A digital asset manager can collect extensive know-your-customer documents and still miss the transaction that creates its greatest illicit-finance risk. It can also buy an expensive wallet-screening tool and misunderstand what the resulting score proves.
The control framework must begin with the manager’s legal status and actual activity. A closed-end fund that accepts fiat subscriptions and holds assets with third parties presents a different profile from a vehicle that accepts tokens, sends assets to decentralized protocols, operates over-the-counter settlement wallets, or transmits value for others. Investor diligence, counterparty review, sanctions screening, and on-chain monitoring should follow those differences.
One regulatory date deserves particular care. FinCEN postponed the effective date of its investment-adviser anti-money-laundering and countering-the-financing-of-terrorism rule from January 1, 2026 to January 1, 2028. Managers should not describe that rule as a current 2026 program mandate. The delay does not suspend sanctions law or erase other federal, state, offshore, contractual, or activity-based requirements.
Determine which rules attach to which entity and activity
“The fund is not a bank” is not a compliance analysis. The manager should identify every entity, jurisdiction, account, service, and transaction type, then determine which obligations apply.
The review may include the adviser’s registration or reporting status, the fund’s domicile, investor locations, commodity or money-transmission activity, broker-dealer or other regulated counterparties, subscription and redemption methods, and the role of affiliated entities. A person providing services that involve accepting and transmitting or exchanging convertible virtual currency for others may require a money-transmitter analysis under FinCEN’s activity-based framework. Labels such as “platform,” “treasury,” or “protocol service” do not control the outcome.
The fund should also review agreements with administrators, banks, custodians, exchanges, prime brokers, and institutional investors. Those agreements may impose representations, diligence standards, notice duties, wallet restrictions, or information-sharing requirements beyond a rule directly applicable to the manager.
The result should be an obligations map, not a generalized statement that the manager follows “industry-standard AML.” It should identify the responsible entity, legal or contractual source, activity covered, control owner, record, and escalation route.
The 2028 adviser-rule deadline is not a reason to wait
FinCEN’s delayed rule would add specified registered investment advisers and exempt reporting advisers to the Bank Secrecy Act framework and require AML/CFT programs and suspicious-activity reporting, among other obligations, when it becomes effective in its applicable form. FinCEN has also indicated that it intends to revisit the rule through further rulemaking.
As of August 12, 2026, managers should therefore avoid presenting a 2024 rule summary as a settled description of their January 2028 obligations. They should monitor further action and leave room to revise policies.
There are still practical reasons to build a proportionate program now. OFAC obligations apply independently. Banks and digital-asset counterparties need information to service the fund. Institutional investors expect a coherent explanation of investor admission, source-of-funds review, wallet use, sanctions controls, and escalation. A rushed future implementation is also harder when records and ownership data have not been collected consistently.
The policy should accurately distinguish mandatory controls, contractual commitments, and voluntary risk management. That precision prevents the manager from overstating compliance while allowing it to prepare for likely changes.
Investor diligence must connect identity to the funding path
Subscription review typically identifies the investor, authorized signatory, beneficial owners where required or appropriate, source of wealth or funds based on risk, sanctions exposure, jurisdiction, and expected activity. Digital-asset subscriptions add wallet ownership and transaction-history questions.
The manager should know whether the subscribing wallet belongs to the admitted investor, a custodian, an exchange, an affiliate, or another person. A cryptographic signature can help demonstrate technical control of an address but does not by itself establish beneficial ownership, lawful source of funds, or authority to invest.
The subscription process should address third-party funding, transfers from hosted wallets, privacy-enhancing technology, recent wallet creation, cross-chain movement, decentralized-exchange activity, and material differences between the investor profile and observed transaction. Those factors are not automatic proof of wrongdoing. They may require additional information, a different funding path, or escalation.
Redemptions deserve equal attention. Sending proceeds to a new address or a party other than the investor can create fraud, sanctions, and ownership risks. Address changes should use verified instructions, cooling-off or confirmation procedures where appropriate, and review independent from the person initiating payment.
Wallet screening is evidence, not a verdict
Blockchain analytics tools associate addresses and transaction paths with identified services, typologies, or risk categories. Their results depend on data coverage, attribution methods, chain support, clustering assumptions, thresholds, and updates. Two tools can score the same wallet differently.
The manager should define:
- which chains, assets, and transaction types are screened;
- when screening occurs before and after a transfer;
- how many transaction hops or what exposure logic the tool evaluates;
- which categories create a stop, escalation, or record-only result;
- how false positives and disputed attribution are handled;
- who may approve an exception; and
- how alerts, evidence, and decisions are retained.
