Anti-money laundering on crypto platforms

A crypto transfer can cross the world in minutes without going through a bank. That is why regulators have put the companies that buy, sell, exchange and hold crypto assets on behalf of others on the front line of anti-money laundering. They are the point where traditional money enters and leaves this system.

This article explains what those obligations are, where they come from and what they change for you as a customer. It describes the duties of service providers; it does not cover ways to get around them. The situation described is as of October 8, 2026.

Money laundering is the process of hiding or disguising the origin of proceeds of crime so that they look legitimate. Brazilian law punishes anyone who conceals or disguises the nature, origin, location, movement or ownership of such assets with 3 to 10 years in prison, and requires the sentence to be increased by one to two thirds when the crime is committed through a virtual asset (Law 9,613/1998, art. 1, § 4).

The international standard: the FATF

The Financial Action Task Force (FATF, known in Portuguese as GAFI) sets the standards countries follow against money laundering and terrorist financing. In 2019, it extended those standards to virtual assets and to virtual asset service providers, or VASPs (in Brazil, PSAVs). The centerpiece is Recommendation 15.

According to the FATF, countries should understand the sector’s risks, license or register providers and supervise them as they supervise other financial institutions. Providers, in turn, should apply the same preventive measures as a financial institution, including knowing the customer, keeping records and reporting suspicious transactions, as well as obtaining, holding and securely transmitting sender and recipient information on transfers (FATF, Virtual Assets).

In its seventh targeted update on the subject, in July 2026, the FATF showed uneven progress. Of the jurisdictions surveyed, 83% already had travel rule legislation (the rule is explained below), up from 73% in 2025. But many have not yet turned the law into effective supervision. The report also states that most of the illicit activity identified on blockchains today involves stablecoins and that criminal groups use virtual assets for scams, sanctions evasion and laundering (FATF, July 16, 2026). These figures are self-reported by countries and were not independently verified by the FATF.

In Brazil: who is covered

Law 14,478/2022, Brazil’s legal framework for crypto assets, amended the money laundering law and added virtual asset service providers to the list of obligated entities in art. 9 of Law 9,613/1998 (Law 9,613/1998, art. 9, sole paragraph, item XIX). Banks, securities brokers, insurers and real estate firms, among others, were already on it.

The Banco Central do Brasil (Brazil’s central bank) regulates and supervises these providers. BCB Resolution 520/2025, in force since February 2, 2026, requires them to comply with the specific anti-money laundering and counter-terrorist financing regulations, to have a director or officer accountable for this area before the central bank, and includes anti-money laundering among the policies they must keep up to date (BCB Resolution 520, arts. 14, 43 and 44). For institutions authorized by the central bank, those specific regulations are Circular 3,978/2020 (BCB Circular 3,978).

The obligations, one by one

Know your customer

This is what the market calls KYC (know your customer). The law requires customers to be identified and their records kept up to date; for companies, identification includes who can represent them and their owners (Law 9,613, art. 10). Circular 3,978 sets out three steps:

• Identify: obtain and validate identity data.
• Qualify: collect information to assess the customer’s financial capacity (income for individuals, revenue for companies) and check whether the customer is a politically exposed person, such as holders of relevant public office, their relatives and close associates. Obligated entities must check the national register of such persons, the CNPEP (Law 9,613, art. 12-A).
• Classify: place the customer in a risk category, which defines how much attention their transactions will receive.

BCB Resolution 520 adds that the provider must also know its business partners and outsourced service providers (art. 47).

Monitor transactions

The provider must monitor transactions to identify those that may indicate laundering, taking into account who is involved, the amounts, how the transaction is carried out and any lack of economic or legal rationale. Each flagged transaction must be analyzed within 45 days and documented in a case file (Circular 3,978, arts. 38, 39 and 43).

For crypto assets, BCB Resolution 520 adds two specific points. When hiring third parties, such as custodians, the provider must have controls to track sanctions lists and wallet addresses sanctioned in Brazil or abroad. And, when choosing which assets to offer, it must exclude those with features that facilitate fraud or crime, such as assets designed to make it harder to identify the holder (art. 64).

Report to Coaf

The Conselho de Controle de Atividades Financeiras (Coaf) is Brazil’s financial intelligence unit. The law requires obligated entities to report to it transactions with serious signs of laundering, without telling the customer about the report. Reports made in good faith do not create civil or administrative liability for the reporter (Law 9,613, art. 11). Under Circular 3,978, a suspicious transaction report must be filed by the business day after the decision to report (art. 48).

