AML, Sanctions, and Investor Protection

Tokens do not escape anti-money laundering and sanctions law: OFAC says sanctions obligations apply equally to virtual currency and fiat transactions, and FinCEN applies its money-transmitter rules to convertible virtual currency businesses based on facts and circumstances ^[2][1]. Broker-dealers handling tokenized securities must run AML and customer identification programs, and the GENIUS Act treats permitted stablecoin issuers as Bank Secrecy Act financial institutions ^[3][4][5]. SEC and FINRA investor materials flag key risks, including lost private keys, custodian failure, limited SIPC coverage, and fraud ^[8][9][10].

Sanctions: the same rules onchain

OFAC's October 2021 guidance for the virtual currency industry states that sanctions compliance obligations apply equally to transactions involving virtual currencies and those involving traditional fiat currencies ^[2]. OFAC may impose civil penalties on a strict liability basis, meaning a U.S. person can be liable even without knowing it was engaging in a violation ^[2]. OFAC encourages technology companies, exchangers, administrators, miners, wallet providers, and traditional financial institutions with virtual currency exposure to adopt a tailored, risk-based sanctions compliance program ^[2].

• Geolocation: OFAC recommends geolocation tools and IP address blocking to stop users in sanctioned jurisdictions ^[2].
• Know your customer: OFAC recommends collecting customer information during onboarding and throughout the relationship ^[2].
• Blocking: a U.S. person holding virtual currency that must be blocked must deny all parties access to it, and must report it to OFAC within 10 business days and annually thereafter while it stays blocked ^[2].

Tokenization infrastructure is being built with these rules in mind. The Innovation Exemption requires a Tokenized Securities Venue to be a U.S. person, which subjects it to OFAC programs, including the prohibition on dealing with persons on the Specially Designated Nationals list ^[7]. In the DTCC tokenization pilot, DTC would register a wallet only after screening it and confirming it complies with OFAC requirements ^[11].

FinCEN and the Bank Secrecy Act

FinCEN's 2019 guidance (FIN-2019-G001) consolidated how its money services business rules apply to convertible virtual currency business models, and it states that it did not establish new requirements ^[1]. Whether a person is a money transmitter is a matter of facts and circumstances ^[1]. The guidance distinguishes hosted wallets, where a third party controls user funds, from unhosted wallets, where users control their own funds ^[1]. FinCEN says the regulatory treatment of such intermediaries is not technology-dependent and turns on four criteria: who owns the value, where it is stored, whether the owner interacts directly with the payment system, and whether the intermediary has total independent control over the value ^[1]. It explains that transfers involving convertible virtual currency can be transmittals of funds subject to the Funds Travel Rule, which can apply to transmittals of $3,000 or more ^[1]. A money transmitter must also register with FinCEN within 180 days of starting to engage in money transmission ^[1]. More broadly, the guidance says a person may be a money transmitter regardless of the technology employed or whether the asset used as value is physical or virtual ^[1].

Broker-dealers handling tokenized securities follow the broker-dealer AML regime. FINRA Rule 3310 requires each member to maintain a written AML program, approved by senior management, with procedures to detect and report suspicious transactions, independent testing, a designated AML officer, ongoing training, and risk-based customer due diligence that includes beneficial owners of legal entity customers ^[3]. FinCEN's customer identification rule requires a broker-dealer to obtain, at a minimum, a customer's name, date of birth for an individual, address, and identification number before opening an account, and to verify identity using risk-based procedures ^[4]. The Investor Advisory Committee stressed that tokenized equity trading must also meet know-your-customer requirements so that sanctioned persons cannot trade anonymously ^[6].

Stablecoin issuers under the GENIUS Act

The GENIUS Act treats a permitted payment stablecoin issuer as a financial institution for Bank Secrecy Act purposes, subject to federal laws on economic sanctions, money laundering, customer identification, and due diligence ^[5]. The Act lists elements including an effective AML program with a designated officer, recordkeeping, suspicious activity monitoring and reporting, technical ability to block, freeze, and reject impermissible transactions, and an effective customer identification program ^[5]. Implementing rules were still proposals as of November 2026:

• FinCEN and OFAC jointly proposed AML/CFT program and sanctions compliance program requirements for permitted issuers, published April 10, 2026, with comments due June 9, 2026 ^[12].
• FinCEN and the federal banking agencies proposed a customer identification program rule for permitted issuers, published June 22, 2026, with comments due August 21, 2026 ^[13].

Investor protection: what the regulators warn about

SEC investor materials explain that tokenized securities are securities subject to SEC regulation, but that synthetic tokens give no claims against the referenced issuer ^[10]. The SEC's December 2025 custody bulletin explains that crypto wallets store private keys rather than the assets themselves, that a lost private key means permanent loss of access, and that hot wallets are exposed to cyberthreats while cold wallets can be lost, damaged, or stolen ^[8]. If a third-party custodian is hacked, shuts down, or goes bankrupt, the bulletin warns that investors may lose access to their assets, and it suggests asking whether the custodian rehypothecates or commingles customer assets ^[8].

