Crypto AML compliance: what a business that accepts crypto actually has to do

If you sell your own goods or services and take crypto as payment, crypto AML compliance usually does not mean a licence or an in-house compliance team. The heavy anti-money-laundering duties fall on the businesses that hold and move crypto for other people: exchanges, custodians and payment processors. What reaches you is shorter and very practical: don't deal with sanctioned people, don't take money you have reason to think is dirty, keep your records, and receive payments through a service that screens them before they land.

What AML means in crypto, and how it differs from KYC

AML stands for anti-money laundering. It is the set of rules and habits that stops criminal money from passing through a business and coming out looking clean. A business that has to follow AML rules does five things:

• Knows its customer. It checks who the person is before doing business with them.
• Screens the money. It checks where the funds come from before accepting them.
• Watches transactions. It notices activity that does not fit what the customer said they do.
• Keeps records. It holds on to who paid what, when and for what.
• Reports suspicions. It tells the authorities about transactions that look like laundering.

Crypto changes the second part most. Every transfer is recorded on a public blockchain, so anyone can follow the coins on an address several steps back. That is why crypto AML leans on address screening: software traces the history of the sending wallet and shows whether it has touched a sanctioned address, a darknet market or the proceeds of a hack.

KYC, short for "know your customer", is the first of those five parts. It answers a single question, who this person is, usually by checking an ID document. AML is the whole system around it.

The simplest way to keep them apart: KYC looks at the person, while AML screening also looks at the money. A customer with a perfectly clean passport can still pay from an address full of stolen coins, and a check of the person alone would never show it. If you have been asked for documents yourself and want to know what that check involves, here is what KYC in crypto is and why exchanges ask for your ID.

Which crypto AML requirements apply to your business

AML law does not ask whether you touch crypto. It asks what your business does with other people's money. Most sellers are in one of three positions, and the duties differ a lot between them.

You sell your own goods or services and get paid in crypto

Say you sell an online course and a customer pays for it in USDT. You are the final recipient of the money, the same way a shop is when a customer pays by card. In the markets described below, the formal AML programme in this case sits with the service that processes the payment, not with the shop.

That does not leave you with nothing to do. Sanctions still apply to you directly, and so does the plain rule against knowingly accepting criminal money. But in those markets, taking crypto for your own goods does not by itself turn you into one of the businesses that must run transaction monitoring and file reports to the authorities.

You hold or move crypto for other people

The picture changes when money passes through you on its way to someone else. In the markets below, these are the models that can need a registration or a licence, and a full AML programme with it:

• Marketplaces that pay sellers. They collect money from buyers and pass it on, minus a commission.
• Platforms that keep balances for users. The crypto on those balances belongs to the users, not to the platform.
• Swap services. They exchange one coin for another, or crypto for dollars and euros, on behalf of customers.

The line is not always obvious. A platform that takes a commission and pays the rest on to sellers can end up holding customer money for days without anyone ever deciding that it should. If that is your model, the question of who holds whose money comes first, and it shapes both the legal side and the mechanics of taking crypto on a marketplace and paying out to sellers.

Your sector has its own AML rules

Some businesses carry AML duties because of what they sell, and those duties do not depend on how the customer pays. As of October 2026, two sectors show it clearly:

• Casinos. They are covered by AML law in the US, the EU and the UK.
• Art dealers. In the EU they are covered on deals of €10,000 or more under the AML directive (Directive 2015/849, as amended in 2018); in the UK, art market participants have been on the list of the Money Laundering Regulations 2017 since 2020.

For these businesses, crypto does not replace the obligations; it adds to them. A casino that takes USDT still identifies its players and watches their deposits under its licence. On top of that, it needs to screen the addresses the money comes from, because a verified player can still deposit coins with a bad history. If gambling is your business, the payment side starts from the licence, and here is how iGaming payment processing is set up in 2026.

How the US, the EU and the UK draw the line

Here is where the formal duties sit in three large markets:

• United States. FinCEN, the Treasury bureau that enforces anti-money-laundering law, set out its crypto rules in guidance in March 2013 and restated them in May 2019. A person who simply uses crypto to buy goods or services is a "user", not a money services business. The money-transmitter duties fall on exchangers and administrators, including a processor that stands between a buyer and a seller.
• European Union. Under the current AML directive (Directive 2015/849, amended in 2018), sellers of goods outside special sectors such as gambling and art are covered only when they take cash payments of €10,000 or more. Since 30 December 2024, crypto-asset service providers, the EU's term for licensed crypto businesses, have had to send sender and recipient details along with crypto transfers. From 10 July 2027, a directly applicable EU regulation (Regulation 2024/1624) takes over, adds more types of business to the list and caps cash payments at €10,000.
• United Kingdom. The FCA registers two kinds of crypto business under the Money Laundering Regulations: cryptoasset exchange providers and custodian wallet providers, which keep crypto or private keys for customers. A shop selling its own goods for crypto is neither.

