AML and Crypto Fraud Regulators: The Institution Determines the Authority

Who regulates money laundering and crypto fraud depends on the institution and its activity. Treasury’s Financial Crimes Enforcement Network administers the Bank Secrecy Act, and the Office of Foreign Assets Control administers sanctions. Bank supervisors, securities and commodities regulators, and states oversee their respective institutions and activities. An insider may know exactly which control failed while seeing only the group name on the office door. The account, the company operating it and the activity behind the transaction determine which authority matters. A bank examiner, a criminal investigator and a whistleblower award office can each have a role in the same conduct. They do different jobs.

Bank Charters Determine the Supervisor

A bank’s charter, Federal Reserve membership and insurance status determine its federal supervisor. The holding company can have a different supervisor from the bank beneath it. That is why a group brand leaves part of the answer missing.

State financial regulators also supervise institutions under their state authority. The chartered bank, its holding company and a money-transmission business in the same group can therefore raise different supervisory questions.

FinCEN sits across that structure and can bring its own civil enforcement action over the same failed controls a bank supervisor examines.

The structure matters inside the business, too. The Wharton Initiative on Financial Policy and Regulation’s 2024 paper, Anti-Money Laundering: Opportunities for Improvement, describes a system in which compliance staff may see themselves as aligned with investigators while their own firms see their work as an expense to minimize. Its account of fragmented oversight puts the problem plainly:

For someone who has watched management leave a control unfunded, that distinction is familiar. The people who need the information, the people checking the compliance program and the people approving its budget can have different priorities.

Which Regulator Handles Crypto Exchange AML Control Failures?

FinCEN administers the Bank Secrecy Act duties that can apply to a crypto exchange operating as a money transmitter. OFAC handles sanctions, while securities, derivatives and state licensing activity can bring other authorities into the same business.

The starting point in FinCEN’s virtual-currency guidance is what the operator does with value. A centralized exchange can accept and transmit it. A hosted-wallet provider can control customer value and move balances on an internal ledger. Those internal movements need not appear individually on a public blockchain.

Control also matters in a multisignature wallet or a decentralized application. Who holds the keys, who approves transfers and who operates the transmission business are concrete questions. A stablecoin issuer’s issuance and redemption activity differs from later transfers between users. A mixer service that accepts and retransmits value falls within FinCEN’s money-transmitter framework. Calling the whole arrangement crypto says little about where those responsibilities sit.

Offshore Exchanges and U.S. Customers

The money-services-business definition can reach a foreign business conducting activity wholly or substantially in the United States. Customer access, domestic agents, transmission functions and U.S. banking relationships can matter more than the incorporation address.

In its guilty plea, Binance admitted publicly claiming to exclude U.S. customers while coaching valuable users to stay through offshore entities. The exclusion was public. The workaround was part of the business. Binance also admitted failing to file suspicious activity reports and permitting U.S.-Iran trade matching.

That is an institution question an insider can make concrete: which company served the customers, what the access controls permitted and who approved the exceptions.

Securities, Commodities and Member Firms

The Financial Industry Regulatory Authority’s anti-money laundering rule addresses its member firms. The National Futures Association’s framework includes futures commission merchants and introducing brokers. Membership and the business being performed determine where those organizations fit.

For deceptive crypto investment promises and trading manipulation, see Crypto Fraud.

State Licenses Add Another Layer

State regulators oversee money-transmitter licenses, virtual-currency activity and state-chartered institutions. New York’s virtual-currency framework includes a BitLicense or approved banking-charter route, separate from money-transmitter licensing. Covered activities include custody, transmission, exchange and issuance involving New York or its residents.

Federal money-services-business registration and state authorization are separate. The legal entity carrying the license matters just as much as the entity operating the account.

The Financial Action Task Force develops international anti-money laundering standards for national governments to implement. U.S. supervisory authority follows the institution and its activity.

