15 (New Technologies) and Recommendation 16 (Payment Transparency / Travel Rule). As of the June 2025 Sixth Targeted Update, 85 of 117 responding jurisdictions have passed legislation implementing the Travel Rule for virtual asset transfers, up from 65 in 2024 and 29 in 2022. An additional 14 jurisdictions are in the process of passing implementing legislation, bringing the total to 99 jurisdictions with active legislative efforts.

Despite this progress, only one jurisdiction has achieved full compliance with Recommendation 15 across all FATF assessment criteria, and 75% of jurisdictions remain partially or non-compliant with FATF's requirements. The gap between enacting legislation and achieving effective implementation remains the central challenge for policymakers.

Among the 19 jurisdictions profiled in this domain, all 19 have an AML/CFT regime applicable to crypto payment providers, and all 19 have implemented or are implementing the Travel Rule -- though the form ranges from in-force statutory rules (EU, UK, Singapore, Japan, South Korea, Switzerland, Hong Kong, Liechtenstein, France, Germany, Canada, UAE) to phased or pending implementation (Brazil's three-phase rollout to 2028, Australia's deferral to 1 July 2026, Nigeria's CBN supervisory pilot from April 2026, India's tightened January 2026 norms, and El Salvador where the Travel Rule is not yet specifically detailed).

Source: FATF Sixth Targeted Update on VA/VASP Implementation (June 2025)

1.2 Three Regulatory Models

Jurisdictions have adopted three broadly distinct approaches to AML/KYC compliance for crypto payment providers:

Model A -- Integrated Financial Services AML (EU, Singapore, Brazil, UAE) Crypto payment providers are brought within the same AML/CFT framework that governs traditional financial institutions. In the

EU, the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624, applicable from 10 July 2027) explicitly designates Crypto-Asset Service Providers (CASPs) as "obliged entities" subject to the same customer due diligence, suspicious transaction reporting, and beneficial ownership requirements as banks and payment institutions. In

Singapore, MAS Notice PSN02 applies equivalent AML/CFT obligations to Digital Payment Token (DPT) service providers as those imposed on traditional payment service providers under PSN01.

Brazil's BCB Resolution 520 aligns AML/CFT for licensed SPSAVs with FATF standards and bank-level prudential oversight, and the

UAE applies Federal Decree-Law No. 20 of 2018 (AML) plus Cabinet Decision No. 10 of 2019 across VARA-, ADGM-, DFSA-, and CBUAE-regulated entities.

Model B -- Parallel Regime with Sector-Specific Adaptations (US, UK, Canada, Germany) Crypto payment providers are subject to existing AML frameworks (BSA in the

US, MLRs 2017 in the

UK, PCMLTFA in

Canada, GwG in

Germany) but with sector-specific guidance and adaptations. FinCEN's 2013 and 2019 guidance documents classify convertible virtual currency transmitters as Money Services Businesses (MSBs), bringing them within the BSA framework. The UK's Money Laundering Regulations 2017 designate cryptoasset exchange providers and custodian wallet providers as "relevant persons" subject to AML obligations. Canada regulates VASPs as money services businesses via FINTRAC; Germany treats CASPs/PIs/EMIs as obliged entities under the GwG. Each applies existing legal frameworks rather than creating wholly crypto-specific AML statutes.

Model C -- Self-Regulatory Organisation (SRO) Supplemented Model (Japan, South Korea, Switzerland) In

Japan, the statutory AML/KYC regime under the Act on Prevention of Transfer of Criminal Proceeds (APTCP) is supplemented by the Japan Virtual and Crypto Assets Exchange Association (JVCEA), a JFSA-recognised SRO that imposes additional self-regulatory AML requirements including token listing pre-assessments, ongoing compliance monitoring, and sanctions screening standards. In

South Korea, the Korea Financial Intelligence Unit (KoFIU) administers VASP registration with AML/CTF requirements, supplemented by the unique real-name bank account verification system that ties exchange operations to verified banking relationships. In

Switzerland, non-FINMA-licensed financial intermediaries must affiliate with a FINMA-recognised SRO (VQF, PolyReg, SO-FIT) to discharge their AMLA obligations -- a long-standing Swiss self-regulatory architecture extended to crypto.

