CVCLD cheat sheet

Distinction that drives most regulation: a virtual currency is a digital representation of value used as a medium of exchange, unit of account, or store of value; it is not legal tender and has no sovereign issuer backing it.

Crypto (convertible) vs. closed virtual currencies: convertible currencies have an equivalent value in fiat and can be exchanged; closed currencies (e.g., in-game credits) cannot be exchanged outside the ecosystem.

Blockchain = append-only distributed ledger of cryptographically linked blocks; each block header contains the prior block's hash, so altering a historical block invalidates all later hashes.

Consensus families: proof-of-work (hash-based, energy-intensive, probabilistic finality), proof-of-stake (validator stake, economic slashing), and permissioned/BFT consensus used by private ledgers.

Key custody models: self-custody (private key held by user; loss is irreversible), hosted/custodial wallet (third-party controls keys), and multisignature or MPC arrangements that split signing authority.

Addresses are derived from public keys via hashing and encoding; a public address is safe to share, but the private key or seed phrase is the sole spending authority and must never be transmitted.

Types of tokens: native coins (BTC, ETH), stablecoins (fiat-referenced, crypto-collateralized, or algorithmic), utility tokens, and security tokens; classification drives which regulatory regime applies.

Hard fork vs. soft fork: a hard fork creates a permanent chain split requiring all nodes to upgrade; a soft fork is backward-compatible and tightens consensus rules.

On-chain analytics: transactions are pseudonymous, not anonymous; clustering heuristics, address reuse, and exchange deposit points allow attribution of flows to entities.

Risk-based approach: the firm must identify, assess, and document ML/TF risk by customer, product, delivery channel, and geography, then apply controls proportionate to that risk.

CDD core elements: identify the customer, verify identity using reliable independent sources, identify beneficial owners (commonly a 25% ownership threshold), and understand the purpose and intended nature of the relationship.

EDD triggers include PEPs, higher-risk jurisdictions, complex or unusually large transactions, and source-of-funds ambiguity; EDD adds source of wealth and senior-management approval.

Transaction monitoring: rules or behavior-based scenarios generate alerts, which pass through triage, investigation, and either closure with rationale or escalation to a SAR/STR.

SAR/STR filing: file promptly on suspicion, do not tip off the customer, and retain documentation; tipping-off is itself an offense in most regimes.

Recordkeeping: typically five years after the relationship ends or after the transaction, depending on jurisdiction; records must be retrievable on regulator request.

Travel Rule: for virtual asset transfers above the applicable threshold, originator and beneficiary information must accompany the transfer; counterparty VASP due diligence is required.

Red flags specific to virtual assets: structuring across many small transfers, rapid pass-through of funds, mixing services, peel chains, and use of unhosted wallets without plausible explanation.

Investment contract test (Howey): an investment of money in a common enterprise with a reasonable expectation of profits derived from the efforts of others; each prong must be satisfied for a token to be a security.

A token's status can change over time: a sufficiently decentralized network may take an asset outside the investment-contract characterization, so analysis is facts-and-circumstances, not permanent labeling.

Commodity classification: assets with a functioning market and no issuer-dependent value may fall under commodity derivatives oversight; derivatives on such assets are regulated as commodity futures/swaps.

Registration consequences of security status: offer/sale requires registration or an exemption, intermediaries need broker-dealer or exchange registration, and ongoing disclosure and reporting obligations attach.

Exemptions commonly relied on for token offerings include private placement to accredited investors, Regulation D, Regulation A, and Regulation S for offshore sales; each carries resale restrictions.

Stablecoins: fiat-referenced tokens may be treated as payment stablecoins, securities, or deposits depending on redemption rights, reserve backing, and whether profit is promised to holders.

DeFi and lending protocols: whether a protocol is a securities exchange, broker, or lender turns on custody, discretion, and fee-taking; automated code does not itself remove regulatory obligations.

Market conduct rules apply to trading venues: prohibition on wash trading, spoofing, and manipulation, plus best-execution and conflict-of-interest controls for intermediaries.

Money transmission generally means receiving money or monetary value for transmission to another location or person by any means, including electronic; accepting and transmitting virtual currency can fall within it.

Licensing triggers vary by state/country; operating without a required license is unlicensed money transmission, exposing the firm and its officers to criminal and civil liability.

Common exemptions: agent-of-a-licensee status, payment processor exclusion for settling goods/services, and de minimis activity thresholds; exemptions are narrow and must be documented.

Permissible investments and safeguarding: licensee must hold customer funds in segregated accounts or high-quality liquid assets and maintain a reserve at least equal to outstanding obligations.

Net worth, surety bond, and minimum capital requirements are set per jurisdiction and scale with transaction volume; bonding protects the state, not the customer directly.

