Three Myths of Crypto Compliance and the Role of VASPs in Combating Illicit Finance

Key takeaways

• VASPs are critical compliance gatekeepers: Virtual asset service providers (VASPs) now sit at the center of global AML enforcement, holding similar regulatory responsibilities as traditional financial institutions
• Crypto is regulated — globally and growing: Contrary to myth, VASPs face robust AML, KYC, and sanctions obligations in jurisdictions including the US, UK, EU, Singapore, and more
• Blockchain intelligence enhances compliance: VASPs leverage public blockchain data to achieve greater transparency, source-of-funds analysis, and network monitoring than legacy systems allow
• Criminals use crypto — but that’s a feature, not a flaw: Blockchain’s transparency supports law enforcement efforts, often helping trace illicit finance faster and more thoroughly than in fiat systems
• Effective crypto compliance is possible — and powerful: VASPs who integrate blockchain intelligence tools, maintain regulatory rigor, and collaborate with law enforcement are actively disrupting financial crime

{{premium-content_chapter-divider}}

More than two decades have now passed since the 9/11 attacks and the subsequent enactment of the USA PATRIOT Act, a piece of legislation that changed the compliance landscape. The two proceeding decades cemented a paradigm shift in the fight against illicit actors that has reverberated across the globe. Foremost among those shifts was an answer to this question: Who are the gatekeepers to detect and prevent illicit finance? A string of enforcement actions and rhetoric from policymakers thrust banks into the forefront as the pivotal gatekeepers in the post-9/11 era. The narrative of banking evolved from passive management of finances to active first-line defense against illicit finance and terrorist financing.

Fast forward to 2024, and the financial landscape is witnessing another evolution with the rise of digital assets, bringing new intermediaries of economic activity. This evolution has introduced a new set of gatekeepers: Virtual Asset Service Providers (“VASPs”). In 2023, the crypto industry and VASPs experienced the largest penalties and enforcement actions ever imposed on its sector, which also included criminal charges against two of its largest CEOs. Coupled with the collapse of FTX, the past two years highlighted VASPs crucial position at the intersection of innovation and regulatory compliance.

As VASPs look to turn the page from the events of the last several years, their execution of compliance obligations have drawn the interest of traditional financial institutions and an increasing number of global regulators. This article looks to summarize what those obligations look like while dispelling several myths about crypto compliance. We’ll look to outline the pivotal role that VASPs play in the arena of financial crime mitigation and underscore how VASPs act as gatekeepers to the digital asset ecosystem with the use of blockchain intelligence.

{{three-myths-of-crypto-compliance-and-the-role-of-vasps-in-combating-illicit-finance-call-out-1}}

While much commentary has been devoted over the years to calling crypto “The Wild Wild West '', the reality is that in many jurisdictions, VASPs have long been held to AML and sanctions obligations. In the U.S., for instance, VASPs are money service businesses and subject to the same AML and sanctions laws as any other institution under the Bank Secrecy Act. In the United Kingdom, VASPs must comply with the Money Laundering, Terrorist Financing, and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), amended in 2020 to include crypto-asset exchange providers following the passage of 5AMLD. In Singapore, VASPs are regulated under the Payment Services Act and regulated by the Monetary Authority of Singapore.

These regulatory obligations may vary slightly between jurisdictions, but generally, what this means is that VASPs are required to be appropriately licensed in their respective jurisdiction, have a customer identification program (i.e. KYC), monitor customer transactions, prohibit interactions and transactions with sanctioned entities, and report suspicious activities.

In addition to those traditional obligations, many countries are creating additional regulatory frameworks and obligations specifically for VASPs. For instance, the Markets in Crypto-Assets Regulation (MiCA) is the European Union's comprehensive regulatory framework aimed at ensuring consumer protection, market integrity, and financial stability in the crypto-assets sector. Singapore will also be implementing investor protection measures and is consulting on market integrity requirements. Some countries and international standard setters have already passed these frameworks into law, with many more countries actively developing these additional obligations. Moreover, it should be noted that some crypto businesses have lobbied for and long supported regulation for VASPs. For instance, Circle, who issues the USDC stablecoin, has applauded various aspects of stablecoin legislation and called on Congressional leaders to pass bills that would place additional obligations on crypto-asset issuers.

