Digital-asset firms operating without a validated transaction monitoring program face a single, unambiguous risk: a regulator, a correspondent bank, or a payment-network operator will close the relationship before the firm has a chance to remediate. The cost is not a fine alone – it is lost banking, frozen rails, and reputational damage that takes months to repair. Transaction monitoring (the continuous, rule-based review of on-chain and off-chain activity to detect suspicious patterns) sits at the center of every AML compliance (anti-money laundering compliance) program that a serious digital-asset business must operate. At OBOLUS, we advise firms on the legal architecture of that program – from the regulatory baseline and the Travel Rule (the obligation to pass originator and beneficiary data with each qualifying transfer) through to tooling selection, MLRO accountability, and cross-border interaction with multiple supervisors. This page sets out exactly what that engagement looks like.
What Is the Regulated Basis for Transaction Monitoring?
Transaction monitoring is a mandatory element of every AML/CFT program that applies to VASPs (virtual asset service providers) under the FATF Recommendations, in particular FATF Recommendation 15, which brings virtual assets and their service providers within the same risk-based AML/CFT expectations that apply to traditional financial institutions. Supervisors across every major hub – ESMA and the national competent authorities under MiCA, VARA in Dubai, MAS in Singapore, the SFC in Hong Kong, FINMA in Switzerland, and the FCA in the United Kingdom – have each enacted domestic rules that translate FATF's baseline into binding obligations. No jurisdiction in which a digital-asset business operates is free of this requirement. The only variable is how it is implemented and audited.
The regulated basis matters for counsel because the legal standard is not a technology specification – it is a risk-based obligation. A firm must demonstrate that its monitoring program is calibrated to its specific risk profile: the asset classes it handles, the geography of its user base, the channels through which value moves, and the counterparties it faces. A system that satisfies VARA's rulebook expectations may not satisfy the FCA's financial crime guidance without adjustment. In our practice, we regularly advise firms that discover this mismatch only after a supervisory visit.
Under MiCA, CASP authorisation (the Crypto-Asset Service Provider authorisation that allows an operator to passport across the EU/EEA) carries an explicit AML compliance obligation enforced by the relevant national competent authority. The European Banking Authority has published sector-specific guidance on the risk-based approach for crypto-asset service providers. A CASP that passports into multiple member states faces the added complexity of satisfying both the home-state supervisor and the host-state expectations, which are not always identical.
For a scoped assessment of your monitoring program's regulatory basis, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What Does Legal Counsel for Transaction Monitoring Setup Actually Cover?
Legal counsel for transaction monitoring setup is not software procurement advice – it is the structured legal work that ensures your monitoring architecture satisfies the regulatory obligations that apply to your business. At OBOLUS, the engagement covers six defined areas.
First, we establish the regulatory perimeter: which regimes govern your entity and your activities, and what each demands at a minimum. This is more complex than it appears. A custodian incorporated in a low-tax offshore jurisdiction but serving institutional clients in the EU, Singapore, and the UAE simultaneously touches at least three supervisory regimes. The monitoring program must be defensible under each.
Second, we review or draft the core policy documents – the AML/CFT policy, the risk appetite statement, the customer risk-rating methodology, and the transaction monitoring policy itself. These documents are what a supervisor reads first. Poorly drafted policies signal a firm that does not understand its own obligations.
Third, we advise on the rule-set and typology library for your monitoring system. This is legal work because the rule-set must reflect the regulatory expectations of your supervisors. Rules calibrated to catch structuring in a fiat payment context may miss the on-chain patterns – layering through mixers, rapid chain-hopping, exposure to sanctioned addresses – that regulators now expect a VASP to detect.
Fourth, we advise on the Travel Rule implementation. Under FATF Recommendation 16 and its domestic implementations, a VASP must collect, verify, and transmit originator and beneficiary data above the applicable threshold. The threshold varies by jurisdiction, which creates a compliance matrix for any cross-border operator. Selecting a Travel Rule solution and embedding the legal obligation into your onboarding and transfer workflows is work that requires legal sign-off, not only a technology decision.
