Boards of digital-asset businesses increasingly face a blunt question from regulators, banking partners and investors: does your KYC and onboarding framework (the documented, board-approved process for identifying customers, assessing risk and admitting them to your platform) actually work, or is it a compliance artefact that nobody reads? With FATF Recommendation 15 now embedded in the regulatory regimes of every major hub – from MiCA across the EU to the VARA rulebooks in Dubai and the Payment Services Act in Singapore – the gap between a written policy and an auditable, consistently applied program has never been more consequential. Regulators are no longer satisfied with policies filed and forgotten; they want evidence of governance, escalation and real-time remediation. This analysis sets out the practical lessons boards need to carry into the next governance cycle.
Why KYC Failures Now Reach Board Level
KYC failure is no longer a compliance-department problem alone – it is a board-level liability event that can freeze banking rails, trigger regulatory action and end a licence. The shift is structural. Across the EU under MiCA, the UK under FCA financial-promotion and anti-money-laundering rules, and the UAE under the VARA regime, senior-management accountability for AML/KYC outcomes has moved from soft expectation to hard, documented obligation. When a deficiency surfaces – a high-risk customer admitted without enhanced due diligence, a suspicious transaction missed, a politically exposed person onboarded without escalation – regulators now ask who approved the framework and what oversight evidence the board holds.
In our practice, we see the same failure mode repeated across jurisdictions. A business builds a KYC policy at licensing stage, satisfies the initial application, and then allows the policy to calcify as the product and user base evolve. The customer segments it was designed for – retail retail spot buyers in one jurisdiction – bear little resemblance to the institutional OTC desks, DeFi protocol integrations and cross-border payment corridors the business is running eighteen months later. The written policy and the operational reality diverge. That divergence is what a regulatory audit surfaces.
The cross-border dimension makes the problem acute. A VASP licensed in, say, Lithuania under the MiCA transition serves users across the EU. Its banking partner sits in a different member state. Its custody layer is in a third. The AML risk assessment that satisfies the Bank of Lithuania may not address the risk profile of the full user population. And the FATF Travel Rule – the obligation to pass originator and beneficiary data with every qualifying transfer – creates a separate data-governance layer that must align with the KYC records underneath it.
The process above describes the standard risk trajectory. Your specific entity structure, user geography and product mix change the analysis materially. For a scoped assessment of where your KYC framework sits relative to current supervisory expectations, contact OBOLUS at info@oboluslaw.com.
The Regulated Perimeter: Who Triggers KYC Obligations?
Any entity providing a virtual asset service – custody, exchange, transfer, issuance, brokerage or related advisory functions – will trigger AML/KYC obligations in every serious hub, regardless of the label it applies to itself. The perimeter question is not just about the primary licensed entity. It extends to the full service chain.
Under MiCA, a CASP (crypto-asset service provider) authorised in one EU member state gains passporting rights across the EU/EEA – but the AML obligations attach at the level of the firm, not the licence alone. The ESMA framework expects a CASP to maintain a risk-based approach to every customer relationship in every market it touches. A Malta-authorised CASP that passports into Germany does not discard its AML obligations because the German user does not walk into a Malta office. The obligations follow the customer.
In Dubai, the VARA regime applies an activity-based licence structure: advisory, broker-dealer, custody, exchange, lending, management and transfer/settlement are each separately regulated. Each activity carries its own customer due diligence expectations. A business that operates in multiple VARA categories needs to map KYC obligations across each, because the customer risk profile for a custody client differs materially from that of a transfer/settlement counterparty.
Singapore's MAS under the Payment Services Act draws a similar distinction. The Digital Payment Token service creates KYC obligations at account opening, at defined transaction thresholds and on an ongoing basis as the customer relationship develops. The licence tier – standard payment institution versus major payment institution – affects the scope of those obligations, but it does not eliminate them.
The practical lesson for boards: the regulated perimeter is determined by what the business does, not by what the licence says on its face. Board oversight must cover every product line and every customer segment, including those added after the original licence was issued.