1.3 The Stablecoin AML Challenge

The FATF March 2026 Targeted Report on Stablecoins and Unhosted Wallets documented that stablecoins accounted for 84% of all illicit virtual asset transaction volume in 2025, with over USD 30 trillion in stablecoin volume growth between May 2024 and May 2025. The report identified peer-to-peer transactions via unhosted wallets as the primary "visibility gap" in the regulated ecosystem and recommended that jurisdictions:

• Require stablecoin issuers to maintain technical capability for asset freeze/burn functions
• Mandate proactive monitoring using blockchain analytics
• Conduct "multi-hop" transaction history analysis for AML/CFT risk assessment
• Apply robust AML/CFT measures across the entire stablecoin lifecycle

This challenge is acute in jurisdictions where stablecoins dominate volume. In

Brazil, BCB chief Galípolo confirmed in November 2025 that ~90% of crypto volume is stablecoin movement -- prompting Resolution 521 to classify fiat-referenced stablecoin transactions as foreign-exchange operations with mandatory monthly FX reporting (effective 4 May 2026). The

EU's MiCA enforcement led to the delisting of non-compliant stablecoins (USDT, PYUSD) for EEA users, and stablecoin AML obligations attach to issuers under both the TFR and AMLR.

Source: FATF Targeted Report on Stablecoins and Unhosted Wallets (March 2026)

1.4 The Offshore VASP Problem

The February 2026 FATF Plenary approved a report on "Understanding and Mitigating the Risk of Offshore VASPs (oVASPs)," examining regulatory gaps exploited when services operate from jurisdictions with weak or absent VASP regulation. The oVASP problem is directly relevant to AML/KYC enforcement: providers operating from offshore jurisdictions frequently serve customers in regulated markets without complying with local AML/KYC requirements, creating enforcement blind spots and undermining the effectiveness of the Travel Rule.

Several profiled jurisdictions have responded with extraterritorial enforcement against offshore providers:

Japan's JFSA secured the removal of five foreign exchanges' apps from Japan-facing app stores (February 2025);

India's FIU-IND issued Section 13 PMLA non-compliance notices to 25 offshore VDA providers (October 2025) with apps and URLs blocked; the

UK's FCA filed its first offshore crypto financial-promotion enforcement against HTX (21 October 2025); and

Singapore's FSMA Part 9 DTSP regime (hard deadline 30 June 2025) required offshore-serving providers to obtain a licence or cease activities.

Source: Outcomes FATF Plenary, 11-13 February 2026

2. Comparative Analysis Table

2.1 Travel Rule Implementation

The following table summarises Travel Rule status and thresholds across the 19 profiled jurisdictions (t4 in the fact matrix), supplemented by FATF's revised R.16.

2.2 KYC, Reporting, Sanctions & Enforcement Intensity

This table maps KYC standards, reporting obligations, and enforcement posture across the profiled jurisdictions (t4 + t6 in the fact matrix). "Enforcement Intensity" is a qualitative reading derived from each jurisdiction's notable actions and maximum penalties.

3. What Works / What Doesn't

3.1 What Works: Evidence-Based Assessment

A. The UK's Zero-Threshold Travel Rule

The

UK's decision to implement the Travel Rule with no minimum threshold (effective September 2023) -- going beyond the FATF recommendation of USD/EUR 1,000 -- has established the most comprehensive data collection regime for crypto transfers among major jurisdictions. While the operational burden on VASPs is higher, this approach eliminates the "structuring" risk where bad actors split transactions below the threshold to evade reporting. The UK's approach is consistent with the direction of travel indicated by the revised R.16 (June 2025), which permits countries to set thresholds at USD/EUR 1,000 or lower, and is shared by the

EU,

France,

Germany and

Japan, all of which apply no de minimis threshold to CASP-to-CASP transfers.