{{premium-content_chapter-divider}}

Crypto regulation around the world

We look at the state of crypto regulation across 21 jurisdictions representing about 70% of global crypto exposure.

{{three-myths-of-crypto-compliance-and-the-role-of-vasps-in-combating-illicit-finance-call-out-2}}

While the AML compliance requirements are very similar between VASPs and traditional institutions, some policymakers and public critics have decried digital assets as not only being the asset of choice for criminal actors, but suggest that one can’t mitigate illicit finance risks in this space. Core to those arguments is the notion that blockchain technology enables both licit and illicit users to quickly transfer large amounts of value peer-to-peer, pseudonymously, across borders, and without the ability to reverse transactions.

While those inherent properties of blockchain technology do enable new risks, they also unlock counter measures and risk mitigation techniques that are not possible in traditional AML programs. VASPs have a unique combination of data points that underpin their AML/CFT and sanctions programs that provide the capability for enhanced and effective monitoring of illicit finance. Not only do they have customer data via KYC processes and internal trade and transaction data—both of which are available to traditional AML programs—but they also have the visibility of public blockchain transactions. The immutable and transparent nature of blockchain provides VASPs with advanced tools for detailed source of wealth/funds and network analysis, extending far beyond the confines of traditional financial systems.

Enhanced source of funds analysis

One of the key advantages offered by blockchain technology is the ability to conduct granular and expansive source of funds analysis. This process involves tracing the origins of digital assets, enabling VASPs to identify the initial deposit and follow the trail of transactions, even when bad actors use complex methods of obfuscation. Blockchain intelligence tools are instrumental in this context. Consider the following example where a customer attempts to deposit funds at their VASP account.

{{premium-content_chapter-divider}}

Network analysis beyond platform boundaries

Another significant opportunity related to enhanced source of wealth/funds analysis is the ability to perform network analysis that extends beyond a VASP’s immediate platform. This includes analyzing the ultimate source of funds for deposits and the final destination of withdrawals, but it also allows VASPs to monitor whether their customers are engaged in suspicious transactions elsewhere on the blockchain, such as structuring deposits across multiple institutions. This broader scope of analysis is vital in painting a holistic picture of a customer’s transaction activities. It empowers VASPs to act not just as isolated entities but as integral parts of a larger network fighting against financial crimes. Moreover, there are a variety of ways that VASPs may go about executing on these enhanced capabilities, apart from the standard KYC and transaction monitoring processes.

One example is an effective approach used by a highly specialized investigative team at Coinbase. Kristen Spaeth is a manager on the Global Intelligence team at Coinbase and is a former Cybercrime Analyst from the Manhattan District Attorney’s Office. Spaeth described a process of intelligence sprints where her team takes a very specific threat or illicit network and runs proactive queries and on-chain reviews to target and identify high quality investigative leads. These proactive sprints help financial crime teams pivot, adapt and target evolving criminal tactics and provide additional opportunities to collaborate with law enforcement efforts on timely threats.

{{three-myths-of-crypto-compliance-and-the-role-of-vasps-in-combating-illicit-finance-call-out-3}}

While illicit actors are increasing their use of crypto into laundering schemes, law enforcement is becoming increasingly adept at disrupting those operations with the assistance of VASPs. By virtue of their positioning at the nexus of fiat and digital assets, VASPs have unique visibility and significant responsibilities in helping disrupt illicit financial flows. They are uniquely situated to play an active and important role due to two factors:

1. “All roads lead to VASPs”: Much of the crypto economic activity, be it in DeFi or more centralized financial applications, ultimately ends with VASPs. This is true of both legitimate and illegitimate actors.
2. VASPs enable linking on-chain activity to real-world entities. While the blockchain provides complete visibility into on-chain transactions, and blockchain intelligence can aid in connecting addresses to entities, they don’t natively link addresses and transactions to real-world entities and individuals. VASPs collecting customer due diligence and other forms of KYC-data make that critical linkage.

