AML Screening for Crypto Exchanges

AML screening checks a firm's customers and their payments against the lists that name sanctioned and high-risk parties. A licensed firm runs it to keep those parties' money out of its accounts, and to prove it did.

Proving it is the expensive half for a crypto exchange or a broker, where the work starts the moment a name matches a list. When the FCA reviewed sanctions controls at more than 150 firms, only 44% closed a name-screening alert within one working day , and over a quarter needed three to five days, long enough for a newly designated customer to withdraw.

This guide covers the four checks, the supervisors who grade them, and three ways to run them, including B2BROKER's integrated back office.

What Is AML Screening?

Anti-money laundering (AML) screening matches every customer, counterparty, and payment a regulated firm handles against sanctions, PEP, and adverse-media data, in search of money laundering and terrorist financing risk.

Screening repeats for as long as the account is open. A sanctions list can add a name overnight, and a low-risk retail trader can become a PEP's business partner a year after onboarding.

In the EU, the Anti-Money Laundering Regulation applies directly in all 27 member states from July 10, 2027 , replacing national transpositions that let the same customer face different checks in different countries.

Core AML Screening Checks

Each of the four checks in a complete screening stack covers a risk the other three tend to miss.

Sanctions Screening

Sanctions screening compares every customer and counterparty name against official lists such as OFAC's SDN list and the UK Sanctions List, at onboarding and again each time a list changes.

Only around two-thirds of the firms the FCA reviewed load a list update within one day. In the regulator's own testing, screening systems caught the sanctioned party in 90% of alerts when the name matched exactly but in 75% when the spelling varied .

PEP Screening

PEP screening identifies customers who hold or recently held a prominent public function, along with their immediate family and close associates, and routes the account to enhanced due diligence (EDD).

A PEP match calls for proportionate diligence: a documented source of funds and source of wealth, a shorter review cycle, and a senior manager's sign-off before the account trades. Refusal is not the requirement. On these files, the FCA most often finds diligence that was run but never recorded, leaving nothing to show at the next review.

Adverse Media and Beneficial Ownership Checks

Adverse media screening flags a customer named in credible reporting on fraud, corruption, or sanctions evasion. Beneficial ownership checks find the person who controls a corporate account behind its holding companies. Both catch risk before an official list does.

Ownership is where the FCA found firms struggling most. They could not trace upstream owners through multilayered structures or connect a counterparty to a designated person when the link ran through an intermediary. For a corporate client, the check has to reach the beneficial owners behind the entity.

The AML Regulatory Landscape Today

The alert data is now the evidence a supervisor works from. Since February 2022, the FCA has tested firms' screening calibration itself, against their own financial-crime returns, and published where it failed, down to honorifics that pushed a match below the alert threshold.

The EU is centralizing the same expectation in one supervisor. AMLA's first programming document, published in February 2026, commits the new authority to a single AML rulebook and convergent supervision across member states by 2028. To deliver it, the authority is growing from 120 staff to 432.

Who Needs AML Screening and Why

A licensed forex broker, crypto exchange, prime broker, or fintech that holds or moves client money is an obliged entity under the AML law of the country that licensed it. Firms diverge from there on which AML checks they run, on which relationships, and which regulator grades the result.

How hard that regulator pushes follows the country's own Financial Action Task Force (FATF) cycle, now in a fifth round that grades effectiveness in practice. A country awaiting its on-site visit, as the UK is for June 2027, tends to press its firms harder in the run-up.

Forex Brokers and MiFID Exposure

A MiFID-licensed forex broker screens clients at onboarding under AML law. The Market Abuse Regulation then keeps it watching how they trade and reporting suspicious orders and transactions. MiFID II client categorization feeds that monitoring, with an eligible counterparty hedging in size and a retail client trading a few lots leaving different footprints.

Layering shows up as ordinary trading on an otherwise clean KYC file. It surfaces only where surveillance and screening read the same customer record.

