CryptolicensePowered by Paralex
Discuss your project
  1. Home
  2. Financial licences
  3. AML/CFT and compliance

AML/CFT compliance that works in daily operations

Regulators look beyond written policies: they check whether customers are actually identified, alerts are actually reviewed and reports actually reach the financial intelligence unit. We design and implement AML/CFT frameworks for crypto, payment, e-money, brokerage and currency exchange businesses — from the risk assessment to the tools and training.

AML/CFTTravel ruleInspection readiness
Discuss your projectJurisdictions
The regime

Why AML/CFT is a separate workstream

AML/CFT (anti-money laundering and countering the financing of terrorism) is a condition of almost every financial licence and registration. In some regimes it is the core obligation: money services businesses in Canada and the United States register with FINTRAC and FinCEN rather than obtaining a licence, and Swiss financial intermediaries comply with the Anti-Money Laundering Act (AMLA) through membership of a self-regulatory organisation. In others, such as payment organisations in Kazakhstan, AML/CFT internal control rules are part of the registration package itself.

For crypto-asset businesses the bar is higher. In the EU, Regulation (EU) 2023/1113 extended the information requirements for transfers, known as the travel rule, to crypto-asset transfers from 30 December 2024. Kazakhstan's Law on Digital Assets requires providers to collect information on the originator and the beneficiary and does not allow a transfer to proceed without it.

We work with the company and with the officer it appoints. We do not act as an MLRO (money laundering reporting officer) or perform any other regulated function on the client's behalf: decisions and reports remain the company's responsibility. Where the law allows, we can discuss outsourced support models, subject to confirmation for each project.

Who this is for

  • Crypto exchanges, brokers, custodians and trading platforms preparing for licensing or already licensed
  • Payment institutions, e-money institutions and money remittance businesses
  • Investment firms and brokers onboarding clients and investors
  • Currency exchange offices
  • Companies that have received inspection findings and need a remediation plan
  • Groups entering a new jurisdiction that need to adapt their policies to local law
  • Fintech companies choosing KYC, screening or blockchain analytics providers
Scope

Scope of our work

What we do

  • Business-wide ML/TF (money laundering and terrorist financing) risk assessment and risk appetite
  • AML/CFT policies, procedures and internal control rules aligned with the applicable law
  • KYC/KYB, verification of customers and beneficial owners, sanctions screening and PEP (politically exposed persons) procedures
  • Transaction monitoring scenarios and suspicious activity handling workflows
  • Travel rule processes for crypto-asset transfers
  • Staff training, inspection preparation and remediation of findings
  • Selection and integration of KYC, screening and blockchain analytics tools together with our engineers

What remains with the company

  • Appointment of the compliance officer or MLRO and that person's decisions
  • Decisions to onboard, reject or exit customers
  • Reports to the financial intelligence unit, submitted through the company's designated officer
  • Day-to-day performance of controls by the company's staff
  • Accountability of the board and management for the AML/CFT framework
  • Contracts with technology providers and their fees
Jurisdictions

AML/CFT frameworks by jurisdiction

Each jurisdiction combines a licensing authority, an AML/CFT supervisor and a financial intelligence unit in its own way. The examples below show where the main obligations come from.

JurisdictionRegulator / supervisorRegimeKey points
European UnionNational authorities; EBA guidelinesRegulation (EU) 2023/1113Travel rule for transfers of funds and crypto-assets applies from 30 December 2024; EBA Travel Rule Guidelines apply from the same date
EstoniaFinantsinspektsioon; Financial Intelligence UnitCASP authorisation; AML/CFT supervision by the FIUFinantsinspektsioon authorises CASPs; the FIU remains the AML/CFT supervisor
MaltaMFSA; FIAULicence and AML/CFT supervisionThe MFSA licenses CASPs; AML/CFT supervision is carried out by the FIAU
Kazakhstan (national regime)NBK; ARDFMLicence or registration with AML/CFT requirementsPayment organisations submit AML/CFT internal control rules and appoint a compliance controller; digital asset providers collect originator and beneficiary information
AIFC (Astana)AFSAAuthorisationSeparate from the national regime; AML/CFT arrangements are reviewed within AFSA authorisation and supervision and confirmed for each project
United KingdomFCARegistration under the MLRs 2017Cryptoasset exchange and custodian wallet providers register with the FCA under the Money Laundering Regulations
SwitzerlandSelf-regulatory organisations (SROs) recognised by FINMASRO membership (AMLA)Professional financial intermediaries, including those trading virtual currencies, must join an SRO, which supervises them
CanadaFINTRACMSB registration (not a licence)Compliance programme: compliance officer, policies, risk assessment, training and an effectiveness review at least every two years
United StatesFinCENMSB registration (not a licence)Registration on FinCEN Form 107 within 180 days, renewal every two years, AML programme
SeychellesFSAVASP (virtual asset service provider) licenceFull-time compliance officer and deputy; outsourcing of the role is not permitted; travel rule applies