The disruption of illicit financial networks is enhanced as VASPs collect, retain, and monitor crucial transactional data that is then passed on to law enforcement. This data includes transaction histories, wallet addresses, a complete view of the portfolio of assets and other relevant information that can link digital assets to specific entities. When suspicious activities are detected, VASPs are required to file Suspicious Activity Reports (SARs) with relevant authorities, just as their traditional counterparts do. These reports are vital in providing law enforcement agencies with actionable intelligence that can lead to the disruption of criminal networks.

{{premium-content_chapter-divider}}

Case study involving Islamic State

Many VASPs, including the largest exchanges, are increasingly collaborating with law enforcement and regulatory bodies to combat financial crimes like money laundering and terrorist financing. Former IRS-Criminal Investigation Special Agent Tigran Gambaryan now leads Binance’s Global Intelligence and Investigations unit. In describing the efforts in working with law enforcement, Gambaryan noted that in 2022, his team responded to over 50,000 law enforcement requests worldwide.

It is also noteworthy that many of these collaborations are proactively initiated by VASPs as they identify threat networks. In 2023, Binance contributed to global counterterrorism efforts, particularly against the Islamic State – Khorasan Province (ISKP). Members of the ISKP were actively planning and involved in imminent attacks across the region. Collaborating with Tajikistan authorities and TRM Labs, Binance's Sanctions Investigations and Compliance teams played a vital role in the arrest of members by providing essential intelligence and investigative support in identifying, locating, and sharing crucial information leading to the disruption. The joint operation also aided in arresting multiple key members of ISKP, including high-ranking members.

It is these types of efforts that demonstrate that many VASPs are increasingly recognizing the unique role they have in disrupting national security and illicit finance threats and are putting resources not just behind basic compliance operations such as KYC, transaction monitoring and suspicious activity reporting, but also more proactive investigation and intelligence units that work closely with law enforcement efforts.

{{premium-content_chapter-divider}}

Challenges confronting VASPs

While VASPs are equipped with innovative tools provided by blockchain technology, they also face significant challenges in their operations. These challenges include the inability to block unsolicited blockchain transactions, the need to adapt to evolving obfuscation techniques used by criminals, and the complexities of navigating intensified regulatory oversight.

Inability to block unsolicited blockchain transactions

This issue stems from the fundamental design of decentralized networks, where a protocol allows any external address to transfer assets to another address without needing the recipient's permission or intervention. In public blockchain networks, transactions are validated and recorded on a distributed ledger through a consensus mechanism, such as proof-of-work or proof-of-stake. These mechanisms ensure the integrity and irreversibility of transactions but do not provide any mechanism for recipient consent.

This technical limitation poses several challenges for VASPs including potential exposure to illicit funds from nefarious or sanctioned actors. To manage the risk associated with unsolicited transactions, VASPs implement a combination of procedures, omnibus accounts, and monitoring systems. These systems are designed to quickly identify and flag suspicious transactions, even if they are unsolicited and, upon detection, allow VASPs to undertake a series of actions that may include enhanced customer due diligence, transaction tracing, internal risk assessment, and, if warranted, the freezing of funds or filing of SARs.

Adapting to new obfuscation techniques by criminals

Irrespective of whether criminal networks use fiat or crypto, they are continually adapting their methods to evade detection. More commonly known tactics include the use of mixing services and privacy coins. But the use of fast digital technologies enables additional, more sophisticated techniques that can be harder to identify.

For instance, FinCEN’s most recent Notice of Proposed Rulemaking on mixing services highlighted some of these sophisticated obfuscation techniques. By leveraging multiple wallets, addresses, assets and code, sophisticated criminal groups can engage in “programmatic money laundering” to create a complex flow of funds that is exceptionally challenging to follow manually and time consuming to trace.

For AML programs to be effective, the sophistication of controls have to match the sophistication level of bad actors. Recognizing this need for continual compliance adaptation, TRM pioneered Crypto AML SIGNATURES®, a technology that enables compliance teams to automatically detect patterns of transactions on the blockchain that may be emblematic of obfuscation techniques. These patterns are sourced from known money laundering typologies, criminal cases, sanctions evasion techniques and other forms of on-chain obfuscation that are monitored by intelligence-focused, threat hunting teams.

