A regulated crypto firm receives a formal notice: the competent authority has opened an AML audit. The compliance team scrambles. The legal team asks the harder question — is this an administrative review, or the opening move in an enforcement action? Getting that distinction wrong costs businesses their operating licences, their banking relationships and, in the worst cases, their ability to trade. The Travel Rule (the obligation to pass originator and beneficiary data with every qualifying transfer), KYC framework failures and gaps in transaction monitoring are the three recurring triggers we see in regulator-initiated AML audits across the major hubs. This analysis sets out the disputes angle: how enforcement escalates, how the defence is built, and where the cross-border complexity compounds the risk.
When an AML Audit Becomes an Enforcement Action
A regulator AML audit moves from routine supervision to active enforcement the moment the authority identifies a material deficiency and issues a formal finding — and most firms do not see the transition coming. The distinction matters enormously. A supervisory visit is a process of inquiry. An enforcement referral is adversarial. The procedural rights, the evidentiary standards and the available remedies differ sharply between the two, yet the same compliance file sits at the centre of both.
In our cross-border practice, we regularly advise firms that have treated an audit questionnaire as an administrative checkbox exercise, only to find that the regulator had already prepared an escalation memo before the first document request arrived. The authority's internal file may be months ahead of the firm's awareness. Regulators under MiCA — the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities — are increasingly empowered to coordinate cross-border enforcement, meaning a finding in one member state can land simultaneously with authorities in two others where the firm has passported its services.
The first practical step is therefore calibration: read the audit notice for its legal basis, the scope of documents requested and the timeline imposed. Those three elements tell an experienced disputes lawyer whether the authority is fishing or has already landed something. A short, tightly scoped request focused on a single product line or a defined transaction window is almost always a sign that the regulator has a specific concern, not a general one. Act accordingly.
What Triggers an AML Audit in a Digital-Asset Business?
AML audits in digital-asset businesses are most commonly triggered by one of four events: a suspicious transaction report filed by a correspondent bank, an adverse finding during a peer firm's inspection that implicates shared infrastructure, a cross-border intelligence sharing request between regulators, or the firm's own internal audit surfacing a gap that then reaches the regulator's desk through mandatory notification obligations.
The Travel Rule is the single most common structural deficiency we see. Under the FATF Recommendation 15 framework, every VASP (virtual asset service provider) transferring digital assets above the applicable threshold must collect, verify and transmit originator and beneficiary data to the receiving institution. The mechanics of compliance differ by jurisdiction — the threshold, the data fields required and the timing obligations all vary under the rules of MAS in Singapore, the FCA's regime in the United Kingdom, VARA in Dubai and the applicable MiCA provisions in the EU. A firm passporting across those jurisdictions without a jurisdiction-specific Travel Rule mapping is, structurally, non-compliant in at least some of them. That gap is exactly what a motivated regulator finds.
KYC framework failures are the second trigger. Inadequate customer due diligence at onboarding, insufficient enhanced due diligence for higher-risk clients and stale periodic reviews are the three sub-categories that dominate enforcement actions we have studied. Transaction monitoring failures — alert thresholds set too high, rules not calibrated to the firm's actual risk profile, backlogs in alert disposition — form the third category. These three areas are also the three pillars of a well-constructed AML audit defence.
CTA #1: The audit notice has arrived and the compliance team is assessing scope. Map your options with OBOLUS before you respond — the framing of your first submission shapes every subsequent step in the process. Contact us at info@oboluslaw.com.
The Cross-Border Complexity That Regulators Exploit
The single most dangerous assumption in multi-jurisdictional AML defence is that a clean bill of health in the licensing jurisdiction provides protection everywhere the firm operates — it does not. Regulators in secondary markets where a firm serves customers routinely assert AML supervision jurisdiction over unregistered activity, even where the firm holds a licence elsewhere.
Consider the architecture of a typical mid-sized crypto exchange: the regulated entity is licensed in the EU under the MiCA CASP authorisation regime, the custody function sits in a separate entity in a common-law offshore jurisdiction, the banking relationships are in a third country and the largest customer base is in a market where the firm has no formal registration. Each layer of that structure carries its own AML obligation. The EU entity must satisfy ESMA and its home NCA. The custody entity faces the rules of its own regulator — whether that is the BVI FSC under the VASP Act 2022, CIMA in the Cayman Islands or the FSRA within ADGM. The banking relationship requires compliance with the bank's own correspondent due diligence standards, which typically mirror FATF standards at a minimum. The customer-facing market may have its own VASP registration requirement with its own AML rules.
