You know where your crypto came from. Could you prove it to an exchange?
A payment can look perfectly ordinary to the person receiving it and still raise questions about earlier transactions. Understanding those questions is becoming part of owning crypto, and that is moving on several fronts.
US lawmakers are wrestling with market structure, European regulators want closer oversight of DeFi-related activities, and Brazil has announced tighter reporting requirements for transfers, an essential part of running a crypto business.
The regulatory involvement of self-custody wallets.
Dmitry Machikhin, CEO of BitOK, a provider of crypto AML screening, transaction monitoring, and blockchain analytics, explains what gets a transfer flagged, when an automated check needs a human investigator, and what users can do when an exchange asks questions.
1. What is the biggest misconception businesses have about crypto compliance?
That having a screening tool means the job is done.
The difficult part starts when a result needs interpretation. Someone has to understand the concern, decide what additional information to request, and explain why a payment was accepted or held for review.
I would judge a compliance program by how well the team handles those decisions. Can people work through an ambiguous case? Do they know when to escalate it? Can they explain their reasoning afterward?
That is the problem we focus on at BitOK. Businesses need useful information and a workable process for acting on it. A risk score is one input into that process.
2. US lawmakers are still debating market structure: the CLARITY Act failed to advance in a Senate procedural vote on September 15. How much compliance work actually depends on that legislation?
It is important to separate the issues. CLARITY concerns the framework for digital asset markets, including the respective roles of the SEC and CFTC. Businesses should not interpret uncertainty around that framework as a pause in anti-money laundering obligations.
Depending on their activities, crypto businesses can already fall within US money services business rules and have Bank Secrecy Act obligations. Those do not begin only if CLARITY passes.
There is plenty a company can do now: organize its records, establish review procedures, and assign responsibility for alerts. None of that work is wasted if a bill changes.
Technology should be adaptable, too. BitOK KYT Office offers a configurable risk model, real-time transaction monitoring, alerts, and API integration. The aim is to give teams a process they can adjust as their business and obligations evolve.
3. How would you test whether that process works in practice?
Ask the team to walk you through a flagged transaction.
How was it detected? Who reviewed it? What evidence did they consider? What happened next? A gap in that account usually tells you where to focus.
Our suggested workflow is straightforward: BitOK KYT Office analyzes the transaction, an analyst investigates in BitOK Graph when a closer look is needed, and the decision is recorded with its context.
The team also needs the skills to challenge a first impression. That is why BitOK’s AML training covers internal procedures, transaction analysis, investigations, and suspicious activity reporting. Software can bring an issue to your attention. Someone still has to make sense of it.
4. European regulators are looking more closely at DeFi-related activities. When does using a DeFi protocol become a meaningful risk signal?
The protocol’s role in the transaction matters. Using a bridge to move assets to another blockchain is an ordinary activity. A known theft followed by rapid swaps, bridge transfers, and movement through many short-lived addresses raises a different set of questions.
I would look at the source of the funds, the sequence and timing of transfers, the services involved, and whether the activity has a plausible explanation. A pattern consistent with obscuring a money trail deserves investigation, but the pattern alone does not establish intent.
BitOK Graph helps analysts examine those connections and record their reasoning. The key is to assess the whole sequence. Treating every bridge user as suspicious would produce poor analysis and unnecessary friction for legitimate customers.
5. Can you give an example where following those connections revealed something a single wallet check would have missed?
In our investigation into Iran’s crypto infrastructure, we examined the network around six addresses listed under US sanctions. Tether had also frozen USDT at those addresses. Those are separate actions: the sanctions listing creates legal restrictions, while the issuer’s freeze prevents the affected tokens from moving.
Our finding was that the wider network remained active. Freezing USDT at those six addresses had not stopped transfers through other parts of the infrastructure.
The analysis identified roughly 20 connected TRON addresses with recurring patterns: long holding periods, similar transaction sequences, and funds splitting across intermediary wallets before converging again. We were careful about the evidence—a shared service or destination does not, by itself, prove common ownership.
We regularly publish cases like this on the BitOK blog. The Iran investigation includes supporting transactions so readers can examine the evidence themselves. The practical lesson is that screening against a sanctions list is a starting point; investigating the surrounding network can reveal activity that address matching alone misses.
6. That explains why the surrounding network matters. What about changes over time—how long can a business rely on an earlier wallet check?
There is no single shelf life that fits every situation. A check reflects the information available when it was performed.
A wallet may subsequently receive funds from a high-risk counterparty. Investigators may also uncover new information about activity that happened earlier. Either development can change the assessment.
Think of a business that screens a partner at onboarding and then accepts payments for months without another review. It is relying on an old picture of a continuing relationship.