Change-of-control and prior-approval rules: acquiring control of a licensee requires regulatory approval; material changes to business or ownership must be notified.

Multi-state coordination: the Money Transmission Modernization Act-style model consolidates licensing, but state-by-state adoption and reciprocity remain uneven.

Bank Secrecy Act registration: a money services business must register with the federal regulator, maintain an AML program, and file currency transaction reports above the threshold.

Default treatment in many jurisdictions: virtual currency is property, not currency; disposing of it (sale, exchange, or use to buy goods) is a taxable event producing capital gain or loss.

Basis and gain: gain = amount realized minus adjusted basis; basis is the acquisition cost including fees, and holding period determines short-term vs. long-term rates.

Crypto-to-crypto trades are taxable dispositions in property-based regimes even though no fiat is received; the fair market value of the property received is the amount realized.

Mining, staking, and airdrops are generally ordinary income at fair market value when received, and that value becomes the basis for later disposition.

Recordkeeping: identify lots (FIFO, specific identification, or average cost where permitted) and retain exchange statements; missing basis can cause the entire proceeds to be taxed.

Reporting: exchanges may issue information returns (e.g., 1099 series) and the taxpayer reports gains on the applicable schedule; foreign accounts may trigger FBAR-type reporting.

Payments to employees or contractors in virtual currency are wages or compensation, subject to withholding and payroll reporting at fair market value on the payment date.

Charitable donations and gifts have special rules: a gift is generally not a taxable event to the donor, and donations may be deductible at fair market value if holding-period requirements are met.

Disclosure duties: firms must present fees, spread, custody arrangements, and risk in a clear, timely, and non-misleading way; material omissions are treated as deceptive.

Unfair or deceptive acts and practices standard: an act is deceptive if it is material and likely to mislead a reasonable consumer; unfair if it causes substantial injury not reasonably avoidable.

Marketing rules: testimonials and influencer promotions require disclosure of compensation, and performance claims must be balanced and not misleading.

Custody and segregation: customer assets must be held for the benefit of customers, reconciled regularly, and not commingled with firm operating funds.

Complaint handling: log, investigate, and respond within defined timeframes; complaint data is a supervisory signal and must feed into compliance monitoring.

Fraud typologies in crypto: rug pulls, pump-and-dump, romance/investment scams, phishing of seed phrases, and fake customer-support impersonation.

Market conduct controls: surveillance for wash trading, spoofing, and layering; employee trading policies; and conflicts-of-interest management for market makers.

Accessibility and fair treatment: onboarding must not discriminate unlawfully, and vulnerable customers require enhanced safeguards against high-pressure sales.

Sanctions screening: screen customers, beneficial owners, counterparties, and wallet addresses against designated lists (OFAC SDN, EU, UN, UK) at onboarding and on an ongoing basis.

Strict-liability principle: sanctions violations generally do not require intent; a firm can be liable for dealing with a blocked person even unknowingly.

Blocked property: assets in which a designated person has an interest must be frozen and reported to the regulator; no dealing without a specific license.

Virtual-currency-specific designations: sanctioned addresses and mixers must be added to blockchain analytics tools, and exposure thresholds for indirect dealings should be defined.

Geographic restrictions: IP geofencing, KYC country checks, and blocking of sanctioned jurisdictions; VPN circumvention must be monitored and treated as a red flag.

Export controls: encryption software and certain technology may be subject to export licensing; providing services to restricted parties or countries can violate export rules.

Cross-border data and reporting: data localization, GDPR-type transfer restrictions, and CRS/FATCA reporting obligations apply alongside AML rules.

Escalation and licensing: potential matches are escalated to compliance, blocked pending review, and resolved via delisting evidence or a regulator-issued license.

Three lines of defense: business units own risk, compliance and risk functions oversee and set frameworks, and internal audit provides independent assurance.

Core program elements: written policies, a designated compliance officer with authority, training, monitoring and testing, and independent audit, backed by board-level oversight.

Risk assessment methodology: rate inherent risk (likelihood x impact) across customer, product, channel, and geography, then apply control effectiveness to derive residual risk.

Tone at the top: board and senior management must approve the risk appetite, resource compliance adequately, and ensure compliance has escalation access without retaliation.

Training: role-based, documented, and refreshed at defined intervals; completion rates and comprehension testing are tracked as metrics.

Issue management: findings are logged with owner, due date, and severity; overdue issues escalate to the board risk committee and are tracked to remediation.

Ethics and conflicts: gifts-and-entertainment limits, outside business activity disclosure, and whistleblower channels with anti-retaliation protections.

Metrics and reporting: define KRIs (alert backlog, SAR timeliness, training completion, control failures) and report them to senior management and the board on a set cadence.