The FCA has acknowledged the "sunrise problem" -- the challenge that counterparties in non-compliant jurisdictions cannot reciprocate Travel Rule data -- and has adopted a pragmatic, risk-based supervisory approach rather than mandating that UK firms block all transfers to non-compliant counterparties. This balances compliance objectives with market functionality.

Sources:

• FCA Travel Rule Expectations
• UK Legislation (SI 2022/860)

B. South Korea's Real-Name Bank Account System

South Korea's requirement that VASPs offering fiat-crypto exchange must operate through verified real-name bank accounts at partner banks is the most structurally rigorous KYC mechanism in global crypto regulation. By requiring that the VASP customer's identity match the bank account holder's identity at the partner bank, the system creates a dual-verification architecture where both the VASP and the bank independently verify the customer's identity.

Evidence of effectiveness: Only five exchanges have secured real-name bank accounts, effectively creating a high barrier to entry that has concentrated the market among compliant operators. Exchanges without real-name accounts are limited to crypto-to-crypto trading, significantly reducing fiat on/off-ramp exposure. The system has proven effective at preventing anonymous fiat-crypto conversions but has drawn criticism for anti-competitive effects and limited innovation. (Bithumb migrated its real-name banking partner from NH Nonghyup Bank to KB Kookmin Bank in March 2025, illustrating how the partner-bank linkage rather than the bank's identity is the structural control.)

Sources:

• MAS / KoFIU comparative analysis -- Sumsub: South Korea Crypto Regulations
• 21 Analytics: South Korea Travel Rule Regulation

C. Japan's SRO-Supplemented Model

Japan's combination of statutory AML requirements (APTCP) with JVCEA self-regulatory oversight has produced a distinctive enforcement model. The JVCEA's pre-assessment of new token listings evaluates money laundering risks, technical feasibility, and issuer auditability before tokens can be offered on registered exchanges. This front-loading of risk assessment reduces the AML burden on individual exchanges and creates industry-wide minimum standards.

Evidence of effectiveness: Japan's enforcement response to the DMM Bitcoin hack (May 2024, approximately 4,502.9 BTC / ~USD 305 million stolen, attributed to North Korea-linked hackers) demonstrated the system's capacity for rapid intervention. The JFSA issued a business improvement order citing "serious problems" with system risk management, and DMM Bitcoin ultimately transferred accounts to SBI VC Trade (March 2025) after obtaining JPY 55 billion from its parent company to offset customer losses. The SRO model ensured that affected customers were made whole despite the platform's closure.

The JFSA's February 2025 request to Apple and Google to remove mobile applications of five unregistered foreign exchanges from Japan-facing app stores -- with both platforms complying -- represents an innovative enforcement mechanism. India later applied a comparable offshore-blocking approach via FIU-IND Section 13 PMLA notices (October 2025), confirming the cross-jurisdictional utility of app-store and URL blocking against oVASPs.

Sources:

• CoinDesk: DMM Bitcoin Shutdown
• BeInCrypto: Japan FSA Warns Unregistered Exchanges

D. The EU's Unified TFR/AMLR Framework

The

EU's combination of the Transfer of Funds Regulation (TFR, Regulation (EU) 2023/1113) and the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624, applicable from 10 July 2027) creates the most comprehensive and harmonised AML framework for crypto payment providers globally. The TFR applies to all crypto-asset transfers with no minimum threshold, while the EUR 1,000 threshold governs verification of unhosted-wallet ownership/control. The EBA's July 2024 Travel Rule Guidelines (EBA/GL/2024/11) provide granular operational guidance on detecting missing or incomplete Travel Rule information and specify acceptable methods for verifying ownership of self-hosted wallets (cryptographic signature, micro-transaction/"Satoshi test," or qualified electronic signature).

