AML/CFT Crypto: Practical Guide for Professionals

Introduction

Mastering AML/CFT means securing your license and building trust.

Anti-money laundering and combating the financing of terrorism (AML/CFT) is at the heart of crypto-asset regulation. For PSANs and future CASPs, mastering these obligations is essential to obtain and maintain their license. This practical guide details the requirements, best practices, and compliance tools.

What you will learn:

• The AML/CFT regulatory framework applicable to crypto-assets
• Customer due diligence obligations (KYC)
• Detection and reporting of suspicious transactions
• Compliance tools and methodologies
• Sanctions for non-compliance

Table of Contents

1. AML/CFT Regulatory Framework
2. Customer Due Diligence (KYC)
3. Risk-Based Approach
4. Transaction Monitoring
5. Suspicious Activity Report (SAR/TRACFIN)
6. Asset Freezing
7. Internal Organization
8. Tools and Technologies
9. Crypto Money Laundering Typologies
10. Sanctions and Controls
11. FAQ

1. AML/CFT Regulatory Framework

From FATF to French law, discover the anti-money laundering legal arsenal.

Applicable Texts

Hierarchy of Standards:

Recent Developments

European AML Package (2024):

• AMLR Regulation: directly applicable obligations
• Creation of AMLA: European anti-money laundering authority
• Harmonization of thresholds and procedures
• Reinforcement for crypto-assets

Competent Authorities in France

2. Customer Due Diligence (KYC)

Knowing your customers is the cornerstone of your AML/CFT framework.

Identification and Verification

Natural Persons:

Legal Entities:

Beneficial Owners (UBO)

Definition: Natural person who owns or controls (directly or indirectly) more than 25% of capital or voting rights.

Identification Cascade:

1. Identify holders > 25%
   │
   ├──▶ Found → UBO identified
   │
   └──▶ Not found
         │
         2. Identify persons exercising
            control through other means
            │
            ├──▶ Found → UBO identified
            │
            └──▶ Not found
                  │
                  3. Effective director = UBO by default

Onboarding Process

Standard Process:

1. Information collection: form, documents
2. Verification: consistency check, databases
3. Screening: PEP, sanctions, adverse media
4. Risk classification: customer scoring
5. Decision: acceptance, refusal, enhanced due diligence
6. Documentation: evidence retention

Information Updates

Update Frequency:

3. Risk-Based Approach

Adapt your controls to each profile for effective and proportionate compliance.

Fundamental Principle

"Obliged entities shall apply customer due diligence measures based on money laundering and terrorist financing risks." — Article L. 561-4-1 CMF

Risk Mapping

Risk Factors to Evaluate:

OVERALL RISK = f(Customer, Product, Channel, Geography)

┌─────────────────────────────────────────────────────────────┐
│                    CUSTOMER FACTORS                          │
│  • Nature (individual, company, association, trust)         │
│  • PEP (Politically Exposed Person)                         │
│  • Business sector (gaming, art, construction...)           │
│  • Reputation, adverse media                                │
│  • Transactional behavior                                   │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                    PRODUCT FACTORS                           │
│  • Potential anonymity (privacy coins)                      │
│  • Transaction complexity                                   │
│  • Volume and frequency                                     │
│  • Mixers, bridges, DeFi                                    │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                    CHANNEL FACTORS                           │
│  • Remote vs in-person relationship                         │
│  • Identity verification used                               │
│  • Payment methods                                          │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                    GEOGRAPHY FACTORS                         │
│  • Customer country of residence                            │
│  • Fund origin/destination                                  │
│  • High-risk countries (FATF, EU)                          │
└─────────────────────────────────────────────────────────────┘

Customer Classification

Typical Scoring Grid:

Enhanced Due Diligence Measures

Mandatory Triggers:

• PEP (Politically Exposed Person)
• High-risk third country (EU list)
• Atypical or suspicious transactions
• Remote customer not verified in person

Additional Measures:

• Supplementary documents
• In-depth source of funds
• Hierarchical approval
• Enhanced transaction monitoring
• More frequent updates

4. Transaction Monitoring

Detect suspicious behavior in real-time to protect your platform.

