Crypto Exchange Compliance Requirements — Mapped to Real Controls

The Four Pillars Every Regulator Asks About

Frameworks differ on thresholds and filings, but underneath they ask for the same four things. Get these right and every jurisdiction becomes a variation on a theme you already know.

Every framework below — MiCA, FinCEN's MSB regime, MAS PSA, VARA — is a jurisdiction-specific expression of these four pillars.

Requirements and Travel Rule Thresholds by Jurisdiction

Figures as commonly cited in mid-2026; verify with counsel, as several are under revision. Note that outside the US, most listed figures set the point above which a fuller data set must travel — not a value below which the rule is switched off (the EU, UK, and Japan apply it to transfers of any size).

The 2025 shift worth planning around: FATF's supervisory best-practices guidance now tells authorities they may treat Travel Rule capability as a licensing prerequisite, and jurisdictions including Singapore and Hong Kong already require applicants to demonstrate it before approval. Data-sharing has moved from "post-launch obligation" to "application exhibit" — which is why it ships in the platform rather than on the roadmap.

Requirement → Control: What Actually Enforces Each Rule

This is the part most compliance guides skip, because most are written by firms that sell advice rather than infrastructure. Each row names the regulatory requirement and the specific, inspectable control in Codono's platform that enforces it:

The Operator Readiness Checklist

Before an application (or an examiner) arrives, you should be able to tick every line:

1. Target jurisdictions chosen and the licensing path per market identified (start with the license guide)
2. Named compliance officer with genuine authority and board access
3. Written AML program: risk assessment, procedures, training, independent testing
4. KYC tiers defined per jurisdiction, with limits bound to each tier
5. Sanctions/PEP screening live at onboarding and on a rescreening cadence
6. KYT/blockchain analytics connected on deposit and withdrawal flows
7. Alert-to-SAR case flow rehearsed: who reviews, who files, in what timeframe
8. Travel Rule thresholds configured per market; counterparty VASP due-diligence process documented
9. Custody model documented: key management, hot/cold split, who approves what
10. Maker-checker enabled on withdrawals, balance adjustments, and config changes
11. Audit logs verified immutable and exportable; retention windows set
12. Jurisdiction gating tested: blocked countries actually blocked, product gates enforced
13. Policy documents versioned and consistent with what the platform actually does
14. Incident playbook: kill-switches tested, regulator notification thresholds known

Counterparty VASP Due Diligence

The Travel Rule's least-understood obligation isn't sending data — it's knowing who you're sending it to. Before transmitting originator information, an exchange must establish that the receiving VASP is a real, regulated entity capable of protecting the data: is it licensed somewhere credible, is it sanctioned, has it demonstrated Travel Rule capability, does it actually control the address you're sending to? FATF calls this counterparty VASP due diligence, and examiners increasingly ask to see the process, not just the policy.

Operationally this means maintaining a counterparty register with jurisdiction, licensing status, and messaging capability per VASP; a risk tier per counterparty that decides whether transfers flow automatically, with additional data, or not at all; and periodic refresh, because a counterparty that was licensed last year may be sanctioned this year. The platform's jurisdiction rule-packs and evidence logging carry the enforcement side; the register discipline is an operator practice worth building before an examiner asks for it.

Proof of Reserves and Solvency Demonstration

Since 2022, "are client assets actually there?" moved from a Twitter question to an examination item. Several regimes now expect exchanges to demonstrate solvency on request: client-asset segregation, reserve attestations, and increasingly Merkle-tree proof-of-reserves that lets individual users verify inclusion of their balances.

Architecture decides how painful this is. Because the platform's MPC-custodied addresses are standard on-chain addresses, reserve attestations work with ordinary block-explorer verification and third-party auditor sampling — no exotic scripts to explain. Internally, the double-entry ledger records every balance mutation, and continuous ledger-versus-chain reconciliation means the number you attest to is a number the system checks against reality all day, not a quarter-end scramble. Liability-side proofs (the harder half of PoR) come down to exportable, complete balance snapshots — which is a query, not a project, when the ledger is the source of truth.

The Failure Modes Examiners Actually Find

Enforcement actions and examination reports repeat the same handful of findings — worth knowing because they're all preventable with configuration and staffing rather than heroics:

Market Integrity and Surveillance

Licensing regimes are converging on a fourth-and-a-half pillar that most compliance guides skim: the exchange must police its own market. MiCA imports market-abuse prohibitions directly into crypto; mature regimes everywhere expect operators to detect wash trading, spoofing and layering, self-matching, and pump-and-dump coordination — and to be able to show an examiner the detection, not just describe it.

The platform side of that obligation: complete, timestamped, exportable trade and order data (surveillance is impossible over lossy records); self-match prevention at the matching layer; per-account and per-IP rate limits that make manipulation expensive; anomaly flags for wash-trading patterns and coordinated account clusters; and circuit breakers for disorderly markets. The operator side: someone actually reviews the flags, dispositions are recorded, and repeat patterns become account restrictions and, where thresholds are met, suspicious-activity reports.

Two details win examinations here. First, surveillance must cover all venues in the platform — spot, derivatives, and P2P each manipulate differently (P2P adds off-platform payment fraud and triangulation, which is why its escrow and dispute records matter to compliance, not just support). Second, the liquidity operation itself must be clean: if the operator runs market-making accounts, they need documented mandates, separated books, and the same surveillance everyone else gets — internal accounts being exempt from monitoring is a finding waiting to happen.

What Non-Compliance Actually Costs

The enforcement record sets the stakes: Binance settled with US authorities in 2023 for over $4 billion across BSA and sanctions violations; Coinbase paid $100 million in its 2023 NYDFS settlement, half of it earmarked for compliance-program investment; BitMEX's founders paid criminal penalties on top of the exchange's $100 million resolution for operating without an AML program. The consistent pattern in every action: the failures were programmatic — missing controls, unstaffed review queues, absent records — not exotic. Which is precisely what the checklist above exists to prevent.

The Honest Part: Software Does Not Make You Compliant

No platform purchase substitutes for a license, an accountable officer, or judgment. What the platform does is change what kind of problem compliance is: from an engineering project bolted onto your launch plan, to configuration and operation of controls that already exist. Operators who have gone through licensing with Codono consistently report the same thing — the technology-audit portion stopped being the hard part. The hard part is the paperwork, as it should be.

For the regulatory landscape per market, continue with the country guides: MiCA, Dubai VARA, Singapore MAS, Latin America — or the operational guides on KYC program design and how regulators audit exchanges.