An exchange's chief compliance officer receives a regulatory demand for transaction records spanning three years. Within hours, counsel is reviewing whether the MLRO (money laundering reporting officer) documented each Suspicious Activity Report filing with the precision a court would later scrutinize. The compliance function that seemed adequate on licensing day now faces a different standard — the evidentiary standard of contested proceedings. That gap is the disputes angle, and it is wider than most operators expect.
The MLRO and compliance officer function sits at the intersection of regulatory obligation and litigation risk. Across the leading digital-asset regimes — VARA in Dubai, MiCA administered by ESMA and national competent authorities, the FCA's registration regime in the United Kingdom, MAS supervision in Singapore — regulators impose a mandatory senior-manager responsibility structure. A named individual must own AML, KYC (know-your-customer), and Travel Rule compliance. When enforcement begins or civil proceedings follow, that individual's documented decisions become the central exhibit. This analysis examines how the compliance function performs under that pressure, and what operators must do differently to survive scrutiny.
The sections below cover the regulatory architecture, the evidentiary dimensions of compliance decisions, the cross-border complexity that multiplies exposure, and a decision matrix for operators assessing their own risk profile.
What do regulators actually require of the MLRO?
Regulators in every major digital-asset hub require a designated individual — the MLRO or its functional equivalent — to take personal responsibility for the firm's AML/CFT program. This is not a nominal appointment. VARA, the FCA, MAS, the FSRA in ADGM, and AFSA within the AIFC each prescribe fitness-and-propriety standards for the role, and most require regulators to pre-approve or receive notification of the appointment before it takes effect. The individual must be sufficiently senior to act independently of revenue-generating functions and to escalate directly to the board.
In our practice, we regularly advise firms that underestimate what "sufficient seniority" means in practice. A compliance officer who reports to the chief revenue officer, or whose SAR filings are subject to commercial sign-off, will fail the independence standard under most regimes. ESMA's guidelines under MiCA reinforce this: the compliance function must have unfettered access to management-body information and the authority to halt activity pending a decision on a suspicious matter.
The compliance officer's documented duties extend beyond SAR filings. Transaction monitoring calibration logs, risk-appetite statements, training records, and the firm's business-wide risk assessment all sit within the MLRO's formal mandate. Each of these documents is routinely requested in both regulatory inspections and civil discovery. Building them defensibly from day one is the difference between a well-managed inspection and an enforcement action.
How do compliance decisions become evidence in proceedings?
Compliance documentation transforms into evidence the moment a regulator issues a formal information request, a court issues a disclosure order, or a counterparty commences civil proceedings. The MLRO's decision-making trail — why a transaction was cleared, why a SAR was not filed, how a customer's enhanced due diligence review concluded — is subject to the same disclosure standards as any internal business record. In a contested regulatory matter, regulators will evaluate whether each decision was reasonable, documented, and consistent with the firm's own stated policies.
This is where the disputes angle diverges sharply from day-to-day compliance management. Regulators conducting a supervisory visit tend to assess systems and controls at a policy level. An enforcement team, a plaintiff's counsel, or a criminal prosecutor examines individual transactions and the documented reasoning behind each one. We have seen compliance programs that appeared coherent in their written form fail under that granular examination because the gap between policy and practice was never closed.
Three categories of documentation carry the highest evidentiary weight. First, SAR decision logs — both the reports filed and, critically, the documented reasons for not filing in borderline cases. Second, transaction monitoring alert disposition records, showing how each triggered alert was reviewed and resolved. Third, the firm's business-wide risk assessment, because it sets the standard against which all subsequent decisions are judged. A firm that assessed its customer base as low-risk but onboarded high-volume institutional counterparties without enhanced due diligence faces a credibility problem when that inconsistency is surfaced in proceedings.
The Travel Rule (the obligation, under FATF Recommendation 15 and its jurisdictional implementations, to pass originator and beneficiary data with virtual-asset transfers) creates an additional evidentiary layer. Each transfer above the applicable threshold must carry compliant data. Failures in Travel Rule transmission are now among the first items examined in regulatory enforcement actions across MiCA, MAS, and VARA-supervised entities.
For a scoped assessment of your compliance documentation posture ahead of a regulatory review, contact OBOLUS at info@oboluslaw.com. The process above describes the standard examination path. Your facts — the entity structure, the customer mix, the jurisdictions served — change the risk analysis materially.