Distinction that drives most regulation: a virtual currency is a digital representation of value used as a medium of exchange, unit of account, or store of value; it is not legal tender and has no sovereign issuer backing it.

Crypto (convertible) vs. closed virtual currencies: convertible currencies have an equivalent value in fiat and can be exchanged; closed currencies (e.g., in-game credits) cannot be exchanged outside the ecosystem.

Blockchain = append-only distributed ledger of cryptographically linked blocks; each block header contains the prior block's hash, so altering a historical block invalidates all later hashes.

Consensus families: proof-of-work (hash-based, energy-intensive, probabilistic finality), proof-of-stake (validator stake, economic slashing), and permissioned/BFT consensus used by private ledgers.

Key custody models: self-custody (private key held by user; loss is irreversible), hosted/custodial wallet (third-party controls keys), and multisignature or MPC arrangements that split signing authority.

Addresses are derived from public keys via hashing and encoding; a public address is safe to share, but the private key or seed phrase is the sole spending authority and must never be transmitted.

Types of tokens: native coins (BTC, ETH), stablecoins (fiat-referenced, crypto-collateralized, or algorithmic), utility tokens, and security tokens; classification drives which regulatory regime applies.

Hard fork vs. soft fork: a hard fork creates a permanent chain split requiring all nodes to upgrade; a soft fork is backward-compatible and tightens consensus rules.

On-chain analytics: transactions are pseudonymous, not anonymous; clustering heuristics, address reuse, and exchange deposit points allow attribution of flows to entities.

Risk-based approach: the firm must identify, assess, and document ML/TF risk by customer, product, delivery channel, and geography, then apply controls proportionate to that risk.

CDD core elements: identify the customer, verify identity using reliable independent sources, identify beneficial owners (commonly a 25% ownership threshold), and understand the purpose and intended nature of the relationship.

EDD triggers include PEPs, higher-risk jurisdictions, complex or unusually large transactions, and source-of-funds ambiguity; EDD adds source of wealth and senior-management approval.

Transaction monitoring: rules or behavior-based scenarios generate alerts, which pass through triage, investigation, and either closure with rationale or escalation to a SAR/STR.

SAR/STR filing: file promptly on suspicion, do not tip off the customer, and retain documentation; tipping-off is itself an offense in most regimes.

Recordkeeping: typically five years after the relationship ends or after the transaction, depending on jurisdiction; records must be retrievable on regulator request.

Travel Rule: for virtual asset transfers above the applicable threshold, originator and beneficiary information must accompany the transfer; counterparty VASP due diligence is required.

Red flags specific to virtual assets: structuring across many small transfers, rapid pass-through of funds, mixing services, peel chains, and use of unhosted wallets without plausible explanation.

Investment contract test (Howey): an investment of money in a common enterprise with a reasonable expectation of profits derived from the efforts of others; each prong must be satisfied for a token to be a security.

A token's status can change over time: a sufficiently decentralized network may take an asset outside the investment-contract characterization, so analysis is facts-and-circumstances, not permanent labeling.

Commodity classification: assets with a functioning market and no issuer-dependent value may fall under commodity derivatives oversight; derivatives on such assets are regulated as commodity futures/swaps.

Registration consequences of security status: offer/sale requires registration or an exemption, intermediaries need broker-dealer or exchange registration, and ongoing disclosure and reporting obligations attach.

Exemptions commonly relied on for token offerings include private placement to accredited investors, Regulation D, Regulation A, and Regulation S for offshore sales; each carries resale restrictions.

Stablecoins: fiat-referenced tokens may be treated as payment stablecoins, securities, or deposits depending on redemption rights, reserve backing, and whether profit is promised to holders.

DeFi and lending protocols: whether a protocol is a securities exchange, broker, or lender turns on custody, discretion, and fee-taking; automated code does not itself remove regulatory obligations.

Market conduct rules apply to trading venues: prohibition on wash trading, spoofing, and manipulation, plus best-execution and conflict-of-interest controls for intermediaries.

Money transmission generally means receiving money or monetary value for transmission to another location or person by any means, including electronic; accepting and transmitting virtual currency can fall within it.

Licensing triggers vary by state/country; operating without a required license is unlicensed money transmission, exposing the firm and its officers to criminal and civil liability.

Common exemptions: agent-of-a-licensee status, payment processor exclusion for settling goods/services, and de minimis activity thresholds; exemptions are narrow and must be documented.

Permissible investments and safeguarding: licensee must hold customer funds in segregated accounts or high-quality liquid assets and maintain a reserve at least equal to outstanding obligations.

Net worth, surety bond, and minimum capital requirements are set per jurisdiction and scale with transaction volume; bonding protects the state, not the customer directly.

