An independent AML review for a crypto payments network

A fast-growing digital-asset payments company needed to know whether its BSA/AML program held up across a chain of exchanges, partner banks and identity vendors. We gave it a clear verdict and a roadmap it could act on.

ClientCryptocurrency payments network, registered money services business

PracticeFinancial Crime & Compliance

EngagementIndependent Compliance Review

Review periodTwelve months of activity

13program areas reviewed

60+recommendations, each rated

0critical failures found

3regulatory frameworks applied

The challenge

A program spread across many hands

The company lets consumers pay merchants in stores using digital assets. Customer funds sit with partner exchanges and banks, identity checks run through outside vendors, and the business had recently opened in a new, higher-risk market.

Its own policy required an independent review every 12 to 18 months. The real question was not whether a program existed on paper, but whether it worked across that whole chain of third parties.

Our approach

Tested in practice, not just on paper

1. 1Document inventory

   Every policy, procedure, risk assessment and log, tracked in a single audit trail.

2. 2Interviews and walkthroughs

   Working sessions with compliance leadership and the people who run each process.

3. 3Testing in practice

   Sampling of live controls to see how the program operates, not just how it reads.

4. 4Validated findings

   Each observation confirmed with its owner, then rated by significance.

Benchmarked againstFFIEC BSA/AML Examination ManualDOJ Evaluation of Corporate Compliance ProgramsFinCEN guidance for money services businesses and virtual currency

Program scorecard

Thirteen areas, one view

Every pillar of the program was reviewed and rated. Select an area to see the headline observation.

Risk assessmentPriority actionsProgram designPriority actionsInternal controlsPriority actionsIndependent testingNo findingsCompliance officerPriority actionsTrainingEnhancements suggestedKnow your customerPriority actionsCDD & EDDPriority actionsTransaction monitoringPriority actionsSuspicious activity reportsPriority actionsCurrency transaction reportsEnhancements suggestedInformation sharingEnhancements suggestedFunds transfer recordsNo findings

Risk assessment. Behind the company’s own annual cycle, and not yet covering its newest market.

Program design. A sound framework; customer and merchant risk ratings and a whistleblower policy were needed.

Internal controls. Commensurate with the risk; additional controls recommended for the new jurisdiction.

Independent testing. Policy requires an independent review every 12 to 18 months.

Compliance officer. Qualified and well supported; program documents needed updating to reflect the role.

Training. Satisfactory and documented; policy should spell out who is trained, and when.

Know your customer. Sufficient and delivered through a vendor; customer risk ratings to be added.

CDD & EDD. Reasonably designed; beneficial ownership for merchant accounts recommended.

Transaction monitoring. Alerts ran monthly; more frequent runs recommended to protect SAR filing timelines.

Suspicious activity reports. Sufficient procedures; deadline language to match the 30-day standard.

Currency transaction reports. Not currently required; pending rules for digital assets to be monitored.

Information sharing. Voluntary participation in information sharing recommended.

Funds transfer records. Required records maintained.

No findingsEnhancements suggestedPriority actions

Details are generalized to protect the client’s confidentiality.

What we found

Four themes worth sharing

Third parties carry much of the program

Exchanges, banks and identity vendors perform key controls. We recommended the company obtain their policies, data and risk findings, so it sees what they see.

Risk had moved faster than the paperwork

A newer, higher-risk market was live before the risk assessment, controls and enhanced due diligence had caught up.

Crypto needs crypto-specific scenarios

For example, flagging several customer wallets funded from the same source wallet, and capturing the wallet addresses customers fund from.

Timing is a control

Monthly alert generation leaves little room inside the 30-day suspicious activity reporting window. More frequent runs close that gap.

The outcome

A clear verdict and a sequenced roadmap

Our overall assessment found the program to be:

• Reasonably well designed for its risk profile and business
• Applied earnestly and in good faith by management
• Satisfactorily effective in meeting its obligations
• Appropriately resourced

No finding amounted to a critical failure. Every recommendation was rated, so leadership could separate the actions examiners would expect from enhancements to schedule over time, and sequence the work accordingly.

Is your independent review coming due?

We review BSA/AML and sanctions programs for banks, fintechs, crypto firms and money services businesses.

Start a confidential conversation