Fifth, we advise on KYC framework (know-your-customer framework) design – the CDD and EDD procedures, beneficial ownership verification, PEP and sanctions screening, and the refresh triggers that keep customer files current. The KYC framework feeds the monitoring system: a miscalibrated risk rating at onboarding means the monitoring rules fire on the wrong population.
Sixth, we advise on MLRO appointment, accountability structure, and the governance framework that connects the compliance function to the board. Every regime that mandates AML compliance for digital-asset businesses also mandates a named, responsible individual. Getting that accountability structure right matters because it is the first thing a regulator examines when something goes wrong.
What Does the Setup Process Look Like, and How Long Does It Take?
Transaction monitoring setup, when approached as a legal engagement, follows a defined sequence that typically runs across several weeks, depending on the firm's starting point and the number of supervisory regimes in scope.
In the first phase – which typically runs for a week or two – we conduct a regulatory gap analysis. We map the firm's current state: existing policies, any prior supervisory correspondence, the technology stack in use, and the jurisdictions in which the firm operates or plans to operate. The output is a gap memorandum that identifies every shortfall and ranks remediation by regulatory urgency.
In the second phase, we produce or revise the policy and procedure suite. This is drafting work, but it requires legal judgment at every step. A transaction monitoring policy that cites the wrong regulatory standard, or that sets a de-minimis threshold that does not match the applicable Travel Rule threshold, creates a self-inflicted audit finding.
In the third phase, we advise on rule-set design in close coordination with the firm's compliance technology vendor. We do not supply the software. We provide the legal specifications the rule-set must meet and review the mapping from regulatory obligation to implemented rule. This phase also covers the Travel Rule solution's legal configuration – the VASP-to-VASP data-sharing protocol, the treatment of unhosted wallets, and the handling of counterparties in jurisdictions without a Travel Rule regime.
In the fourth phase, we deliver a compliance readiness memorandum – a document the MLRO can present to a supervisor, a banking partner, or a prospective institutional client as evidence that the program has been constructed with legal oversight. We have seen this document serve as the decisive factor in a banking relationship that was under review.
The total elapsed time varies. A firm with existing policies that need revision typically moves faster than a firm building from the ground up. Cross-border scope adds time because each jurisdiction's requirements must be mapped and reconciled. We scope each engagement before we begin and give a clear timeline in that scope.
What Are the Most Costly Mistakes in Transaction Monitoring Setup?
In our cross-border practice, we see the same failure modes repeat across exchanges, custodians, and payment facilitators at every stage of maturity.
The most frequent is treating transaction monitoring as a technology problem alone. Firms buy a screening tool, configure a standard rule-set, and consider the obligation met. Supervisors do not agree. The FCA, FINMA, and MAS each expect the firm to demonstrate that its rule-set is calibrated to its specific risk profile – not to the default configuration that comes out of the box. When a supervisory visit arrives, the absence of that demonstrated calibration is an immediate finding.
The second most frequent mistake is building the Travel Rule workflow as an afterthought. Travel Rule data must be collected before a transfer is executed, not reconciled afterwards. Firms that retrofit the obligation into existing transfer flows create gaps – typically at the point of transfer to an unhosted wallet or to a VASP in a non-Travel-Rule jurisdiction – that accumulate into systemic non-compliance.
The third mistake is failing to connect the KYC framework to the monitoring system. If the risk rating assigned at onboarding does not propagate correctly into the transaction monitoring engine, the engine operates without context. A high-risk customer flagged at onboarding who then transacts without elevated monitoring is a compliance failure regardless of how good the underlying technology is.
A fourth, less visible mistake is the governance gap: no named MLRO with clear authority, no escalation path from the compliance function to the board, and no record of board-level engagement with AML risk. In every regime we operate in – from MiCA's NCA supervision to VARA's rulebook to the FCA's senior manager accountability expectations – that governance gap is itself a breach, independent of whether any suspicious transaction was missed.
How Does Cross-Border Operation Change the Monitoring Obligation?
Every digital-asset firm of any scale faces a multi-jurisdiction reality. The entity may sit in one jurisdiction, the users in several others, and the banking relationships in a third set. Each of those touch points potentially brings a separate supervisory expectation into the picture.
