AML & BSA Compliance

Crypto SAR and Red Flags Guide for MSBs and Platforms (2025-2026)

10 min readArticle
Filing path

How to approach this

A source-based path from understanding the rule to filing and recordkeeping.

  1. Determine the requirement

    Confirm whether and how the rule applies to you.

  2. Identify the forms

    Map the requirement to the specific IRS forms involved.

  3. Prepare and file

    Complete the forms accurately and submit on time.

  4. Retain records

    Keep documentation supporting every figure you report.

Key formsIRS guidance

Key Takeaways

  • Crypto AML expectations are increasingly visible through FinCEN alerts and enforcement actions.
  • Suspicious activity review should match the platform's actual business model and risks.
  • Red flags can include scams, sanctions exposure, layering behavior, and evasion of recordkeeping.
  • A good SAR file connects monitoring, customer data, and the narrative of concern.

Crypto AML failures are now showing up in public enforcement

FinCEN's recent enforcement and alert materials for virtual currency businesses show a steady pattern: failing to register as an MSB when required, operating without a risk-based AML program, or facilitating suspicious activity involving sanctioned actors, scams, darknet markets, ransomware, or similar high-risk use cases. These are not abstract policy concerns anymore. They are live enforcement themes.

Suspicious activity analysis depends on the business model

A peer-to-peer platform, kiosk operator, hosted wallet provider, or exchange will see different red flags, but FinCEN repeatedly emphasizes the need to identify and report suspicious patterns. Scam-related virtual currency flows, sanctioned-party exposure, rapid movement through layered wallets, and evasion of recordkeeping obligations are all examples of issues that should not be invisible to the compliance file.

The SAR file should connect alerts, customer data, and narrative

A useful compliance program does more than trigger alerts. It preserves what the business knew about the customer, what transactions raised concern, what the platform did in response, and whether reporting or blocking obligations were triggered. In crypto AML, a weak narrative often undermines a strong alert.

Frequently Asked Questions

What kinds of crypto activity are showing up in FinCEN enforcement and alerts?

Recent FinCEN materials point to scam-related flows, sanctioned actor exposure, illicit market activity, and failures to maintain core AML controls.

Why is alerting software alone not enough for crypto AML?

Because the compliance case still depends on how the business investigated the alert, understood the customer, and documented the suspicious activity narrative.

What is a practical first move for a growing crypto platform?

Match the monitoring program to the actual product risks and preserve clear investigation files rather than relying on generic dashboards alone.

AMLBSAanti-money launderingKYCcompliance

Never miss an IRS deadline

Get free email reminders for Form 5472, state annual reports, quarterly estimated tax, and OBBBA rule changes — built for foreign-owned LLC owners. No spam. Unsubscribe anytime.

We respect your privacy. No spam, ever.

More on AML & BSA Compliance

Read the in-depth guides