Why are virtual assets a big AML enforcement target right now?
Virtual assets have moved from the edge of financial services into mainstream payments, investment and cross-border finance. That growth has brought legitimate innovation—and a larger surface area for money laundering, sanctions evasion, fraud and other financial crime. For regulators, the question is no longer whether virtual assets belong in anti-money laundering (AML) supervision. It is whether firms can identify and manage the risks their products create.
That helps explain why virtual assets AML has become a prominent enforcement issue. The technology can make value move quickly across borders and between services, sometimes through chains of wallets and intermediaries. Yet those features do not make transactions invisible. Blockchain records can provide investigators with a durable trail; the challenge is linking wallet activity to people, businesses and criminal conduct.
For compliance teams, the consequences are practical. Weak controls can expose a business to enforcement, damage customer trust and leave staff unsure how to raise concerns. The United States has also strengthened incentives for people who report possible violations of the Bank Secrecy Act (BSA), the federal law that underpins key anti-money laundering requirements. Those changes make it important to understand both the compliance obligations and the routes for reporting concerns.
Why virtual assets attract enforcement attention
Virtual assets are not inherently illicit. The same technologies can support lawful payments and investment as well as criminal activity. Enforcement attention tends to focus on how a service is used, what controls it applies and whether the business responds appropriately when risks become apparent.
Several features can make the sector difficult to supervise. A customer may move assets between countries and service providers in minutes. A business may rely on third-party platforms to hold or transfer assets. Wallet addresses do not, by themselves, disclose the identity of their users. And products built around decentralised or automated transactions may not fit neatly into traditional assumptions about who controls a financial service.
These challenges matter because virtual assets can intersect with well-established crime types. FinCEN—the Financial Crimes Enforcement Network, the US Treasury bureau responsible for administering key parts of the BSA—has identified priorities that include cybercrime, fraud, corruption, drug trafficking, human trafficking, transnational criminal organisations and proliferation financing. Virtual assets can feature in several of these areas, including ransomware payments, investment scams and attempts to conceal the proceeds of crime.
Sanctions evasion is another concern. A transaction involving a virtual asset is not automatically a sanctions breach, but firms must consider whether customers, counterparties or activity involve sanctioned parties or jurisdictions. A compliance programme that relies on incomplete customer information or fails to investigate meaningful alerts may struggle to identify that risk.
Traceable transactions still require good controls
It is tempting to describe virtual asset activity as anonymous. That is too broad. Many public blockchains record transactions in a way that can be examined later. But a visible wallet address is not the same as a verified customer identity. Investigators and compliance teams may need additional information to connect an address to a person, business or service.
The result is a mixed picture: transaction records can help trace flows, while gaps in customer due diligence, weak monitoring or poor record-keeping can make it harder to understand what those flows mean. Technology can assist analysis, but it cannot replace sound governance and trained staff. Firms need procedures for identifying customers, assessing risk, monitoring activity, investigating alerts and escalating concerns.
Effective crypto compliance also depends on clear responsibility. A business should know which team owns a risk decision, who can escalate a concern and how unresolved issues reach senior management. If a firm uses vendors or relies on another organisation for part of its service, it still needs to understand how that arrangement affects its own obligations.
What FinCEN priorities mean for virtual asset firms
FinCEN’s stated priorities provide a useful view of the threats US financial institutions are expected to consider. They are not a separate checklist that resolves every firm’s obligations, and the risks will differ between businesses. But they help explain why regulators examine whether a firm’s controls are tailored to its actual products, customers and exposure.
For a virtual asset business, that may mean asking whether its monitoring do whistleblowers get paid can detect suspicious patterns relevant to its services, whether its customer information is reliable and whether staff know how to escalate concerns. It also means checking that policies work in practice. A written programme has limited value if alerts are routinely closed without adequate review or senior managers are not told about material weaknesses.
Suspicious Activity Reports (SARs) are part of this framework. In broad terms, covered institutions must report certain suspicious activity to the relevant authorities when reporting requirements are met. A SAR is not a finding that a customer has committed whistleblower tip timing a crime; it is a confidential regulatory report based on activity that warrants attention. Firms should take care with legal requirements, including restrictions on disclosing a SAR or the fact that one has been filed.
Internal reporting and external submissions are not the same thing
Employees often first raise a concern through an internal compliance channel, such as a manager, compliance officer, ethics hotline or designated reporting system. These channels can help a firm investigate quickly, preserve records and address a control weakness. They may also allow a concern to be raised without an employee first approaching a regulator.
An internal report is not the same as a SAR. A SAR is an external submission made by an institution to a government authority under applicable reporting rules. Nor should an employee assume that telling a manager automatically satisfies the institution’s reporting obligations. The firm must assess the information and decide what regulatory steps, if any, are required.
External whistleblower submissions are different again. A person may provide information to a government body about a possible legal violation. The rules governing an award or protection depend on the particular programme, the information supplied, the person’s role and other legal requirements. Internal reporting can be valuable, but it does not guarantee an award, prevent retaliation or determine what a regulator will do.