OFAC cautions that searching the Specially Designated Nationals and Blocked Persons List for an exact digital-currency address is not enough to identify every potentially sanctioned person or transaction. A sanctioned actor may use an address that OFAC has not listed, and a listed address can require analysis of property interests and transaction facts.
The opposite error is to treat any indirect exposure as legally prohibited. A risk score may identify historical proximity to an illicit service without showing that the fund is dealing in blocked property or with a sanctioned person. The policy should separate vendor risk categories from legal conclusions and route uncertain cases to qualified review.
Monitor the fund’s outbound activity, not only investor wallets
The manager’s most complex exposure may arise after subscription. Trading wallets can interact with exchanges, bridges, decentralized applications, validators, liquidity pools, counterparties, and smart contracts. Assets may return from a protocol through different addresses from those used for deposit.
A transaction inventory should identify normal activity by wallet and strategy. Monitoring can then focus on deviations, prohibited services, high-risk jurisdictions where relevant data is available, sanctioned or blocked exposure, unexpected counterparties, address poisoning, anomalous approvals, and movement inconsistent with the fund’s purpose.
Pre-transaction screening is appropriate where the fund knows the destination and has time to review. Post-transaction monitoring can detect new attribution, indirect exposure, or protocol-generated flows that were not visible earlier. A process that screens only at onboarding will not address a portfolio that changes addresses daily.
Geolocation and access controls may also matter. In its 2022 Kraken settlement, OFAC described failures involving users who appeared to be in Iran based on internet-protocol address information. For a manager, the lesson is not that one data point resolves location; it is that available information should be evaluated together and escalated when it conflicts.
Know what to do with a potential sanctions match
An alert is useful only if the team knows whether to stop, reject, block, report, request information, or seek advice. Those actions are not interchangeable, and the correct response depends on the sanctions program, property interest, parties, jurisdiction, and transaction status.
The escalation procedure should identify who can pause a transaction, who performs the legal analysis, who contacts the custodian or exchange, and who handles any report or communication with OFAC. It should preserve the relevant wallet data, screening result, transaction details, source information, and decision.
If the fund holds blocked digital currency in circumstances requiring blocking, OFAC guidance explains that it should be denied access and reported in accordance with applicable requirements. The fund should not move property to a separate wallet in a way that constitutes an unauthorized transfer merely to make internal tracking easier. Operational procedures should be reviewed in advance with counsel and providers.
Incident plans should also cover ransom or recovery proposals. Payments or negotiations involving malicious cyber actors can create sanctions exposure, and an urgent demand is a poor time to locate decision-makers or law-enforcement contacts.
Vendors do not outsource the manager’s judgment
Administrators may perform investor diligence, and analytics providers may screen wallets. The manager remains responsible for understanding the allocated role and for meeting obligations that apply to it.
Vendor diligence should address data sources, chain coverage, service levels, model changes, alert calibration, manual review, record retention, confidentiality, cybersecurity, subcontractors, and assistance during investigations. Contracts should define who receives alerts, how quickly they are escalated, and whether the manager can obtain the underlying data supporting a decision.
Testing should use realistic scenarios rather than only confirming that a policy exists. Examples can include a subscription from an exchange omnibus wallet, a redemption-address change after email compromise, a new attribution applied to an existing counterparty, a transaction involving a listed address, or funds returning from an exploited protocol. The test should show whether the right people receive enough information to decide.
Investor communications should be accurate about the control’s limits
Due-diligence questionnaires often invite broad answers: “All wallets are screened,” “The administrator handles AML,” or “The fund does not transact with sanctioned persons.” Each can overstate the system.
A better response identifies the scope and division of responsibility. It may explain that the administrator performs specified investor checks, the manager screens defined wallet activity using a named process, alerts are escalated under a written policy, and service providers perform their own controls. It should also state material exclusions or limitations where necessary.
Records should support the description. That includes risk assessments, investor files, wallet inventories, screening logs, alerts, exceptions, training, vendor reviews, tests, and policy updates. Sensitive details can be protected without reducing the answer to unsupported assurances.
The goal is a control system proportionate to the fund’s actual touchpoints with people, assets, and protocols. Veritas Global advises digital asset managers on regulatory perimeter analysis, sanctions controls, investor documentation, wallet procedures, provider agreements, and institutional diligence. If your program ends at investor onboarding while the strategy continues on-chain, contact us to review the missing transactions.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal, regulatory, sanctions, anti-money-laundering, investment, or other professional advice. It does not create an attorney-client relationship. Obligations depend on entity status, activities, jurisdictions, counterparties, assets, and facts. Readers should consult qualified advisers before acting.
