First determine which set of rules governs your business
The FATF Recommendations provide international standards, but each jurisdiction must implement them through local regimes; the Recommendations cannot be treated directly as a single list of statutory obligations common to all platforms. For example, the UK FCA applies anti-money laundering registration supervision to money changers and custodial wallet service providers operating in the UK and falling within the relevant scope; registration is not a full financial business license, still less a security endorsement. Where the same company also engages in fiat payment, the payment business rules must be examined separately.
Extend from account opening review to the entire transaction
One should first identify the customer, the persons operating on the customer's behalf, and the beneficial owners behind the enterprise, and then understand the product's use, expected amounts, payees and source of funds. Further verification should be conducted when risk is triggered or local rules require it; the same set of materials should not be mechanically requested for every transaction. On-chain address analysis can provide only part of the evidence and needs to be corroborated against bank credits, orders and customer explanations; the requirement to accompany transfers with transfer information where legally applicable also cannot be replaced by a transaction hash.
A distinction should also be drawn among three categories of subjects: customer accounts, counterparties and cooperating service providers. A customer passing due diligence does not mean that each of its payees or upstream parties has been understood; cooperating with another platform does not mean that the other party's conclusions can be directly adopted. In practice, the purpose of verification, acceptable information and review timing can be recorded separately for different subjects, and transaction monitoring can then be linked to these records. In this way, when an alert arises, the handling personnel can know whether what is missing is identity, authorization or a commercial explanation, without having to ask the entire set of questions again.
Hypothetical scenario: the customer is genuine, yet the transaction may still be anomalous
Assume a trading company that has completed real-name verification normally pays a fixed supplier monthly, and suddenly requests that a large amount of stablecoins be transferred in a dispersed manner to unfamiliar personal wallets. Genuine identity documents cannot explain such a change. The commercial background, payee relationships and authorization of the new transactions may first be checked, and then the matter escalated in accordance with internal procedures; whether to suspend, whether to report, and how much can be explained to the customer should be determined by applicable law and the specific risk, and an anomaly cannot simply be equated with a crime.
Make the regime work in practice
The UK FCA's application guidance examines risk assessment, how policies are translated into day-to-day operations, and arrangements for responsible persons and outsourcing. A more useful approach for startup teams is to designate, for each type of alert, the handler, escalation conditions and evidence requirements, retain the reasons for judgments, and keep records, submit necessary reports and conduct training in accordance with local rules. Before launch, test with real business patterns: whether transactions can be blocked when materials are missing, who can decide in emergencies, and who takes over after a tool failure. A small headcount may justify narrowing the product scope, but reducing costs by leaving alerts unhandled is not advisable.
Recommended actions
- Map the complete flow of funds among customers, wallets, banks and cooperating institutions, and mark the applicable supervisory authority at each stage.
- Establish a customer risk-tiering and anomaly-escalation checklist, and designate authorized responsible persons and alternates.
- Test the process with three types of tests—normal transactions, conflicting information, and anomalous addresses—and record the correction results.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- FATF Recommendations (updated June 2026) — FATF
- Cryptoassets: What we expect to see in your application for registration — UK FCA
- Cryptoassets: AML / CTF regime — UK FCA