Evidence of effectiveness: The enforcement of MiCA compliance requirements led to the delisting of USDT across EU-regulated exchanges for EEA users (H2 2024-Q1 2025) and the suspension of PayPal's PYUSD (January 2025) due to non-compliance with EMT issuance requirements. This demonstrated that the EU framework has real market consequences: aggregate MiCA penalties exceeded EUR 540 million since enforcement began (November 2025), with the largest single fine of EUR 62 million imposed by France's AMF.

Sources:

• EUR-Lex: TFR (EU) 2023/1113
• EBA Travel Rule Guidelines (EBA/GL/2024/11)
• CoinLaw: EU MiCA Regulations Statistics 2025

E. Canada's Escalated AML Enforcement (FINTRAC)

Canada's 2025-2026 enforcement surge illustrates how an activity-based AML regime with credible penalties can shift behaviour. FINTRAC imposed a record C$176.9 million administrative monetary penalty on Cryptomus/Xeltox (October 2025, 2,593 violations) -- the largest in its history -- and revoked 80+ MSB registrations across 2025-2026, including 51 in a single day (24 March 2026). Bill C-12 (Royal Assent 26 March 2026) raised per-violation AMPs roughly 40-fold (to C$20 million for very serious violations) and added a compliance-program violation. The lesson: free registration paired with heavy, publicised enforcement deters non-compliant operators more effectively than high entry barriers alone.

Sources:

• FINTRAC Administrative Monetary Penalties
• Department of Finance Canada -- Bill C-12 / Budget Implementation Act 2025

3.2 What Doesn't Work: Evidence-Based Assessment

A. The US USD 3,000 Travel Rule Threshold

The

US Travel Rule threshold of USD 3,000 (31 CFR 1010.410(f)) is the highest among major jurisdictions and significantly exceeds the FATF-recommended USD/EUR 1,000 de minimis. This gap means that a substantial volume of crypto transfers -- including those that may be suspicious -- falls below the threshold at which originator/beneficiary information must be collected and transmitted. FinCEN proposed lowering the cross-border threshold to USD 250 in 2020, but this proposal has not been finalised as of June 2026.

Evidence of weakness: The higher threshold creates an arbitrage opportunity. Actors seeking to evade Travel Rule data collection can structure transactions below USD 3,000 -- a tactic that is technically simple in the crypto context where transaction splitting incurs minimal cost. By comparison, the EU, France, Germany, the UK, and Japan apply the Travel Rule to all transfers regardless of amount, while Canada (C$1,000) and Switzerland (CHF 1,000) sit at the FATF de minimis.

Sources:

• 21 Analytics: US Travel Rule Regulation
• Sumsub: US Crypto Travel Rule

B. The Sunrise Problem

The "sunrise problem" -- where jurisdictions implement the Travel Rule at different times, leaving compliant VASPs unable to exchange data with counterparties in non-compliant jurisdictions -- remains the single most significant operational challenge to Travel Rule effectiveness. As of June 2025, approximately 59% of jurisdictions with Travel Rule legislation had yet to issue supervisory findings, directives, or enforcement actions specifically tied to Travel Rule compliance. Legislative enactment without effective enforcement creates the worst outcome: compliant firms bear the cost of implementation while non-compliant firms in other jurisdictions face no consequences.

The revised R.16 (June 2025) attempted to address this by setting a universal compliance deadline of end-2030, but this five-year runway -- a departure from FATF's usual immediate-effect practice -- risks prolonging the sunrise problem rather than resolving it. Phased national rollouts compound the issue:

Brazil's Travel Rule reaches full mandatory exchange only on 2 February 2028, and

Australia's obligations commence 1 July 2026, leaving multi-year windows in which cross-border counterparty data cannot be reciprocated.

Sources:

• FATF: Revised Recommendation 16 (June 2025)
• CGAP: The FATF's Revised Travel Rule

C. De-Risking and Banking Access

Across nearly all jurisdictions studied, crypto payment providers report persistent difficulty in obtaining and maintaining banking relationships. This "de-risking" phenomenon occurs because banks' AML/CFT compliance costs for crypto clients are disproportionately high relative to the revenue generated, and the perceived reputational risk of banking crypto firms discourages engagement.

