MSTR Cat

Crypto Law/Level V · Builders and launchers/5.2 Money rules/Lesson 3

KYC, AML and the Bank Secrecy Act

What a crypto money services business must actually build under the Bank Secrecy Act, from identity checks to suspicious activity reports, and what the OKX and Binance cases show about getting it wrong.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Design the product so it is not a money services business (non-custodial, no fiat handling, no buying and selling as a business). The Bank Secrecy Act’s AML programme, SAR and CTR duties then do not attach.
  2. If you are an MSB, a written, risk-scaled programme under 31 CFR 1022.210 can be built in-house. The independent review may be done by an employee who is not the compliance officer, and it must be in place within 90 days.
  3. Avoid handling cash, which removes currency transaction reports for cash over $10,000. Suspicious activity reports still apply from $2,000 and are due within 30 days of detection.
  4. Keep required records for five years in a single searchable store. That is cheaper than rebuilding them during an examination, and it is the evidence regulators ask for first.
  5. A written ban on US customers is not a shield; OKX paid over $504 million despite one. Either really exclude a market, for example by checking KYC nationality and residence, or comply there.

Materials31 CFR 1022.210, the anti-money-laundering programme rule for money services businesses (on ecfr.gov)31 CFR 1022.320, suspicious activity reports by money services businessesThe Justice Department’s 24 February 2025 press release on OKX’s guilty pleaYour own customer onboarding flow, written out step by step

Wonder

  1. What exactly does ‘an effective AML programme’ require a small crypto business to have?
  2. Does a policy banning US customers protect an offshore exchange that still gets them?
  3. Who gets punished when the programme fails: the company, the founders, or both?

Explore

  1. ‘Know your customer’ (KYC) means collecting and checking who a customer is; ‘anti-money-laundering’ (AML) is the wider set of controls meant to stop a business being used to clean criminal money. In the US both come from the Bank Secrecy Act of 1970 and FinCEN’s rules under it (lesson 1.3.4). For a crypto business that is a money services business (lesson 5.2.1), the central rule is 31 CFR 1022.210: it must develop, implement and maintain an effective, written AML programme reasonably designed to prevent it being used for money laundering or terrorist financing, scaled to the risks of its location, size, services and volume.
  2. The rule sets four minimum parts. First, policies, procedures and internal controls, including for verifying customer identification, filing reports, keeping records and responding to law-enforcement requests. Second, a named person responsible for day-to-day compliance. Third, training for the right staff, including on spotting suspicious transactions. Fourth, an independent review of the programme, which an employee may do as long as it is not the compliance officer. A new business must have its programme in place within 90 days of being established. Banks have a separate, detailed customer identification rule; for money services businesses, identity verification sits inside this programme rule.
  3. The programme feeds reports. A money services business must file a suspicious activity report (SAR) on a transaction of at least $2,000 that it knows, suspects or has reason to suspect involves illegal funds, is designed to evade reporting, or has no apparent lawful purpose, and it must file within 30 calendar days of first detecting the facts (31 CFR 1022.320). A currency transaction report is required for cash transactions over $10,000 (31 CFR 1010.311), which matters wherever physical cash comes in, such as kiosks. Required records generally must be kept for five years (31 CFR 1010.430), which is why exchanges hold onboarding and transaction data long after an account closes.
  4. The OKX case shows what regulators look at. On 24 February 2025 the exchange’s Seychelles operator pleaded guilty in New York to operating an unlicensed money transmitting business and agreed to pay more than $504 million. According to its admissions, OKX had an official policy against US users from 2017, yet sought US customers; until about November 2022 retail customers could open accounts and trade without completing KYC; its block on US internet addresses could be bypassed with cheap VPNs; and in 2023 an employee suggested a US customer list another nationality. A written ban counts for little when the business knows the customers it bans are there.
  5. Failures reach individuals as well as companies. Binance’s founder Changpeng Zhao pleaded guilty in November 2023 to failing to maintain an effective AML programme, as part of the settlement described in lesson 1.3.4, and was sentenced on 30 April 2024 to four months in prison; President Trump pardoned him on 23 October 2025. On 27 January 2025 the exchange KuCoin pleaded guilty to operating an unlicensed money transmitting business and agreed to pay nearly $300 million. A pardon ends a person’s punishment; it does not change the duties the Bank Secrecy Act places on any business operating today.
  6. The list of covered businesses keeps growing. The GENIUS Act makes permitted payment stablecoin issuers financial institutions under the Bank Secrecy Act (lesson 3.2.4), and on 10 April 2026 FinCEN and OFAC jointly proposed the programme rules for them; the proposal was not final as of October 2026. For builders, the duties follow what a business does, not what it calls itself. A practical check: mark on a diagram every point where cash enters or leaves, or where your company controls customers’ keys, and for each point write down who checks identity, who watches for suspicious activity and where the records are kept.

Key facts

  • Under 31 CFR 1022.210, a money services business must maintain a written anti-money-laundering programme that is effective and reasonably designed to prevent money laundering.
  • The MSB programme rule requires internal controls, a designated compliance person, training and an independent review.
  • A money services business must report suspicious transactions involving at least $2,000 within 30 calendar days of initial detection.
  • Currency transaction reports are required for transactions in cash of more than $10,000.
  • On 24 February 2025 OKX pleaded guilty to operating an unlicensed money transmitting business and agreed to pay more than $504 million.
  • Changpeng Zhao was sentenced to four months in prison on 30 April 2024 and was pardoned on 23 October 2025.

Exercise nine, six, three, one

9CollectList up to 9 checks you have met when opening or using a crypto account, such as an ID upload, a selfie, a source-of-funds question, a withdrawal hold or a request to explain a transfer (some lists are shorter).
6ClusterSort them into 6 categories: identity verification, ongoing monitoring, suspicious-activity follow-up, cash-related rules, record keeping, and checks you cannot explain.
3DistillReduce the 6 to 3 groups: checks required by the AML programme rule, checks driven by reporting duties, and checks that look like the platform’s own risk choices.
1CrystallizeWrite 1 sentence explaining, in your own words, why a policy that bans certain customers did not protect OKX.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS