Do Crypto Exchanges Have to Follow the Bank Secrecy Act?

Short answer: many do. A crypto exchange does not have to be a bank to fall under the Bank Secrecy Act (BSA). In the United States, an exchange that accepts and transmits convertible virtual currency for customers may be treated as a money services business (MSB), specifically a money transmitter. That can bring registration, recordkeeping, and anti-money-laundering obligations with it.

Here is the catch: “crypto exchange” is a business label, not a legal category that settles the question. What matters is what the company actually does, who it serves, and where it operates. A centralized exchange that holds customer assets and moves value is in a different position from software that simply lets users interact directly with one another.

This guide explains when a crypto exchange may need to register as a money service business, what BSA compliance involves, and what the much-discussed FinCEN whistleblower awards do—and do not—mean. It is general information, not a legal determination for a particular company.

What the Bank Secrecy Act Does

The BSA is a U.S. law aimed at helping authorities detect and investigate money laundering and other financial crime. It requires certain financial institutions and businesses to keep records, establish controls, and report specified activity to the government.

Despite the name, the BSA is not just a law for banks. Its reach includes a range of businesses that move or exchange money, including certain money transmitters, casinos, and other financial service providers. FinCEN, the Financial Crimes Enforcement Network, administers key parts of the BSA and issues rules and guidance.

For an in-scope crypto business, the practical question is often whether it is a money transmitter—and therefore an MSB under federal rules. State money-transmission laws may also apply. Federal registration does not automatically satisfy state licensing requirements.

When a Crypto Exchange Is an MSB

FinCEN’s 2013 guidance explained how its existing money-transmission rules apply to convertible virtual currency. In broad terms, a business that accepts one type of value from https://www.tycoonstory.com/the-new-get-rich-quick-program-whistleblowers/ one person and transmits it to another person or location may be a money transmitter. An exchange that takes in customer funds or crypto and sends value on a customer’s behalf can fall within that definition.

That is why the phrase crypto exchange as MSB is often relevant to centralized platforms. If the company controls customer accounts, receives deposits, exchanges assets, or sends withdrawals, it should analyze whether those activities make it a money transmitter under FinCEN rules.

Examples that may point toward MSB treatment

A centralized platform accepts customers’ dollars or crypto, executes exchanges, and credits balances to customer accounts.
A business receives virtual currency from one customer and transfers it to another customer or an external wallet.
A hosted wallet provider has control over customer assets and transmits them when customers request it.
A foreign exchange serves customers in the United States in a way that brings it within U.S. rules.

These are examples, not automatic conclusions. The details of custody, control, transaction flow, customer relationships, and geography matter.

When the answer may be different

A company that only supplies software or publishes code, without accepting or transmitting value, may be treated differently from a business that operates a custodial exchange. A peer-to-peer platform’s status can depend on whether it merely connects users or participates in moving funds. Calling a service “decentralized” does not, by itself, resolve the legal analysis.

Here is the catch: the label in a pitch deck, terms of service, or website will not do the work. The actual product flow is what regulators are likely to examine.

What It Means to Register as a Money Service Business

If a business is an MSB and no exemption applies, it generally must register as a money service business with FinCEN. Registration is not an endorsement, a license to operate in every state, or proof that the business has satisfied all of its compliance obligations.

Federal MSB registration is generally completed through FinCEN’s registration process, with renewal requirements. Separately, a company may need state money-transmitter licenses. Those state rules differ, and operating across state lines can mean dealing with multiple regulators and application requirements.

A company should not treat registration as a box-checking exercise. It is one part of a broader compliance program. Depending on the business and its activities, that program can include:

A written anti-money-laundering program tailored to the company’s risks.
A designated person responsible for day-to-day compliance.
Procedures for identifying customers and understanding the purpose of accounts.
Transaction monitoring and a process for investigating alerts.
Staff training and independent testing of the program.
Required records and reports, including suspicious activity reports where applicable.

What BSA Compliance Looks Like for a Crypto Exchange

BSA compliance is not simply collecting an ID at signup. A program should be designed around the risks the business actually faces: its products, customers, jurisdictions, transaction sizes, and methods of funding or withdrawal.

Customer identification and risk assessment

An exchange may need to identify customers, verify information, and apply additional checks when the risk warrants it. That can include understanding whether an account is being used by an individual, a business, or someone acting for another person. Strong onboarding is useful, but it does not replace monitoring after the account is open.

Monitoring and suspicious activity reports

MSBs may have to file suspicious activity reports (SARs) when the applicable legal criteria are met. The point is not to report every unusual transaction automatically. It is to use a documented process to review activity, make a reasoned decision, and file when required. SARs are confidential; a business generally must not tell the subject that a SAR was filed.