Evidence of impact:

• US: The House Financial Services Committee's December 2025 report documented "Operation Choke Point 2.0," finding that at least 30 crypto entities lost banking access and the FDIC sent "pause letters" to approximately 24 banks requesting they delay crypto services between 2022 and 2024. Federal agencies reversed these policies in early 2025 (OCC IL 1183 of 7 March 2025; FDIC FIL-7-2025 of 28 March 2025; Fed withdrawal of the pre-approval requirement), but the structural de-risking incentive persists.

• UK: Despite FCA registration, UK crypto firms continue to face significant difficulties obtaining banking relationships. The FCA has acknowledged the issue but has limited power to compel banks to open accounts.

• EU: CASPs authorised under MiCA face challenges obtaining SEPA membership, with commercial banks refusing to onboard crypto clients as indirect access points.

• Singapore: Banking access for licensed DPT providers is described as notoriously difficult even after MPI licensing.

The de-risking problem creates a circular vulnerability: firms denied banking access may resort to less transparent financial channels, increasing the very ML/TF risks that banking de-risking ostensibly mitigates. By contrast,

Liechtenstein (best-in-class banking access via Bank Frick) and the

UAE (onshore safeguarding accounts at Emirates NBD/Mashreq for stablecoin reserves) demonstrate that a supportive banking ecosystem can be a deliberate policy advantage.

Sources:

• House Financial Services Committee Debanking Report (December 2025)
• FDIC FIL-7-2025

D. Fragmented US State-Level Enforcement

The US multi-jurisdictional licensing requirement (49 states + DC + territories, each with independent AML/KYC oversight) creates enforcement fragmentation. The Block/Cash App enforcement actions illustrate this: NYDFS imposed a USD 40 million penalty (April 2025), while a multi-state coalition (7 states) imposed a separate USD 80 million penalty for BSA/AML violations including 169,000+ unreviewed compliance alerts by 2020. A single entity faced overlapping enforcement actions from different regulators for substantially similar compliance failures -- demonstrating duplication rather than coordination. The federal market-structure bill intended to clarify the SEC/CFTC perimeter -- the Digital Asset Market Clarity Act (CLARITY Act, H.R. 3633) -- remains not enacted (advanced by the Senate Banking Committee 14 May 2026), so the fragmentation persists.

Sources:

• NYDFS: Block $40M Settlement (April 2025)
• CSBS: Block $80M Penalty

E. Sanctions Screening for Smart Contracts: The Tornado Cash Precedent

The Tornado Cash saga exposed fundamental uncertainty about whether autonomous smart contracts can be sanctioned. OFAC designated Tornado Cash in August 2022. The Fifth Circuit Court of Appeals ruled in November 2024 that immutable smart contracts are not "property" under IEEPA because no person or entity controls them post-deployment. OFAC lifted sanctions on 21 March 2025, and a Texas federal judge permanently enjoined OFAC from re-sanctioning the protocol in April 2025.

However, criminal proceedings against individual developers proceeded independently. Co-developer Roman Storm was convicted on 6 August 2025 on the count of conspiracy to operate an unlicensed money-transmitting business (18 U.S.C. 1960); the jury deadlocked on the money-laundering and sanctions-violation counts, which the judge declared a mistrial. On 9 March 2026 the DOJ filed a letter seeking an October 2026 retrial on the deadlocked counts. This creates a clear precedent: the protocol itself is no longer sanctioned, but an individual associated with its development was convicted of unlicensed money transmitting and faces possible retrial on the remaining charges. For compliance teams, the lesson is that sanctions screening must distinguish between sanctioned entities/addresses (which may be removed from sanctions lists) and criminal conduct (which remains prosecutable regardless of sanctions status).

Sources:

• Venable: Treasury Lifts Tornado Cash Sanctions
• CoinDesk: US Government Removes Tornado Cash Sanctions (March 2025)

4. Recommended Framework

4.1 Principles

The following framework is designed for regulators and policymakers seeking to establish or strengthen AML/KYC compliance regimes for crypto payment providers. It is informed by the comparative evidence analysed in Sections 1-3 and aligned with FATF Recommendations 15 and 16 as revised in June 2025.

Principle 1: Functional Equivalence Crypto payment providers performing functionally equivalent activities to traditional payment service providers must be subject to the same AML/CFT obligations. Where a single entity qualifies as both a VASP and a payment service provider, it must comply with the higher standard.

Principle 2: Technology Neutrality AML/KYC requirements should be specified in terms of outcomes (e.g., "verify the identity of the originator") rather than technology-specific methods. This enables compliance solutions to evolve with technology while maintaining consistent regulatory expectations.

Principle 3: Risk Proportionality Requirements should be calibrated to the risk profile of the activity, not the technology. Low-value domestic stablecoin transfers may warrant simplified due diligence, while high-value cross-border transfers involving unhosted wallets warrant enhanced due diligence.

Principle 4: Supervisory Coordination Where multiple regulators have AML/KYC oversight of the same entity (as in the US, Canada, the UAE, and Nigeria), a designated lead supervisor should be identified to prevent enforcement duplication and ensure consistent expectations.

Principle 5: Banking Access Preservation AML/KYC frameworks should include explicit guidance to banks on proportionate risk assessment of licensed crypto firms, preventing reflexive de-risking that undermines regulatory objectives.

4.2 Travel Rule Implementation Recommendations

4.3 KYC and Customer Due Diligence Recommendations

4.4 Sanctions Screening Recommendations

4.5 SAR/STR Reporting Recommendations

4.6 Institutional Architecture Recommendations

Designated AML/KYC Supervisor: Jurisdictions should designate a single lead AML/KYC supervisor for crypto payment providers, even where multiple regulators have overlapping authority. The EU's establishment of the Anti-Money Laundering Authority (AMLA, headquartered in Frankfurt, operational from 1 July 2025) provides a supranational model. AMLA will directly supervise up to 40 high-risk obliged entities -- potentially including large CASPs -- beginning 1 January 2028, and can impose sanctions of up to 10% of annual turnover or EUR 10 million.

Self-Regulatory Supplement: Following the Japanese JVCEA and Swiss SRO models, jurisdictions should consider recognising industry SROs that can supplement statutory requirements with sector-specific standards, pre-vet token listings for AML risk, and provide a first line of compliance monitoring. SRO recognition should be conditional on robust governance, enforceable rules, and regulatory oversight.

Sources:

• AMLA: Expectations for Crypto Sector (2025)
• AMLA Work Programme 2025
• JVCEA Official Website

5. Decision Matrix

5.1 Regulatory Design Decisions

The following matrix maps key regulatory design decisions to the jurisdictional evidence analysed in this document. Each row presents a binary or spectrum-based decision that policymakers must resolve, the options available, the jurisdictions that have adopted each approach, and the observed trade-offs.

5.2 Implementation Sequencing

For jurisdictions establishing new AML/KYC regimes for crypto payment providers, the following sequencing is recommended based on the comparative evidence:

Phase 1 (0-12 months): Foundation

• Enact VASP/CASP registration or licensing requirement with AML/KYC obligations
• Designate lead AML/KYC supervisor
• Implement basic CDD requirements (identity verification at onboarding)
• Establish SAR/STR reporting channel to FIU
• Begin sanctions screening requirement

Phase 2 (12-24 months): Travel Rule

• Implement Travel Rule legislation aligned with FATF R.16
• Set threshold at USD/EUR 1,000 or lower
• Provide 12-month grace period for technical implementation
• Issue guidance on sunrise problem (risk-based approach for non-compliant counterparties)