Crypto Exchanges and VASP Obligations

A crypto exchange is a virtual asset service provider under FATF's Recommendation 15. On top of the checks a forex broker runs, it screens wallet addresses and, under the Travel Rule, exchanges originator and beneficiary details with the counterparty VASP. In the EU, that data travels with every transfer, at any amount.

Legislation has spread faster than supervision. FATF's July 2026 update counts 91 of 109 surveyed jurisdictions with Travel Rule legislation in force , up from 73% of respondents a year earlier, while 60% of those 91 have yet to take a single supervisory action under it.

Licensing turns the controls into a condition of market access. Hong Kong has required a license to issue fiat-referenced stablecoins since August 1, 2025, with an AML/CFT guideline attached to it. Few firms get one. In April 2026, the regulator granted two licenses out of 36 applications .

Prime Brokers and Institutional Desks

A prime broker's exposure runs through every firm in its settlement chain. That puts counterparties, custodians, and liquidity providers under screening for the life of each relationship.

Here the check that matters is who owns and controls the counterparty. In the FCA's casework, a link that sat inside a corporate group was enough to hide whether a counterparty was owned by a designated person. Firms that came out well in the same review compared each counterparty's activity against the business model declared at onboarding.

How AML Screening Works

Screening runs as three connected stages: onboarding, ongoing monitoring, and escalation. Supervisors report most failures in the handoff between them. When the three stages keep separate records, a payments system approves the withdrawal that monitoring already flagged.

Onboarding and Customer Due Diligence

Onboarding screening runs identity verification under know your customer (KYC) rules, matches the name against sanctions lists and the PEP database, and assigns a risk score before the account can trade.

A risk-based approach then sets the depth of the file. A retail client from a low-risk country gets standard customer due diligence (CDD), while a corporate account from a country on FATF's gray list needs source of funds documented and a senior sign-off before it opens.

The thresholds that trigger these checks sit lower for crypto than for any other sector. Under the EU's AMLR, a crypto-asset service provider applies full due diligence to an occasional transaction of €1,000 and still identifies the customer below that amount. For most other financial institutions, the first threshold is €10,000.

Ongoing Transaction Monitoring

Every change to a sanctions list rescreens the whole customer book. Real-time monitoring works in the other direction, reading each deposit, withdrawal, and trade against the activity that the customer was expected to show at onboarding.

The FCA's breach reports show what that catches: funds moved out within days of the holder's designation, or money routed through crypto wallets to hide a link to a designated person. Both surface only in complete payment data tied to the account.

In B2CORE, deposits and withdrawals across payment providers run through a single Payment System Service that logs the amount received and the fee at the point of deposit.

A stolen login turns a clean account into a channel for someone else's money, putting account security next to monitoring. The B2CORE iOS app pushes an alert on a login from an unrecognized location, a password reset, or a 2FA change .

Escalation and Suspicious Activity Reporting

Escalation turns a monitoring alert into a documented decision inside a fixed window that starts at detection. A crypto exchange registered in the US as a money services business files its suspicious activity report within 30 calendar days of detection for transactions of $2,000 or more , with a further 30 days only if it cannot identify a suspect.

Under the Bank Secrecy Act, as amended by the USA PATRIOT Act, that same exchange also maintains a written AML compliance program with internal controls, a named compliance officer, and ongoing employee training.

Detection is rarely the failure here. One bank in the FCA's review saw its alerts fire on a newly designated individual, then watched its payments go out anyway before anyone applied restrictions. The regulator names the handoff between teams as the cause. The practices it rated as strong are ordinary ones:

• an internal deadline for closing an alert
• a written rationale on every closed alert
• a second reviewer sampling those closures for quality

Setting Up Robust Monitoring Rules

A monitoring rule earns its place when it catches real risk without burying analysts in alerts. True matches are rare enough that the tuning carries as much weight as the rule itself.

In the FCA's data, 95% of the firms that run repeat customer screening had not found a single true sanctions match since 2022 . At those firms, every alert an analyst opened was a false positive.

