Crypto and anti-money-laundering rules: FinCEN, KYC and the travel rule

Crypto companies are subject to the same kind of anti-money-laundering (AML) law as banks and money transfer firms. They must identify customers, watch for suspicious activity and share certain details when crypto moves between companies.

What does US law require?

The main law is the Bank Secrecy Act, enforced by the Treasury's Financial Crimes Enforcement Network, known as FinCEN. In guidance issued in May 2019, FinCEN said a business that exchanges or transmits crypto for other people is a money transmitter, a type of money services business. That covers most crypto exchanges and custodial wallet providers.

Such a business must:

• register with FinCEN,
• run a written AML program,
• verify who its customers are, a step known as KYC, short for "know your customer",
• keep records and file reports on large cash transactions and suspicious activity.

A person who uses crypto to buy goods or services for themselves is not a money transmitter.

What is the travel rule?

The travel rule requires a financial business to pass along information about the sender and the recipient when it transmits funds for a customer. In the US it applies to transfers of $3,000 or more, including transfers in crypto.

The Financial Action Task Force (FATF), the body that sets global AML standards, extended the same idea to crypto firms in 2019. In a progress report in July 2026, FATF said countries had moved forward but that significant gaps remain in licensing and supervision. It pointed to fraud by organized crime groups, misuse of stablecoins and offshore firms as growing risks.

How do sanctions apply?

The Treasury's Office of Foreign Assets Control (OFAC) bars US persons from dealing with sanctioned people, groups and countries, and that includes crypto transactions.

How far sanctions reach into software is contested. OFAC sanctioned the mixing service Tornado Cash in August 2022. A federal appeals court ruled in November 2024 that the service's self-running smart contracts were not property that could be blocked, and the Treasury removed the listing in March 2025.

What about personal wallets and privacy?

The duties above fall on intermediaries. A non-custodial wallet, where the user holds the keys, has no company behind it to run checks.

On October 5, 2026, FinCEN withdrew two proposals that would have reached further, according to press reports. One, from 2020, would have required banks and exchanges to verify and report larger transfers to self-custody wallets. The other, from 2023, targeted mixers, which pool funds from many users to hide where they came from.

The debate continues. Law enforcement agencies say identity checks are how crypto gets traced to criminals. Privacy advocates say the rules collect sensitive data on millions of lawful users and create targets for hackers.

Rules differ by country and state and change often. Check the regulator's website or a qualified professional for a specific case.