Under MiCA, a CASP passporting into multiple EU member states is supervised primarily by its home-state NCA, but host states retain certain supervisory rights, particularly around conduct. The monitoring program must satisfy the home-state standard. But if a host-state supervisor conducts a visit – which they may do – the program will be examined through their lens as well.
A firm with a VARA licence in Dubai and a MAS-regulated operation in Singapore runs two separate supervisory relationships, each with its own inspection cycle, its own AML examination expectations, and its own Travel Rule threshold. Those two programs need not be identical, but they must be consistent at the level of risk appetite and governance. We have seen firms maintain separate policy documents for each jurisdiction with no overarching framework connecting them. That fragmentation creates internal contradictions that surface badly in a joint supervisory review.
The cross-border Travel Rule challenge is particularly acute. When a VASP in a Travel Rule jurisdiction sends funds to a VASP in a jurisdiction without a Travel Rule regime, the sending VASP still has obligations under its home rules. The receiving VASP may have no corresponding obligation. The legal position of each party in that transaction chain is a matter of counsel, not of the transfer software alone.
Allied counsel in the relevant jurisdiction will often be involved where the cross-border configuration is complex. Our engagement model accounts for that coordination explicitly. We do not assume that a monitoring program built for one jurisdiction will transfer to another without adjustment.
A Cross-Border Monitoring Program Under Two Supervisors
In a recent engagement, an exchange holding a licence in a Gulf-region regulatory free zone and a registration in a European Union member state retained us to consolidate its transaction monitoring and Travel Rule programs ahead of a supervisory examination in the EU jurisdiction. The firm had built two separate monitoring systems with different risk-rating methodologies and no shared typology library. We conducted a gap analysis, produced a unified AML policy and governance framework that both supervisors could read consistently, and revised the Travel Rule workflow to capture the data handoff at the point of transfer initiation rather than on settlement. The supervisory examination concluded without a critical finding. The banking relationship that had been under review was retained.
Which Firms Need Legal Counsel for This, and When?
Not every firm is at the same point in the monitoring lifecycle. The engagement looks different depending on the profile.
A newly licensed exchange building its compliance program from the ground up is the clearest case for a full-scope engagement: gap analysis, policy suite, rule-set legal specifications, Travel Rule workflow, governance structure, MLRO accountability. The timeline here is the most extended, and the investment in getting it right at the start avoids the much higher cost of remediation under supervisory pressure.
A growth-stage custodian that has outgrown its initial compliance setup – typically because it has expanded into new jurisdictions or added product lines – needs a targeted gap analysis and a policy update. The rule-set may need to be rethought for the new asset classes. The Travel Rule configuration will almost certainly need revision as new jurisdictions are added. The MLRO's authority and resourcing may need to be re-documented as the firm scales. This is a mid-scope engagement with a faster turnaround.
An established payment facilitator or token issuer facing a banking review or a supervisory examination needs rapid, focused support: a compliance readiness memorandum, a legal opinion on the adequacy of the monitoring program, and, where a finding has already been made, a remediation plan with a defensible timeline. This is the highest-urgency profile. Recovery windows are short.
In every case, the engagement begins with a scoped assessment. We do not propose a standard retainer until we have read the firm's current state. The scope drives the structure and the timeline.
If a supervisory review or a banking relationship is under pressure, contact OBOLUS now at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options
Is an Offshore Licence Sufficient to Cover Global Operations?
A common assumption among operators entering the digital-asset space is that a single licence – particularly one obtained in a low-cost offshore jurisdiction – is sufficient to serve clients globally. This assumption is incorrect as a matter of regulatory law and has practical consequences that are becoming more severe as enforcement tightens.
Every jurisdiction asserts supervisory authority over activity that has a sufficient nexus to its territory. That nexus may be established by the location of the customer, the location of the banking partner, the language of the marketing material, or the jurisdiction where key personnel sit. Regulators in the EU, the UK, Singapore, and the UAE have each taken enforcement action against firms that operated in their jurisdictions without local authorisation on the basis that a foreign licence was sufficient. It is not.