Anyone handling a concern should follow applicable confidentiality rules and avoid taking customer or company information unlawfully. Employees considering an external report may wish to obtain independent legal advice, particularly where the matter involves confidential information, a potential SAR or a risk of retaliation.
The 2022 overhaul of the BSA whistleblower programme
Congress substantially strengthened the BSA whistleblower framework in legislation enacted in December 2022. The changes expanded the potential for awards and established stronger protections for people who report possible BSA violations. The programme is intended to encourage people with relevant information to come forward, including information about failures in anti-money laundering controls.
The changes matter to virtual asset firms because their compliance obligations can sit within the BSA framework, depending on the business and its activities. Employees may become aware of issues such as inadequate monitoring, deficient customer checks or failures to escalate suspicious activity. Whether a particular concern qualifies for an award or legal protection is a question of law and fact, not simply a matter of the employee working in compliance.
The programme does not turn every workplace complaint into a qualifying whistleblower submission. A report needs to meet statutory conditions, and the information must be useful in the relevant enforcement process. Eligibility can also depend on the person’s access to information, their role and the way the information was obtained. These details make specialist advice important where a person is weighing how and when to report.
Mandatory awards and the $1 million sanctions trigger
Under the strengthened framework, qualifying whistleblowers may be entitled to an award where their original information leads to a successful enforcement action and the action results in more than $1 million in monetary sanctions. If the statutory conditions are met, an award is generally set at 10 to 30 per cent of the monetary sanctions collected, subject to the programme’s rules.
“Mandatory” is significant, but it should not be mistaken for automatic. The existence of a report alone does not trigger payment. There must be a qualifying enforcement action, the required sanctions must be imposed and collected, and the whistleblower must satisfy the relevant eligibility and contribution criteria. The appropriate authority determines whether those requirements are met and the award amount within the statutory range.
Feature What it means in practice $1 million threshold The qualifying enforcement action must result in monetary sanctions exceeding $1 million. 10 to 30 per cent range The award is calculated by reference to monetary sanctions collected, subject to statutory rules and the decision-maker’s assessment. Original information The information must meet the programme’s requirements and contribute to a successful action; a report by itself is not enough. Timing and process Submission requirements, eligibility rules and the handling of evidence can affect whether a claim qualifies.The percentage range can be meaningful, but it is not a promise of a particular payment. A person should not assume that every enforcement settlement counts, that all sanctions will be collected or that the maximum percentage will apply. The details of the action and the whistleblower’s contribution matter.
Anti-retaliation protections and a federal cause of action
The strengthened BSA framework also includes anti-retaliation protections. In broad terms, an employer may not take specified adverse action against a covered employee for engaging in protected whistleblowing activity. The statutory framework includes a federal cause of action, allowing an eligible person to bring a claim in federal court if they believe they have been retaliated against.
These protections are important, but they should not be presented as a guarantee that retaliation will not happen or that a claim will succeed. Legal protection depends on the facts and statutory requirements. Timing matters: a person who experiences a demotion, dismissal, threat or other adverse treatment should promptly document events and seek advice about applicable procedures and deadlines.
Reporting internally can sometimes help a firm resolve an issue and can create a record of the concern. It can also carry workplace risks, especially where the concern implicates senior people or a significant business relationship. Employees should not be pressed to choose between an internal channel and a regulator without understanding the relevant rules. The right route depends on the circumstances, and a lawyer can advise on confidentiality, evidence preservation and protection against retaliation.
What firms should do now
Virtual asset businesses should treat enforcement risk as a governance issue, not just a monitoring-system problem. A practical review can test whether procedures match the actual products and whether staff can use them under pressure.
- Map the business: Identify the services, customer types, jurisdictions and third parties that shape the firm’s money-laundering and sanctions exposure.
- Test controls: Review customer due diligence, transaction monitoring, alert investigation, record-keeping and escalation processes against real scenarios.
- Clarify SAR decisions: Make sure staff know who assesses suspicious activity and who is responsible for any required external submission.
- Maintain safe reporting channels: Provide clear internal routes, explain how concerns are handled and prohibit retaliation for protected reporting.
- Train managers: Supervisors should know how to receive a concern without discouraging the employee, compromising evidence or making promises about outcomes.
- Review governance: Material control weaknesses should reach people with authority to fix them, with decisions and remediation recorded.
For individuals, the practical lesson is to distinguish a workplace report, an institutional SAR and a whistleblower submission to a government authority. They serve different purposes and follow different rules. A person with potentially significant information should consider the timing and consequences of each route, keep a careful record of relevant events and seek independent legal advice rather than relying on assumptions about eligibility or confidentiality.
The enforcement target is the control failure
Virtual assets are drawing sustained attention because they can move value across borders, intersect with serious crime and test the limits of traditional controls. But the technology alone is not the whole story. Enforcement often turns on what a firm knew, what its systems should have detected and whether it responded appropriately.
For firms, strong crypto compliance means making controls specific to the business and ensuring that staff can escalate concerns safely. For employees, the 2022 BSA changes offer a more substantial potential award framework and a federal route to challenge retaliation—but only when statutory conditions are met. Understanding the distinction between internal reporting and external submissions is essential to navigating both sides of that risk.