Fiat On/Off-Ramps, Exchanges, and VASP Due Diligence
This domain tests how you evaluate the firms that convert fiat to crypto and back, and how you decide whether their records will support an investigation.
Service types
- Centralised exchanges (CEXs): custodial, KYC-based, hold order books and withdrawal records.
- P2P platforms and brokers: match buyers and sellers; KYC quality varies.
- Crypto ATMs: cash-to-crypto; often small operators with limited AML programmes.
- Payment processors and card on-ramps: may be the only link between a bank account and a wallet.
Due diligence dimensions
Registration and licensing in the relevant jurisdiction; AML/CFT programme and MLRO; KYC and CDD standards; sanctions and wallet screening; Travel Rule capability; record retention; ownership and jurisdiction; security history; cooperation with law enforcement.
Worked example
Two exchanges serve the same region. Exchange A is registered, publishes AML policies, retains KYC and withdrawal logs for five years, and has a law-enforcement response process. Exchange B is unregistered, offers no-KYC trading below limits, and routes orders through a mixer-friendly liquidity provider. Reasoning: A is the better source of attribution evidence and the lower-risk counterparty; B presents a sanctions and laundering risk and its records may be incomplete or inaccessible. Document the comparison and the rationale.
Traps
- Assuming all exchanges keep usable KYC records.
- Confusing a hot wallet with a customer's deposit address.
- Overlooking ATM and payment-processor routes.
- Treating a licence as proof of effective AML controls.