Navigating intensified regulatory oversight

VASPs also face the challenge of intensified regulatory scrutiny. For instance in 2023, the U.S. Commodity Futures Trading Commission filed 96 enforcement actions, nearly half of those were against digital asset commodity firms. Similarly, the U.K.’s Financial Conduct Authority recently undertook a review of 44 crypto firms and noted that they “found significant levels of non-compliance without rules.”

Regulators have moved well beyond considering whether they should regulate crypto—the question now is how. As regulators become more familiar with this industry and blockchain technology, the future of regulatory scrutiny may come in the form of real-time supervision. Here, regulators will be able to leverage blockchain intelligence-driven risk insights to carry out their licensing and examination mandates. For VASPs, these challenges will be coupled with a shifting regulatory landscape where nuanced differences emerge between the United States, EMEA and APAC regions.

{{premium-content_chapter-divider}}

Conclusion

Despite the challenges posed by new digital assets and the complexities of blockchain technology, VASPs have emerged as crucial gatekeepers in the fight against financial crimes. Their unique position, equipped with advanced tools and emerging regulatory frameworks, has the potential to enable a more effective approach to AML compliance, if implemented correctly. As VASPs continue to increase their compliance efforts, their collaboration with traditional financial institutions and law enforcement bodies will be paramount to detecting and preventing illicit finance at scale in the emerging financial system.

{{premium-content_chapter-divider}}

Frequently asked questions (FAQs)

1. Are cryptocurrencies unregulated?

No. In most jurisdictions, VASPs are subject to existing anti-money laundering (AML) and sanctions regulations, just like banks or other financial entities.

2. What is a VASP?

A virtual asset service provider (VASP) is any entity that facilitates the exchange, custody, or transfer of crypto assets. VASPs are subject to compliance laws and increasingly seen as essential gatekeepers in the fight against illicit finance.

3. Can blockchain really help combat illicit finance?

Yes. Blockchain’s transparency enables forensic tracing of funds, pattern detection, and real-time intelligence gathering — offering unique advantages over traditional financial monitoring.

4. Why are VASPs important to law enforcement?

Because most crypto transactions flow through them, VASPs provide a critical link between pseudonymous blockchain data and real-world identities via Know Your Customer (KYC) and transaction monitoring.

5. Is crypto really the preferred tool of criminals?

Illicit actors use crypto to transfer value quickly — but law enforcement has blockchain analytics. The immutable nature of blockchain makes it easier to trace suspicious activity compared to cash or traditional methods.

6. What are some global crypto compliance frameworks?

Examples include MiCA in the EU, MLR 2017 in the UK, the Payment Services Act in Singapore, and the Bank Secrecy Act in the US.

7. What tools do VASPs use to detect illicit activity?

VASPs use blockchain intelligence platforms like TRM Labs, KYC systems, behavioral signatures, and network-level analysis to flag risks and generate leads for enforcement.

8. How do unsolicited blockchain transactions affect VASPs?

Since anyone can send crypto to any address, VASPs must monitor and manage exposure to illicit funds using internal risk protocols and transaction tracing.

9. What is “programmatic money laundering”?

It refers to the use of automated, layered, and obfuscated techniques on-chain — like mixers and chain-hopping — to obscure the origin of funds. Tools like TRM's Signatures® are built to detect these patterns.

10. How does TRM support VASPs and law enforcement?

TRM provides a blockchain intelligence platform that includes transaction tracing, risk detection, and real-time investigation support. These tools empower compliance teams and public sector investigators to trace illicit activity and reduce risk exposure.

{{premium-content_chapter-divider}}

About TRM Labs

TRM Labs provides blockchain analytics solutions to help law enforcement and national security agencies, financial institutions, and cryptocurrency businesses detect, investigate, and disrupt crypto-related fraud and financial crime. TRM’s blockchain intelligence platform includes solutions to trace the source and destination of funds, identify illicit activity, build cases, and construct an operating picture of threats. TRM is trusted by leading agencies and businesses worldwide who rely on TRM to enable a safer, more secure crypto ecosystem.

TRM is based in San Francisco, CA, and is hiring across engineering, product, sales, and data science. To learn more, visit www.trmlabs.com.