FinCEN's Three Mandates for Crypto AML Compliance
FinCEN Director Kenneth Blanco has delivered one of the clearest statements yet on what the agency actually expects from crypto businesses operating in or serving the United States. Three themes dominated his recent discussion with blockchain analytics firm Elliptic: the intelligence value of Suspicious Activity Reports (SARs), the agency's reach over decentralised platforms, and the non-negotiable requirement to understand every digital asset a firm touches. For compliance officers, auditors, and CFOs with digital asset exposure, each theme carries direct operational weight.
SAR Quality: From Checkbox to Intelligence Asset
FinCEN has received more than 96,000 crypto-related SARs since 2013. That figure alone signals the volume of financial crime intelligence the agency depends on from the private sector. Director Blanco was explicit that quantity is not the point — the quality and specificity of what firms include in each report determines whether investigators can act on it.
What FinCEN actually wants in a SAR narrative
Blanco named specific data types that move cases forward: IP addresses, malware hashes, malicious domains, and virtual currency addresses. In his words, "Whatever you can give us on a SAR that leads us to someplace, that's what you should be doing when you file your SARs." The implication for compliance teams is that a SAR narrative consisting of generic transaction descriptions falls short of what FinCEN considers adequate.
He illustrated the stakes with a real example. When a major cyber incident unfolded over the summer, FinCEN issued an alert asking the private sector to file SARs related to the case as a matter of urgency. The crypto industry responded, and the intelligence gathered from those filings contributed directly to the apprehension of the perpetrators. Blanco noted that the information in SAR forms and narratives can lead investigators to prevent harm, solve serious crimes, or protect individuals from exploitation. This is not rhetorical — it reflects how FinCEN actually uses the data.
Implications for crypto accounting and compliance workflows
For firms using crypto accounting software or digital asset accounting software to manage transaction records, the SAR workflow needs to sit alongside, not separate from, the data those systems capture. Wallet addresses, transaction hashes, and counterparty metadata that are already being recorded for accounting purposes should feed directly into SAR narratives. Firms that treat their bookkeeping data and their AML reporting as siloed processes will struggle to meet Blanco's standard. The records are already there; the gap is usually in the process for surfacing them at filing time.
Compliance programmes should also revisit their SAR review cadence. A report filed 60 days after a suspicious transaction with minimal narrative detail is, in FinCEN's view, a missed opportunity. Tighter integration between transaction monitoring alerts and SAR drafting workflows is the practical response.
DeFi and DEX Platforms: The Substance-Over-Form Rule
Director Blanco's position on decentralised finance is the clearest the agency has articulated to date, and it will be uncomfortable reading for firms that assumed structural decentralisation provided a compliance shield.
FinCEN's functional test for regulated activity
Blanco rejected the argument that a platform without a central operator cannot be regulated. FinCEN's test is functional, not definitional. The agency looks at what a platform does and how it does it, not what it calls itself. If a platform facilitates activity that would be regulated if performed by a traditional money services business, FinCEN will treat it as such. "Just because you call yourself a banana, doesn't mean you're a banana," Blanco said. "It's what you do and how you do it that really matters."
A decentralised exchange (DEX) that fails to apply AML measures is, in FinCEN's view, a non-compliant money services business, not an exempt technology platform. This position has significant consequences for any firm that routes transactions through DEXs as part of its treasury or trading operations, as well as for accounting firms that audit or advise clients with DeFi exposure.
Extraterritorial reach: no safe harbour for foreign-based firms
Blanco was equally direct about geographic scope. Platforms headquartered outside the US are not exempt if they serve US customers. "If you do business in whole or in substantial part in the United States, you fall under our regulations. Period," he said. He cited FinCEN's 2017 action against the BTC-e exchange as a precedent: a foreign-operated platform serving the US market was found liable for operating as an unregistered money services business.
The takeaway for firms is that regulatory arbitrage — operating from a lighter-touch jurisdiction while still onboarding US clients — is not a viable long-term strategy. Firms advising clients with cross-border crypto operations should flag this explicitly. For context on how FinCEN has handled related rulemaking, see our coverage of FinCEN withdraws crypto mixer and unhosted wallet rules, which illustrates how the agency's enforcement priorities and rulemaking can move independently of each other.
The enforcement action against Larry Dean Harmon, the creator of the Helix and Coin Ninja mixers, was also cited by Blanco as an example of FinCEN's zero-tolerance posture. Harmon's mixers were penalised for operating as unregistered money service businesses. The label "mixer" was irrelevant; the activity triggered the obligation.
Transparency and Asset-Level Risk: The Hardest Mandate
The third theme from Blanco's discussion is arguably the most operationally demanding, because it requires firms to have documented, asset-level risk programmes rather than entity-level programmes that treat all digital assets as interchangeable.
