{"id":21315,"date":"2025-12-04T14:23:35","date_gmt":"2025-12-04T13:23:35","guid":{"rendered":"https:\/\/www.in-diem.com\/aml-ctf-audits-the-new-mandatory-requirement-for-crypto-projects-in-2025\/"},"modified":"2026-08-12T03:22:46","modified_gmt":"2026-08-12T01:22:46","slug":"aml-ctf-audits-the-new-mandatory-requirement-for-crypto-projects-in-2025","status":"publish","type":"post","link":"https:\/\/www.in-diem.com\/en\/aml-ctf-audits-the-new-mandatory-requirement-for-crypto-projects-in-2025\/","title":{"rendered":"AML\/CTF audits: the new mandatory requirement for crypto projects in 2025"},"content":{"rendered":"
\n

IMPORTANT:<\/strong> This article analyzes AML\/FT audits for crypto projects and crypto-asset service providers in accordance with the regulatory framework in effect at the time of publication. Currently, any audit, CASP application, risk matrix, KYC\/KYB review, blockchain traceability, or anti-money laundering program must be reviewed on a case-by-case basis in accordance with the MiCA Regulation, Regulation (EU) 2023\/1113 on fund transfers and crypto-assets, the European AML\/CFT package, Spanish anti-money laundering regulations, and the current guidelines issued by the CNMV, SEPBLAC, ESMA, EBA, and other competent authorities. <\/em><\/p>\n\n

Crypto regulation in Europe has taken a significant leap forward with the entry into force of the MiCA<\/a> Regulation, published by the European Commission. This framework reclassifies cryptoasset service providers as Crypto Asset Service Providers (CASP)<\/strong> and requires them to meet much stricter compliance standards, particularly regarding anti-money laundering (AML) and counter-terrorism financing (CTF)<\/strong>. <\/p>\n\n

These obligations are complemented by the Sixth Anti-Money Laundering Directive (6AMLD)<\/a>, which strengthens corporate criminal liability. In Spain, SEPBLAC<\/a> is reinforcing its supervision of crypto operators, in line with the future AMLA<\/a>. <\/p>\n\n

In this new regulatory environment, AML\/CTF audits are no longer a technical recommendation: they are a mandatory legal requirement to operate in Europe<\/strong>.<\/p>\n\n

What does AML\/CTF regulation currently require for crypto projects?<\/strong><\/h2>\n\n

Compliance obligations for blockchain projects have expanded considerably. Key requirements include: <\/p>\n\n

Enhanced user identification and verification (KYC\/KYB)<\/strong><\/h3>\n\n

This includes identity verification, analysis of economic activity, financial documentation, and checks against international sanctions lists.<\/p>\n\n

Risk matrices aligned with European parameters<\/strong><\/h3>\n\n

ESMA <\/a>has published technical standards on its official website requiring users, transactions and geographies to be classified according to their level of risk.<\/p>\n\n

Full traceability of blockchain transactions<\/strong><\/h3>\n\n

CASPs must monitor crypto transfers using specialised tools capable of detecting illicit patterns.<\/p>\n\n

Ongoing transaction monitoring<\/strong><\/h3>\n\n

Simple customer identification is no longer sufficient<\/strong>: regulations require monitoring their activity over time.<\/p>\n\n

Reporting of suspicious transactions<\/strong><\/h3>\n\n

Reports must be submitted through the official SEPBLAC<\/strong> channels, using formats set out by Spanish regulation.<\/p>\n\n

What does a crypto AML\/CTF audit involve?<\/strong><\/h2>\n\n

An AML\/CTF audit assesses whether a crypto project\u2019s systems comply with MiCA and European regulations. It includes: <\/p>\n\n

Business Model Analysis<\/strong><\/h3>\n\n

Assessment of the type of assets, volume, functionality, involved jurisdictions and level of risk exposure.<\/p>\n\n

Comprehensive literature review<\/strong><\/h3>\n\n

Including AML policies, risk matrix, procedures manual, onboarding manual and monitoring criteria.<\/p>\n\n

Technical Assessment of Traceability<\/strong><\/h3>\n\n

This is where Cryptoveritas360<\/strong>, our technology partner, comes in, providing:<\/p>\n\n

    \n
  • smart contract audit<\/li>\n\n\n\n
  • blockchain forensic analysis<\/li>\n\n\n\n
  • on-chain metrics<\/li>\n\n\n\n
  • risk detection in wallets and protocols<\/li>\n\n\n\n
  • exposure testing for laundering through clustering and advanced tools<\/li>\n<\/ul>\n\n

    Operational Tests and Simulations<\/strong><\/h3>\n\n

    Assessment of how the team responds to real risk scenarios:<\/p>\n\n

      \n
    • suspicious transactions<\/li>\n\n\n\n
    • irregular transactions<\/li>\n\n\n\n
    • changes of jurisdiction<\/li>\n\n\n\n
    • unexpected activity in monitored wallets<\/li>\n<\/ul>\n\n

      Final Report and Remediation Plan<\/strong><\/h3>\n\n

      The outcome includes a roadmap to align the project with MiCA and European AML rules.<\/p>\n\n

      At this stage, our technology partner Cryptoveritas360<\/strong> participates, providing smart contract audits, forensic analysis and advanced on-chain tools.<\/p>\n\n

      Projects that require an AML\/CTF audit<\/strong><\/h2>\n\n
        \n
      • Exchanges<\/li>\n\n\n\n
      • Custodians and wallet providers<\/li>\n\n\n\n
      • DeFi platforms with an identifiable team<\/li>\n\n\n\n
      • Tokenisation providers and NFT marketplaces<\/li>\n\n\n\n
      • Fintechs with crypto services<\/li>\n\n\n\n
      • Companies applying for a CASP licence<\/li>\n\n\n\n
      • Operators managing staking, lending or financial products based on blockchain<\/li>\n<\/ul>\n\n

        Consequences of non-compliance<\/strong><\/h2>\n\n

        Spain will be one of the strictest jurisdictions. Consequences may include: <\/p>\n\n

          \n
        • Significant fines.<\/li>\n\n\n\n
        • Freezing of funds.<\/li>\n\n\n\n
        • Loss of CASP licence.<\/li>\n\n\n\n
        • Administrative investigations.<\/li>\n\n\n\n
        • Enhanced criminal liability under 6AMLD.<\/li>\n<\/ul>\n\n

          How can we help you at IN DIEM Abogados?<\/strong><\/h2>\n\n

          At IN DIEM, we combine legal expertise and advanced technical support with Cryptoveritas360:<\/p>\n\n

            \n
          • Comprehensive AML\/CTF audits<\/li>\n\n\n\n
          • Preparation for CASP licences<\/li>\n\n\n\n
          • Drafting AML policies and manuals<\/li>\n\n\n\n
          • Defence in inspections<\/li>\n\n\n\n
          • Training and ongoing support<\/li>\n\n\n\n
          • Investor due diligence<\/li>\n<\/ul>\n\n
            \n\n