Regulator AML Audit Defence from a Cross-border Perspective

A regulator announces an AML audit. The letter arrives on a Tuesday. By Thursday, the compliance team has identified three gaps in the transaction-monitoring logic, a Travel Rule (the obligation to pass originator and beneficiary data with a transfer) implementation that lags behind what the supervising authority expects, and a KYC framework (the customer due-diligence architecture underpinning the AML program) that was built for the home jurisdiction but never updated for the two additional markets where the business now operates. This is the audit scenario we see most often. The legal question is not whether the program will survive – it is whether counsel can close the gaps before the examiner's first on-site session and present a coherent, jurisdiction-aware defence for everything that remains.

AML audit defence for a digital-asset business is, at its core, a cross-border legal problem. The entity may hold a CASP authorisation under MiCA and simultaneously serve users whose transactions are monitored under the FATF Travel Rule as implemented in three further jurisdictions. Each supervising authority – ESMA's network of national competent authorities, VARA in Dubai, the FCA in the United Kingdom, MAS in Singapore – applies the same FATF baseline with material local variations. Counsel who knows only one regime cannot defend the whole program. This page explains the regulated basis for an AML audit, the defence process, the cross-border complexity, and how OBOLUS approaches each stage.

What Gives a Regulator the Authority to Audit Your AML Program?

Every major licensing regime grants the supervising authority broad examination powers as a condition of authorisation, and a digital-asset business that has multiple licences is subject to multiple audit jurisdictions simultaneously. Under MiCA, national competent authorities may request documents, interview staff, conduct on-site inspections and impose supervisory measures without first finding a breach. VARA in Dubai holds equivalent powers over all virtual-asset activities licensed on the Dubai mainland. The FCA in the United Kingdom may audit a cryptoasset firm registered under the Money Laundering Regulations at any point during the registration period. MAS in Singapore exercises supervisory powers over all licensed Digital Payment Token service providers under the Payment Services Act.

The FATF Recommendations – specifically Recommendation 15 on virtual assets – set the global baseline. They require jurisdictions to ensure that VASPs (virtual asset service providers) are subject to AML/CFT obligations equivalent to those applying to financial institutions. The Travel Rule obligation, derived from FATF Recommendation 16, sits within that baseline. What changes across jurisdictions is the de-minimis threshold at which the Travel Rule bites, the technical standard required for data transmission, and the documentary evidence the regulator expects to see during an audit. When a business operates under more than one regime, the audit defence must speak to each supervisor in its own regulatory language.

The process above describes the standard path. Your facts – the entity structure, the user base geography, the banking relationships – change the analysis substantially. For a scoped assessment of your AML audit exposure, contact OBOLUS at Map your options.

What Does a Regulator Actually Examine During a Crypto AML Audit?

A regulator conducting a crypto AML audit will examine five core areas: the written AML/CFT policy and its consistency with current law, the KYC framework and its application to actual customer onboarding files, the transaction-monitoring system and its alert-handling logs, Travel Rule compliance documentation, and the role and qualifications of the MLRO (money laundering reporting officer). In our practice, the most common examination failure points are not in the written policies – those tend to be well-drafted – but in the evidence that the policies were actually followed and that staff understood them.

Regulators increasingly examine transaction-monitoring systems at a technical level. They will ask for the rule-set governing alert generation, the threshold logic for escalation, the resolution documentation for closed alerts, and the periodic review records showing the firm tested whether the system was catching what it should. For a cross-border business, this raises an immediate problem: a monitoring system calibrated to the risk typologies of one jurisdiction may be systematically blind to patterns that the second or third supervising authority considers high-risk. We have seen audit findings in one jurisdiction trace directly to a monitoring configuration that was set up for a different regulatory environment and never adapted.

The KYC framework review is similarly fact-intensive. The examiner will pull a sample of customer files and test them against the firm's own onboarding policy. Enhanced due diligence files for higher-risk customers receive particular attention. Where the business operates across jurisdictions, the question arises whether the EDD standard applied was the home-jurisdiction standard or the standard of the jurisdiction most relevant to that customer relationship. That is a legal judgment that must be made in advance and documented – not reconstructed after the file is pulled.

How Does the Travel Rule Create Cross-border Audit Complexity?

The Travel Rule creates audit complexity because no single technical standard has been adopted globally, and the regulator auditing a VASP will apply its own jurisdiction's implementation, not a universal benchmark. Under the FATF framework, a VASP must collect and transmit originator and beneficiary information for virtual-asset transfers above the applicable threshold. In practice, this means a business operating under MiCA, the FCA regime and MAS concurrently must satisfy three potentially different transmission standards and three different evidential expectations – all with the same underlying technology stack.