Change-of-control and prior-approval rules: acquiring control of a licensee requires regulatory approval; material changes to business or ownership must be notified.

Multi-state coordination: the Money Transmission Modernization Act-style model consolidates licensing, but state-by-state adoption and reciprocity remain uneven.

Bank Secrecy Act registration: a money services business must register with the federal regulator, maintain an AML program, and file currency transaction reports above the threshold.

Default treatment in many jurisdictions: virtual currency is property, not currency; disposing of it (sale, exchange, or use to buy goods) is a taxable event producing capital gain or loss.

Basis and gain: gain = amount realized minus adjusted basis; basis is the acquisition cost including fees, and holding period determines short-term vs. long-term rates.

Crypto-to-crypto trades are taxable dispositions in property-based regimes even though no fiat is received; the fair market value of the property received is the amount realized.

Mining, staking, and airdrops are generally ordinary income at fair market value when received, and that value becomes the basis for later disposition.

Recordkeeping: identify lots (FIFO, specific identification, or average cost where permitted) and retain exchange statements; missing basis can cause the entire proceeds to be taxed.

Reporting: exchanges may issue information returns (e.g., 1099 series) and the taxpayer reports gains on the applicable schedule; foreign accounts may trigger FBAR-type reporting.

Payments to employees or contractors in virtual currency are wages or compensation, subject to withholding and payroll reporting at fair market value on the payment date.

Charitable donations and gifts have special rules: a gift is generally not a taxable event to the donor, and donations may be deductible at fair market value if holding-period requirements are met.

Disclosure duties: firms must present fees, spread, custody arrangements, and risk in a clear, timely, and non-misleading way; material omissions are treated as deceptive.

Unfair or deceptive acts and practices standard: an act is deceptive if it is material and likely to mislead a reasonable consumer; unfair if it causes substantial injury not reasonably avoidable.

Marketing rules: testimonials and influencer promotions require disclosure of compensation, and performance claims must be balanced and not misleading.

Custody and segregation: customer assets must be held for the benefit of customers, reconciled regularly, and not commingled with firm operating funds.

Complaint handling: log, investigate, and respond within defined timeframes; complaint data is a supervisory signal and must feed into compliance monitoring.

Fraud typologies in crypto: rug pulls, pump-and-dump, romance/investment scams, phishing of seed phrases, and fake customer-support impersonation.

Market conduct controls: surveillance for wash trading, spoofing, and layering; employee trading policies; and conflicts-of-interest management for market makers.

Accessibility and fair treatment: onboarding must not discriminate unlawfully, and vulnerable customers require enhanced safeguards against high-pressure sales.

Sanctions screening: screen customers, beneficial owners, counterparties, and wallet addresses against designated lists (OFAC SDN, EU, UN, UK) at onboarding and on an ongoing basis.

Strict-liability principle: sanctions violations generally do not require intent; a firm can be liable for dealing with a blocked person even unknowingly.

Blocked property: assets in which a designated person has an interest must be frozen and reported to the regulator; no dealing without a specific license.

Virtual-currency-specific designations: sanctioned addresses and mixers must be added to blockchain analytics tools, and exposure thresholds for indirect dealings should be defined.

Geographic restrictions: IP geofencing, KYC country checks, and blocking of sanctioned jurisdictions; VPN circumvention must be monitored and treated as a red flag.

Export controls: encryption software and certain technology may be subject to export licensing; providing services to restricted parties or countries can violate export rules.

Cross-border data and reporting: data localization, GDPR-type transfer restrictions, and CRS/FATCA reporting obligations apply alongside AML rules.

Escalation and licensing: potential matches are escalated to compliance, blocked pending review, and resolved via delisting evidence or a regulator-issued license.

Three lines of defense: business units own risk, compliance and risk functions oversee and set frameworks, and internal audit provides independent assurance.

Core program elements: written policies, a designated compliance officer with authority, training, monitoring and testing, and independent audit, backed by board-level oversight.

Risk assessment methodology: rate inherent risk (likelihood x impact) across customer, product, channel, and geography, then apply control effectiveness to derive residual risk.

Tone at the top: board and senior management must approve the risk appetite, resource compliance adequately, and ensure compliance has escalation access without retaliation.

Training: role-based, documented, and refreshed at defined intervals; completion rates and comprehension testing are tracked as metrics.

Issue management: findings are logged with owner, due date, and severity; overdue issues escalate to the board risk committee and are tracked to remediation.

Ethics and conflicts: gifts-and-entertainment limits, outside business activity disclosure, and whistleblower channels with anti-retaliation protections.

Metrics and reporting: define KRIs (alert backlog, SAR timeliness, training completion, control failures) and report them to senior management and the board on a set cadence.