How jurisdictions differ

  • Who supervises: in Estonia and Malta AML/CFT supervision sits with a body other than the licensing authority, and in Switzerland many intermediaries are supervised by self-regulatory organisations.
  • Registration versus licence: FINTRAC and FinCEN registrations are not licences and do not mean approval, yet they carry full AML programme obligations.
  • Travel rule: the EU applies Regulation (EU) 2023/1113 from 30 December 2024; Kazakhstan requires originator and beneficiary information for digital asset transfers; other jurisdictions set their own rules.
  • Ownership screening: in Kazakhstan, founders of a digital asset exchange operator may not be from countries on the FATF lists or appear on AML/CFT sanctions lists.
  • Compliance officer: some regimes require a full-time officer and prohibit outsourcing of the role, as is the case for Seychelles VASPs; others allow external support under conditions.
  • Review cycle: Canada requires the compliance programme to be reviewed at least every two years; elsewhere the frequency follows the regulator's rules.
Requirements

What a working framework requires

Governance

  • AML/CFT policy and risk appetite approved by the board
  • Business-wide risk assessment covering customers, products, channels and geographies
  • Responsibility allocated to an appointed compliance officer with direct access to management
  • Transparent ownership of the company itself: verified beneficial owners and source of funds

Budget and resources

  • Budget for compliance staff, training and independent review
  • Subscriptions to KYC, screening, monitoring and, for crypto, blockchain analytics tools
  • Capacity planning: expected alert volumes against the number of analysts
  • Infrastructure for record retention

People and roles

  • Compliance officer meeting the qualification and residency rules of the jurisdiction
  • Trained front-line staff for onboarding and payments
  • Independent review or internal audit function
  • Documented escalation path to the officer for suspicious activity

Processes and systems

  • Customer risk scoring and triggers for enhanced due diligence
  • Sanctions and PEP screening at onboarding and on an ongoing basis
  • Transaction monitoring rules calibrated to the business model
  • Travel rule data exchange for crypto-asset transfers
  • Case management and an audit trail of decisions and reports

Regulatory capital is separate from state and application fees, operating costs and our fees. Our fees are agreed after the project assessment.

Documents

Documents we prepare

  • Business-wide ML/TF risk assessment
  • AML/CFT policy and internal control rules
  • Customer due diligence (KYC/KYB) procedures and risk scoring methodology
  • Sanctions screening and PEP procedures
  • Transaction monitoring scenarios and alert handling procedure
  • Suspicious activity escalation and reporting procedure
  • Travel rule procedure for crypto-asset transfers
  • Record-keeping and data retention procedure
  • Training programme and training plan
  • Compliance monitoring plan and remediation tracker
  • Tool selection memo and integration specification
Process

How the project runs

  1. 01

    Diagnostics

    We review the business model, current documents, systems and any inspection findings, and map the applicable requirements.

  2. 02

    Risk assessment

    We prepare the business-wide ML/TF risk assessment that sets the basis for all controls.

  3. 03

    Policies and procedures

    We draft or rewrite policies, procedures and internal control rules for the jurisdiction and the actual operations.

  4. 04

    Tools and integration

    We help select KYC, screening, monitoring and blockchain analytics providers, and our engineers integrate them into onboarding and payment flows.