How does cross-border operation complicate the MLRO's mandate?
Operating across multiple jurisdictions multiplies the MLRO's compliance obligations in ways that a single-entity, single-jurisdiction structure does not reveal. A digital-asset business with an exchange licensed under MiCA, a custody subsidiary regulated by the FSRA in ADGM, and a payment layer registered with the FCA in the United Kingdom faces three distinct AML regimes, three supervisory authorities, and potentially three separate MLRO appointments — each with its own reporting obligation, risk-assessment standard, and inspection cadence.
The cross-border Travel Rule obligation compounds this. FATF's standard applies globally, but the implementing rules under MiCA, the MAS Payment Services Act, and VARA's rulebooks each carry jurisdiction-specific data-field requirements, de minimis thresholds, and sunrise-period provisions. A transfer that is compliant under one regime may be deficient under another if the receiving VASP sits in a jurisdiction with a stricter data standard. The MLRO must map those interaction points and document how the firm manages the gaps — otherwise, the firm's Travel Rule compliance posture is only as strong as the weakest link in its counterparty chain.
In our cross-border practice, we regularly advise operators who have appointed a group MLRO without analysing whether that individual's appointment satisfies each subsidiary jurisdiction's seniority and residency requirements. Several major hubs — including Singapore under MAS and Hong Kong under the SFC — expect the compliance officer to have meaningful operational involvement in the local entity, not merely a group title held offshore. When regulators discover that the nominally appointed MLRO has no decision-making authority over the local entity's actual transactions, the resulting gap is treated as a structural control failure, which carries significantly heavier sanctions than an isolated procedural breach.
What goes wrong in enforcement? Common structural failures
The most consequential compliance failures in enforcement proceedings share a recognisable pattern. They are rarely failures of policy design; they are failures of implementation fidelity and documentation discipline. Understanding the pattern allows operators to self-assess before a regulator or opposing counsel does it for them.
The first structural failure is the disconnected risk assessment. The business-wide risk assessment is prepared at licensing stage, stored, and never updated to reflect material changes in the customer base, product range, or jurisdictional reach. When an enforcement team compares the risk assessment against actual transaction flows, the divergence is immediate. Regulators treat a stale risk assessment as evidence that management did not take the AML mandate seriously — and that inference is damaging in any subsequent proceedings.
The second failure is the alert-to-action gap. Automated transaction monitoring systems generate alerts. Those alerts are reviewed and closed, but the closure rationale is recorded only as a one-line disposition code. When a regulator or court examines a specific transaction that was cleared and subsequently linked to illicit activity, the absence of a documented analytical chain makes it impossible to demonstrate that the decision was reasonable. In several enforcement matters we have reviewed, the underlying analysis was sound but the record was simply not kept.
The third failure is the MLRO isolation problem. In smaller digital-asset businesses, the MLRO role is combined with other functions — legal, finance, operations. That is not inherently prohibited under most regimes, but it creates a record problem. An MLRO who also serves as general counsel produces documents that may later be subject to privilege disputes, and an MLRO who also manages banking relationships may face regulatory challenge to their independence. Structuring these roles clearly, with documented reporting lines and recusal procedures, is a matter we address early in compliance engagements.
When compliance records enter litigation: the disputes lens
Civil proceedings involving digital-asset businesses increasingly engage with compliance records in ways that were uncommon even a few years ago. Asset recovery actions, counterparty disputes, and regulatory civil penalty proceedings all reach into the compliance file. Operators and their MLROs must understand the litigation dynamic before it arises.
In asset recovery proceedings, a plaintiff seeking a freezing order or a disclosure order will often point to a respondent VASP's compliance failures to support the inference that the platform was used to conceal or move misappropriated assets. The VASP's own SAR logs and transaction monitoring records may be sought via a Norwich Pharmacal order (a disclosure mechanism in English and common-law courts that compels a third party to provide information identifying a wrongdoer). Platforms operating in England and Wales, the DIFC Courts, and Singapore — all recognized common-law recovery forums — face this risk routinely. A well-documented compliance record protects the platform; a fragmented one invites adverse inference.