When a regulator audits the EU entity, it frequently requests information about the custody and banking arrangements because the AML risk assessment must account for the full transaction flow, not just the portion of it that occurs within the regulated entity's own systems. Firms that have siloed their compliance functions across those legal entities — a common structural choice made for cost reasons — find themselves unable to produce a coherent group-wide AML response. That inability is itself evidence of inadequate oversight. We have seen regulators treat the failure to produce integrated AML documentation as a finding in its own right, separate from the underlying substantive deficiency.
How Do You Build an AML Audit Defence That Holds?
An effective AML audit defence rests on three things: a defensible risk assessment, contemporaneous evidence of implementation and a credible remediation narrative. The risk assessment must be authentic — written to reflect the firm's actual business, not a generic template. The implementation evidence must be contemporaneous; a compliance policy document with a last-amended date of three years ago and no supporting evidence of day-to-day application is not a defence, it is an aggravating factor. The remediation narrative must be specific, timed and already in progress before the firm responds to the regulator.
The MLRO (Money Laundering Reporting Officer) sits at the centre of all three. Most leading regimes — including those administered by the FCA, MAS, VARA and the relevant MiCA national competent authorities — require that a natural person carry the MLRO function with real authority, real resources and documented access to the board. A nominal MLRO who lacks the authority to halt a business line or the budget to escalate a compliance failure will not survive regulatory scrutiny. Examiners interview the MLRO directly; the quality and depth of those answers determines whether the audit stays administrative or escalates.
In practice, the defence also requires a forensic review of the audit period's transaction monitoring alerts. If the regulator's preliminary finding is that certain alerts were not dispositioned, the firm's response must either explain why the alert logic did not require escalation or acknowledge the gap and demonstrate remediation. Regulators in the leading hubs are sophisticated enough to distinguish between a firm that had a weak rule and fixed it and a firm that had no rule at all. The former attracts a remediation order; the latter attracts sanctions.
The Disputes Angle: Adversarial Procedure and Legal Privilege
Once an AML audit reaches the enforcement stage — a formal notice of proposed action, a warning notice or a decision to suspend activity — the procedural posture changes and legal professional privilege becomes critical. The internal review documents, the legal advice obtained and the communications between the firm and its counsel are, in most common-law jurisdictions, protected. But the protection is not automatic and it is not always preserved when firms use compliance consultants rather than qualified lawyers to conduct the review.
Privilege questions are particularly acute in cross-border matters. A memo prepared by a lawyer in England & Wales for a regulator audit in the EU may attract English legal professional privilege for English proceedings while receiving different treatment under the procedural rules of the EU forum. DIFC Courts in Dubai apply common-law privilege doctrine, making them generally favourable for protecting strategy documents in UAE-adjacent matters. MAS enforcement proceedings in Singapore also operate within a developed privilege framework. The risk arises when a firm assumes that the protection available in its licensing jurisdiction extends automatically to materials that a foreign regulator demands.
We regularly advise that the engagement structure for an AML audit defence should be configured with privilege in mind from the outset — meaning that the lawyer leads the internal review, the factual investigation is conducted under the lawyer's direction and the written output is addressed to the lawyer rather than to the compliance committee. That structure is often not in place when a firm first instructs us. Reorganising it retrospectively is possible but creates gaps; establishing it at the moment of the audit notice is materially better.
Contrasting Positions: When to Remediate and When to Contest
The choice between accepting a regulator's preliminary findings and contesting them is one of the most consequential decisions a firm makes during an AML enforcement process. It is also one where the instinct of in-house counsel and the advice of external disputes counsel routinely diverge.
In-house teams, understandably, want to preserve the relationship with the regulator. They lean toward early acknowledgment, remediation commitments and settlement. That posture is often correct — many regulatory processes offer a discount on sanctions for early cooperation and genuine remediation, and the commercial cost of a prolonged contested process is substantial. But early capitulation on a finding that is factually incorrect, legally unsound or disproportionate in its scope creates precedent within the same regulator's file for the firm's future supervision. Every admitted deficiency is on the record. The next audit starts from a different baseline.
