Red flags for crypto exchanges and virtual asset providers

What supervisors and standard-setters expect

The international standard is FATF Recommendation 15, which extends anti-money laundering rules to virtual assets and the firms that exchange or hold them. In its seventh targeted update on July 16, 2026, the FATF said jurisdictions are licensing firms and implementing the Travel Rule, but that serious gaps remain in risk-based supervision and enforcement. It named industrialised fraud by organised crime groups, misuse of stablecoins, peer-to-peer transfers through unhosted wallets, offshore providers outside effective oversight, and decentralised finance as growing risks.

National law then turns this into specific duties. In the EU, Regulation 2023/1113 has applied since December 30, 2024 and requires information on the sender and recipient to accompany transfers of crypto-assets, including transfers to or from a self-hosted address when a crypto-asset service provider is involved. In the UK, cryptoasset exchange providers and custodian wallet providers are covered by the Money Laundering Regulations and must carry out customer due diligence on any cryptoasset transfer of £800 or more, including linked transfers, and on every transaction through a crypto ATM. In Canada, a reporting entity must report each receipt of virtual currency worth $10,000 or more, including linked receipts within 24 hours, within five working days. In the US, a platform serving US customers must register with FinCEN as a money services business and run an effective anti-money laundering program.

This is how the red flags connect to duties. Mixer, chain-hopping, peel-chain and privacy-coin indicators are what transaction monitoring and blockchain analytics are meant to surface, and what a suspicious transaction report should describe. Crypto ATM and pig butchering proceeds indicators go to customer due diligence and reporting at the point of cash-in. Unlicensed exchange and stablecoin desk indicators go to registration, and to whether counterparties provide transfer information.

Two enforcement actions show the pattern. On November 21, 2023, Binance pleaded guilty and agreed to pay over $4 billion to resolve the Justice Department's investigation. The department said Binance let users open accounts and trade with only an email address for years, did not systematically monitor transactions, and never filed a suspicious activity report with FinCEN.

In Canada, FINTRAC announced on October 22, 2025 a $176,960,190 penalty against Xeltox Enterprises, operating as Cryptomus. In July 2024 alone, it found 1,068 occasions where suspicious transaction reports were not submitted and 1,518 unreported receipts of $10,000 or more in virtual currency. FINTRAC linked the unreported suspicious activity to proceeds of child sexual abuse material trafficking, fraud, ransomware payments and sanctions evasion.

As of October 2026: The FATF update was read on its publication page, not in the full PDF; the Recommendation 15 reference comes from that page. The EU regulation text was read on EUR-Lex; the EU's broader Regulation 2024/1624 (applies from July 10, 2027) was not covered here. The cryptoasset transfer threshold (regulation 27, amended effective June 30, 2026) were checked on legislation.gov.uk. The UK also has a new FCA authorisation regime for cryptoasset firms still to start, which was not verified in detail. The Binance details are from the Justice Department release (archived page); the FinCEN and OFAC parts of the global settlement are not described. FINTRAC's notice of the Xeltox penalty shows an appeal to the Federal Court, with no outcome stated, and its per-violation counts do not fully reconcile with its stated total, so only the July 2024 counts from the news release are quoted.