The EU rules still reach a seller in two indirect ways:

• Questions at the customer's exchange. A customer paying you from a European exchange may be asked whose address they are sending money to, because the exchange has to record it.
• Which stablecoins are on offer. Since 30 June 2024, the EU's crypto law, MiCA, has decided which stablecoins crypto businesses in the EU may offer, which in turn shapes which stablecoins a business in Europe can accept after MiCA.

Sanctions: the rule that applies to everyone

Even where no AML programme is required of you, sanctions law is. In the US, OFAC, the Treasury office that runs sanctions, says in its digital currency FAQ (updated in October 2021) that sanctions obligations are the same whether a payment is made in crypto or in dollars. The same answer names businesses that engage in online commerce among those responsible.

In practice, a US person must not deal with anyone on the sanctions list, and OFAC publishes specific crypto addresses next to some of the names on it. Other countries keep their own sanctions lists, and a seller should know which ones apply where it is registered and where it trades.

Here is how that plays out. A customer pays 3,000 USDT for a year of software from an address that appears on a sanctions list. Nothing in the transfer warns you: the coins arrive like any others, and the order shows as paid. The only way to know is to check the sending address, which is exactly what payment screening is for.

Tainted crypto: what it is and what happens when it reaches you

Tainted crypto is coins whose history leads back to crime: a hack, ransomware, a darknet market, a sanctioned exchange, or a mixer, a service that blends many users' coins to hide where they came from. The coins themselves look the same as any others. The taint is in the public record of where they have been.

Analytics companies turn that record into a risk score for each address: a grade that reflects how much of its money came from flagged sources and how directly. A wallet that received coins straight from a hack is treated as riskier than one that sits ten transfers away. What goes into the grade, and why two services can score the same address differently, is laid out in how crypto risk scores and AML wallet checks work.

Picture a customer who buys a 2,000 USDT software licence. Their USDT came from an address that, two transfers earlier, received money from a hacked exchange. The customer may know nothing about it, and the trail still runs through your address now.

Here is what can follow from a payment like that:

• The exchange holds your deposit. When you send the money to an exchange to convert it, the exchange's screening flags the deposit and holds the funds while it asks where they came from.
• Your account gets a closer look. One flagged deposit can end with a few questions; a pattern of them can end with a limited or closed account.
• Your bank asks for the source. When the money finally reaches a bank account as dollars or euros, the bank may want to see the orders behind it.

A flag is not a verdict on you. It means you now have to show that it was an honest sale, and the further the money has travelled since, the harder that gets.

What to do if a flagged payment has already reached you

If an exchange or a payment service has already flagged money you received, these steps keep a bad situation from getting worse:

1. Leave the coins where they are. Moving flagged coins to another wallet or swapping them for another coin adds steps to the trail and can look like an attempt to hide it.
2. Collect the order record. Keep the invoice, what was sold and delivered, the customer's contact details and the transaction hash, which is the ID of the transfer on the blockchain.
3. Answer the exchange or payment service in full. A real order with proof of delivery is the strongest evidence that you were paid in good faith.
4. Agree any refund with the service that holds the money before sending anything. Sending coins back on your own can mean paying a sanctioned address, which the sanctions rules above forbid.
5. Talk to a lawyer when the amount is large or the address is on a sanctions list. Legal advice costs money, but a wrong move with sanctioned funds costs more.

How payment screening works before money reaches your balance

Most sellers do not run blockchain analytics themselves; they get it through their payment service. A crypto payment gateway sits between the customer's wallet and your balance: it issues the invoice, watches the network and credits you when the payment arrives. If that setup is new to you, start with how a crypto payment gateway helps a business accept crypto.

Screening adds one step to that chain. Before crediting a payment, the service checks the address it came from. A clean payment goes through as usual; a flagged one is held while the service looks into it.

The timing is what matters for you. A payment caught at the door has not mixed with the rest of your balance yet, so the problem stays the size of one payment. Caught weeks later at an exchange, the same payment can hold up a whole withdrawal.

What to ask a payment service about screening

Before you sign up, it is worth getting straight answers to four questions:

• Does it screen every incoming payment? A check that only runs above a certain amount lets smaller tainted payments through.
• What happens to a flagged payment? It can be held, returned or credited with a warning, and you need to know who decides and how long that takes.
• How will you find out? A held payment should show up as its own status in the dashboard and in the notifications your website receives, so an order does not just sit unpaid.
• Does it verify its merchants? A merchant check shows that the service takes AML seriously on its own side, and it tells you what you will need to get started.

Screening is one line in a longer comparison that also covers fees, coins and payouts, and the full list sits in how to choose a crypto payment gateway for your business.

What a held payment looks like to your customer and to your website

For the customer, a held payment looks like any stuck payment: the money has left their wallet, and the order has not confirmed. They will write to support, and your team needs a short, calm answer ready. The payment has arrived, it is going through a standard check, and the customer will hear back as soon as the check ends.

