Risk, regulation and professional ethics · Lesson 2 of 5
AML/CFT and the Travel Rule
5 min read
What AML/CFT seeks to accomplish
Anti-money laundering (AML) is the framework for detecting and limiting attempts to disguise the origin, ownership, or destination of criminal proceeds. Countering the financing of terrorism (CFT) addresses financing connected to terrorism, which may involve funds from legal or illegal sources. Some regimes also expressly address proliferation financing. The goal is not to label every complex transaction suspicious; it is to apply lawful, risk-based controls, detect specified concerns, and provide usable information to competent authorities.
The Financial Action Task Force (FATF) is an intergovernmental standard setter. Its Recommendations are international standards, not a self-executing worldwide statute. FATF Recommendation 1 requires identification, assessment, and understanding of risks. Recommendation 10 addresses customer due diligence, including identifying and verifying customers and, where relevant, beneficial owners. Recommendation 11 covers recordkeeping; Recommendation 20 concerns suspicious-transaction reporting. Recommendation 15 and its Interpretive Note extend the framework to virtual assets and virtual asset service providers (VASPs). The recommendations and national laws should not be mistaken for identical texts.
Who is in scope?
A VASP is defined by functions carried out as a business for or on behalf of another person, rather than by whether the entity calls itself an exchange. Relevant FATF activities can include exchange, transfer, custody or administration, and specified financial services related to an issuer's offering or sale. A wallet application, an autonomous piece of software, and a company operating services are not automatically equivalent actors. Whether a person is covered depends on actual control, services, facts, and applicable domestic implementation. Public bodies, lawyers, and contractors may have different professional reporting and confidentiality duties under their own rules.
The risk-based compliance cycle
Identify, verify, monitor, and report
An organization first defines its customer and product risks, geographic exposure, delivery channels, and transactions. Customer due diligence (CDD) gathers and verifies identity information; beneficial ownership checks seek the natural persons who ultimately own or control a customer when relevant. Enhanced due diligence is more intensive review for higher-risk circumstances. Ongoing monitoring compares activity with the known purpose and risk profile of a relationship. The organization must document why an alert is resolved, escalated, or reported, rather than using an unexplained score alone.
Common concerns include inconsistent source-of-funds explanations, unusual movement through multiple services, use of intermediaries that obscure an expected relationship, or activity inconsistent with a customer's declared business. Source of funds means the origin of assets used in a particular transaction; source of wealth refers to how a person accumulated overall wealth. Neither question can always be answered from public blockchain data. A risk-based approach combines available account evidence, lawful external records, behavioral patterns, and human review.
A suspicious transaction report (STR), sometimes called a suspicious activity report (SAR), is a jurisdiction-specific filing to a designated authority. Filing criteria, deadlines, secrecy obligations, and permitted disclosures differ. A staff member must not automatically tell a customer that a report was filed; many legal systems restrict tipping off. Conversely, staff should not promise secrecy beyond law or organizational policy. Record retention and privacy safeguards have to operate together.
The Travel Rule in plain terms
Data travels between responsible providers
The 'Travel Rule' refers to requirements that certain information about the originator (sender) and beneficiary (recipient) accompany or be made available in connection with qualifying transfers. It is a transparency rule for obligated institutions, not an instruction to publish people's identity details in a blockchain transaction. The FATF framework historically connected VASP transfers to Recommendation 16 (Payment Transparency), read with the virtual-asset provisions of Recommendation 15 and their interpretive material. FATF revised Recommendation 16 in 2025, with further changes in the Recommendations as amended June 2026; implementation and transition should be checked against the applicable national rules at the time of a transfer.
For example, an originator's VASP may need to obtain and send required originator and beneficiary identifiers to the receiving VASP through an appropriate secure arrangement. The receiving provider checks completeness and handles deficiencies under local law. Information exchanged between providers is not necessarily embedded on-chain. A public address, without additional records, usually does not identify a real person reliably.
Self-hosted wallets and cross-border complications
A self-hosted address is controlled directly by a user rather than by a service provider acting as custodian. Requirements for transactions involving such addresses vary; professionals must not assume a universal exemption or a universal prohibition. Jurisdictions set different thresholds and checks: for example, the EU applies verification checks to certain transfers involving self-hosted addresses above EUR 1,000, while long-standing US funds-transfer rules use a USD 3,000 baseline. These figures must not be treated as global de minimis rules or as permission to split transfers.
| Term | Practical meaning | Common error |
|---|---|---|
| CDD | Verify and understand the customer | Equating an address with verified identity |
| Beneficial owner | Natural person who ultimately owns or controls | Relying only on a company's name |
| Transaction monitoring | Review behavior against known risk | Treating an algorithmic score as proof |
| Travel Rule | Required transfer-related information exchange | Assuming personal details must be on-chain |
Governance, privacy, and public-sector use
AML/CFT compliance is a controlled decision process. Governance should specify who approves policies, who investigates alerts, how conflicts are resolved, and how quality is sampled. Systems need access logging and data minimization: collect what law and legitimate risk management require, protect it, and do not broadcast sensitive customer information unnecessarily. Data-protection laws (the EU's GDPR is a well-known example) also govern how customer information is processed and retained. Legal grounds for processing and retention periods are specific questions for each organization and jurisdiction.
A public agency may encounter an address in a seized record or procurement file. An internal analyst should document provenance, avoid opening unauthorized personal accounts, and share intelligence only with an authorized recipient. 'Risk-based' does not mean discretionary avoidance of mandatory checks. It means effort and scrutiny are proportionate within legal minimums, with a reasoned rationale and an audit trail. The 2026 FATF targeted update on VAs and VASPs reports ongoing implementation gaps worldwide, reinforcing the need to check local supervisory requirements rather than assume global uniformity.
Exam focus: Explain AML, CFT, CDD, beneficial ownership, monitoring, STR/SAR reporting, and the Travel Rule; distinguish FATF standards from binding local law and on-chain transfers from protected off-chain information exchange.