In a recent recovery matter, a digital-asset payments business had its compliance records sought by way of a disclosure order in a leading common-law forum. The MLRO's documented alert-disposition logs demonstrated a coherent, contemporaneous review process. The platform was able to satisfy the court that the transfers at issue had been reviewed against the applicable AML framework, and the platform was released from the proceeding within weeks rather than months. The documentation was not perfect, but it was sufficient — and sufficiency, in litigation, is determined by the standard the forum applies, not the standard the operator assumed.
The inverse scenario is equally common. A VASP that cannot produce organized compliance records in response to a disclosure order creates the impression — regardless of the underlying facts — that its controls were either absent or deliberately obscured. That impression is hard to correct once formed, and it materially affects the platform's relationship with regulators, banking partners, and institutional clients in parallel.
If a regulatory review has commenced or a disclosure request has been received, reach OBOLUS before responding — contact us at info@oboluslaw.com. A second read of the compliance record can surface structural issues and define the most defensible response path before positions harden.
Decision matrix: assessing MLRO risk by operator profile
Not all digital-asset operators face the same MLRO risk profile. The exposure correlates directly with entity structure, jurisdictional spread, product complexity, and the size and composition of the customer base. The matrix below describes the four operator profiles we encounter most frequently in cross-border practice, and the primary risk and recommended action for each.
Profile A — Single-entity, single-jurisdiction exchange. An operator licensed under one regime, serving a geographically concentrated customer base, with a dedicated MLRO who holds no other senior function. This is the lowest-exposure profile. The primary risk is documentation drift — the risk assessment grows stale, alert-disposition logs become formulaic, and the Travel Rule mapping is not updated when counterparty relationships change. The recommended action is a scheduled annual compliance health check aligned with the regulator's inspection cycle, with the MLRO producing a written attestation of current posture.
Profile B — Multi-entity group with a centralized compliance function. A group with licensed entities in two or more jurisdictions — for example, a MiCA-authorized CASP and a MAS-licensed DPT service provider — sharing a group MLRO. The risk here is structural: whether the group MLRO appointment satisfies local seniority and operational-involvement requirements in each jurisdiction, and whether the group's AML policies are appropriately localized rather than applied wholesale. The recommended action is a jurisdictional gap analysis before the next scheduled regulatory review, with documented evidence that the local entity's compliance officer has independent decision-making authority over local transactions.
Profile C — DeFi or protocol-adjacent business with a compliance overlay. An operator offering access to decentralized protocols or managing a treasury function alongside a regulated interface. The MLRO's mandate is difficult to scope because the activity boundary is contested — regulators in multiple hubs are actively examining where the "service provider" perimeter ends. The risk is both regulatory (classification of activities) and evidentiary (difficulty producing transaction-level records for on-chain activity). The recommended action is an early, documented legal analysis of which activities fall within the regulated perimeter, with the MLRO's mandate defined against that analysis and reviewed quarterly as regulatory positions evolve.
Profile D — Operator with prior regulatory contact, enforcement action, or banking disruption. A business that has previously been subject to a regulatory notice, had a SAR program queried, or lost banking access for compliance-related reasons. This is the highest-exposure profile. Regulators in subsequent inspections will measure current controls against the prior findings. The primary risk is recurrence — a compliance improvement program that addressed the stated findings without resolving the underlying structural cause. The recommended action is independent external review of the current program, with the MLRO producing a written gap analysis against the prior regulatory findings and a remediation log.
Contrasting positions on MLRO independence and combined roles
Operators and regulators do not always agree on what MLRO independence requires in practice. The regulatory position is clear in its principle: the MLRO must be able to act without commercial interference. The operational reality is that many digital-asset businesses — particularly those in their early growth phase — cannot support a dedicated, full-time MLRO whose sole function is AML oversight.
The regulatory view, expressed consistently across VARA, MiCA's competent-authority guidance, and MAS supervisory expectations, is that combined roles are permissible only where the MLRO retains demonstrable independence in AML decision-making. That independence must be evidenced, not merely asserted. A board resolution that names the CFO as MLRO is not evidence of independence; a documented protocol specifying that the CFO-as-MLRO recuses from commercial decisions affecting customer risk classification, and that SAR filings are reviewed only by external legal counsel and the board chair, is closer to evidence.
The operator's position — and one we have advocated in regulatory dialogue — is that the quality of the compliance program matters more than the organizational chart. An MLRO who combines roles but maintains rigorous documentation, clear escalation protocols, and an externally reviewed risk assessment can satisfy the independence standard more convincingly than a nominally dedicated MLRO who is integrated into the revenue function in practice. Regulators are increasingly receptive to this argument, but only where the documentation supports it unconditionally.
