Crypto AML & Travel Rule support

AMLA requires relevant records to be retained for at least ten years after the business relationship ends or the transaction is completed, as applicable. A policy should identify the relevant starting point, records, access rights and preservation duties. A blockchain record alone does not contain every identification document or decision the firm must retain.

Professional activity involving third-party assets, exchange, payment transfers or certain custody arrangements can fall within AMLA. The exact service and commercial-activity tests matter. We analyze what the operator controls and does for customers before defining the supervisory and compliance route.

It concerns information about the originator and beneficiary that must accompany relevant transfers between financial intermediaries. The required process covers collection, verification, transmission and handling of missing information. A blockchain address by itself does not necessarily provide the required customer information.

For transfers involving external wallets, Swiss supervisory expectations can require evidence connecting the wallet with the identified customer. The applicable framework and transfer circumstances determine the controls. We help define acceptable evidence, exceptions and escalation rather than rely on an unchecked customer statement.

No. Duties differ between ongoing relationships, occasional exchanges and other transactions. FINMA’s rules include a CHF 1,000 threshold for certain virtual-currency exchanges, with safeguards against linked transactions over 30 days. Applicable SRO rules and suspicion-based duties must also be checked; the figure is not a general exemption.

The process should identify the contracting party and relevant beneficial owners, understand the purpose of the relationship and assess risk. Higher-risk cases require appropriate additional inquiries and approval. The resulting file should explain the decision and support later monitoring and review.

The firm needs a documented process for investigating alerts, escalating concerns and deciding whether a statutory reporting duty is triggered. Reports to MROS use the required reporting channel. Responsibilities, deadlines, recordkeeping and any restrictions on customer communication should be clearly assigned.

The business must assess the applicable transfer rules, wallet-control evidence and its own risk policy. Some transfers may need additional verification or be declined. The procedure should explain which scenarios are permitted, what evidence is retained and who approves exceptions.

Outsourcing may be possible within the applicable framework, but requires suitable contracts, provider oversight, access to information and clear decision authority. The financial intermediary retains its own responsibilities. We review the arrangement rather than assume a software subscription transfers the obligation.

The AML framework should match the relevant supervisory status and the model described in the application. The project may prepare admission documents or improve an existing operation. Designing controls does not itself grant membership or authorization.

Deficiencies can lead to audit findings, remediation, restrictions, membership or licensing consequences and, where applicable, criminal exposure. We prioritize gaps according to their significance and assign concrete corrective actions. The aim is a working process supported by evidence, rather than policies that exist only on paper.

Yes. We assess how the tools fit the process, what information they provide and which decisions remain with people. Missing capabilities are translated into requirements for your technical or procurement team. We do not assume that one tool can satisfy every control.

The standard project develops the legal framework and procedures. Transaction-level operation requires a separate, express mandate covering access, volume, staffing, authority and escalation. The engagement letter makes clear which team performs day-to-day reviews.

The scope can include a gap assessment, risk analysis, onboarding and transfer procedures, escalation rules, provider-contract review and training materials. We agree the outputs around your operating model and identify any technical, audit or ongoing operational work that needs separate coverage.