What is compliance in crypto? The rules exchanges must follow
Compliance in crypto means following the laws and rules that apply to crypto businesses: holding the right licence, checking who customers are, watching for money laundering and sanctions breaches, and reporting to authorities. For you as a customer, compliance is the reason an exchange asks for your passport, questions a large deposit, or checks who owns the wallet you withdraw to. In the EU, a crypto exchange that doesn’t comply with MiCA and the anti money laundering rules is not allowed to serve you at all.
What is compliance in crypto?
Crypto compliance is the set of legal duties that crypto firms must meet to operate, and the internal compliance programs they run to meet them. The duties are much the same as for banks and other financial institutions: know your customer, stop financial crimes, and cooperate with regulators.
In practice, regulatory compliance at a crypto exchange covers five areas:
- Licensing. Holding authorisation from a regulatory authority in each market the firm serves. In the EU that is a MiCA licence as a crypto asset service provider (CASP).
- Customer due diligence. KYC, meaning verifying customer identity before you can trade, plus enhanced due diligence for higher-risk customers or large amounts.
- Anti money laundering (AML). Ongoing transaction monitoring to spot illicit activity, and reporting suspicious transactions.
- Sanctions compliance. Sanctions screening of customers and wallet addresses so the firm doesn’t deal with sanctioned entities.
- Investor protection and conduct. Keeping client assets separate, clear fee disclosures, fair marketing and a complaints procedure.
How crypto AML compliance works
Crypto AML compliance works in layers: identify the customer, assess the risk, monitor what happens, and report what looks wrong. Compliance teams at major exchanges combine automated systems with human review.
- Onboarding. You upload ID and a selfie, and answer questions about your job and where your money comes from.
- Risk assessment. The exchange scores you on risk factors such as your country, expected volumes and whether you are a politically exposed person. Higher risk means more questions.
- Screening. Your name is checked against sanctions lists, and wallet addresses are checked with blockchain analysis tools for links to hacks, darknet markets or sanctioned addresses.
- Ongoing transaction monitoring. Deposits, trades and withdrawals are compared with your profile. Sudden large or unusual crypto transactions trigger a review.
- Reporting obligations. If something looks like money laundering, the firm must file a report with the national financial intelligence unit, without telling you.
Every licensed firm has a compliance officer or money laundering reporting officer who is personally responsible for these AML controls. Regulators have fined crypto companies for insufficient transaction monitoring, so firms take it seriously.
An example with euros
Say you open an account at a MiCA-licensed exchange and deposit €500 a month by SEPA transfer to buy bitcoin. That fits a normal profile, and you’ll rarely hear from compliance. Then you deposit €40,000 in one go. Expect the exchange to ask for proof of where the money came from, such as a payslip, a house sale contract or an inheritance statement. Until you answer, the deposit or your account may be on hold.
Later you withdraw €1,500 of bitcoin to your own wallet. Because the amount is above €1,000, the travel rule requires the exchange to check that you control that address, for example with a signed message. If you send it to another exchange instead, your name travels with the transfer.
Crypto regulation in the EU: the frameworks behind compliance
In the EU, crypto compliance rests on three regulatory frameworks. Together they make the EU one of the most detailed regulatory landscapes for crypto and digital assets.
| Rule | What it requires | Applies since |
|---|---|---|
| MiCA (Regulation (EU) 2023/1114) | A licence for crypto services, capital, client asset segregation, disclosure and conduct rules | 30 December 2024; transition ended 1 July 2026 |
| Transfer of Funds Regulation (the travel rule) | Sender and receiver data on every crypto transfer between providers | 30 December 2024 |
| EU anti money laundering rules | KYC, monitoring and reporting for crypto firms | 2020, with a new AML regulation from July 2027 |
Since 1 July 2026, only MiCA-authorised CASPs may provide crypto services in the EU, and ESMA has told unauthorised firms to stop taking on customers. A MiCA licence from one country, such as the Netherlands (AFM) or Germany (BaFin), lets a firm passport its services across the EU.
Tax is becoming part of compliance too. Under the EU’s DAC8 directive, crypto providers have collected customer and transaction data for tax authorities since 1 January 2026.
Outside the EU
Other countries follow the standards of the Financial Action Task Force (FATF), which calls crypto firms virtual asset service providers (VASPs). In the US, exchanges register with the Financial Crimes Enforcement Network (FinCEN) as a money services business under the Bank Secrecy Act. The Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) oversee crypto that counts as a security or commodity, the Office of Foreign Assets Control (OFAC) enforces sanctions, and many states require their own licence. Banking regulators such as the Federal Reserve also oversee how traditional financial institutions deal with crypto businesses.
Why compliance matters to you
Compliance matters to you because it decides whether anyone is accountable when something goes wrong. A licensed, compliant exchange is supervised, has to keep your crypto assets separate from its own, must publish its fees, and must handle complaints. If it breaks the rules, a regulator can step in.
It also has limits you should know:
- Compliance is not a guarantee against losses. Crypto prices can still fall sharply, and crypto-assets are not covered by investor compensation schemes such as the Dutch one, even at a fully licensed firm.
- Your account can be frozen. If compliance teams can’t verify your identity or your source of funds, they can restrict your account until you respond. That is a legal duty, not a punishment.
- Your data is stored. Licensed firms must keep KYC records for years. Choose platforms you trust with your passport scan.
Red flags and pitfalls
The biggest pitfall is trusting a compliance claim you haven’t checked. Some platforms show logos, “registered” badges or licence numbers from other countries that don’t allow them to serve EU residents.
- Check the register yourself. Look the firm up in ESMA’s MiCA register or your national regulator’s list.
- Be wary of “no KYC” offers. An exchange that skips verification for EU residents isn’t compliant, and you have no regulatory oversight to fall back on.
- Watch for fake compliance messages. Scammers send emails claiming your account is frozen “for AML reasons” and ask for a fee or your login. Real exchanges never charge a fee to unfreeze an account. More on this under AML.
Our KYC verification guide explains what to expect when you sign up, and our methodology shows how licence status weighs in our scores.
The bottom line
Crypto compliance is the rulebook that turns an exchange from an anonymous website into a supervised financial business. It costs you a few minutes of paperwork and the occasional question about your money. In return you get a platform that is accountable under crypto regulation, which is the minimum you should expect before trusting anyone with your euros.
Related terms
Questions people ask
Is KYC mandatory for crypto?
Yes, at every licensed crypto exchange in the EU, the UK and the US. You have to verify your identity before you can deposit, trade or withdraw. Self-custody wallets don't require KYC.
How does AML work in crypto?
Exchanges verify who you are, screen you against sanctions lists, monitor your crypto transactions for unusual patterns, and report suspicious transactions to the national financial intelligence unit. Blockchain analysis tools help them trace where coins came from.
Who regulates crypto in the US?
Several agencies share the job. FinCEN enforces anti money laundering rules under the Bank Secrecy Act, the SEC and CFTC oversee crypto that counts as a security or commodity, OFAC handles sanctions, and states license exchanges too.
How can I check if a crypto exchange is compliant?
For the EU, look the company up in ESMA's MiCA register or your national regulator's register, such as the AFM in the Netherlands or BaFin in Germany. A claim on the exchange's own website is not enough.
Can authorities track crypto transactions?
Often, yes. Public blockchains record every transaction, and licensed exchanges link wallet addresses to verified identities, so law enforcement agencies can follow the money with blockchain analysis tools.