Bank Prudential Regulator Report Versus FinCEN Whistleblower Submission

A bank prudential regulator report concerns the institution under that supervisor’s authority. A FinCEN whistleblower submission supplies information for covered enforcement and potential consideration under the anti-money laundering and sanctions award program. The supervisory relationship and the personal award route require separate attention.

The bank’s report, an employee’s information about management overriding controls and a later personal award claim serve different purposes.

We connect the suspected failure to the institution’s actual duty, including what managers knew and what they decided to leave unresolved.

A supervisory complaint does not automatically become an application under FinCEN, SEC or CFTC award rules. We assess those possibilities with you as part of the case, including which office has authority over the conduct and which program can recognize your contribution.

OFAC Oversees Sanctions and the Institution’s Response

OFAC investigates apparent sanctions violations and administers sanctions restrictions, blocked property and licenses. That work can overlap with an anti-money laundering case against the same business.

FinCEN’s Bittrex consent order addressed failures in the exchange and hosted-wallet business’s anti-money laundering program and suspicious-transaction reporting. A separate OFAC resolution addressed sanctions. The same platform’s activity gave the agencies different questions to answer.

A company’s voluntary self-disclosure likewise concerns its own conduct and penalty treatment. FinCEN administers the whistleblower award route for covered sanctions information. We examine that distinction with insiders whose employer has already dealt with OFAC.

Who Investigates Money Laundering in the USA?

The FBI, IRS Criminal Investigation, Homeland Security Investigations and the Secret Service investigate money laundering and related financial crime within their authority. The Justice Department and U.S. Attorneys’ Offices bring federal criminal cases. FinCEN analyzes financial reports and makes referrals, alongside its regulatory and civil enforcement work.

IRS Criminal Investigation has a different role from the IRS examiners who conduct delegated Bank Secrecy Act examinations of many nonbanks, including money services businesses and casinos.

What an Insider’s Records Can Show

Customer and beneficial-owner files, internal ledgers, wallet-control records and management decisions connect the movement of money to the institution responsible for it. A public transaction hash can show a transfer. An internal balance transfer can change who is credited without creating a separate public transaction. The exchange ledger can identify that customer, while permissions and escalation records can show who controlled the transaction and what staff knew.

Customer identification, due diligence, transaction monitoring and sanctions screening connect those records to the controls the business was supposed to operate. The industry’s controls distribute that knowledge across teams. Onboarding staff know what the customer supplied. Monitoring engineers know how the rules operated. Investigators know what alerts revealed, and managers know which exceptions or staffing decisions they approved. Those connections are where we focus with an insider who has seen the program fail in practice.

The Travel Rule supplies a further institutional record: required information accompanies covered transfers between financial institutions. The customer information travels with the transfer instructions rather than being published on the blockchain. The message and the public transfer can answer different parts of the same question.

We treat an analytics score as a starting point for inquiry. The customer’s identity, the firm’s ledger and the decision to allow the activity give that inquiry substance. SAR confidentiality and the handling of sensitive records are matters we address with you and anti-money laundering whistleblower counsel.

FinCEN Awards and the Proposed Rules

FinCEN’s enacted award framework provides qualifying whistleblowers collectively 10% to 30% of qualifying collections from covered enforcement actions with monetary sanctions exceeding $1 million. The award law includes covered Bank Secrecy Act and sanctions violations. It also recognizes information learned and reported through a person’s job, an important point for compliance staff and auditors.

FinCEN’s program statement said it was accepting tips and would begin processing and paying awards after final regulations. Its April 1, 2026 notice proposed the implementing rules, including award applications and treatment of information obtained through specified professional roles. We assess the award rules that apply to your information when building the case.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate route for fraud involving government money. FinCEN, SEC and CFTC award programs have their own authority and requirements. Identifying the institution is how we begin deciding which fits the facts you know.

When You Know Who Approved the Failure

If you know which business kept the customers, controlled the wallets or approved the monitoring exceptions, talk to our whistleblower experts about that decision. We stay beside you throughout the case, shaping the evidence of failed controls into your strongest whistleblower case and bringing in anti-money laundering and crypto fraud whistleblower lawyers with the experience it requires.