Coaf analyzes these reports. When it finds well-founded signs of crime, it records the result in a Financial Intelligence Report (RIF) and sends it to the competent authorities, who decide whether to investigate. The RIF is confidential (Coaf, Financial Intelligence Reports).

Keep records

Customer files and transaction records must be kept for at least five years after the account is closed or the transaction is completed (Law 9,613, art. 10, § 2). BCB Resolution 520 repeats the minimum period for records of virtual asset transactions (art. 45).

The travel rule

The travel rule is the obligation to make sender and recipient data “travel” with the transfer from one institution to the other. In banking, it has existed for years in FATF Recommendation 16. For virtual assets, it was incorporated through Recommendation 15.

Recommendation 16 was revised in June 2025. Among the changes, cross-border person-to-person payments above 1,000 dollars or euros must now carry the name, address and date of birth, and institutions will have to adopt tools against fraud and error, such as verifying the recipient’s details. The changes are due to take effect by the end of 2030 (FATF, June 18, 2025).

How it works in Brazil

BCB Resolution 520 lists the minimum data the provider must send to the institution receiving the transfer (art. 44):

• Sender: name, account identification, address, CPF or CNPJ (Brazil’s individual and corporate taxpayer IDs, or an equivalent foreign document) and the identification of the wallet used.
• Recipient: name, account identification and wallet identification.

Implementation comes in two stages (art. 89). The first, for transfers between providers in Brazil, must be in place within 365 days of the rule taking effect on February 2, 2026. The second, for cross-border transactions, has another 365 days. The rule is mandatory for all authorized providers from February 2, 2028. Until then, they may rely on customers’ own statements about the recipient, asset, amount and purpose, as long as they are documented.

How it works in the European Union

Regulation (EU) 2023/1113, applicable since December 30, 2024, requires crypto transfers between providers to carry sender and recipient data regardless of the amount, including domestic transfers. When the transfer goes to a wallet the user controls directly, without an intermediary (a so-called self-hosted wallet), the provider must keep that data and, above 1,000 euros, assess whether the wallet actually belongs to the customer (Regulation (EU) 2023/1113, art. 14).

The next step is the EU anti-money laundering regulation, Regulation (EU) 2024/1624, which applies from July 10, 2027. It bans crypto-asset service providers from keeping anonymous accounts or accounts that allow the holder to be anonymized or transactions to be hidden, including through privacy coins. It also requires these providers to apply full customer due diligence on occasional transactions from 1,000 euros, a much lower threshold than the 10,000 euros of the general rule (Regulation (EU) 2024/1624, arts. 19 and 79).

What happens to those who fail to comply

In Brazil, a provider and its managers that fail to meet the identification, record-keeping and reporting obligations are subject to a warning; a fine of up to twice the transaction amount, twice the profit obtained or R$ 20 million; disqualification of managers for up to ten years; and revocation or suspension of authorization (Law 9,613, art. 12).

What this changes for you

These rules explain situations that customers of a regulated exchange run into day to day:

• Requests for documents and source of funds. These are part of knowing the customer. The platform may ask you to update your records periodically.
• Questions about transfers. When sending crypto out, you may have to say who the recipient is and whether the wallet is yours. During Brazil’s transition period, these statements replace part of the data exchange between providers.
• Delays or refusals. A transaction flagged for review may take longer or be refused. By law, the platform cannot tell you whether it filed a report with Coaf.
• Lending your account is a risk. Letting someone use your account or wallet to move their money can involve you in money laundering, which is a crime.
• Watch out for fake requests. Scammers impersonate exchange support to ask for documents, passwords or your seed phrase. A legitimate exchange never asks for your seed phrase. See Crypto scams: how to spot and report them and Phishing in crypto wallets.

The same concerns come up in the tokenization of securities: the CVM (Brazil’s securities regulator) recommends that token offerings explain their controls over the source of funds, as shown in Tokenization and capital markets: regulatory limits. To understand how criminal proceeds move through crypto assets and how authorities trace them, see Ransomware and cryptocurrency: flows and prevention.

Regulation does not eliminate investment risk. It narrows the room for crime inside regulated platforms, but it does not protect against a drop in asset prices, which can lead to a total loss.

Key takeaways

• Crypto exchanges and custodians have been obligated entities under Brazil’s money laundering law since 2022 and, under the central bank, follow the same basic duties as financial institutions: know the customer, monitor, report to Coaf and keep records.
• The travel rule makes sender and recipient data accompany the transfer. In Brazil, it comes in two stages and is mandatory for all authorized providers from February 2028; in the European Union, it has applied since December 2024.
• According to the FATF, most countries already have laws, but effective supervision is still lagging, and stablecoins now account for most of the illicit activity identified on blockchains.