AML/CFT Frameworks, Sanctions, and Travel Rule Compliance
This domain tests the rules that bind VASPs and the investigative consequences when they fail.
Core framework
- FATF Recommendation 15 requires VASPs to be licensed or registered and supervised for AML/CFT.
- Recommendation 16 (Travel Rule) requires originator and beneficiary information to travel with transfers. The FATF threshold is USD/EUR 1,000; the EU Transfer of Funds Regulation applies a zero threshold to CASPs from 30 December 2024.
- CDD: identify the customer, verify beneficial ownership, understand purpose and expected activity, and apply enhanced measures for high-risk cases.
- Reporting: suspicious transaction reports go to the FIU; tipping-off is prohibited.
Sanctions
Sanctions are separate from AML. OFAC's SDN list, EU and UN lists, and the 50% rule (entities owned 50% or more by a designated person) matter. Tornado Cash was designated by OFAC in August 2022 and delisted in March 2025, illustrating that status changes and must be checked at the time of the transaction and the investigation.
Worked example
A CASP in the EU sends 0.4 BTC to a counterparty VASP in a non-EU jurisdiction. The transfer is below USD 1,000, but the EU TFR zero threshold applies, so name, account and address data must be transmitted and screened. Reasoning: do not apply the FATF threshold mechanically; check the sending and receiving jurisdictions and the asset.
Traps
- Using the FATF threshold where a zero-threshold regime applies.
- Treating sanctions screening as optional for crypto.
- Ignoring the 50% ownership rule.
- Confusing an STR with a sanctions report.