Anti-money-laundering compliance is the set of obligations a regulated financial business — including a licensed crypto derivatives exchange — carries to prevent its platform from being used to move the proceeds of crime or to finance sanctioned activity. It sits alongside KYC: KYC establishes who a customer is at account opening, while AML compliance covers the ongoing monitoring, reporting and screening that continues for as long as the account is active. The obligation exists whether or not any given transaction on the platform is ever connected to actual criminal activity — it is a preventative and reporting duty.
A licensed venue's AML programme typically includes four elements set by the jurisdiction's anti-money-laundering statute:
A venue that fails to run this programme risks losing its licence and facing direct enforcement action from its regulator, which is why AML compliance is treated as a cost of operating. Most modern AML frameworks also direct a venue to apply a risk-based approach: an account showing indicators of higher risk — a jurisdiction with weak AML enforcement, an unusually large or rapid pattern of transfers, or a customer type the venue's own risk assessment flags — receives deeper scrutiny than a standard retail account, while lower-risk activity moves through a lighter process. This is why two customers on the same platform can experience noticeably different monitoring intensity even though both cleared the same nominal KYC tier.
Beyond identifying who a customer is, a venue's AML programme screens where a customer's funds came from, particularly for large deposits or withdrawals, and monitors the pattern of activity on an account for signs — rapid movement of funds through the account, transactions structured to stay under a reporting threshold, or activity inconsistent with the stated purpose of the account — that a compliance team or an automated system is required to flag. This monitoring runs continuously, which is the practical difference between a KYC check and a full AML programme. A pattern the monitoring system flags does not automatically freeze an account; it typically routes to a human compliance reviewer who decides whether the activity warrants a suspicious-activity report, a request for further documentation, or no action at all. That decision, and the underlying report where one is filed, is generally confidential — a customer is not usually told a report has been filed about their account, since disclosing that fact can itself be a separate offence in several jurisdictions.
The Financial Action Task Force's travel rule requires the sending and receiving financial institutions in a transfer above a jurisdiction-specific threshold to exchange identifying information about the originator and the beneficiary of that transfer — the same principle that has applied to a wire transfer between banks for decades, extended to crypto transfers between licensed venues. A transfer that moves from one licensed exchange to another above that threshold typically triggers this exchange of information even where the underlying blockchain transaction itself carries no identifying data. Implementing the rule across the crypto industry has been uneven compared with traditional banking, in part because a blockchain transaction itself carries no built-in field for originator and beneficiary information — the exchange of that information happens through a separate messaging layer between the two institutions' compliance systems, alongside the on-chain transaction.
A centralized, licensed exchange runs its AML programme at the account level, because it has an account to run it against. A wallet-based decentralized exchange has no account in that sense, and the smart contract executing a trade has no mechanism to file a suspicious-activity report or freeze a wallet — the obligation, where it exists at all for a DEX's front end operator, attaches to whichever company runs the interface a trader connects through. See how no-KYC perpetual trading works for how that structural difference plays out in practice.
Separate from the money-laundering programme, a licensed venue screens customers and transactions against government sanctions lists and typically blocks access from jurisdictions its regulator treats as high-risk or from customers whose jurisdiction the venue is not licensed to serve. This is the mechanism behind the geoblocking a trader in a restricted country encounters even before any specific transaction is reviewed. Sanctions lists themselves are maintained by national and multilateral bodies and updated on an ongoing basis, which means a jurisdiction or entity unrestricted at one point can become restricted with little advance notice — a venue's screening system checks against the current list at the time of a transaction. See which countries face access restrictions .
An AML programme is a reporting and monitoring obligation the venue owes to its regulator; it is not a consumer-protection guarantee, and it does not reverse a fraudulent transaction, recover funds sent to the wrong address, or insure an account against a platform's own failure. A trader assessing a venue's legitimacy should treat a functioning AML programme as one signal of regulatory standing.
AML requirements are the obligations a regulated exchange must meet to prevent its platform from being used for money laundering: customer identification, ongoing transaction monitoring, suspicious-activity reporting to a financial intelligence unit, and record retention, all set by the jurisdiction that licenses the venue.
Anti-money laundering is the body of law and compliance practice aimed at preventing criminal proceeds from being disguised as legitimate funds through the financial system. For a licensed crypto exchange, it includes KYC at onboarding plus ongoing monitoring, reporting and sanctions screening for the life of the account.
Perpetual markets for stocks, gold, indices and pre-IPO names — settled on-chain, no wallet-to-exchange transfers.
