Compliance and controls for crypto firms as regulation turns into supervision

a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}

Why compliance and controls now define crypto risk

Compliance and controls are no longer a back-office checklist for crypto firms. As of September 29, 2026, the supervisory direction is clear: regulators want evidence that a firm can identify its customers, screen sanctions risk, monitor transactions, protect client assets, manage conflicts, document decisions and remediate failures. The European Union’s MiCA regime is fully applicable, FATF continues to press jurisdictions on virtual asset supervision, and the United States has enacted a federal payment stablecoin framework while agencies continue implementation. The practical conclusion is straightforward: policies still matter, but provable control execution matters more.

For exchanges, custodians, brokers, payment stablecoin issuers, wallet providers and token platforms, the key question is not whether a compliance policy exists. It is whether that policy is connected to risk assessments, system rules, trained staff, logs, escalation paths, board reporting and audit-ready evidence. That shift is central to modern crypto Regulation and Compliance coverage because it affects how firms budget, hire, select vendors and decide which products can safely launch.

The regulatory baseline has become more operational

Crypto regulation used to be discussed mainly as a classification issue: Is a token a security, commodity, payment instrument, e-money token or something else? Classification still matters, but supervisors are increasingly focused on how firms operate in practice. FATF’s Recommendation 15, updated in 2019 for virtual assets and virtual asset service providers, remains the global AML/CFT anchor. FATF’s July 16, 2026 targeted update described continued progress in licensing, registration, Travel Rule implementation and supervisory action, while also pointing to remaining gaps across the global network.

In the EU, MiCA created a harmonized framework for crypto-asset service providers and issuers of certain crypto-assets. Its stablecoin-related provisions began applying in 2024, and the broader CASP regime became fully applicable on December 30, 2024, with transitional arrangements available in some circumstances until July 1, 2026. MiCA is not only about authorization. It requires governance, complaints handling, recordkeeping, conflicts management, prudential safeguards, market integrity expectations and operational resilience.

The EU Transfer of Funds Regulation also extended Travel Rule-style requirements to crypto-asset transfers from December 30, 2024. In practical terms, affected providers must collect, transmit and verify originator and beneficiary information, including controls for transfers involving self-hosted addresses where required. This brings identity, wallet risk and transaction monitoring controls closer together.

In the United States, FinCEN has long treated many administrators and exchangers of convertible virtual currency as money services businesses subject to Bank Secrecy Act duties. OFAC’s virtual currency sanctions guidance, published in October 2021, remains a key sanctions compliance reference. The GENIUS Act, enacted on July 18, 2025, created a federal framework for payment stablecoins; 2026 agency proposals addressed prudential standards, AML/CFT obligations, sanctions programs and customer identification. Broader U.S. market-structure questions remain jurisdiction-specific, but stablecoin, AML and sanctions controls are no longer optional planning topics.

What a crypto control framework should cover

A strong control framework starts with a plain inventory of regulated activity. A firm should know which legal entities perform custody, exchange, transfer, brokerage, issuance, staking, lending, market making, fiat settlement, token listing, wallet software, on-chain analytics or customer support. It should then map those activities to jurisdictions, licenses, exemptions, counterparties, vendors and customer segments.

That inventory should feed a risk and control matrix. The matrix does not need to be complex at first, but it should identify each material risk, the rule or obligation behind it, the control owner, the system used, the evidence produced, the test frequency and the escalation path. This is where compliance becomes operational. A policy that says “we screen customers” is weak on its own. A control that shows screening sources, match rules, reviewer decisions, false-positive handling, blocked-account logs and periodic model tuning is much stronger.

The best frameworks borrow from established control models without pretending that crypto is identical to banking. COSO’s five internal-control components are useful for governance and audit structure: control environment, risk assessment, control activities, information and communication, and monitoring. NIST’s Cybersecurity Framework 2.0 is also relevant because it places “Govern” beside Identify, Protect, Detect, Respond and Recover. For crypto firms, governance and cybersecurity are closely linked because private keys, smart contracts and privileged access can create direct financial loss.

AML, sanctions and Travel Rule controls need more than screening

AML and sanctions controls are often described as “screening,” but that term is too narrow. A crypto firm needs controls across the full customer and transaction lifecycle. Onboarding should establish who the customer is, who owns or controls the customer, what activity is expected, which jurisdictions are involved, whether the customer uses mixers or other high-risk services, whether there is sanctioned exposure, and whether enhanced due diligence is needed.

For retail users, the control design may focus on identity verification, device intelligence, IP risk, sanctions screening, source-of-funds triggers and behavioral monitoring. For institutions, it should include beneficial ownership, authorized traders, wallet ownership, corporate structure, source of wealth, counterparties, geographic exposure and licensing status. For self-hosted wallet transfers, firms should define when they collect ownership information, when they verify control, when they decline a transfer and when they escalate for review.

Transaction monitoring should combine fiat and blockchain data. Rule sets may cover rapid in-and-out movement, structuring, exposure to darknet markets, ransomware-linked addresses, sanctioned wallets, mixers, chain-hopping, high-risk bridges, newly created wallets, unusual stablecoin flows and account takeover indicators. No blockchain analytics tool is perfect, so the control should include model governance, vendor oversight, alert tuning and independent quality assurance.

The Travel Rule adds a data-quality problem. Firms need to validate originator and beneficiary information, manage counterparty VASP due diligence, reject or hold transfers when required information is missing, and protect personal data in transmission. A Travel Rule program that buys a messaging tool but does not maintain counterparty risk scoring, exception handling and audit trails is incomplete.