The data-transmission problem is compounded by the sunrise issue: when a VASP sends a Travel Rule message to a counterparty VASP in a jurisdiction that has not yet implemented the requirement, the receiving firm cannot comply with the data request. The sending firm has nonetheless met its obligation, but the audit record must reflect a documented protocol for exactly this situation. Examiners treat a missing sunrise protocol as a gap in the compliance program, regardless of whether any specific transaction was actually harmed by the absence.

In our cross-border practice, we advise clients to maintain a jurisdiction-by-jurisdiction Travel Rule matrix showing the applicable threshold, the transmission standard, the sunrise status of key counterparty jurisdictions, and the documented escalation path for unresolvable gaps. That matrix is itself an audit document – one that demonstrates to a supervisor that the firm has thought carefully about the problem rather than applied a single-country template globally.

What Are the Most Common AML Audit Mistakes a Digital-asset Firm Makes?

The most common and most costly mistake is treating the audit as a documentation exercise rather than a legal defence. Firms that receive an audit notice frequently focus on producing documents the regulator has not yet requested, rather than first understanding the examiner's likely theory and preparing a structured legal response to it. An audit that begins without a defined legal narrative – a coherent account of why the program is fit for purpose, what its known limitations are and what remediation is already underway – is far harder to defend than one where counsel has shaped the opening submission.

A second common mistake is the failure to assert privilege over internal review documents generated in anticipation of an audit. In many jurisdictions, a legal professional privilege analysis applies to communications between in-house or external counsel and the business created for the purpose of legal advice in connection with regulatory proceedings. Firms that circulate internal gap analyses by compliance staff without counsel involvement lose the ability to protect those documents from disclosure. By the time external counsel is engaged, the damaging gap analysis is already a disclosable document.

A third mistake is scope creep in the response. When a regulator asks a question, the firm's response defines the scope of the next question. A response that volunteers information outside the examiner's specific request invites follow-on examination of areas the regulator had not prioritised. Managing the information boundary – answering fully and accurately, but only what was asked – requires experience across multiple regulatory audit processes.

Operators we advise routinely discover that the programme they consider compliant was built to the law as it stood at the time of the last comprehensive review, not as it stands today. AML regimes move quickly. The MiCA transition, the FCA's evolving financial-promotion rules, and VARA's iterative rulebook updates all create live compliance gaps in programs that were sound when written.

How Should a Multi-licensed Firm Structure Its AML Audit Defence?

A multi-licensed firm facing audit in one jurisdiction must treat that audit as a preview of what every other licensing authority could examine on the same facts – and structure the defence accordingly. The starting point is a privilege-protected gap analysis across all live licence jurisdictions, completed before the first examiner session. This gives the legal team a full picture of where the program is strong, where it is defensible with additional documentation, and where substantive remediation is needed before findings are crystallised.

The second structural step is establishing a single legal command point. Where allied counsel are engaged in multiple jurisdictions, each handling their respective supervisor, the strategy must be co-ordinated by a lead counsel who holds the full cross-border picture. Inconsistent responses to different regulators examining the same underlying program – describing the transaction-monitoring system differently, or characterising the MLRO's role differently – generate more risk than the original audit finding. We have seen enforcement action escalated from a single-jurisdiction examination to a multi-authority co-ordinated review because the firm gave materially different accounts to two regulators.

The third structural step is a remediation plan with an auditable timeline. Regulators in the leading hubs increasingly expect not just an acknowledgment of gaps but a documented remediation roadmap with assigned ownership, completion dates and evidence criteria. A plan that exists only in a PowerPoint presentation does not satisfy this expectation. The plan must be executable, monitored and capable of being demonstrated as live at any subsequent examiner session.

If a prior audit raised findings that were not fully resolved, or if a new examination has been announced, the window for pre-examination structuring is short. Write to OBOLUS at Map your options to discuss the scope of a defence-ready gap analysis.

Which Audit Defence Approach Fits Your Business Profile?

The right approach depends on the firm's licence footprint, the seniority of the examination and the state of the existing compliance program. Three profiles recur in our practice.

Profile A – Single-licence firm, first routine supervision visit. The appropriate instrument is a targeted pre-examination review: confirm that the written policy is current, that the transaction-monitoring log is production-ready for examiner review, and that the MLRO can speak fluently to the program's design decisions. The indicative preparation window is measured in weeks, not months. The key risk is complacency – assuming that a program that has never been examined is necessarily sound.

Profile B – Multi-licensed firm, regulator-initiated thematic or for-cause examination. This requires a full cross-border gap analysis under legal privilege, counsel co-ordination across all active jurisdictions, and a structured legal narrative prepared before the first examiner session. The key risk is inconsistency between what different jurisdictions are told. The process takes longer and the investment in legal preparation is materially higher – but the cost of a poorly co-ordinated response across three supervisors is higher still.