What Does a Defensible KYC Framework Actually Require?
A defensible KYC framework, in the terms regulators in leading hubs currently use, requires four integrated components: a customer risk-assessment model, documented due-diligence procedures calibrated to that model, a transaction-monitoring program aligned with the risk tiers, and an escalation and governance structure with clear board visibility. Each component is necessary; none is sufficient alone.
The customer risk-assessment model sets the foundation. It assigns every customer, at onboarding and on an ongoing basis, a risk tier that determines the depth of due diligence required. A retail user making small spot purchases in a low-risk jurisdiction receives standard due diligence. A high-net-worth individual using non-custodial wallet connections, operating from a jurisdiction on the FATF grey list, or whose source of funds is opaque, requires enhanced due diligence. That distinction must be made by the policy, applied consistently by the operations team and evidenced in the customer file.
Due-diligence procedures must be specific enough to be auditable. "We collect ID" is not a procedure. A defensible procedure specifies what ID is collected, from which source, how it is verified (automated vendor, manual review, or both), what liveness or biometric check applies, how identity is matched to sanctions and PEP screening databases, and how often screening is refreshed. ESMA guidance under MiCA and the FATF Recommendations both emphasize that procedures must be risk-proportionate but also consistent – a regulator reviewing fifty customer files expects to see the same logic applied to each.
Transaction monitoring is the operational layer that turns static KYC into a living program. A business that collects good identity documentation at onboarding but runs no meaningful monitoring is compliant only at the point of entry. Regulators at the FCA, VARA and MAS have all signaled that transaction monitoring adequacy – the rules, the thresholds, the alert-disposition process and the escalation to the MLRO – is a primary focus of supervisory review. The board needs reporting on alert volumes, disposition rates and Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) filing rates.
Governance is the component most often missing from smaller businesses. The board must receive, at a defined frequency, a consolidated AML/KYC report covering: the risk model's performance, material changes to the customer book, high-risk customer dispositions, monitoring alert statistics and any regulatory correspondence. Without that feed, board accountability is nominal.
How Does the Travel Rule Interact with Your KYC Stack?
The Travel Rule (the FATF-derived obligation requiring VASPs to collect, verify and transmit originator and beneficiary information alongside a qualifying virtual asset transfer) sits on top of the KYC framework but is not the same thing – and confusing the two creates structural compliance gaps. Travel Rule compliance assumes a functioning KYC layer beneath it; it does not substitute for one.
Under FATF Recommendation 15 and the domestic implementations of it – including the provisions applicable to CASPs under MiCA, the VARA transfer/settlement rules and the MAS regime – a VASP sending a qualifying transfer must include the originator's name, account number and address (or an acceptable equivalent), together with the beneficiary's name and account. The receiving VASP must screen that information before making funds available. The data-flow requirement is bilateral.
The gap the board needs to address is the alignment between Travel Rule data and the underlying customer record. If the originator's KYC file holds an outdated address or a name that does not match the Travel Rule message format, the discrepancy creates both a compliance failure and a forensic alert. Regulators reviewing a Travel Rule implementation will check whether the transmitted data is consistent with the KYC record on file. Inconsistencies suggest either stale KYC or, worse, fabricated Travel Rule data.
There is also the unhosted-wallet problem. Where a customer transfers to or from a wallet that is not held at a regulated VASP, many jurisdictions require the firm to apply enhanced due diligence to confirm the customer controls the unhosted address. The mechanics of that confirmation – a signed message, a micro-transaction, a third-party attestation – must be defined in policy and applied consistently. Several VASPs have received supervisory criticism for blanket unhosted-wallet policies that either prohibit all such transfers (commercially unworkable) or permit them without any due diligence (regulatory exposure).
The Travel Rule obligation is jurisdiction-specific in its data-threshold details, but the structural principle is uniform: the sending VASP bears responsibility for the accuracy of the data it transmits. That responsibility traces back to the quality of the underlying KYC record.
