Operations guidance only — not legal advice. Virtual-asset rules, travel-rule implementations and licensing perimeters differ by jurisdiction and change quickly; confirm current requirements with counsel and your MLRO per market. Product architecture for a crypto-native launch lives on the crypto-native solution page.
The duty map: what stays, what changes shape
| Duty | On fiat rails | On crypto rails |
|---|---|---|
| Know the customer | Identity + instrument checks, bank-assisted | Identical duty; the instrument is an address, so wallet attribution joins the file — see KYC/AML flow design |
| Source of funds | Statements, employer, banking history | Same questions plus on-chain provenance: where has this value been? |
| Screening | Largely delegated to banks and PSPs | Pulled in-house or to a screening vendor — the operator owns the policy either way |
| Monitoring & reporting | Transaction monitoring, SARs/STRs per regime | Identical duty, new signals; reports still go to the same authorities |
| Record-keeping | Ledger + provider records | Ledger + chain data + screening verdicts, retained per the same schedules |
The pattern is consistent: nothing is waived, several things are insourced. An operator adding crypto rails is not escaping payment compliance — it is hiring itself to do work banks used to do silently.
Screening: policy first, vendor second
- Screen at both edges. Deposit-side screening protects the book; payout-side screening protects you from paying into a sanctioned or stolen-funds cluster. Both need documented thresholds — block, hold-for-review, proceed-and-monitor — with the same case-queue discipline as any AML monitoring: dispositions reviewed, dead rules retired, queue age watched.
- Decide the indirect-exposure policy. Risk rarely arrives from a flagged address directly; it arrives two hops away. How many hops, at what taint share, triggers what action — that is a written policy, because it will be applied at 3am by someone who did not write it.
- Log the verdicts, not just the blocks. The screening result that allowed a transaction is part of the audit story, exactly like the orchestration audit trail on fiat.
Custody: the structural decision
Three models, in rising order of inherited obligation: processor-mediated (crypto converts to fiat at the edge; familiar books, fees and a dependency), custodial-partner (a licensed custodian holds keys; duties split by contract — read the split), and self-custody (maximum control, and in many regimes a VASP-shaped obligation set of your own). The wrong way to choose is by integration convenience; the right way is by mapping each model against your licence perimeter, treasury capacity and audit appetite, with counsel in the room. Whichever model wins, the wallet remains the platform's source of truth: on-chain events enter the same event schema, with the same append-only and reconciliation discipline as every other money movement.
Treasury on volatile rails
Crypto float is float with a price feed. The treasury disciplines apply unchanged — map where value sits, set concentration limits, decide conversion policy deliberately — plus two crypto-specific lines: a marked-to-market by-asset position reviewed daily, and an explicit policy on who absorbs price movement between player deposit and operator conversion. Operators that skip the second line discover it as a P&L surprise in the first volatile week.
The questions to settle before launch
- Which entity, under which licence, touches virtual assets at all — and does that perimeter require its own registration anywhere you operate?
- What is the custody model, in one sentence, and which duties does it leave with you?
- What are the screening thresholds and the indirect-exposure policy, in writing?
- How do travel-rule requirements apply to your structure, per market, per your counsel?
- Can the ledger reconcile chain, processor and wallet views daily — and compute player liability in every asset right now?
Five questions, none technical. The rails are the easy part; the operators who run crypto well are the ones who answered these before the first deposit landed.
Continue reading: The crypto-native solution — the product architecture these controls wrap. Payment orchestration — where crypto becomes one more route in the same system.