That is why ongoing relationships need monitoring. BitOK KYT Office helps teams identify new signals and decide which transactions require attention. The frequency and depth of review should follow the company’s risk policy and obligations.
7. Brazil has announced tighter reporting requirements for transfers involving self-custody wallets. How can businesses meet those requirements without treating every wallet owner as a suspect?
By keeping the assessment grounded in what actually happened.
Self-custody does not establish wrongdoing. Neither does the amount of a transfer. Moving personal savings and receiving proceeds from a fraudulent platform could involve the same sum, but the circumstances are very different.
I would examine the source of funds, the transaction history, and whether the activity fits what is known about the customer.
A reporting requirement is also distinct from a finding of suspicious activity. Good compliance preserves that distinction. Teams should be able to explain why additional checks are necessary—and recognize when the available evidence supports allowing a transaction to proceed.
8. What can an individual do before accepting crypto from someone new?
Ask which address the payment will come from and confirm the blockchain network. Run a wallet check, then read what is behind the headline score. Is there a specific concern you need to resolve before proceeding?
BitOK AML Bot makes that available through Telegram, with screening for addresses and transactions, and a report on the results.
Once the payment arrives, check the actual transfer, too. The sender may have used a different address. When checking a transaction, specify whether you are the sender or the recipient so the relevant side is assessed.
Keep the details of the deal: who paid you, what the payment was for, and the supporting records. Blockchain screening and those records answer different parts of the same question.
9. What actually causes crypto to be flagged? And does a high-risk score mean the funds are “dirty”?
Common triggers include exposure to sanctioned addresses, wallets associated with theft or scams, darknet marketplaces, and certain mixing services. Unusual transaction patterns can also prompt a review.
Exposure may be direct or appear further back in the transaction history. But several transfers through intermediary wallets do not automatically make funds illicit. Analysts need to examine how strong the connection is, how much value is involved, how recent it is, and how reliable the attribution is. Mixer use also needs context; it is not proof of a crime on its own.
In BitOK AML Bot, users can examine the risk sources behind the result rather than relying only on the overall score.
A high-risk result is a reason to investigate. It is not a verdict on the wallet owner. Nor is there a universal “safe” percentage that guarantees acceptance by every exchange.
10. Suppose the exchange has already asked for proof of the source of funds. What should the user do now?
First, verify the request through the exchange’s official app or website. Do not rely on a link in an unexpected message. A legitimate compliance review does not require you to disclose your seed phrase or private keys.
Then identify the transactions and period involved, the documents requested, and the deadline. Export the available trading and transfer history. Gather purchase confirmations, bank statements, income records, contracts, invoices, or other evidence relevant to how the assets were acquired. Write a short chronology connecting those records to the questioned transfer.
Answer the questions asked. If a document is missing, explain the gap and ask what alternative evidence is acceptable. If you need more time, request it before the deadline.
Once the immediate request is handled, improve the recordkeeping. BitOK Tracker can help organize transactions and supporting documents, while BitOK Reports helps prepare transaction, income, and profit-and-loss reports. That makes the next request easier to address.
11. If the problem is theft rather than a compliance query, what should happen first—and how realistic is recovery?
The first priority is to prevent further losses, but the response depends on what was compromised.
If a malicious token approval is responsible, revoke that permission. Simply disconnecting a website does not revoke its access. If your private key or seed phrase has been exposed, create a new wallet with a new seed phrase on a secure device and move the remaining assets there. Changing the old wallet’s password does not make exposed keys safe.
If the device may still be compromised, use a clean one. If an attacker’s sweeper bot is automatically draining the wallet, do not keep adding funds for transaction fees—they may be stolen immediately. Get specialist help before attempting further transfers.
Preserve transaction hashes, addresses, timestamps, and communications. Contact any platform involved and report the incident to the relevant authorities.
BitOK’s investigations service helps trace stolen assets and assess recovery options. Recovery depends on who controls the funds and what legal action is possible.
Be wary of anyone guaranteeing a return, demanding an “unlocking fee,” or asking for your seed phrase. Recovery scammers exploit the urgency people feel after a loss. Nobody should promise recovery before examining the case.
12. What should businesses and individuals do this month to get better prepared?
For a business, check whether the written procedures match daily practice. Make sure alerts have a responsible reviewer, decisions are recorded, and staff know when to escalate a case. Test where the process breaks down and fix those gaps.
For an individual, I would focus on three habits: screen unfamiliar counterparties before a deal, keep transaction records together with evidence of how the assets were acquired, and review wallet security—including active permissions and how recovery information is stored.
Then pick one recent transaction and ask yourself: if an exchange questioned this tomorrow, could I explain it and produce the records?
Your answer will tell you where to start.
El artículo Why Crypto Gets Flagged—and What You Can Do About It apareció primero en The Coin Republic.