Crypto-specific monitoring can involve looking for patterns such as rapid movement of assets, activity inconsistent with a customer’s profile, or exposure to higher-risk services. A blockchain analytics tool may help identify signals, but a tool does not make the decision or own the compliance program. Human review, escalation rules, and good records still matter.

Recordkeeping and the “Travel Rule”

Under BSA rules, certain money transmitters must keep records and transmit specified information for qualifying funds transfers. These requirements are often called the “Travel Rule.” The applicable threshold and details depend on the rule and transaction type. Crypto businesses need to assess how the rules apply to transfers involving virtual currency rather than assume that an on-chain transfer is outside the framework.

There is an important distinction: a virtual-currency transfer is not automatically a cash transaction. Currency Transaction Report requirements for cash should not be casually applied to crypto transfers as if they were the same thing. Businesses need to classify the activity correctly and follow the rules that actually cover it.

Question Why it matters Does the business accept and transmit value? This can help determine whether it is a money transmitter under federal rules. Does the company control customer assets? Custody and operational control can affect how regulators view the service. Does it serve U.S. customers? U.S. activity may trigger federal and state obligations, including for some foreign firms. Does it have a functioning AML program? Registration alone does not satisfy ongoing BSA duties.

FinCEN Whistleblower Awards: Real, but Not Fast

Whistleblower awards are not just a headline-writing device. The Anti-Money Laundering Act (AMLA), enacted in 2021, created a statutory framework for awards tied to qualifying information that leads to successful enforcement actions. Later legislative and implementation developments have addressed the program’s funding and operation. The basic point for companies is that reporting channels and enforcement incentives are real, even if an award is never guaranteed.

For qualifying cases, the statutory framework provides for awards generally ranging from 10% to 30% of collected monetary sanctions, subject to the law’s conditions. That range is not a promise that every whistleblower will receive an award—or that an award will be at the top of the range. The decision is discretionary and depends on factors such as the significance and usefulness of the information, the whistleblower’s assistance, and the impact on the enforcement action.

There are also eligibility rules and procedures. A person needs to provide information through the proper channels and meet the applicable requirements. Not every tip leads to an investigation, and not every investigation results in sanctions that produce an award. The process can take years because regulators may need to investigate, litigate, settle, and collect penalties before an award can be determined.

So, yes, FinCEN whistleblower awards are real. No, they are not quick cash. For operators, the sensible takeaway is to maintain credible internal reporting channels, investigate concerns promptly, protect people from retaliation, and preserve relevant records. A compliance program that exists only on paper will not help when a real issue surfaces.

Common Myths About Crypto and the BSA

“Crypto is not money, so the BSA cannot apply.”

That argument misses the point. FinCEN’s rules can apply to businesses transmitting convertible virtual currency, even when the asset is not legal tender. The legal analysis focuses on the activity and the rules, not just the everyday meaning of “money.”

“We are registered, so we are compliant.”

Registration and compliance are different things. A registered MSB can still fail to maintain an effective AML program, file required reports, or meet applicable state licensing rules.

“We use blockchain analytics, so we have monitoring covered.”

Software can support monitoring. It cannot replace risk assessment, escalation decisions, written procedures, staff training, or independent testing.

“We are decentralized, so there is no company to regulate.”

That may be true for some arrangements, but it is not a safe conclusion based on branding alone. If identifiable people or entities operate a service, control customer assets, or arrange transfers, the facts deserve careful review.

A Practical Starting Checklist for Founders

Map the money flow. Document who receives assets, who controls them, who executes exchanges, and where withdrawals go.
Define the customer and geography. Identify customer types and the places where the company actively offers or provides services.
Assess federal MSB status. Analyze the business under FinCEN’s money-transmission rules, including relevant guidance and any potential exemptions.
Check state requirements separately. Federal MSB registration is not a substitute for state licensing analysis.
Build operations around the risk. Set up customer checks, monitoring, investigations, reporting, recordkeeping, training, and testing before growth makes gaps harder to fix.

When reviewing the issue with counsel or a compliance lead, ask specific questions: Which exact product flows make us a transmitter or an exchanger? Do our custody arrangements change the analysis? Which state licenses may be required before launch? What reporting and recordkeeping rules apply to our transaction types? Who owns alert investigations, and how do we document decisions?

Bottom Line

Many centralized crypto exchanges have to follow the BSA because their activities can make them money transmitters and MSBs. The answer is not based on the word “crypto,” or on whether the company calls itself a bank, exchange, protocol, or software provider. It depends on what the business does.

For founders, the costly mistake is waiting until after launch to map the product against the rules. Determine whether the company must register as a money service business, evaluate state licensing separately, and build BSA compliance into the operating model. Those steps are less exciting than a new token launch. They are also much easier to handle before customers, regulators, or a whistleblower raise the issue first.