Emerging Risk Areas & Evolving Guidance
DeFi, NFTs, DAOs, Unhosted Wallets & Privacy Coins
While much of the compliance framework for centralized digital asset firms is now established, several areas remain genuinely ambiguous and evolving. This final whitepaper in the AMLRS series examines the frontier compliance challenges facing the industry: the absence of clear AML obligations for DeFi protocols and the FATF guidance attempting to address it; regulatory uncertainty around peer-to-peer transactions and unhosted wallets; the treatment of privacy coins and mixing services; the growing scrutiny of NFT platforms as potential AML-obliged entities; DAO liability for AML failures; and the global fragmentation of crypto compliance rules. It also looks ahead to emerging privacy-preserving compliance technologies - including zero-knowledge proofs for KYC, decentralized identity frameworks, and ZK-enabled Travel Rule data sharing - that may reconcile regulatory demands with the open-access ethos of blockchain.
Jurisdictions with new rules (2025)
30+ per TRM Labs Global Crypto Policy Review
FATF DeFi guidance 2021
VASP definition - control/influence test
Transfer threshold proposed for private wallet reporting
Key Takeaways
Key developments shaping crypto AML compliance in 2025, from regulatory gaps and emerging risks to privacy-preserving compliance technologies.
-
DeFi Uncertainty
DeFi remains the single biggest area of regulatory ambiguity - FATF's 'control or sufficient influence' test for VASP classification is difficult to apply in practice, and neither the U.S. nor the EU has issued DeFi-specific AML regulations as of 2025.
-
Unhosted Wallet Gap
The unhosted wallet rule proposed by FinCEN in 2020 - which would require exchanges to collect counterparty information for transfers above $3,000 to private wallets - faced significant industry pushback and has not been implemented, leaving a recognized gap in Travel Rule coverage.
-
NFT AML Expansion
NFT platforms are moving toward AML-obliged entity status as regulators respond to documented cases of money laundering through high-value digital art sales; EU draft AML regulations include NFT marketplaces as obliged entities where they intermediate transactions of significant size.
-
Privacy Coin Restrictions
Privacy coins (Monero, Zcash) and mixing services face growing restrictions - Japan and South Korea have prohibited exchange listings; OFAC directly sanctioned the Tornado Cash mixer; and most compliant exchanges either delist privacy coins or apply significantly enhanced monitoring.
-
ZK-KYC Innovation
Zero-knowledge proof KYC solutions - including Polygon ID, zkKYC initiatives, and ZK-enabled Travel Rule data sharing - are in active development and may enable compliant identity verification without exposing full personal data, potentially resolving the tension between privacy rights and AML obligations.
Reimagining Compliance
Resources
More Links