Custody, reserves and operational resilience are compliance issues

Crypto custody controls are not merely technical safeguards. They are compliance controls because client assets can be lost through poor governance, weak access control, unclear segregation, vendor failure or emergency processes that override normal approvals. Supervisors are likely to ask who can initiate a transfer, who can approve it, what limits apply, how hot and cold wallets are separated, how addresses are whitelisted, how keys are generated, how backups are protected and how exceptions are reviewed.

Sound custody programs use separation of duties. The person who requests a movement should not be the only person who approves it. Privileged access should be time-limited, logged and reviewed. Wallet balances should be reconciled to customer liabilities and internal ledgers. Smart contract upgrades, staking operations and bridge interactions should go through change management, testing and rollback planning. Emergency withdrawals should be documented in advance, not invented during a crisis. See also: Blockchain Technology.

Stablecoin controls deserve separate attention. A payment stablecoin or e-money token control program should cover reserve eligibility, reserve segregation, concentration limits, redemption timing, liquidity stress, public disclosures, attestations, complaints, sanctions controls and customer communications. The GENIUS Act implementation process in the United States and MiCA’s requirements in the EU both point toward more formal reserve, redemption and governance expectations. A stablecoin issuer should also avoid marketing language that suggests deposit insurance or bank-like protection where that protection does not apply.

Operational resilience links these areas. Under MiCA and the EU’s digital operational resilience framework, CASPs need systems and procedures that address ICT risk, continuity and incident management. Even outside the EU, regulators and counterparties increasingly expect tested incident response, vendor due diligence, disaster recovery, penetration testing, vulnerability management and board reporting. A crypto firm that cannot restore systems, explain an outage or preserve evidence after an incident will struggle to show control maturity.

Disclosure, conflicts and market integrity controls protect trust

Financial crime controls are only part of the picture. Crypto firms also need controls for disclosures, token listings, conflicts of interest, market abuse, complaints and marketing. MiCA requires crypto-asset service providers to maintain complaints procedures and conflict-of-interest arrangements, and it expects clear information to clients. Securities and consumer protection regimes in other jurisdictions apply similar logic even when the legal labels differ.

A listing control should ask whether the asset has an identifiable issuer, what disclosures are available, whether the token has special rights or restrictions, whether insiders hold large allocations, whether smart contracts have been audited, whether liquidity is concentrated, and whether the asset creates sanctions, privacy or market manipulation concerns. The outcome should be documented. If a listing committee approves a high-risk asset, the file should explain the rationale, conditions and monitoring plan.

Marketing controls are equally important. Claims about yield, reserves, staking rewards, safety, insurance, decentralization or regulatory approval should be reviewed before publication. Social media posts, influencer campaigns and app-store descriptions can create regulatory risk if they overstate protections or omit material limitations. Complaints data should feed compliance monitoring because recurring complaints may reveal a control failure before a regulator does.

How to build an audit-ready control program

An audit-ready program does not mean every firm needs a bank-sized department. It means the firm can show how risks are identified, how controls operate, who owns them, how exceptions are handled and how management knows whether the controls work. Smaller firms can begin with a concise control library and expand as products, volumes and jurisdictions grow.

1. Define the regulated activity map. Identify each product, legal entity, customer type, jurisdiction, asset type and third-party dependency.
2. Create a risk and control matrix. Link each obligation to a named control, owner, system, evidence source and testing cadence.
3. Separate first, second and third-line responsibilities. Product and operations teams own daily control execution; compliance and risk oversee; internal audit or independent reviewers test.
4. Use measurable control indicators. Track overdue KYC reviews, unresolved sanctions alerts, Travel Rule exceptions, failed reconciliations, wallet-limit breaches, incident response times and complaint trends.
5. Document exceptions and remediation. A failed control is not automatically a crisis if the firm detects it, escalates it, fixes it and prevents recurrence.
6. Report to leadership. Boards and senior managers should receive clear, periodic reporting on key risks, control failures, regulatory changes and remediation progress.

The most common weakness is fragmentation. AML may sit in one tool, custody approvals in another, sanctions decisions in spreadsheets, complaints in customer support software and board reporting in slide decks. Fragmentation is not always avoidable, but firms should be able to connect the evidence. If a suspicious wallet triggers an alert, the investigator should be able to see customer history, prior alerts, related addresses, withdrawal controls and final reporting decisions.

Frequently asked questions

What is the difference between compliance and controls?

Compliance is the obligation to follow laws, regulations, standards and internal policies. Controls are the specific processes, approvals, systems, records and reviews that make compliance happen. In crypto, a sanctions policy is compliance documentation; wallet screening, alert review, blocked-transfer logs and periodic testing are controls.

Which crypto firms need the strongest compliance controls?

Any firm that holds client assets, moves value, issues stablecoins, operates an exchange, serves customers across borders, lists tokens, provides custody or interfaces with fiat rails needs strong controls. The exact obligations depend on jurisdiction and business model, but the direction of supervision is toward more evidence, not less.

Is blockchain analytics enough for AML compliance?

No. Blockchain analytics can support wallet risk detection, sanctions screening and investigations, but it does not replace customer due diligence, Travel Rule processes, fiat monitoring, human investigation, suspicious activity reporting, vendor governance or independent testing.

How often should crypto controls be tested?

High-risk controls such as sanctions screening, private-key access, transaction monitoring, reconciliations and stablecoin reserve reporting should be tested frequently and after material system changes. Lower-risk controls may be tested periodically. The testing schedule should reflect product risk, transaction volume, regulatory requirements and past failures.

Do DeFi projects need the same controls as centralized platforms?

Not always, but DeFi teams should not assume that decentralization removes all compliance risk. Front-end operators, governance participants, treasury managers, custodians, token issuers and service providers may face obligations depending on their role and jurisdiction. At minimum, DeFi projects should evaluate sanctions exposure, admin-key risk, disclosures, smart contract controls and governance transparency.