Compliance risks for crypto exchanges and blockchain businesses

A crypto exchange or blockchain business cannot determine its legal obligations from the label it uses in marketing. Regulators and courts examine what the company actually does: whose assets it accepts, whether it transmits value for customers, how accounts are opened, and which jurisdictions its services reach.

A platform described as software, a marketplace, or a decentralized service may still face questions about money transmission, customer identification, recordkeeping, sanctions, securities, commodities, and consumer protection.

Business function matters more than terminology

Federal guidance distinguishes between a person who uses convertible virtual currency for personal transactions and a business that accepts or transmits value for others. An exchanger or administrator may be treated as a money services business and money transmitter unless a limitation or exemption applies.

The analysis is fact-specific. A company that only develops software may have different obligations from one that controls customer funds, processes withdrawals, sets transaction rules, or intermediates exchanges.

Early legal counsel for crypto compliance matters can help map the product’s actual functions before policies are copied from a different business model.

AML programs must reflect real operations

A written anti-money-laundering policy is not useful when it does not match the company’s systems. Controls should identify who is responsible, how customers are reviewed, what transactions are monitored, how alerts are resolved, and how records are retained.

Common weaknesses include:

• Using incomplete customer information;
• Failing to document why an alert was closed;
• Allowing high-risk functions without additional review;
• Applying policies inconsistently across jurisdictions;
• Relying on vendors without testing their performance.

A compliance program should also define escalation procedures. Front-line employees need to know when an issue must be referred to compliance or legal personnel instead of being resolved informally.

Licensing and registration depend on location and activity

A blockchain business may face federal registration obligations and state licensing requirements. The answer can depend on where the company operates, where customers are located, and whether the activity falls within a statutory definition.

Operating from outside the United States does not necessarily eliminate U.S. risk when American customers, financial institutions, employees, servers, or transactions are involved.

Because requirements can change and differ between jurisdictions, businesses should document the analysis supporting where they operate and which customers they accept.

Sanctions controls cannot rely only on names

Digital-asset businesses may need controls for blocked persons, restricted jurisdictions, ownership, and prohibited transactions. Screening only the customer’s name may miss entity ownership or wallet information that requires review.

At the same time, an automated alert is not proof that a customer is sanctioned. False matches, common names, and incomplete data require a documented resolution process.

Internal records become evidence during an investigation

Policies, risk assessments, board materials, employee messages, customer complaints, and alert histories may all be requested by regulators or prosecutors. A company that adopted a policy but repeatedly ignored it may face greater difficulty explaining its decisions.

Arkady Bukh Law Firm’s cryptocurrency practice addresses matters in which digital-asset operations can overlap with compliance, investigations, disputes, financial allegations, and criminal exposure.

Compliance should evolve with the product

A company may begin with non-custodial software and later add hosted wallets, customer accounts, exchange functions, or payment processing. Each change can alter the risk analysis.

Compliance review should therefore occur before a new product launches, after material operational changes, and when the business enters a new market. Training and monitoring should be based on real transactions rather than generic policy language.

The goal is not to eliminate every business risk. It is to understand which legal duties apply, build procedures that operate in practice, and create a reliable record showing how the company identified and addressed foreseeable problems.