Phase 3 (24-36 months): Enhanced Measures

• Implement unhosted wallet verification requirements (EUR 1,000 threshold model)
• Require or recommend blockchain analytics adoption
• Begin Travel Rule-specific supervisory examinations
• Issue guidance on stablecoin-specific AML risks (informed by FATF March 2026 report)
• Establish banking access guidance for licensed crypto firms

Phase 4 (36+ months): Enforcement Maturity

• Conduct enforcement actions for non-compliance
• Publish enforcement outcomes to create deterrent effect (Canada's publicised nine-figure FINTRAC penalty is a model)
• Establish cross-border supervisory cooperation arrangements
• Consider SRO recognition for supplementary monitoring
• Review and adjust thresholds based on observed risk data

5.3 Risk-Based Calibration

Regulators should calibrate AML/KYC intensity based on the following risk factors:

6. Enforcement Actions Against Crypto Payment Providers -- Reference Table

The following table compiles significant enforcement actions against crypto payment providers for AML/KYC and related failures across the 19 jurisdictions analysed (t6 in the fact matrix). Where a jurisdiction's framework is newly operational and no specific public action is verified, this is noted explicitly.

7. Technical Solutions for Travel Rule Compliance

7.1 The Interoperability Challenge

A persistent challenge in Travel Rule implementation is the absence of a single universal messaging protocol for exchanging originator/beneficiary information between VASPs. Multiple competing solutions have emerged:

The lack of protocol interoperability means that two compliant VASPs using different solutions may be unable to exchange Travel Rule data, effectively reproducing the sunrise problem at the technology layer. The FATF has deliberately avoided mandating a specific solution, maintaining technology neutrality. However, regulators should monitor interoperability progress and consider requiring that chosen solutions demonstrate cross-protocol compatibility.

7.2 Blockchain Analytics as AML Infrastructure

The normalisation of blockchain analytics tools as standard AML compliance infrastructure represents a significant development in the 2025-2026 period. Wallet-risk scoring, counterparty analytics, and transaction chain analysis have moved from optional enhancement to de facto baseline requirement. Leading providers include Chainalysis, Elliptic, TRM Labs, and Crystal Blockchain.

The FATF March 2026 stablecoin report explicitly recommended that jurisdictions mandate "proactive monitoring using blockchain analytics" and "multi-hop transaction history analysis." While no profiled jurisdiction has yet enacted a standalone statutory requirement for blockchain analytics adoption, the direction of travel is clear:

El Salvador already mandates KYT (know-your-transaction) real-time monitoring under LEAD, and regulators increasingly expect crypto payment providers to deploy these tools as part of their AML/CFT programmes.

Key compliance applications include:

• Sanctions screening: Matching on-chain addresses against OFAC SDN, EU, and national sanctions lists
• Transaction monitoring: Identifying suspicious patterns including rapid chain-hopping, mixer usage, and layering
• Counterparty risk assessment: Evaluating the AML/CFT posture of receiving VASPs before executing transfers
• Unhosted wallet risk scoring: Assessing the risk profile of unhosted wallet addresses based on transaction history

Sources:

• Chainalysis: FATF Targeted Report Analysis (March 2026)
• Elliptic: Five Steps to Effective Cryptocurrency Sanctions Compliance in 2026
• Grant Thornton: Crypto Compliance in 2026

8. The AMLA Paradigm: Supranational AML Supervision

8.1 Structure and Mandate

The EU Anti-Money Laundering Authority (AMLA), established under Regulation (EU) 2024/1620, represents the first supranational AML supervisor with direct oversight authority over the crypto sector. Headquartered in Frankfurt am Main and operational from 1 July 2025, AMLA's mandate includes:

• Preparing Level 2/3 regulatory technical standards ahead of AMLR application (10 July 2027)
• Directly supervising up to 40 high-risk obliged entities in the financial sector from 1 January 2028, with CASPs explicitly within scope
• Coordinating AML/CFT supervision across
  EU member states to ensure consistent enforcement for cross-border CASPs
• Maintaining a central EU register of CASPs linked with EBA and ESMA supervisory portals
• Imposing administrative sanctions of up to 10% of annual turnover or EUR 10 million (whichever is higher)