  5. 05

    Training and testing

    We train staff and the officer, test scenarios on sample data and adjust thresholds.

  6. 06

    Inspection readiness

    We prepare evidence files, run a mock review and support the remediation of findings.

Timing

Timing

The law sets no deadline for building a framework, but hard dates surround it: an application for a licence or registration cannot be filed without AML/CFT documents, and supervisors may set deadlines for remediating inspection findings. The duration of our work depends on the factors below.

  • Number of products, jurisdictions and customer types
  • Whether the company starts from scratch or adapts existing group policies
  • Readiness of the IT stack and the data available for monitoring
  • Choice and contracting of technology providers
  • Volume and nature of inspection findings
Our work

What our team does

Lawyers

  • Analysis of the AML/CFT law and regulator rules that apply to the business
  • Policies, procedures and internal control rules
  • Contracts with KYC, screening and analytics providers, including data protection terms
  • Customer terms and onboarding disclosures
  • Responses to regulator requests and inspection findings
  • Work with local counsel where foreign law applies

Finance specialists

  • Compliance budget and cost model
  • Methodology for analysing source of funds and source of wealth
  • Financial crime indicators for payment and trading flows
  • Alignment of AML/CFT data with financial and regulatory reporting

AML/compliance specialists

  • Business-wide risk assessment and customer risk scoring
  • KYC/KYB, beneficial owner verification, sanctions and PEP procedures
  • Transaction monitoring scenarios and alert handling
  • Support for the appointed officer in analysing suspicious activity and preparing reports to the FIU
  • Training of staff and management
  • Mock inspections and remediation plans

Engineers

  • Integration of KYC and screening providers into onboarding
  • Transaction monitoring rules and case management set-up
  • Integration of a travel rule solution for crypto-asset transfers
  • Blockchain analytics integration for wallet and transaction risk
  • Audit trail, record retention and reporting data
After authorisation

Ongoing support

  • Updating the risk assessment when products, customers or jurisdictions change
  • Regular review and calibration of monitoring scenarios
  • Refreshing customer due diligence according to risk
  • Ongoing staff training
  • Tracking changes to sanctions lists, FATF lists and national law
  • Periodic independent review of the framework
  • Support during inspections and remediation
Related services

Related services and regimes

Digital asset exchange

Buying, selling and exchanging digital assets for clients: exchange services, online exchangers, in-app exchange.

Learn more
EU · MiCAAuthorisationEU passport

MiCA CASP authorisation

Authorisation of a crypto-asset service provider under MiCA in an EU Member State, with a passport to serve clients across the Union.

Learn more

Payment and fintech solutions

Payment services linked to digital assets, e-money, payment apps and infrastructure.

Learn more
EU · UK · UAE · SGKazakhstan · NBKAIFC · AFSA

Payment institution licence

Authorisation or registration of a payment service provider in the EU, UK, UAE, Singapore, Kazakhstan or the AIFC — from the choice of regime to launch.

Learn more
EU · UK · UAE · HK · SGAIFC · AFSAKazakhstan · bank model

E-money institution licence

Licensing of electronic money institutions and stored value facilities in the EU, UK, UAE, Hong Kong, Singapore and the AIFC, and e-wallet models for Kazakhstan.

Learn more
Fiat · cash and non-cashNot crypto, not FX trading

Currency exchange licence

Licences, registrations and list entries for bureaux de change, exchange houses and money changers dealing in fiat currency: Kazakhstan, EU, UAE, Hong Kong, Singapore, North America.

Learn more
FAQ

Frequently asked questions

Describe your project in a few sentences. We will give you a substantive reply: which questions need answering and where to start.

Discuss your project
Can you act as our MLRO or compliance officer?

No. We do not perform regulated functions for clients. We help the company select and prepare the person it appoints and support that person with methodology, documents and analysis. Where the law of the jurisdiction allows external support, we can discuss outsourced models, subject to confirmation for each project; some regimes, such as the Seychelles VASP regime, require a full-time officer and prohibit outsourcing of the role.

Who files suspicious activity reports?

The company, through its designated officer, files reports with the national financial intelligence unit. We help build the escalation process, prepare the analysis and maintain the documentation, but the decision to report and the submission remain with the company.