Distinction that drives most regulation: a virtual currency is a digital representation of value used as a medium of exchange, unit of account, or store of value; it is not legal tender and has no sovereign issuer backing it.

Crypto (convertible) vs. closed virtual currencies: convertible currencies have an equivalent value in fiat and can be exchanged; closed currencies (e.g., in-game credits) cannot be exchanged outside the ecosystem.

Blockchain = append-only distributed ledger of cryptographically linked blocks; each block header contains the prior block's hash, so altering a historical block invalidates all later hashes.

Consensus families: proof-of-work (hash-based, energy-intensive, probabilistic finality), proof-of-stake (validator stake, economic slashing), and permissioned/BFT consensus used by private ledgers.

Key custody models: self-custody (private key held by user; loss is irreversible), hosted/custodial wallet (third-party controls keys), and multisignature or MPC arrangements that split signing authority.

Addresses are derived from public keys via hashing and encoding; a public address is safe to share, but the private key or seed phrase is the sole spending authority and must never be transmitted.

Types of tokens: native coins (BTC, ETH), stablecoins (fiat-referenced, crypto-collateralized, or algorithmic), utility tokens, and security tokens; classification drives which regulatory regime applies.

Hard fork vs. soft fork: a hard fork creates a permanent chain split requiring all nodes to upgrade; a soft fork is backward-compatible and tightens consensus rules.

On-chain analytics: transactions are pseudonymous, not anonymous; clustering heuristics, address reuse, and exchange deposit points allow attribution of flows to entities.

Risk-based approach: the firm must identify, assess, and document ML/TF risk by customer, product, delivery channel, and geography, then apply controls proportionate to that risk.

CDD core elements: identify the customer, verify identity using reliable independent sources, identify beneficial owners (commonly a 25% ownership threshold), and understand the purpose and intended nature of the relationship.

EDD triggers include PEPs, higher-risk jurisdictions, complex or unusually large transactions, and source-of-funds ambiguity; EDD adds source of wealth and senior-management approval.

Transaction monitoring: rules or behavior-based scenarios generate alerts, which pass through triage, investigation, and either closure with rationale or escalation to a SAR/STR.

SAR/STR filing: file promptly on suspicion, do not tip off the customer, and retain documentation; tipping-off is itself an offense in most regimes.

Recordkeeping: typically five years after the relationship ends or after the transaction, depending on jurisdiction; records must be retrievable on regulator request.

Travel Rule: for virtual asset transfers above the applicable threshold, originator and beneficiary information must accompany the transfer; counterparty VASP due diligence is required.

Red flags specific to virtual assets: structuring across many small transfers, rapid pass-through of funds, mixing services, peel chains, and use of unhosted wallets without plausible explanation.

Investment contract test (Howey): an investment of money in a common enterprise with a reasonable expectation of profits derived from the efforts of others; each prong must be satisfied for a token to be a security.

A token's status can change over time: a sufficiently decentralized network may take an asset outside the investment-contract characterization, so analysis is facts-and-circumstances, not permanent labeling.

Commodity classification: assets with a functioning market and no issuer-dependent value may fall under commodity derivatives oversight; derivatives on such assets are regulated as commodity futures/swaps.

Registration consequences of security status: offer/sale requires registration or an exemption, intermediaries need broker-dealer or exchange registration, and ongoing disclosure and reporting obligations attach.

Exemptions commonly relied on for token offerings include private placement to accredited investors, Regulation D, Regulation A, and Regulation S for offshore sales; each carries resale restrictions.

Stablecoins: fiat-referenced tokens may be treated as payment stablecoins, securities, or deposits depending on redemption rights, reserve backing, and whether profit is promised to holders.

DeFi and lending protocols: whether a protocol is a securities exchange, broker, or lender turns on custody, discretion, and fee-taking; automated code does not itself remove regulatory obligations.

Market conduct rules apply to trading venues: prohibition on wash trading, spoofing, and manipulation, plus best-execution and conflict-of-interest controls for intermediaries.

Money transmission generally means receiving money or monetary value for transmission to another location or person by any means, including electronic; accepting and transmitting virtual currency can fall within it.

Licensing triggers vary by state/country; operating without a required license is unlicensed money transmission, exposing the firm and its officers to criminal and civil liability.

Common exemptions: agent-of-a-licensee status, payment processor exclusion for settling goods/services, and de minimis activity thresholds; exemptions are narrow and must be documented.

Permissible investments and safeguarding: licensee must hold customer funds in segregated accounts or high-quality liquid assets and maintain a reserve at least equal to outstanding obligations.

Net worth, surety bond, and minimum capital requirements are set per jurisdiction and scale with transaction volume; bonding protects the state, not the customer directly.