FINRA's investor page warns that crypto assets are risky and often extremely volatile, that SIPA protections might not apply even at a SIPC member broker-dealer, that crypto asset exchanges might not provide important investor protections, and that once assets are sent in a scam they are generally gone for good ^[9]. Trading and Markets staff confirm that SIPC does not protect customer claims for non-security crypto assets ^[14].

Worked scenario: onboarding an investor to a tokenized offering

A placement agent registered as a broker-dealer is distributing a tokenized private placement. It collects the investor's name, date of birth, address, and taxpayer ID, verifies identity, and screens the investor against the SDN list. It then screens the wallet address the investor wants to use and blocks access from sanctioned jurisdictions using geolocation. Only after those checks is the wallet added to the token's whitelist. If a later transfer request comes from a wallet linked to a sanctioned person, the transfer agent's controls should block it, and the firm considers whether a blocked-property report or suspicious activity report is required. None of this replaces disclosure: the investor still needs to understand what rights the token carries and who controls the keys.

Key terms

OFAC

Treasury's Office of Foreign Assets Control, which administers and enforces U.S. economic and trade sanctions.

SDN List

OFAC's Specially Designated Nationals and Blocked Persons List; U.S. persons generally may not deal with listed persons and must block their property.

Strict liability

Liability that does not depend on knowledge or intent; OFAC civil penalties generally follow this standard.

Bank Secrecy Act (BSA)

The federal anti-money laundering framework administered by FinCEN, requiring covered financial institutions to keep records and report suspicious activity.

Customer identification program (CIP)

Written, risk-based procedures to collect and verify a customer's identifying information before opening an account.

Hosted vs. unhosted wallet

A hosted wallet is controlled by a third party on the user's behalf; an unhosted wallet is controlled directly by the user.

Funds Travel Rule

A BSA rule requiring certain information to accompany transmittals of funds, which can include virtual currency transfers of $3,000 or more.

Private key

A secret code that authorizes transactions from a wallet; if it is lost, access to the assets is lost.

Check your understanding

Sources

1. [1]Financial Crimes Enforcement Network (U.S. Department of the Treasury), “Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001),” May 9, 2019.
2. [2]Office of Foreign Assets Control (U.S. Department of the Treasury), “Sanctions Compliance Guidance for the Virtual Currency Industry,” October 15, 2021.
3. [3]FINRA, “FINRA Rule 3310 — Anti-Money Laundering Compliance Program,” Accessed November 2026.
4. [4]Electronic Code of Federal Regulations, “31 CFR 1023.220 — Customer identification programs for broker-dealers,” Accessed November 2026.
5. [5]U.S. Government Publishing Office (govinfo), “Public Law 119-27: Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act),” July 18, 2025.
6. [6]SEC Investor Advisory Committee, “Recommendation of the Investor Advisory Committee Regarding the Tokenization of Equity Securities,” March 12, 2026.
7. [7]U.S. Securities and Exchange Commission, “Order Granting Temporary Conditional Exemptive Relief, Pursuant to Section 36(a)(1) of the Securities Exchange Act of 1934, from the Definition of "Exchange" in Section 3(a)(1) of the Exchange Act for the Use of Certain Distributed Ledger Trading Venues for Tokenized NMS Stocks and from the Definition of "Dealer" in Section 3(a)(5) of the Exchange Act for Certain Liquidity Providers for Tokenized NMS Stocks, and Request for Comment (Release No. 34-106402),” September 17, 2026.
8. [8]Investor.gov (SEC Office of Investor Education and Assistance), “Crypto Asset Custody Basics for Retail Investors – Investor Bulletin,” December 12, 2025.
9. [9]FINRA (Investor Insights), “Crypto Assets — Risks,” Accessed November 2026.
10. [10]Investor.gov (SEC Office of Investor Education and Assistance), “Tokenized Securities,” Accessed November 2026.
11. [11]U.S. Securities and Exchange Commission (Division of Trading and Markets), “No-Action Letter Request Related to The Depository Trust Company's Development of the DTCC Tokenization Services,” December 11, 2025.
12. [12]Federal Register (FinCEN and OFAC, U.S. Department of the Treasury), “Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements (Proposed Rule),” April 10, 2026.
13. [13]Federal Register (FinCEN, OCC, Federal Reserve Board, FDIC, and NCUA), “Permitted Payment Stablecoin Issuer Customer Identification Program (Proposed Rule),” June 22, 2026.
14. [14]U.S. Securities and Exchange Commission (Division of Trading and Markets), “Frequently Asked Questions Relating to Crypto Asset Activities and Distributed Ledger Technology,” Last updated February 19, 2026.

Educational content only — not legal, tax, or investment advice, or an offer to sell or a solicitation of an offer to buy any security. Rules and data are described as of November 2026 and may change. Securities offered through Umergence LLC, Member FINRA/SIPC.