Cross-Border KYC: The Multi-Jurisdiction Compliance Stack
For a business operating across multiple jurisdictions, the KYC compliance stack is not a single program – it is a layered structure where the obligations of each jurisdiction must be satisfied without creating irreconcilable conflicts. That is harder than it sounds, and it is where many operators discover the limits of the "one offshore licence covers everything" assumption.
The single-licence myth is the most persistent misconception we address in cross-border advisory work. A CASP authorised under MiCA in one EU member state passports across the EU – but it does not authorise activities in Singapore, Dubai or the UK. A VARA licence in Dubai covers mainland Dubai activities – it does not cover DIFC, and it does not cover users located in jurisdictions where a separate registration or licence is required. A BVI VASP registration under the Virtual Asset Service Providers Act 2022 creates a compliance baseline for the BVI entity, but the moment that entity actively solicits or serves users in, say, Germany or Australia, the question is whether local rules in those jurisdictions require a separate registration or impose their own AML obligations directly.
In practice, a business with EU users, a Dubai-licensed entity and a BVI holding structure needs to map three separate AML regimes: MiCA/ESMA expectations for the EU-facing activity, the VARA rulebook for the Dubai entity and the BVI FSC requirements for the BVI entity. Each may impose different customer-risk-assessment models, different PEP-screening frequencies and different record-retention periods. The board's governance reporting must be designed to surface compliance status across all three, not just the primary licence jurisdiction.
Banking adds a further layer. The correspondent bank of a crypto firm will conduct its own customer-due-diligence assessment on the firm, including a review of the firm's AML program. That review is conducted at the bank's standard, which often exceeds what the primary regulator requires. Banks have derisked from crypto firms not because the firms lacked a licence but because the AML program did not meet the bank's internal risk appetite. A board that treats KYC as a regulatory-filing exercise, rather than as an operational program, is more likely to lose banking access.
Common KYC Failures: What Regulators Actually Find
Supervisory examinations across the leading hubs reveal a consistent set of KYC failures, and understanding them is more useful to a board than reading abstract policy guidance. The patterns we observe cluster around five recurring deficiencies.
The first is stale customer files. A customer onboarded three years ago under a lighter-touch pre-MiCA regime may have had only a passport and a self-certified source-of-funds statement collected. Under current expectations, that file may be materially deficient. Regulators increasingly expect periodic re-verification for higher-risk customers, with the frequency tied to risk tier. Firms that have not run a retroactive remediation program are carrying latent exposure in their existing customer book.
The second is PEP and sanctions screening that is either incomplete or not refreshed. Real-time sanctions screening – particularly for OFAC designations and the UN consolidated list – is the minimum. PEP screening must capture not just the customer but also beneficial owners and, in some jurisdictions, close associates. A static screening run at onboarding that is not refreshed as lists change is a documented liability.
The third is an inadequate risk model for the crypto-specific customer base. Generic bank-derived risk models were built for fiat customers. They typically do not address the specific risk indicators relevant to virtual-asset customers: use of privacy coins, high-frequency small-value transfers consistent with structuring, cross-chain bridge activity, counterparties associated with darknet markets, or customers accessing the platform through mixing services. A KYC framework for a crypto firm needs crypto-specific typologies embedded in both the risk model and the transaction-monitoring rules.
The fourth is the governance gap: no board-level reporting, no formal MLRO escalation log, no record of what was reviewed and what decision was made. When a regulator asks to see the board's AML oversight record and the answer is a single annual policy sign-off, that is a governance failure in itself.
The fifth – and most damaging – is inconsistent application. The policy says enhanced due diligence applies to high-risk customers. The files show that some high-risk customers received it and others did not. Inconsistency suggests either the policy is aspirational or the operations team is not resourced to execute it. Either conclusion is adverse.