Tightening a rule moves that cost without removing it. The alert still fires, and the firm's own service level decides whether anyone reaches it before the funds leave. Where a vendor tunes thresholds with machine learning, the settings are still the firm's to explain. The FCA's findings call it poor practice to leave them unreviewed.

Transaction Thresholds and Layering Signals

Threshold rules flag a single transaction above a set amount. Layering rules catch the pattern built to stay beneath it.

Start from the filing rule you answer to, such as the $2,000 floor at which a US money services business reports a suspicious transaction, and then set the detection thresholds below it, so that a pattern surfaces before the obligation to file does. Three patterns each deserve their own rule:

• several deposits sized just under the reporting threshold in one day, which is what structuring looks like
• a chain of transfers across accounts opened in the same week
• a deposit withdrawn within the hour with no trade in between

High-Risk Jurisdiction Flags

A jurisdiction flag adds the customer's country exposure to the rule's score, with the FATF lists of jurisdictions under increased monitoring or subject to a call for action as the baseline. Country exposure runs past the passport to residence and the funding bank, each carrying a score of its own.

Score the countries yourself. Where firms bought jurisdictional ratings from a vendor and never challenged them, the FCA flagged a weakness, in some cases finding those ratings inconsistent with FATF's own assessments.

A supervisor grades the queue behind your alerts, and the one true match waits in the same queue as the false positives.

Build, Buy, or Partner for Compliance

You can build AML screening tools in-house, buy a standalone point solution, or take screening as part of an integrated platform. Each option puts your screening data in a different place and leaves a different person able to explain a missed alert.

An in-house build gives you full control of the rules and the data model. The bill arrives every year in list feeds, re-testing after each list change, and developers on call when a regulator moves a threshold. The FCA's testing found long names that exceeded a system's character limit and failed silently. A firm that built its own filter finds that bug itself.

A standalone point tool deploys in days and does the screening well, out of a record it keeps separately from the CRM and the payment system. The alert fires in one system, the account lives in a second, and the withdrawal clears in a third.

An integrated partner puts the screening inside the system that already opens the account and processes the deposit. You still own the governance. When several firms had to ask their vendor why a name had not alerted, the FCA called that dependence poor practice. You govern one record instead of three.

Comparison at a Glance

Five criteria decide the choice.

An in-house build suits a firm with its own engineers, one product, and one jurisdiction, and stops paying for itself as soon as records fragment past that.

AML Screening Inside B2BROKER's Ecosystem

In B2BROKER's ecosystem, AML screening runs inside B2CORE , the back office that opens the account, holds the KYC file, and processes the deposit. Screening alerts and the evidence behind them stay in that same client file, next to the KYC documents and the payment history.

B2CORE ships with more than 150 ready integrations, KYC and antifraud providers among them. Whatever those providers return stays in the client record. Role-based user groups decide which compliance officer sees which clients, and the audit trail records who changed what and when.

The same record feeds the rest of the stack. Multi-asset liquidity supplies the pricing, B2TRADER feeds trading activity into the client record, and B2BROKER's partner B2BINPAY , integrated with B2CORE, covers the crypto payment leg, keeping deposits and withdrawals inside the same compliance record.

Service has legal and jurisdictional limitations. Check T&Cs here .

B2CORE CRM and Integrated Payments

B2CORE keeps the compliance record current without freezing the client. Its v21 release added dynamic address verification to keep the record audit-ready when a client moves, without pausing their trading. Jurisdiction-based segmentation from the same release switches features on or off by the client's country.

On the payments side, the Payment System Service hands the monitoring rules a single payment record where each provider would otherwise file its own.

The back office comes from a regulated operator. B2BROKER has built brokerage infrastructure since 2014 and holds more than 10 regulatory licenses of its own, each putting one of its entities under the same AML obligations its clients carry. More than 1,000 corporate clients run on it.

Whichever path you take, start from where the alert, the KYC file, and the payment will live when a supervisor asks for them, and map that against your verticals and jurisdictions with B2BROKER's team.