8.2 Implications for Crypto Payment Providers

AMLA's 2025 Work Programme specifically identified CASPs as exposed to significant ML/TF risks and has prioritised the development of supervisory standards for the crypto sector. For crypto payment providers operating across EU member states, AMLA's establishment means:

1. Harmonised enforcement: AMLA will coordinate NCA enforcement to prevent regulatory arbitrage where firms establish in the most lenient member state
2. Direct supervision risk: Large CASPs may be selected for direct AMLA supervision from 2028, bringing supranational examination and enforcement powers
3. Standard-setting: AMLA's Level 2/3 measures will create detailed, binding rules on CDD, beneficial ownership, and suspicious transaction reporting for CASPs
4. Cross-border cooperation: AMLA will facilitate information sharing between NCAs and with third-country supervisors, reducing the effectiveness of offshore structures

8.3 Lessons for Other Jurisdictions

The AMLA model addresses a fundamental limitation of national AML supervision: crypto payment providers operate globally, but AML supervisors operate nationally. Jurisdictions outside the EU -- particularly those in regional economic blocs (ASEAN, MERCOSUR, AU) -- should study the AMLA model as a potential template for supranational AML coordination. The FATF's oVASP report (February 2026) underscores the urgency: offshore VASPs exploit supervisory gaps between national jurisdictions, and purely national enforcement is insufficient to address cross-border ML/TF risks. The

UAE's CMA-VARA unified register (mutual VASP recognition across emirates) is an early sub-federal analogue of this coordination logic.

Sources:

• AMLA Homepage
• Jones Day: Crypto Assets, CASPs, and AML/CFT Compliance (July 2025)
• Jones Day: Investigatory Powers of AMLA (December 2025)

9. Key Metrics and Indicators for Supervisors

Regulators assessing the effectiveness of their AML/KYC regime for crypto payment providers should monitor the following metrics:

Cross-Domain References

• AML/CFT obligations attaching to stablecoin issuers and reserve-freeze/burn capabilities are developed in stablecoin AML/KYC compliance.
• Broker reporting (Form 1099-DA), DAC8, OECD CARF, and tax-driven transaction reporting that intersect with AML data are covered in OECD CARF.
• Custody safeguarding and segregation standards referenced in the safeguarding columns are detailed in crypto-custody compliance.

Verification Notes

Methodology

All claims in this document were mirrored from the canonical per-jurisdiction fact matrix (.claude/crypto-payment-regulation-fact-matrix.json), which is the verified source of truth for this refresh. No new web searches were conducted in this pass; corrections reflect facts the matrix now states differently. Primary regulatory sources (FATF, EU Official Journal, FinCEN, FCA, MAS, JFSA, FSC/KoFIU, FINTRAC, BCB, CBUAE, CBB, SEC Nigeria) underpin the matrix entries. The "X of N" jurisdiction aggregates (e.g., all 19 with AML regimes and Travel Rule implementation) are derived from the matrix; the 85-of-117 and 75% figures are FATF global statistics, not the 19-jurisdiction sample.

Source Verification Status

Items Requiring Future Verification

• EU MiCA aggregate penalty figures (EUR 540M+) are from a single aggregator source (CoinLaw); official NCA-by-NCA verification would improve confidence.
• Brazil, El Salvador, and Nigeria have newly operational or piloting AML regimes with limited verified public enforcement actions; these are flagged "NOT VERIFIED" in the enforcement table per the matrix.
• AMLA's selection criteria for direct supervision of CASPs (from 2028) are under development; final criteria not yet published.
• Exact number of MAS-licensed DPT providers (reported as 36 MPI licences by January 2026): based on MAS reporting; independent verification against the MAS public register recommended.
• Travel Rule thresholds recorded as "NOT VERIFIED" / "Not specified" in the matrix (Bahrain, Nigeria, El Salvador, India, Liechtenstein) should be confirmed against each regulator's published rulebook in the next refresh.