A recent matter illustrates the consequences. A payments business operating across two jurisdictions had a well-drafted AML policy that had been approved by its board and signed off by external counsel at licensing. Over time, product additions created new customer types that the original risk model had not contemplated. When a supervisory examination occurred, the examiner found a cohort of customers who should have been assigned an enhanced-due-diligence rating under the firm's own policy but had been admitted at standard. The business was required to undertake a full customer-book remediation, extend enhanced due diligence to the identified cohort and provide the regulator with a board-signed remediation plan. The process consumed several months and materially delayed planned product development. No enforcement action resulted – but only because the firm engaged proactively once the gap was identified. In our experience, early engagement is the single most effective cost-control measure in a supervisory context.
Decision Matrix: KYC Program by Operator Profile
No single KYC program design fits every digital-asset business. The appropriate framework depends on the operator's product type, customer profile, jurisdictional footprint and regulatory status. The following profiles illustrate how the analysis branches.
A retail exchange licensed under MiCA and serving EU customers needs a high-volume, automated KYC stack: real-time identity verification, automated sanctions and PEP screening at onboarding, risk-tiering by customer geography and transaction behavior, and a transaction-monitoring system calibrated to retail-value thresholds. The Travel Rule obligation applies to qualifying transfers. The board needs quarterly AML reporting and an MLRO with sufficient resource to handle alert volume. The primary risks are screening gaps in the automated layer and failure to escalate edge cases to manual review.
An institutional OTC desk serving a smaller number of high-value counterparties has a different profile. Customer volumes are lower; due-diligence depth must be higher. Enhanced due diligence should be standard for all institutional counterparties. Beneficial ownership verification must reach the ultimate beneficial owner, not just the corporate entity. Source-of-funds documentation is non-negotiable. The Travel Rule obligation is more straightforward to execute because transfer volumes are lower and counterparties are typically themselves regulated VASPs. The key risk is the complexity of corporate structures – SPVs, trusts, fund vehicles – that obscure beneficial ownership.
A custody provider holding assets for third parties sits at the intersection of KYC and safeguarding obligations. Regulators expect the custodian to know the source of assets it holds, not merely the identity of the customer. Where a custody client itself is a regulated VASP, the custodian may apply a lighter-touch approach to the end-customer layer – but it must still verify the VASP's own compliance status. The MFSA and FSRA both expect documented due diligence on the regulated-entity customer, not a blanket waiver because the counterparty holds a licence.
A token issuer conducting a public sale has a KYC obligation at the point of sale that combines AML due diligence with securities-law considerations. In the EU, the MiCA whitepaper regime applies for non-security tokens; for securities tokens, national securities laws apply. Regardless of token classification, AML obligations require the issuer to verify purchaser identity and apply risk-based screening. The issuer who treats a token sale as a technical event rather than a customer-onboarding event is creating regulatory exposure that can attach to the token structure long after the sale closes.
What Does a Board-Grade AML Governance Structure Look Like?
Board-grade AML governance requires a formal structure with defined responsibilities, documented oversight and a paper trail that survives a supervisory examination. The components are well-established in supervisory guidance from ESMA, VARA and MAS; the challenge is implementation at the pace of a fast-growing digital-asset business.
The Money Laundering Reporting Officer – the MLRO, or equivalent title depending on jurisdiction – must be a named individual with the seniority and independence to escalate concerns to the board and, where required, to report externally. In several leading jurisdictions, the MLRO must be formally approved by the regulator. The role cannot be held by the CEO, the CCO wearing two hats, or an external consultant without adequate internal operational authority. Board minutes should record the MLRO's appointment, the reporting line and the escalation protocol.
The board must receive, at a defined minimum frequency, a consolidated AML/KYC report. That report should cover: the current state of the customer book by risk tier; material onboarding decisions, including declined or exited customers; transaction-monitoring alert statistics and disposition rates; SAR/STR filings; any correspondence from regulators on AML matters; and the status of any open remediation actions. The board should ask questions and minute its review. A passive board that receives the report and asks no questions is not demonstrating meaningful oversight.
Annual AML policy review is the minimum. A high-growth digital-asset business should review its policy whenever a material product change, a new customer segment or a new jurisdictional footprint is added. The review should be documented. Changes should be approved at board or senior-management level. The prior version should be retained.