Contesting a finding requires a different analysis. The evidentiary threshold that regulators must meet before issuing a formal sanction varies by jurisdiction. Under the applicable MiCA provisions, the procedural rights for a CASP facing an enforcement action include defined response periods and, in many member states, a right to be heard before the competent authority. VARA's enforcement framework in Dubai provides a structured process for responding to proposed regulatory actions. The FCA's regulatory decision-making process in the United Kingdom is one of the most developed, with a defined distinction between the supervisory and enforcement teams, a warning notice procedure and an independent Regulatory Decisions Committee. Understanding where the burden lies and whether the regulator has met it is the foundation of a contested defence.
The decision matrix breaks down by profile:
An exchange with a largely intact AML programme and an isolated process failure is a strong candidate for early cooperative remediation. The finding is specific, the fix is demonstrable and the cost of contesting exceeds the benefit. Timeline to resolution: typically measured in weeks to months, depending on the jurisdiction and the nature of the required remediation plan.
A firm whose entire transaction monitoring architecture is under challenge — where the regulator's finding goes to the systemic adequacy of the AML programme — must contest, because full acceptance of that finding creates an existential risk to the licence. That is a contested engagement of months. It requires forensic AML expertise, regulatory advocacy and, potentially, parallel proceedings in multiple jurisdictions where the firm operates.
A firm facing cross-border enforcement — where two or more regulators are coordinating — must manage both processes simultaneously while preventing one jurisdiction's findings from becoming admissions in another. That requires allied counsel in each relevant jurisdiction, working under a common privilege structure, with a coordinated response strategy. We have managed that architecture in practice; the coordination cost is real but the alternative — uncoordinated responses producing inconsistent admissions — is far worse.
CTA #2: If a prior remediation submission did not resolve the regulator's concerns, or if enforcement has escalated faster than anticipated, the analysis above suggests a different approach is available. Map your options with our disputes desk at info@oboluslaw.com — a second read on the regulatory file often surfaces the structural reason for the impasse and the route through it.
A Micro-Matter: Coordinated Audit Defence Across Two Regulators
In a recent matter, a digital-asset exchange holding a licence in a leading EU jurisdiction received simultaneous audit notices from its home NCA and from the financial intelligence unit of a second jurisdiction where it served a substantial customer base without formal registration. The two notices referenced different regulatory bases but both centred on the same transaction monitoring gap: a period during which automated alert rules had not been updated to reflect a significant change in the firm's product line.
We were instructed at the point of the second notice. The immediate priority was to establish a common privilege structure covering both engagements and to prevent the firm's internal project team — which had been preparing a voluntary remediation report for the home NCA — from inadvertently producing a document that could be disclosed to the second regulator without protection. We restructured the internal review under legal direction, submitted coordinated but jurisdiction-specific responses to both authorities and supported the MLRO through examiner interviews in both forums. By the following quarter, both matters had been resolved through supervised remediation plans rather than formal sanctions. The firm's licence and its primary banking relationship remained intact throughout.
How Does the Travel Rule Feature in AML Enforcement Actions?
The Travel Rule is, at this stage of the market cycle, the compliance obligation most likely to generate an enforcement finding in a digital-asset AML audit. The regulatory framework is settled in principle — FATF Recommendation 15 establishes the obligation for VASPs to transmit originator and beneficiary data with every qualifying transfer — but the implementation requirements differ materially across the major jurisdictions, and most firms operating across borders are non-compliant in at least one of them.
MAS in Singapore requires full Travel Rule compliance for DPT service providers above the applicable threshold. The FCA in the United Kingdom imposes Travel Rule obligations on UK-registered CASPs. Under MiCA, the EU's Transfer of Funds Regulation — extended to cover crypto-assets — applies to CASPs transacting within the EU. VARA in Dubai has its own Travel Rule obligations under the applicable rulebooks. Each regime sets its own threshold, its own data fields and its own technical standards for transmission, including rules on how to handle transfers to and from unhosted wallets.