Change-of-control and prior-approval rules: acquiring control of a licensee requires regulatory approval; material changes to business or ownership must be notified.

Multi-state coordination: the Money Transmission Modernization Act-style model consolidates licensing, but state-by-state adoption and reciprocity remain uneven.

Bank Secrecy Act registration: a money services business must register with the federal regulator, maintain an AML program, and file currency transaction reports above the threshold.

Default treatment in many jurisdictions: virtual currency is property, not currency; disposing of it (sale, exchange, or use to buy goods) is a taxable event producing capital gain or loss.

Basis and gain: gain = amount realized minus adjusted basis; basis is the acquisition cost including fees, and holding period determines short-term vs. long-term rates.

Crypto-to-crypto trades are taxable dispositions in property-based regimes even though no fiat is received; the fair market value of the property received is the amount realized.

Mining, staking, and airdrops are generally ordinary income at fair market value when received, and that value becomes the basis for later disposition.

Recordkeeping: identify lots (FIFO, specific identification, or average cost where permitted) and retain exchange statements; missing basis can cause the entire proceeds to be taxed.

Reporting: exchanges may issue information returns (e.g., 1099 series) and the taxpayer reports gains on the applicable schedule; foreign accounts may trigger FBAR-type reporting.

Payments to employees or contractors in virtual currency are wages or compensation, subject to withholding and payroll reporting at fair market value on the payment date.

Charitable donations and gifts have special rules: a gift is generally not a taxable event to the donor, and donations may be deductible at fair market value if holding-period requirements are met.

Disclosure duties: firms must present fees, spread, custody arrangements, and risk in a clear, timely, and non-misleading way; material omissions are treated as deceptive.

Unfair or deceptive acts and practices standard: an act is deceptive if it is material and likely to mislead a reasonable consumer; unfair if it causes substantial injury not reasonably avoidable.

Marketing rules: testimonials and influencer promotions require disclosure of compensation, and performance claims must be balanced and not misleading.

Custody and segregation: customer assets must be held for the benefit of customers, reconciled regularly, and not commingled with firm operating funds.

Complaint handling: log, investigate, and respond within defined timeframes; complaint data is a supervisory signal and must feed into compliance monitoring.

Fraud typologies in crypto: rug pulls, pump-and-dump, romance/investment scams, phishing of seed phrases, and fake customer-support impersonation.

Market conduct controls: surveillance for wash trading, spoofing, and layering; employee trading policies; and conflicts-of-interest management for market makers.

Accessibility and fair treatment: onboarding must not discriminate unlawfully, and vulnerable customers require enhanced safeguards against high-pressure sales.

Sanctions screening: screen customers, beneficial owners, counterparties, and wallet addresses against designated lists (OFAC SDN, EU, UN, UK) at onboarding and on an ongoing basis.

Strict-liability principle: sanctions violations generally do not require intent; a firm can be liable for dealing with a blocked person even unknowingly.

Blocked property: assets in which a designated person has an interest must be frozen and reported to the regulator; no dealing without a specific license.

Virtual-currency-specific designations: sanctioned addresses and mixers must be added to blockchain analytics tools, and exposure thresholds for indirect dealings should be defined.

Geographic restrictions: IP geofencing, KYC country checks, and blocking of sanctioned jurisdictions; VPN circumvention must be monitored and treated as a red flag.

Export controls: encryption software and certain technology may be subject to export licensing; providing services to restricted parties or countries can violate export rules.

Cross-border data and reporting: data localization, GDPR-type transfer restrictions, and CRS/FATCA reporting obligations apply alongside AML rules.

Escalation and licensing: potential matches are escalated to compliance, blocked pending review, and resolved via delisting evidence or a regulator-issued license.

Three lines of defense: business units own risk, compliance and risk functions oversee and set frameworks, and internal audit provides independent assurance.

Core program elements: written policies, a designated compliance officer with authority, training, monitoring and testing, and independent audit, backed by board-level oversight.

Risk assessment methodology: rate inherent risk (likelihood x impact) across customer, product, channel, and geography, then apply control effectiveness to derive residual risk.

Tone at the top: board and senior management must approve the risk appetite, resource compliance adequately, and ensure compliance has escalation access without retaliation.

Training: role-based, documented, and refreshed at defined intervals; completion rates and comprehension testing are tracked as metrics.

Issue management: findings are logged with owner, due date, and severity; overdue issues escalate to the board risk committee and are tracked to remediation.

Ethics and conflicts: gifts-and-entertainment limits, outside business activity disclosure, and whistleblower channels with anti-retaliation protections.

Metrics and reporting: define KRIs (alert backlog, SAR timeliness, training completion, control failures) and report them to senior management and the board on a set cadence.

