Building the compliance function

A compliance program is only as strong as the function that runs it. When supervisors examine a crypto business, they look first at who owns financial crime risk, whether that person can say no to the business, and whether the team has the people, tools and budget its risk profile requires. This lesson shows how to design that function and how to evidence that it works.

What the standard requires

FATF Recommendation 18 requires obliged entities to run programs against money laundering and terrorist financing. Its Interpretive Note lists the minimum content: internal policies, procedures and controls with appropriate compliance management arrangements, screening procedures when hiring employees, an ongoing training program, and an independent audit function to test the system. Compliance management arrangements "should include the appointment of a compliance officer at the management level". The Interpretive Note to Recommendation 15 applies these preventive measures to VASPs.

Two principles run through every design choice:

• Proportionality. The Interpretive Note to Recommendation 18 says the type and extent of measures should match the risk and the size of the business. A 20-person exchange and a global platform with millions of users both need a compliance officer, but not the same structure.
• Accountability at the top. The board sets risk appetite and remains accountable; senior management implements; the compliance function advises, monitors and challenges. The Basel Committee guidelines Sound management of risks related to money laundering and financing of terrorism (first issued 2014, last revised July 2020) describe the same arrangement for banks, with a chief AML/CFT officer in the second line.

The core elements and the three lines model are covered in the lesson Core elements of an AML/CFT program. This lesson turns them into an organization chart, a headcount and a budget.

Organizational design

Most crypto businesses group financial crime work into a handful of teams. Which ones sit in the first line (business and operations) and which in the second (compliance) varies between firms, but the split must be written down and known to staff.

A firm active in several countries chooses among three models. In a centralized model one team serves every market. In a hub-and-spoke model a central team sets standards and runs shared services, with local compliance officers where licenses or local reporting require them. In a federated model each legal entity runs its own program. Hub-and-spoke is the most common for VASPs: tools and on-chain analytics scale centrally, while some regimes require a locally based officer and local filing.

Independence and reporting lines

Independence is tested in practice, not by job title. The evidence a supervisor looks for:

• a direct reporting line from the compliance officer to the board or one of its committees, not only through the chief executive or the head of a revenue line;
• the right to escalate to the board without permission, and unrestricted access to data, systems and staff;
• no business-line responsibilities: a compliance officer who also runs operations or growth ends up reviewing their own decisions;
• pay not linked to revenue, trading volume or onboarding numbers;
• appointment and dismissal decided or approved by the board;
• a protected reporting decision: no one can instruct the compliance officer not to file a suspicious transaction report.

Small firms often combine roles. Combining compliance with risk management or legal can be acceptable if the conflicts are documented and managed. Combining it with internal audit is not, because the auditor would be testing their own work.

The compliance officer and MLRO role

Some regimes separate a compliance officer, who owns the program, from a money laundering reporting officer (MLRO), who owns reporting decisions. Many firms give both roles to one person. Either way, the role includes:

1. owning the AML/CFT and sanctions policies and the enterprise-wide risk assessment;
2. deciding whether internal reports of suspicion are filed with the financial intelligence unit;
3. acting as the contact point for the supervisor and the financial intelligence unit;
4. overseeing monitoring, screening and Travel Rule controls, including outsourced parts;
5. reporting to the board at least annually, and promptly on material issues;
6. approving new products, tokens, chains and markets from a financial crime point of view.

Appoint a trained deputy so that reporting continues during absences. Many regimes subject the role to fit and proper approval, and the officer can bear personal liability (see the lesson Supervision, examinations and enforcement).

Staffing, skills and budget

Headcount should be derived from workload and risk, then documented so that the board can see what it is approving. A worked example for transaction monitoring:

• 6,000 alerts a month, with level-1 review taking 20 minutes on average: 6,000 × 20 = 120,000 minutes, or 2,000 hours.
• 15% are escalated (900 cases), and level-2 investigation takes 90 minutes: 900 × 90 = 81,000 minutes, or 1,350 hours.
• An analyst has about 120 productive hours a month after training, meetings and leave.
• Level 1 needs 2,000 ÷ 120 = 16.7 FTE and level 2 needs 1,350 ÷ 120 = 11.3 FTE. Adding 10% for quality assurance gives about 31 FTE.

Repeat the calculation for onboarding, screening and Travel Rule queues, and rerun it when volumes, products or markets change. Skills matter as much as numbers. A crypto compliance team needs on-chain investigators (the IDFE-BA course covers their methods), data analysts who can query monitoring data, sanctions specialists, and people who understand the firm's products. Keep a skills matrix for the team, plan for key-person risk in niche skills such as tracing across bridges, and budget for the team's own continuing education.

The budget covers people, technology, data, training, independent testing and a contingency for surges such as a market rally or a major hack. When the board declines a request, the minutes should record the decision and the residual risk accepted. A supervisor will ask.

Outsourcing

Firms outsource document checks, level-1 alert review, screening operations, Travel Rule messaging and sometimes internal audit work. Responsibility stays with the firm. This differs from reliance under Recommendation 17, where a firm relies on CDD performed by another regulated entity: the Interpretive Note to Recommendation 17 states that it does not apply to outsourcing or agency relationships, in which the provider acts on the firm's behalf.

Never outsource the decision to file a report, the risk appetite or ownership of the risk assessment. For everything else, a sound arrangement includes due diligence on the provider; a contract with service levels, audit and data access rights, data protection terms, limits on sub-outsourcing and an exit plan; and ongoing oversight through quality samples and key indicators. Intra-group arrangements count too: when a group service company runs monitoring for several licensed entities, each entity needs a written agreement, its own oversight, and access for its local officer to the case files it is accountable for. International references include the FSB toolkit Enhancing Third-Party Risk Management and Oversight (December 2023), IOSCO's Principles on Outsourcing (October 2021) and the Basel Committee's Principles for the sound management of third-party risk (December 2025).

Board reporting

The board needs information that lets it judge whether risk is within appetite. A useful quarterly pack covers:

The annual compliance officer report adds the updated risk assessment and an opinion on the effectiveness of the program. Board minutes should show questions asked and decisions taken, not just "noted".

Exam focus: what the Interpretive Note to Recommendation 18 requires (compliance arrangements, a compliance officer at management level, hiring screening, training, independent audit) and its proportionality principle; centralized, hub-and-spoke and federated models; the evidence of independence (direct board line, no business-line duties, pay, protected reporting decision) and why compliance cannot be combined with internal audit; the duties of the compliance officer and MLRO; sizing a team from alert volumes and handling times; why outsourcing never transfers responsibility and how it differs from reliance under Recommendation 17; what belongs in board reporting.