A common assumption in this area is that engaging an external compliance consultant satisfies the MLRO appointment requirement. It does not, under any major regime. The MLRO must be a natural person with a defined accountability within the firm's governance structure, approved or notified to the relevant regulator as applicable. External consultants can support the function and provide second-opinion review, but they cannot hold the regulatory appointment.
Building a defensible AML program: the MLRO's working checklist
A defensible AML/CFT program is one that can be reconstructed, transaction by transaction, in front of a regulatory inspector or a court. Building it requires discipline in seven operational areas, each of which produces the documentary record that ultimately determines whether the compliance function performs under scrutiny.
First, the business-wide risk assessment must be a living document. It is updated — not merely reviewed — when the firm adds a product, enters a new jurisdiction, changes its customer onboarding channel, or modifies a key counterparty relationship. The update date and the author of each revision are recorded. Second, the KYC framework must specify enhanced due diligence triggers with objective criteria, not discretionary assessments. When EDD is required and how it was conducted should be determinable from the customer file alone, without the need for oral explanation. Third, transaction monitoring rules are calibrated, documented, and backtested against the firm's actual transaction population. Changes to rule parameters are logged with the MLRO's sign-off and a brief rationale. Fourth, the Travel Rule compliance log records, for each qualifying transfer, the data transmitted, the transmission method, and any exception applied. Exceptions are justified in writing at the time, not reconstructed after a query. Fifth, SAR filing decisions — including negative decisions on borderline cases — are documented contemporaneously. The record should answer three questions: what gave rise to the suspicion, what analysis was conducted, and why the filing decision reached was the correct one. Sixth, training records are maintained per employee, showing the date, content, and assessed competency of each AML training session. Seventh, the MLRO's annual report to the board is formally adopted and minuted, covering alert volumes, SAR filings, regulatory developments, and any material control gaps identified during the period.
Each of these elements is examined in a regulatory inspection. In our practice, we find that the checklist itself is rarely the gap — operators generally know what is required. The gap is between the checklist and the execution, and it is usually largest in the areas that require ongoing maintenance rather than one-time drafting.
Related at OBOLUS
- AML, KYC and Travel Rule compliance for digital-asset businesses – our full compliance and AML practice overview for exchanges, custodians and token issuers
- VASP business risk assessment in Gibraltar – how Gibraltar's AML-first supervisory model affects the MLRO function and risk documentation
- VARA licence application in Kazakhstan (AIFC) – AFSA's compliance expectations for MLRO appointments and AML programs in the AIFC
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule, derived from FATF Recommendation 15 and implemented across MiCA, the MAS Payment Services Act, VARA, and other major regimes, requires a virtual asset service provider to collect and transmit originator and beneficiary identification data with each qualifying transfer. The specific data fields, transfer threshold, and counterparty verification obligations vary by jurisdiction. Failures in Travel Rule compliance are among the first matters examined in regulatory enforcement actions and can constitute a standalone breach independent of broader AML deficiencies.
Who must act as MLRO for a crypto firm?
The MLRO must be a named natural person with defined accountability within the firm's governance structure. Most major regimes — including those administered by VARA, the FCA, MAS, and ESMA's competent authorities under MiCA — require the individual to be sufficiently senior to act independently of revenue functions and to escalate directly to the board. An external consultant cannot hold the appointment. In multi-entity groups, each regulated entity may require its own locally qualified MLRO, depending on the jurisdictional requirements applicable to that entity.
How do regulators audit crypto AML programs?
Regulatory inspections of digital-asset AML programs typically examine the business-wide risk assessment for currency and calibration, the KYC framework and enhanced due diligence triggers, transaction monitoring rule parameters and alert-disposition logs, Travel Rule compliance records, SAR filing decisions including documented negative decisions, training records, and the MLRO's board reporting. Regulators compare stated policies against actual transaction flows. Discrepancies between the written program and operational practice are treated as control failures and, in more serious cases, as evidence of systemic non-compliance warranting enforcement action.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the AML, Travel Rule and compliance infrastructure that sits around them. Digital assets are the whole of our practice. We map the licence, compliance and banking stack across operating, custody and payment layers before you commit — and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst — specialising in AML program architecture, MLRO governance, and cross-border compliance enforcement risk for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.