Monitoring Objectives

Purposes:

1. Detect atypical transactions
2. Identify suspicious behavior
3. Feed suspicious activity reports
4. Keep risk profile up to date

Detection Scenarios (Red Flags)

Behavioral Alerts:

Crypto-Specific Alerts:

Blockchain Analysis

Elements to Analyze:

Incoming transaction
        │
        ▼
┌─────────────────────────────┐
│   SOURCE ADDRESS            │
│   ANALYSIS                  │
│                             │
│   • History                 │
│   • Clustering              │
│   • Known labels            │
│   • Risk score              │
│   • Hops from suspicious    │
│     source                  │
└─────────────────────────────┘
        │
        ▼
┌─────────────────────────────┐
│   PATTERN ANALYSIS          │
│                             │
│   • Amount                  │
│   • Frequency               │
│   • Profile consistency     │
│   • Transaction chain       │
└─────────────────────────────┘
        │
        ▼
    Decision: OK / Alert / Block

5. Suspicious Activity Report (TRACFIN)

Report your suspicions to TRACFIN, a legal obligation under high confidentiality.

Reporting Obligation

Triggering Event:

"Obliged entities shall report to TRACFIN sums recorded in their books or transactions involving sums which they know, suspect or have good reason to suspect originate from an offense..." — Article L. 561-15 CMF

Reporting Criteria

Triggering Elements:

Reporting Procedure

Steps:

1. Detection: automatic or manual alert
2. Analysis: internal investigation
3. Decision: report or close
4. Writing: description of facts
5. Transmission: via ERMES (TRACFIN platform)
6. Follow-up: possible TRACFIN response
7. Archiving: retention 5 years

Report Content

Elements to Include:

SUSPICIOUS ACTIVITY REPORT
│
├── Declarant identification (PSAN)
│
├── Identification of persons concerned
│   ├── Customer
│   ├── Counterparties
│   └── Beneficial owners
│
├── Transaction description
│   ├── Dates
│   ├── Amounts
│   ├── Crypto-assets involved
│   ├── Blockchain addresses
│   └── Transaction hashes
│
├── Suspicion grounds
│   ├── Observed indicators
│   ├── Risk analysis
│   └── Context
│
└── Attachments
    ├── KYC documents
    ├── Transaction records
    └── Blockchain analysis

Confidentiality

⚠️ Absolute secrecy: Having filed a suspicious activity report must NEVER be disclosed to the customer concerned. This disclosure ("tipping-off") is criminally punishable.

6. Asset Freezing

Immediately block assets of sanctioned persons, an absolute obligation.

Freezing Obligation

Legal Framework: PSANs must freeze assets of persons and entities on sanctions lists.

Lists to Consult:

Freezing Procedure

Steps:

1. Continuous screening: customer verification vs lists
2. Match detected: immediate blocking
3. Verification: match confirmation (homonym?)
4. Effective freeze: prohibition of any movement
5. Declaration: notification to DG Trésor
6. Monitoring: until measure lifted

Freezing Scope

What is Frozen:

• All customer crypto-assets
• Any transfer attempt
• Any service benefiting the customer
• Including indirect assets

7. Internal Organization

Structure your teams and procedures for an operational AML/CFT framework.

Mandatory Functions

Typical AML/CFT Organization:

General Management
        │
        ├──▶ AML/CFT Compliance Officer
        │           │
        │           ├── KYC/Onboarding Team
        │           │
        │           ├── Transaction Monitoring Team
        │           │
        │           └── TRACFIN Correspondent
        │
        └──▶ TRACFIN Declarant (can be the same)

AML/CFT Compliance Officer

Missions:

• Develop procedures
• Supervise their application
• Train staff
• Ensure regulatory watch
• Interface with authorities
• Reporting to management

Required Profile:

• Compliance experience
• Knowledge of crypto sector
• Integrity and independence
• Access to management

Staff Training

Training Program:

Data Retention

Retention Periods:

8. Tools and Technologies

Equip yourself with the best KYC and analytics solutions to automate compliance.

KYC Solutions

Onboarding Tools:

Blockchain Analytics Solutions

Investigation Tools:

Typical Features:

• Address risk scoring
• Flow tracing
• Wallet identification (exchange, darknet, mixer...)
• Automatic alerts
• Reports for regulators

Monitoring Solutions

Monitoring Platforms:

Technical Architecture

Typical AML/CFT Stack:

┌─────────────────────────────────────────────────────────────┐
│                      CLIENT LAYER                            │
│                                                             │
│    ┌──────────────┐    ┌──────────────┐                    │
│    │ Onboarding   │    │  Compliance  │                    │
│    │    (KYC)     │    │  Dashboard   │                    │
│    └──────────────┘    └──────────────┘                    │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│                      BUSINESS LAYER                          │
│                                                             │
│  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐       │
│  │  KYC    │  │  Risk   │  │  List   │  │ Alert   │       │
│  │ Engine  │  │ Scoring │  │Screening│  │ Engine  │       │
│  └─────────┘  └─────────┘  └─────────┘  └─────────┘       │
└─────────────────────────────────────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────────┐
│                      DATA LAYER                              │
│                                                             │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │  Blockchain │  │  Sanctions  │  │   Customer  │         │
│  │  Analytics  │  │    Lists    │  │    Data     │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
└─────────────────────────────────────────────────────────────┘

9. Crypto Money Laundering Typologies

Identify money laundering patterns specific to crypto-assets to better detect them.