Two things are worth keeping out of that answer:

• A promised time. The check runs on the payment service's side, so a deadline you name is one you do not control.
• Guesses about the reason. The customer may be as surprised as you are, and a guess about their wallet's history helps nobody.

On the website side, the held state has to reach your order system. If the payment service only ever reports "paid" or "not paid", a held payment leaves an order stuck with no explanation, and someone ends up checking it by hand. When you connect through an API, a separate status for held payments is one of the things to check in a crypto payment API before integrating it.

How CryptumPay handles screening and merchant checks

Here is how both sides of the check work at CryptumPay:

• Suspicious funds are held before they reach the balance. At CryptumPay, a payment from a suspicious source is caught and held before it gets to the merchant's balance, so it never mixes with the rest of the money.
• Every merchant passes KYC. CryptumPay verifies the identity of every merchant without exception, and without that check withdrawals are not possible.
• An identity check may be enough. At CryptumPay, a merchant may be able to start with an identity check alone, without a package of company documents.

For a seller, the first point means a tainted payment surfaces as one held payment at the start, not as a frozen withdrawal weeks later at an exchange. The second and third mean the merchant check is a known step with a clear purpose: without it there are no withdrawals, and for a freelancer or a small shop it may come down to an identity check rather than a stack of corporate paperwork. How payments, checks and withdrawals fit together is on the CryptumPay website.

A crypto AML policy that fits a small business

An AML policy is a short written document that says how your business deals with suspicious money: who decides, what gets checked and what happens when something is flagged. If your business is not one the law obliges to run AML checks, nobody requires you to have one. It is still worth an hour of your time.

The reason is practical. Payment services, exchanges and banks may ask how you handle risk, and a written answer gets you through those questions faster. More importantly, the policy makes the decisions in advance, so a flagged payment on a Friday evening does not turn into improvisation.

For a seller who takes crypto, the whole policy fits on one page and covers seven points:

1. One person owns it. In a small company it makes sense for that to be whoever runs the money, so a flagged payment always has someone to decide on it. That person then sits close to conversions, fees and withdrawals, the work described in stablecoin payment operations for CFOs.
2. Incoming payments are screened. The policy names the payment service that checks every sending address and says what that service does with a flagged payment.
3. Large orders get one more question. Pick an amount, say 5,000 USDT, above which you ask for the buyer's full name or company before you ship; where you draw that line is up to you, but write it down.
4. Records are kept. Every crypto order keeps its invoice, the transaction hash, the customer's contact details and proof of delivery, for at least as long as your tax records, so you can answer an exchange's question months later.
5. Flagged payments follow a fixed route. The order is paused, the owner of the policy is told, and nothing is refunded or moved until the payment service has given its answer.
6. Payout addresses are checked too. Money you send to suppliers, contractors or affiliates goes only to addresses that were checked and approved in advance, which is what crypto address allowlists for business are for.
7. The policy is reviewed once a year. Review it sooner when you add a new coin, a new country or a new way of paying people.

What crypto AML compliance comes down to for a seller

For a business that sells its own goods for crypto, AML compliance comes down to a few habits rather than a licence: respect sanctions, take payments through a service that screens them, keep records and decide in advance what happens to a flagged payment. The full set of AML duties starts when you hold or move crypto for others, or when your sector has its own rules. If you are in one of those groups, the one-page policy above is a start, not the finish.

An ad network or CPA platform sits close to that line: money from advertisers comes in, payouts to affiliates go out, and screening should cover both directions. For a network paying affiliates in USDT, the next question is what those affiliate payouts really cost.

Questions people ask next

Is KYC mandatory when a business accepts crypto?

For checking your own customers, usually not, if you sell ordinary goods or services in the US, the EU or the UK. As of October 2026, KYC is mandatory for exchanges and other crypto service providers in the US, the EU and the UK, so a customer who bought their coins on a regulated exchange has already been checked there. Asking for a name or company on large orders is your choice rather than a duty, and it costs some friction at checkout, which is why it makes sense only above a set amount.

How can I prevent money laundering through my crypto payments without paying for analytics?

Free tools cover the first check before a large order. A blockchain explorer, a public website that shows every transfer on a network, will show you where an address got its coins at no cost, and OFAC publishes its sanctions list, crypto addresses included, for free. What free tools rarely do is follow the money several steps back and label who owns each address, so they catch the obvious cases and miss a hack three transfers back.

Can tainted cryptocurrency be frozen after it reaches me?

It can, and who does it depends on the coin. USDT and USDC have issuers, Tether and Circle, which can freeze tokens on a specific address and have done so at the request of law enforcement. Bitcoin has no issuer, so nobody can freeze the coins themselves, and a freeze happens at the exchange where they land.

This article is general information, not legal advice. AML and sanctions duties depend on your country and on how your business is set up, so for a decision about your own business, check with a lawyer who works in your jurisdiction.