Listing 300 assets you don't understand is a liability
Blanco singled out crypto exchanges that list hundreds of cryptoassets without adequately understanding the risk profile of each one. "We've seen instances where [crypto businesses] take on 300, 400 types of crypto they really don't understand," he said. "Well, guess what? You're responsible for it. You better understand what you're dealing with and how you're dealing with it. And even more importantly, how you're going to mitigate that risk."
This is not simply a compliance observation — it has direct accounting implications. If a firm cannot demonstrate it understands the risk characteristics of a digital asset it holds, services, or lists, it has a gap in its risk framework that an examiner or auditor will find. For CFOs managing treasury positions across multiple token types, the requirement to document risk mitigation at the asset level is now explicit.
What a compliant risk programme looks like
Blanco described FinCEN's expectation in practical terms: firms should have a documented risk strategy and a programme that articulates what activities they are willing to take on and how they will manage the associated risks. This goes beyond a generic AML policy. It means per-asset risk assessments, documented onboarding criteria for new listings, and a clear escalation path when an asset's risk profile changes.
For accounting firms advising crypto-native clients, this creates a natural due-diligence obligation. Auditors reviewing a client's digital asset holdings should be asking whether the client can produce asset-level risk documentation. If it cannot, that is both a compliance gap and a potential financial reporting risk, particularly where the asset's liquidity or valuation is tied to its regulatory status.
Blanco's remarks on unhosted wallets also bear noting. He acknowledged that blockchain analytics can provide a level of counterparty insight that is not possible with cash, because wallet addresses associated with known illicit actors or sanctioned entities can be identified through screening. This positions robust transaction screening not as an optional enhancement but as the baseline expectation. For more on how illicit flows move through less-scrutinised infrastructure, our piece on AML red flags compliance teams must know for crypto bridge hacks covers related typologies that examiners are watching.
Practical Steps for Compliance and Accounting Teams
Pulling Blanco's three themes together, the operational priorities for firms are clear.
Immediate actions
First, audit SAR narrative quality. Pull a sample of recent filings and check whether they include the data types Blanco specified: IP addresses, wallet addresses, transaction hashes, and domain information. If narratives are generic, retrain staff and revise templates.
Second, map DeFi and DEX exposure. Any client or firm routing value through decentralised platforms needs to assess whether those platforms meet FinCEN's functional test for a money services business. If they do, AML controls need to be applied or the relationship reconsidered. The classification does not change because the platform uses smart contracts.
Third, build asset-level risk documentation. For every digital asset a firm holds, services, or lists, there should be a record of the risk assessment performed, the decision made, and the controls applied. This is not a one-time exercise; it needs to be refreshed when an asset's characteristics change, for example if it is delisted by regulated exchanges, becomes associated with a sanctioned issuer, or adopts a new privacy feature.
Finally, review the geographic scope of client activity. If any client serves US customers through a non-US entity and assumes that removes FinCEN obligations, that assumption needs to be tested against Blanco's explicit statement on extraterritorial reach.
For firms using crypto bookkeeping software or digital asset accounting software, the data infrastructure to support all of these steps usually already exists. The gap is typically in connecting that data to compliance workflows in a way that is auditable and documented.
Frequently Asked Questions
Does FinCEN's jurisdiction apply to a crypto firm based outside the US?
Yes, according to Director Blanco. If a firm does business in whole or in substantial part in the United States — including by serving US customers — it falls under FinCEN's regulations regardless of where it is incorporated or headquartered. The 2017 action against BTC-e is the standing precedent.
Are DEX platforms exempt from AML requirements because they have no central operator?
FinCEN's position is that exemption is determined by function, not structure. If a DEX facilitates activity that would require AML compliance if performed by a traditional money services business, FinCEN will treat it as a regulated entity. The absence of a central operator is not, on its own, a defence.
What specific information should be included in a crypto SAR narrative?
Director Blanco identified IP addresses, malware hashes, malicious domains, and virtual currency addresses as particularly valuable. Any data point that can help investigators trace illicit activity to a specific actor or address should be included. Generic transaction descriptions without supporting technical detail fall short of FinCEN's expectations.
What does FinCEN expect from firms that list a large number of cryptoassets?
Firms are responsible for understanding the risk profile of every asset they list or service. FinCEN expects documented risk assessments at the asset level, not just an entity-level AML policy. Listing hundreds of tokens without understanding their risk characteristics is, in Blanco's words, something firms will be held accountable for.
How does crypto accounting software connect to AML compliance obligations?
Transaction records, wallet addresses, and counterparty data captured by crypto accounting or digital asset accounting software are exactly the data types FinCEN wants to see in SAR filings. Integrating those records into SAR workflows, rather than treating bookkeeping and AML as separate functions, is the practical step that closes the gap Blanco identified.
Source: Elliptic