Profile C – Firm that has received a preliminary finding or a notice of proposed enforcement action. The defence moves from the administrative examination track to a formal legal proceeding track. At this stage, the firm needs experienced regulatory counsel, a privilege review of all internal documents that have been produced or are within scope, and a disciplined strategy on which issues to contest, which to accept and what remediation commitments to offer. The cross-border dimension remains live: a finding in one jurisdiction can trigger a supervisory review in others, particularly where the regulators share information under FATF-compliant co-operation frameworks.

An Illustrative Scenario: Travel Rule Gaps Across Three Regimes

In a recent matter, a custody and exchange business operating under licences in two European jurisdictions and one Middle Eastern hub received simultaneous audit notices from two of its three supervisors. The firm had implemented a Travel Rule solution built to the standard of its primary EU jurisdiction and applied it uniformly across all three. The Middle Eastern supervisor's implementation applied a different data-field requirement and a lower threshold. The European second-jurisdiction supervisor had updated its guidance since the solution was deployed, and the firm had not updated the configuration. We conducted a privilege-protected cross-border gap analysis, mapped each supervisor's specific requirements against the deployed technical solution, and prepared a remediation plan addressing both gaps with documented timelines. The firm entered its examination sessions with a structured legal narrative, a live remediation roadmap and consistent documentation across all three jurisdictions. No enforcement action resulted from either examination.

Self-Assessment: Is Your Program Audit-Ready?

Before a regulator schedules its first call, a digital-asset firm should be able to answer yes to each of the following.

• The written AML/CFT policy has been reviewed against current law in every jurisdiction where the business holds a licence, within the past twelve months.
• The transaction-monitoring system has been tested against the risk typologies published by each relevant supervising authority, and the test records are retained.
• The Travel Rule implementation covers the specific data-field and threshold requirements of each licensing jurisdiction, not just the primary one, and a sunrise protocol is documented.
• The MLRO can produce a contemporaneous record of every significant compliance decision taken in the past audit period, with the legal basis for that decision.
• Internal gap analyses and legal advice documents have been created or reviewed with external counsel involvement, preserving the privilege analysis.
• There is a documented escalation path for suspicious transaction reports across every jurisdiction, and the path has been tested.
• Key staff in the compliance function can articulate the design rationale for the KYC framework, not just follow a checklist.

A gap against any of these criteria is not a failure. It is a scoped piece of legal work. The risk is discovering the gap during the examination rather than before it.

Related at OBOLUS

Related at OBOLUS

• AML and Travel Rule compliance for digital-asset businesses – the full practice overview covering KYC, transaction monitoring and ongoing supervisory obligations.
• AML audit defence legal counsel for digital-asset firms – counsel engagement model and process for firms facing active regulatory examination.
• Legal counsel for digital-asset custodians – custody-specific licensing, safeguarding and AML obligations across the major regulatory hubs.

FAQ

What does the Travel Rule require from a VASP?

The Travel Rule, derived from the FATF Recommendations, requires a VASP to collect and transmit specified originator and beneficiary information alongside a virtual-asset transfer above the applicable threshold. The precise data fields required and the threshold at which the obligation bites vary by jurisdiction. Where a counterparty VASP cannot receive the data – the sunrise issue – the sending firm must have a documented protocol for that scenario. Failure to demonstrate a working, jurisdiction-specific implementation is a common examination finding.

Who must act as MLRO for a crypto firm?

Every regulated digital-asset firm operating under a licensing regime that implements the FATF recommendations – including those subject to MiCA, VARA, the FCA's registration regime and MAS's Payment Services Act – is required to designate a money laundering reporting officer. The MLRO must be a natural person with sufficient seniority and operational access to fulfil the statutory function. Regulators examine whether the MLRO was genuinely empowered to make compliance decisions or was a nominal appointment; the distinction matters significantly in an enforcement context.

How do regulators audit crypto AML programs?

A regulator conducting an AML audit of a crypto firm will typically review the written compliance policy, sample customer onboarding files against the KYC framework, examine transaction-monitoring alert logs and resolution documentation, test Travel Rule implementation records, and assess the MLRO's documented decision-making. On-site or virtual examination sessions may involve interviews with compliance staff. The process can run from a targeted desk-based review to a multi-month thematic examination, depending on the scope and the regulator's risk appetite for the sector at that moment.

About OBOLUS — OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the AML, Travel Rule and compliance obligations that sit around them. We map the compliance architecture across operating, custody and payment layers before clients commit to a structure. Digital assets are the whole of our practice. To discuss your audit situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.

By Victor Olsen, Regulatory & Compliance Analyst – specialising in cross-border AML programme design, regulator audit defence and Travel Rule implementation for digital-asset businesses operating across multiple licensing regimes.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.