In enforcement, the Travel Rule gaps that regulators pursue most aggressively are: failure to collect originator data at all; collection without verification; transmission to a counterparty VASP without confirmation that the counterparty can receive structured data (the "sunrise problem" where one jurisdiction has implemented the rule and the counterparty jurisdiction has not); and the absence of a documented policy for handling transfers that cannot be Travel Rule-compliant because the counterparty is not a regulated VASP. Each of these is a distinct finding, and a firm can accumulate several across a single audit period without realising it.
The practical defence for a Travel Rule finding requires the firm to produce: the rule's implementation date relative to the jurisdiction's effective date; the technical architecture used for data transmission; evidence of counterparty VASP due diligence; and the documented treatment of exceptions. If any of those four elements is missing or inadequate, the remediation plan must address it specifically. A generic commitment to "improve Travel Rule compliance" is not accepted by any sophisticated regulator as a remediation plan.
Self-Assessment Checklist: AML Audit Readiness for Digital-Asset Firms
AML audit readiness is not a static state — it is an ongoing programme that should be calibrated against the specific risk profile of the business and the regulatory expectations of each jurisdiction in which the firm operates or plans to operate. The following assessment points reflect the areas most commonly deficient in audits we have advised on.
First, risk assessment: is the firm-wide AML risk assessment less than twelve months old, does it cover all product lines and customer segments, and does it reflect the specific risks of digital-asset activity including DeFi, stablecoin and NFT exposure where relevant?
Second, KYC framework: are customer due diligence procedures documented at the product level rather than generically? Is enhanced due diligence applied to higher-risk customers with documented trigger criteria? Are periodic reviews scheduled and tracked with evidence of completion?
Third, Travel Rule: has the firm mapped every jurisdiction in which it operates or sends transfers, identified the applicable threshold and data requirements in each, and confirmed that its technical infrastructure can transmit and receive structured Travel Rule data in each market?
Fourth, transaction monitoring: is the alert rule set documented and reviewed on a defined cycle? Are thresholds calibrated to the firm's actual transaction profile, not to an industry generic? Is alert disposition tracked, evidenced and subject to second-line review?
Fifth, MLRO function: does the MLRO have documented authority, adequate resource, board access and evidence of independent operation? Are SAR filing records maintained and reconciled to the alert disposition record?
Sixth, privilege and legal readiness: is external disputes counsel already briefed on the firm's AML architecture, or would that briefing have to happen from scratch on the day a notice arrives? The firms that manage enforcement best are those whose external counsel already understands the structure before the audit begins.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – our full-service compliance practice covering VASP obligations across all major regimes
- Regulator AML audit defence: the structuring angle – how entity structure affects audit exposure and the remediation options available
- Enforcement of foreign judgments in South Korea – cross-border enforcement in a key digital-asset market
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule, derived from FATF Recommendation 15, requires every VASP to collect, verify and transmit originator and beneficiary data with each qualifying virtual asset transfer. The specific threshold, required data fields and technical transmission standards vary by jurisdiction — MAS, the FCA, VARA and the MiCA Transfer of Funds framework each set their own requirements. Non-compliance is one of the most commonly cited deficiencies in regulator AML audits of digital-asset businesses.
Who must act as MLRO for a crypto firm?
Most leading regulatory regimes — including those administered by the FCA, MAS, VARA and EU national competent authorities under MiCA — require a named natural person to carry the MLRO function. That person must have genuine authority, documented independence from commercial pressures, board-level access and adequate resource to fulfil the role. A nominal appointment without those attributes will not withstand regulatory scrutiny, and the MLRO is typically interviewed directly by examiners during an AML audit.
How do regulators audit crypto AML programs?
Regulators typically begin with a document request covering the AML risk assessment, policies and procedures, customer due diligence records, transaction monitoring alert logs and Travel Rule implementation evidence. They then conduct examiner interviews, often with the MLRO and senior compliance staff. Findings are issued in a preliminary form, giving the firm an opportunity to respond, before any formal action. Cross-border audits may involve coordinated requests from multiple authorities examining the same underlying activity from different regulatory angles.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the AML, Travel Rule and compliance obligations that run through every layer of a digital-asset structure. We map the compliance and licence stack across operating, custody and payment layers before you commit — and we defend that structure when regulators test it. Digital assets are the entirety of our practice, and we act only for businesses. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst — specialist in AML enforcement defence, on-chain asset recovery and cross-border regulatory proceedings for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.