Distinction that drives most regulation: a virtual currency is a digital representation of value used as a medium of exchange, unit of account, or store of value; it is not legal tender and has no sovereign issuer backing it.

Crypto (convertible) vs. closed virtual currencies: convertible currencies have an equivalent value in fiat and can be exchanged; closed currencies (e.g., in-game credits) cannot be exchanged outside the ecosystem.

Blockchain = append-only distributed ledger of cryptographically linked blocks; each block header contains the prior block's hash, so altering a historical block invalidates all later hashes.

Consensus families: proof-of-work (hash-based, energy-intensive, probabilistic finality), proof-of-stake (validator stake, economic slashing), and permissioned/BFT consensus used by private ledgers.

Key custody models: self-custody (private key held by user; loss is irreversible), hosted/custodial wallet (third-party controls keys), and multisignature or MPC arrangements that split signing authority.

Addresses are derived from public keys via hashing and encoding; a public address is safe to share, but the private key or seed phrase is the sole spending authority and must never be transmitted.

Types of tokens: native coins (BTC, ETH), stablecoins (fiat-referenced, crypto-collateralized, or algorithmic), utility tokens, and security tokens; classification drives which regulatory regime applies.

Hard fork vs. soft fork: a hard fork creates a permanent chain split requiring all nodes to upgrade; a soft fork is backward-compatible and tightens consensus rules.

On-chain analytics: transactions are pseudonymous, not anonymous; clustering heuristics, address reuse, and exchange deposit points allow attribution of flows to entities.

Risk-based approach: the firm must identify, assess, and document ML/TF risk by customer, product, delivery channel, and geography, then apply controls proportionate to that risk.

CDD core elements: identify the customer, verify identity using reliable independent sources, identify beneficial owners (commonly a 25% ownership threshold), and understand the purpose and intended nature of the relationship.

EDD triggers include PEPs, higher-risk jurisdictions, complex or unusually large transactions, and source-of-funds ambiguity; EDD adds source of wealth and senior-management approval.

Transaction monitoring: rules or behavior-based scenarios generate alerts, which pass through triage, investigation, and either closure with rationale or escalation to a SAR/STR.

SAR/STR filing: file promptly on suspicion, do not tip off the customer, and retain documentation; tipping-off is itself an offense in most regimes.

Recordkeeping: typically five years after the relationship ends or after the transaction, depending on jurisdiction; records must be retrievable on regulator request.

Travel Rule: for virtual asset transfers above the applicable threshold, originator and beneficiary information must accompany the transfer; counterparty VASP due diligence is required.

Red flags specific to virtual assets: structuring across many small transfers, rapid pass-through of funds, mixing services, peel chains, and use of unhosted wallets without plausible explanation.

Investment contract test (Howey): an investment of money in a common enterprise with a reasonable expectation of profits derived from the efforts of others; each prong must be satisfied for a token to be a security.

A token's status can change over time: a sufficiently decentralized network may take an asset outside the investment-contract characterization, so analysis is facts-and-circumstances, not permanent labeling.

Commodity classification: assets with a functioning market and no issuer-dependent value may fall under commodity derivatives oversight; derivatives on such assets are regulated as commodity futures/swaps.

Registration consequences of security status: offer/sale requires registration or an exemption, intermediaries need broker-dealer or exchange registration, and ongoing disclosure and reporting obligations attach.

Exemptions commonly relied on for token offerings include private placement to accredited investors, Regulation D, Regulation A, and Regulation S for offshore sales; each carries resale restrictions.

Stablecoins: fiat-referenced tokens may be treated as payment stablecoins, securities, or deposits depending on redemption rights, reserve backing, and whether profit is promised to holders.

DeFi and lending protocols: whether a protocol is a securities exchange, broker, or lender turns on custody, discretion, and fee-taking; automated code does not itself remove regulatory obligations.

Market conduct rules apply to trading venues: prohibition on wash trading, spoofing, and manipulation, plus best-execution and conflict-of-interest controls for intermediaries.

Money transmission generally means receiving money or monetary value for transmission to another location or person by any means, including electronic; accepting and transmitting virtual currency can fall within it.

Licensing triggers vary by state/country; operating without a required license is unlicensed money transmission, exposing the firm and its officers to criminal and civil liability.

Common exemptions: agent-of-a-licensee status, payment processor exclusion for settling goods/services, and de minimis activity thresholds; exemptions are narrow and must be documented.

Permissible investments and safeguarding: licensee must hold customer funds in segregated accounts or high-quality liquid assets and maintain a reserve at least equal to outstanding obligations.

Net worth, surety bond, and minimum capital requirements are set per jurisdiction and scale with transaction volume; bonding protects the state, not the customer directly.