What is the travel rule and does it apply to us?

The travel rule requires providers to send and receive information on the originator and the beneficiary of transfers. In the EU, Regulation (EU) 2023/1113 applies it to crypto-asset transfers from 30 December 2024, and Kazakhstan's Law on Digital Assets also requires this information from digital asset providers. Whether and how it applies to you depends on your services and jurisdictions.

We already have group policies. Why adapt them?

Local law sets terminology, thresholds, reporting channels and record-keeping rules. A group policy that does not reflect them is a common inspection finding. We map the gaps and prepare local addenda or full local versions.

Which KYC and blockchain analytics tools do you recommend?

We have no fixed vendor. We derive requirements from the risk assessment and the law, compare providers on coverage, data location and cost, and our engineers integrate the chosen tools. The contract is signed by the company.

Can you help after an inspection?

Yes. We analyse the findings, prepare a remediation plan with owners and deadlines, update documents and processes, and help prepare the evidence the supervisor requests. We cannot guarantee the supervisor's assessment.

Sources checked on 15 October 2026
  • European Banking Authority — Travel Rule Guidelines press release (Regulation (EU) 2023/1113) — https://www.eba.europa.eu/publications-and-media/press-releases/eba-issues-travel-rule-guidance-tackle-money-laundering-and-terrorist-financing-transfers-funds-and (checked 15 Oct 2026)
  • Estonian Financial Intelligence Unit — Authorisation of economic activity — https://www.fiu.ee/en/authorisation-economic-activity/authorisation-economic-activity (checked 15 Oct 2026)
  • Finantsinspektsioon — Transition period for crypto companies — https://fi.ee/en/news/transition-period-crypto-companies-ends-summer (checked 15 Oct 2026)
  • MFSA — Dear CEO letter on VFA licences and transition to CASP — https://www.mfsa.mt/wp-content/uploads/2026/06/Dear-CEO-Letter-VFA-Licence-and-Transition-to-CASP-under-the-Markets-in-Crypto-Assets-Act-MiCA-Act.pdf (checked 15 Oct 2026)
  • National Bank of Kazakhstan — Registration of payment organisations — https://nationalbank.kz/ru/news/uchetnaya-registraciya-platezhnoy-organizacii (checked 15 Oct 2026)
  • Law of the Republic of Kazakhstan No. 193-VII On Digital Assets, official text (IZPI) as amended to 23 Jul 2026 (project file z2300000193.23072026.rus.pdf) (checked 15 Oct 2026)
  • AFSA — Guide on the Authorisation Process — https://afsa.aifc.kz/files/pages/2134/docs/10/guide-on-the-authorisation-process_.pdf (checked 15 Oct 2026)
  • FCA Handbook — PERG 18 (cryptoasset registration under the MLRs) — https://handbook.fca.org.uk/handbook/perg18/perg18s12 (checked 15 Oct 2026)
  • FINMA — Self-regulatory organisations (SROs) — https://www.finma.ch/en/authorisation/self-regulatory-organisations-sros/ (checked 15 Oct 2026)
  • FINMA — FinTech — https://www.finma.ch/en/authorisation/fintech/ (checked 15 Oct 2026)
  • FINTRAC — MSB registration — https://fintrac-canafe.canada.ca/msb-esm/intro-eng11 ; https://fintrac-canafe.canada.ca/msb-esm/reg-eng (checked 15 Oct 2026)
  • FinCEN — Money Services Business registration — https://www.fincen.gov/index.php/money-services-business-msb-registration (checked 15 Oct 2026)
  • FSA Seychelles — VASP FAQs — https://fsaseychelles.sc/vasp/faqs (checked 15 Oct 2026)

Assess your AML/CFT framework

Send us a description of your business model and current documents, or the inspection findings you need to address. We will identify the gaps and propose a work plan; our fees are agreed after this assessment.

Discuss your project
Contact

Tell us about your project

We will review the description and give you a substantive reply: which regime may apply and where to start.

Prefer e-mail? Write to us directly.info@paralex.kz

Powered by Paralex

Services needed

We reply to the contact you provide.