AML (Anti-Money Laundering)

Anti-Money Laundering (AML) refers to the framework of laws, regulations, and internal controls that financial institutions and crypto businesses must implement to detect, prevent, and report attempts to disguise the origins of illegally obtained money. The global standards baseline is set by the Financial Action Task Force (FATF), an intergovernmental body founded at the request of the G7 in 1989 to combat money laundering and, later, terrorist financing. National regulators then translate FATF's 40 Recommendations into binding domestic law — the Bank Secrecy Act lineage in the United States, FINTRAC's regime in Canada, and the successive AML directives in the European Union.

What an AML program contains

For a regulated exchange, an AML program typically bundles several obligations: customer due diligence and identity verification (KYC) before onboarding; ongoing transaction monitoring to flag unusual patterns; sanctions screening against lists such as those maintained by OFAC; record-keeping over multi-year retention periods; a designated compliance officer; and the filing of suspicious activity reports with a national financial-intelligence unit — reports the customer is legally never told about. In crypto specifically, AML duties extend to data-sharing under the Travel Rule and to screening counterparty wallet addresses with blockchain-analysis tools that assign risk scores based on an address's transaction history and its proximity to flagged entities.

How it touches Bitcoin users

AML rules bind the businesses that sit between fiat and Bitcoin, not the protocol or peer-to-peer transfers. A node operator running their own full node and spending from a self-hosted wallet has no AML obligations. The practical friction appears at custodial choke points: withdrawals to certain addresses may be delayed, questioned, or blocked because screening software scored them as risky, and deposits arriving from coins with a history the analytics disapprove of — including, in some documented cases, coins that merely passed through a CoinJoin — can trigger account freezes and source-of-funds interrogations. This is where AML policy and Bitcoin's design philosophy grind against each other: the ledger is neutral and permissionless, but the fiat boundary is neither.

The sovereign perspective

Critics note that the AML regime imposes enormous compliance costs and sweeping financial surveillance on the entire population while intercepting only a small fraction of illicit flows — a trade-off worth understanding even if you comply cheerfully, which you should. For the sovereign Bitcoiner the practical posture is twofold. First, know the rules of any regulated service before using it, because its obligations become your friction. Second, recognize that activities entirely outside the obligated perimeter — self-custody, running a node, mining coins fresh from the protocol, transacting peer to peer where lawful — are not loopholes but the ordinary, legal exercise of holding a bearer asset. Privacy within the law is a legitimate preference, not a red flag, however much risk-scoring software may struggle with the distinction.

One second-order effect deserves its own mention: de-risking. Because AML penalties are severe and compliance is expensive, banks and payment providers often find it cheaper to refuse entire categories of customers than to assess them individually — and businesses touching Bitcoin have spent years on that refusal list in many jurisdictions, regardless of their own compliance quality. Miners have felt this directly: perfectly lawful operations denied bank accounts, payment processing, or insurance simply for being in the industry. De-risking is a rational response to regulatory pressure, but its effect is to punish lawful activity wholesale, and it is one of the practical forces pushing Bitcoin businesses and individuals alike toward infrastructure they control — self-custody, direct settlement, and revenue earned in bitcoin rather than routed through reluctant intermediaries.

This is general education, not legal advice. For related concepts, see our entries on KYC (Know Your Customer), the FATF Travel Rule, and VASP (Virtual Asset Service Provider).