The transaction monitoring and AML implications are equally direct. A monitoring program calibrated to the requirements of a light-touch jurisdiction will not satisfy the expectations of a FATF-compliant supervisor in a major market. When a correspondent bank in a major financial center runs its own due diligence on the firm's AML program, it applies its own home-jurisdiction standard – and in most cases that standard is at least as demanding as the bank's own supervisory requirements. A program built for a single offshore jurisdiction will fail that review.
The correct approach is to map the full licensing stack before the business is operational – the operating entity, the custody vehicle, the payment layer, and the jurisdiction of the primary banking relationship – and to design the monitoring program to satisfy the most demanding supervisor in that stack. That is the work OBOLUS does at the outset of every engagement of this kind.
Self-Assessment: Is Your Program Ready for a Supervisory Examination?
The following questions are drawn from the examination frameworks that supervisors in the leading VASP hubs routinely apply. A firm that cannot answer each question with documentary evidence is exposed.
- Does your AML/CFT policy name the specific regulatory regimes under which your firm operates, and has it been reviewed by legal counsel in the past twelve months?
- Is your transaction monitoring rule-set documented in a policy that explains how each rule was calibrated to your firm's risk profile?
- Does your Travel Rule implementation capture originator and beneficiary data at the point of transfer initiation, before execution?
- Is your KYC risk-rating methodology connected to your monitoring system, so that a high-risk customer triggers elevated monitoring rules automatically?
- Is your MLRO a named individual with documented authority, adequate resourcing, and a direct reporting line to the board?
- Does your board receive regular AML risk reporting, and is that reporting documented in board minutes?
- Have you mapped the Travel Rule obligations that apply in each jurisdiction where you operate or where your counterparties are located?
- Is your sanctions screening applied at onboarding, at transfer initiation, and on a periodic refresh basis?
A firm that answers no to two or more of these questions has identifiable remediation work to do before a supervisory examination. The remediation is almost always faster and less disruptive when initiated before the examination notice arrives.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – our full practice overview covering the AML/CFT obligations that apply to VASPs globally
- Transaction monitoring setup in Guernsey – jurisdiction-specific analysis of monitoring obligations for digital-asset firms in Guernsey
- Crypto regulation and licensing in Switzerland – FINMA's licensing and AML framework for Swiss-based digital-asset businesses
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a VASP originating a virtual asset transfer to collect, verify, and transmit identifying information about the originator and the beneficiary to the receiving VASP – before or simultaneously with the transfer. The specific data fields and the transfer threshold above which the obligation applies vary by jurisdiction. Most FATF-aligned regimes follow Recommendation 16's baseline. Where a receiving VASP is in a jurisdiction without a matching regime, the sending VASP must still comply with its own home-jurisdiction obligations and apply enhanced due diligence to assess the counterparty risk.
Who must act as MLRO for a crypto firm?
Every VASP operating under an AML/CFT-regulated regime must appoint a named MLRO (Money Laundering Reporting Officer) – an individual with documented authority to make suspicious activity reports, to oversee the AML program, and to report directly to senior management or the board. The personal accountability expectations differ across regimes: the FCA, VARA, MAS, and MiCA's national competent authorities each set out the qualifications, seniority, and resourcing that make an MLRO appointment credible. Appointing a nominal MLRO without adequate authority or resource is itself a regulatory finding.
How do regulators audit crypto AML programs?
Supervisors in the leading VASP jurisdictions – including VARA, MAS, the SFC, FINMA, and national competent authorities under MiCA – audit AML programs through a combination of document review, interview, and transaction-level testing. They typically request the AML/CFT policy, the risk appetite statement, the transaction monitoring rule-set documentation, a sample of SAR filings, and evidence of board-level AML reporting. They will also test whether the monitoring system actually caught, escalated, and resolved a sample of flagged transactions. A program that exists only on paper will not survive that test.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance obligations that sit around them. Digital assets are the whole of our practice. We map the licence, monitoring, and Travel Rule stack across operating, custody, and payment layers before you commit – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery is needed. To discuss your transaction monitoring setup or AML program, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in AML/CFT program architecture, Travel Rule implementation, and multi-jurisdictional VASP compliance.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.