Independent AML audits – whether by internal audit or an external specialist – provide the third line of defense that regulators expect. An audit limited to checking that policies exist misses the point. The audit must test whether the policies are actually applied, using sample files, alert-disposition records and escalation logs. The board should receive audit findings and sign off on remediation plans. That sign-off is the evidentiary record of board accountability.
For a scoped review of your AML governance structure against current supervisory standards in your operating jurisdictions, write to OBOLUS at info@oboluslaw.com. If a prior examination or banking review surfaced gaps, a second read can identify the structural route forward.
Objection Handler: Common Assumptions That Create Exposure
A common assumption among boards of digital-asset businesses is that a licence, once obtained, confers ongoing regulatory cover for the business model as it evolves. That assumption is incorrect. The licence authorises the activities described in the application at the time of approval. Material changes to the business – new product lines, new customer segments, new jurisdictional activity – typically require either regulatory notification or a fresh authorisation. The AML obligations attach to what the business is actually doing, not to what the licence document describes.
A related assumption is that strong technology substitutes for governance. Automated KYC vendors, sanctions-screening APIs and transaction-monitoring platforms are operationally necessary – but they are not compliance programs. The technology executes rules that humans must design, calibrate, monitor and adapt. A board that believes the vendor is responsible for compliance has misread both the vendor's terms and its own regulatory obligations. The regulator holds the licensed entity responsible. The vendor is a tool.
A third assumption is that offshore structures reduce AML exposure. A BVI or Cayman holding structure may have legitimate tax and governance rationale. But the AML obligations attach to where the activities occur and where the customers are located, not to the place of incorporation of the holding entity. A business with a Cayman fund vehicle, a BVI operating entity and EU customers is not exempt from MiCA AML obligations because neither the Cayman nor the BVI entity is EU-incorporated. The question is whether the activity of serving EU customers triggers CASP authorisation obligations – and that is a facts-and-activities analysis, not a letterbox-address analysis.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule, derived from FATF Recommendation 15 and implemented across MiCA, the VARA regime and the MAS Payment Services Act framework, requires a sending VASP to collect and transmit the originator's name, account identifier and address, together with the beneficiary's name and account, alongside any qualifying virtual-asset transfer. The receiving VASP must screen that information before making funds available. The data threshold triggering the obligation varies by jurisdiction and should be confirmed against current legislation in each operating market.
Who must act as MLRO for a crypto firm?
A Money Laundering Reporting Officer must be a named individual with sufficient seniority and independence to escalate concerns internally and, where legally required, to report externally to a financial intelligence unit. In several leading jurisdictions – including under the MiCA/ESMA framework, VARA and MAS – the MLRO must be formally approved or notified to the regulator. The role cannot be held by the CEO or an individual who lacks genuine operational authority over the compliance function. The MLRO must report regularly to the board with documented oversight evidence.
How do regulators audit crypto AML programs?
Supervisory examinations of crypto AML programs typically combine a document review – policies, procedures, risk model, MLRO reports, board minutes – with a sample file review testing whether the documented procedures were actually applied to real customers. Examiners check KYC file completeness, screening records, transaction-monitoring alert dispositions and SAR/STR filing history. They also review governance evidence: whether the board received AML reporting and whether findings were formally addressed. Inconsistency between policy and practice is the most common adverse finding across ESMA, VARA and MAS examinations.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – full-practice overview of the AML, KYC and Travel Rule compliance service
- Travel Rule compliance under heightened regulatory scrutiny – detailed analysis of Travel Rule program design and supervisory expectations
- Tokenised fund structuring in the Bahamas – jurisdiction analysis for digital-asset fund formation and the applicable compliance baseline
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and AML compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack across operating, custody and payment layers before you commit – and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where recovery is in issue. To discuss your situation, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst – advising digital-asset businesses on the intersection of cross-border AML obligations, structural compliance and the board-level governance frameworks that satisfy regulators across the EU, UAE and Singapore.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.