Classic Schemes Adapted

1. Structuring (smurfing):

Criminals → Multiple small deposits → Exchange → Consolidation → Cash out

2. Layering via exchanges:

BTC sale → Buy XMR → Exchange XMR→ETH → Exchange ETH→USDT → Withdrawal

3. Trade-based laundering:

Fictitious NFT purchase at inflated price = laundering via "art sale"

Crypto-Specific Schemes

4. Mixing services:

BTC → Mixer/Tumbler → "Clean" BTC (multiple addresses)

5. Chain hopping:

ETH (Ethereum) → Bridge → AVAX (Avalanche) → Bridge → Arbitrum

6. DeFi obfuscation:

Funds → Liquidity pool → Farming → Harvest → Swap → Cash out

7. Privacy coins:

BTC → Swap XMR → Untraceable transactions → Swap BTC → Clean wallet

High-Risk Indicators

Priority Red Flags:

10. Sanctions and Controls

Fines up to 5 million, authorities don't joke with AML/CFT.

Sanctions Regime

Administrative Sanctions (AMF/ACPR):

Criminal Sanctions:

Authority Controls

Types of Controls:

On-Site Control Process:

1. Notification (few weeks before)
2. Preparatory document submission
3. Inspector arrival (several days)
4. Staff interviews
5. Customer file review
6. Procedure testing
7. Preliminary report
8. Entity observations
9. Final report
10. Possible sanctions

11. FAQ

Practical Questions

Q: What AML/CFT team size for a PSAN?

A: It depends on business volume. As a guide:

• < 10,000 customers: 1-2 dedicated persons
• 10,000 - 100,000 customers: 3-5 persons

• 100,000 customers: structured team (5-15+)

The more automation, the fewer human resources needed for processing, but analysis remains human.

Q: Can I outsource AML/CFT?

A: Partially. Operational tasks (KYC, screening) can be outsourced, but responsibility remains with the PSAN. The compliance officer and decisions must stay internal.

Q: What budget for AML/CFT compliance?

A: Annual estimates:

• Tools (KYC, analytics, screening): €50-200k
• Staff: €100-500k
• Training: €10-30k
• External audit: €20-50k
• Total: €200-800k depending on size

Regulatory Questions

Q: What to do when in doubt about a transaction?

A: In case of serious doubt, report to TRACFIN. It's better to report a false positive than miss a real case. TRACFIN doesn't sanction good faith reports.

Q: Should I refuse a PEP customer?

A: No, being a PEP is not grounds for automatic refusal. Enhanced due diligence applies: source of funds, management approval, increased monitoring. Refusal is only justified if risks are unacceptable.

Q: Should my customers' wallets be monitored continuously?

A: Yes, monitoring must be continuous, not just at onboarding. Blockchain analytics tools enable real-time monitoring of your customers' addresses.

Conclusion

AML/CFT compliance is an essential pillar for any PSAN. It represents a significant but indispensable investment for the company's sustainability and reputation.

Key Points to Remember:

1. Risk-based approach: adapt measures to risk level
2. Rigorous KYC: foundation of the entire framework
3. Continuous monitoring: transactions and behavior
4. TRACFIN reporting: legal obligation when suspicious
5. Documentation: everything must be traced and retained
6. Training: continuous staff awareness

Recommendations for PSANs:

✅ Invest in performant tools (analytics, KYC) ✅ Recruit experienced compliance profiles ✅ Exhaustively document all procedures ✅ Regularly train all staff ✅ Anticipate regulatory developments (AMLR, AMLA) ✅ Consider compliance as a competitive advantage

AML/CFT is not just a constraint: it contributes to crypto sector legitimization and protects the company from reputational and legal risks.

Article updated December 2025. Information presented is educational and does not constitute legal advice. Consult a qualified professional for your specific situation.

Related Articles — Professional Compliance

• MiCA Compliance Preparation
• Travel Rule PSAN Compliance
• PSAN Digital Asset Service Provider