AML — anti-money laundering — is the regulatory framework that obligates financial institutions, including US-regulated crypto exchanges, to detect and report transactions consistent with money laundering or terrorist financing. The companion concept to KYC: KYC identifies the customer, AML monitors what the customer does. Together they form the compliance backbone of Coinbase, Kraken, Gemini, Binance.US, and every other US-regulated crypto platform.
The legal stack a US holder is subject to
Three layers of US AML law touch crypto:
The Bank Secrecy Act (BSA, 1970, extended to crypto in 2013 via FinCEN guidance) requires Money Services Businesses to maintain AML programs, file Suspicious Activity Reports (SARs) above certain thresholds, and report cash-equivalent transactions over $10,000 via Currency Transaction Reports (CTRs).
The OFAC sanctions program (Office of Foreign Assets Control, Treasury Department) prohibits US persons and US-regulated platforms from transacting with sanctioned addresses. Tornado Cash addresses were sanctioned in August 2022; the relevant US-regulated exchanges immediately blocked withdrawals to those addresses. North Korean Lazarus Group addresses are perpetually on the sanctioned list.
The FATF Travel Rule (Recommendation 16, applied to crypto since the 2019 update) requires platforms to share originator and beneficiary information for crypto transactions above certain thresholds — $3,000 in the US per FinCEN's implementation.
What this means at your exchange
Three operational consequences for a US-resident holder:
Withdrawals to "high-risk" addresses get delayed or blocked. The exchange uses Chainalysis or TRM Labs scoring; an address that has interacted with Tornado Cash, certain mixers, or known-bad clusters gets flagged. Sometimes this is a false positive; you can usually appeal but the process takes days.
Large deposits trigger source-of-funds documentation. A $50K incoming wire to your Coinbase account from a non-US source will probably prompt a request for KYC of the sending party. A series of mid-size deposits from many different sources can trigger structuring suspicion.
Account closures happen without explanation. Under SAR rules, the exchange cannot tell you it filed a SAR. If your account is suddenly closed and you cannot get a clear answer why, the most likely explanation is a SAR was filed and the exchange is exiting the relationship.
The compliance arms race
Crypto-specific AML tooling has matured rapidly. Chainalysis, TRM Labs, and Elliptic provide on-chain analytics that every US-regulated exchange now uses. The 2024–2025 OFAC sanctions on Garantex, North Korean clusters, and various ransomware operators have been enforced through these tools more than through traditional financial-system mechanisms.
For ordinary US-resident retail holders, this is mostly invisible. Withdraw to your own wallet, buy a hardware wallet, trade on Coinbase — none of this triggers AML attention. Friction shows up when you start interacting with mixers, sanctioned addresses, or platforms in sanctioned jurisdictions.