Change-of-control and prior-approval rules: acquiring control of a licensee requires regulatory approval; material changes to business or ownership must be notified.

Multi-state coordination: the Money Transmission Modernization Act-style model consolidates licensing, but state-by-state adoption and reciprocity remain uneven.

Bank Secrecy Act registration: a money services business must register with the federal regulator, maintain an AML program, and file currency transaction reports above the threshold.

Default treatment in many jurisdictions: virtual currency is property, not currency; disposing of it (sale, exchange, or use to buy goods) is a taxable event producing capital gain or loss.

Basis and gain: gain = amount realized minus adjusted basis; basis is the acquisition cost including fees, and holding period determines short-term vs. long-term rates.

Crypto-to-crypto trades are taxable dispositions in property-based regimes even though no fiat is received; the fair market value of the property received is the amount realized.

Mining, staking, and airdrops are generally ordinary income at fair market value when received, and that value becomes the basis for later disposition.

Recordkeeping: identify lots (FIFO, specific identification, or average cost where permitted) and retain exchange statements; missing basis can cause the entire proceeds to be taxed.

Reporting: exchanges may issue information returns (e.g., 1099 series) and the taxpayer reports gains on the applicable schedule; foreign accounts may trigger FBAR-type reporting.

Payments to employees or contractors in virtual currency are wages or compensation, subject to withholding and payroll reporting at fair market value on the payment date.

Charitable donations and gifts have special rules: a gift is generally not a taxable event to the donor, and donations may be deductible at fair market value if holding-period requirements are met.

Disclosure duties: firms must present fees, spread, custody arrangements, and risk in a clear, timely, and non-misleading way; material omissions are treated as deceptive.

Unfair or deceptive acts and practices standard: an act is deceptive if it is material and likely to mislead a reasonable consumer; unfair if it causes substantial injury not reasonably avoidable.

Marketing rules: testimonials and influencer promotions require disclosure of compensation, and performance claims must be balanced and not misleading.

Custody and segregation: customer assets must be held for the benefit of customers, reconciled regularly, and not commingled with firm operating funds.

Complaint handling: log, investigate, and respond within defined timeframes; complaint data is a supervisory signal and must feed into compliance monitoring.

Fraud typologies in crypto: rug pulls, pump-and-dump, romance/investment scams, phishing of seed phrases, and fake customer-support impersonation.

Market conduct controls: surveillance for wash trading, spoofing, and layering; employee trading policies; and conflicts-of-interest management for market makers.

Accessibility and fair treatment: onboarding must not discriminate unlawfully, and vulnerable customers require enhanced safeguards against high-pressure sales.

Sanctions screening: screen customers, beneficial owners, counterparties, and wallet addresses against designated lists (OFAC SDN, EU, UN, UK) at onboarding and on an ongoing basis.

Strict-liability principle: sanctions violations generally do not require intent; a firm can be liable for dealing with a blocked person even unknowingly.

Blocked property: assets in which a designated person has an interest must be frozen and reported to the regulator; no dealing without a specific license.

Virtual-currency-specific designations: sanctioned addresses and mixers must be added to blockchain analytics tools, and exposure thresholds for indirect dealings should be defined.

Geographic restrictions: IP geofencing, KYC country checks, and blocking of sanctioned jurisdictions; VPN circumvention must be monitored and treated as a red flag.

Export controls: encryption software and certain technology may be subject to export licensing; providing services to restricted parties or countries can violate export rules.

Cross-border data and reporting: data localization, GDPR-type transfer restrictions, and CRS/FATCA reporting obligations apply alongside AML rules.

Escalation and licensing: potential matches are escalated to compliance, blocked pending review, and resolved via delisting evidence or a regulator-issued license.

Three lines of defense: business units own risk, compliance and risk functions oversee and set frameworks, and internal audit provides independent assurance.

Core program elements: written policies, a designated compliance officer with authority, training, monitoring and testing, and independent audit, backed by board-level oversight.

Risk assessment methodology: rate inherent risk (likelihood x impact) across customer, product, channel, and geography, then apply control effectiveness to derive residual risk.

Tone at the top: board and senior management must approve the risk appetite, resource compliance adequately, and ensure compliance has escalation access without retaliation.

Training: role-based, documented, and refreshed at defined intervals; completion rates and comprehension testing are tracked as metrics.

Issue management: findings are logged with owner, due date, and severity; overdue issues escalate to the board risk committee and are tracked to remediation.

Ethics and conflicts: gifts-and-entertainment limits, outside business activity disclosure, and whistleblower channels with anti-retaliation protections.

Metrics and reporting: define KRIs (alert backlog, SAR timeliness, training completion, control failures) and report them to senior management and the board on a set cadence.