Crypto Exchange and On/Off Ramp Compliance
Crypto exchanges occupy a peculiar position in the money transmitter regulatory landscape. They're engaged in currency exchange—buying and selling currencies—which historically has been regulated as money transmission, but their specific structure and the nature of the assets they deal with create complications that affect licensing determinations and compliance requirements in ways that differ significantly from traditional money transmitters.
Let me begin with what constitutes a crypto exchange under state law. A crypto exchange in its simplest form is a platform where customers can buy and sell digital assets. Some of the largest global crypto exchanges match buyers and sellers but don't take custody of assets—the assets remain in the customer's wallet or held by a separate custodian. Other exchanges operate as market makers themselves, buying and selling digital assets directly to customers from an inventory they maintain. Still others operate as custodial platforms where customers deposit both fiat currency and digital assets, and the exchange holds both on the customer's behalf.
The money transmitter question turns on custody and control. If an exchange takes custody of customer funds—either fiat currency or digital assets—it almost certainly meets the definition of a money transmitter in most states. You're accepting money or value from a customer and paying it out to another customer. The fact that the exchange is facilitating the purchase and sale of digital assets rather than transmitting money across a network doesn't change the fundamental transaction.
Some exchanges have structured themselves as non-custodial to avoid money transmitter licensing. In these cases, the customer retains control of their digital assets, and the exchange merely provides the platform for matching buyers and sellers. This raises the question: if the exchange never takes custody, does it need a money transmitter license? The answer depends on the state and how that state's money transmitter statute is written. Some state statutes focus exclusively on custody and transmission of funds. In those states, a non-custodial exchange might not trigger licensing requirements. Other states have broader definitions that capture anyone engaged in currency exchange, custodial or not.
The practical problem is that many state regulators have indicated that non-custodial exchanges still need licensing if they're exchanging currencies. And some state statutes have been written or interpreted so broadly that they seem to capture any entity that facilitates the movement of value, even if that entity never takes custody itself. The safest approach for any exchange—custodial or non-custodial—is to assume licensing is required and then make a state-by-state determination.
On-ramps and off-ramps represent a specific subset of exchange functionality that deserves its own analysis. An on-ramp is a service that converts fiat currency into digital assets. If I give you dollars and you give me Bitcoin, that's an on-ramp. An off-ramp is the reverse—I give you Bitcoin and you give me dollars. These services are critical infrastructure for the crypto industry because users need some way to get digital assets in the first place and some way to convert them back to spendable currency.
The licensing requirements for on-ramps are straightforward in most states: you're accepting fiat currency from customers and disbursing digital assets. This clearly falls within the definition of money transmission in any state that defines the term broadly. You're receiving funds and paying them out—the fact that the payout is in digital form rather than dollars or checks doesn't matter. States that have dealt with on-ramps explicitly have uniformly concluded that on-ramp operators need money transmitter licenses.
Off-ramps are where the analysis becomes more subtle. If a customer gives you Bitcoin and you give them dollars, are you receiving "money" (the dollars) or are you receiving a virtual currency (the Bitcoin)? The answer depends entirely on how the state defines money transmission. If the state statute says that money transmitters accept money and pay it out, and the statute defines money as currency, then someone who accepts Bitcoin and pays out dollars might not technically be accepting "money"—they're accepting a virtual asset and converting it to money.
However, most state regulators have determined that off-ramps do trigger licensing requirements. The reasoning is that off-ramps are effectively currency exchange operations, and currency exchange has traditionally been regulated. Whether the currency being exchanged is dollars, euros, or Bitcoin is irrelevant. You're moving value from one form to another, and the regulatory framework applies.
The more practical way to think about on-ramps and off-ramps is that they're both money transmission activities. An on-ramp is transmitting fiat value into digital form. An off-ramp is transmitting digital value into fiat form. Both require money transmitter licenses in most states. The few states that have tried to argue otherwise have been outliers, and the trend is toward requiring licensing for both.
This has immediate practical consequences. An exchange operator who wants to provide on-ramps and off-ramps to customers in multiple states faces significant licensing burdens. They need to figure out in which states they have customers, obtain licenses in those states, and maintain compliance with each state's specific requirements. Many exchange operators have responded by limiting their geographic footprint—accepting customers only from states where they've obtained licenses—but the internet makes geographic limitation difficult.
The custody question becomes central to many exchanges' regulatory strategies. If an exchange avoids taking custody of fiat currency by partnering with a separate payment processor, the exchange operator can argue that they're not accepting money—they're just facilitating the exchange. The payment processor takes custody of the fiat. The exchange takes custody only of digital assets. This structure can reduce licensing requirements in some states, though it depends entirely on how that specific state defines money transmission.
I advised an exchange platform that pursued this strategy. The platform's users would connect their bank accounts directly to the platform. When a user wanted to buy Bitcoin, the platform would send a request to a third-party payment processor, which would pull funds from the user's bank account. The payment processor would fund the user's Bitcoin purchase, and the platform would deliver the Bitcoin. The platform itself never touched the fiat currency.
In some states, this structure worked. Regulators concluded that because the platform wasn't accepting money directly, it didn't need a money transmitter license—the payment processor did, and they already had one. In other states, regulators took the position that the platform was still functioning as a money transmitter even though it wasn't taking direct custody of the fiat, because the platform was accepting customer money (in the form of authorizations to withdraw from their bank accounts) and paying out value (Bitcoin). The licensing requirement came from the facilitation of the transmission, not the direct custody.
The custodial versus non-custodial distinction also applies to digital asset custody. Some exchanges hold Bitcoin and other digital assets in custody for customers. Others use third-party custodians. If you use a third-party custodian, you might not be a money transmitter under some state interpretations because you're not taking custody of the digital assets. But this is uncertain ground. Many regulators have taken the view that if you hold the private keys or have control over digital asset movement, you're the custodian regardless of where the assets are technically stored.
DeFi protocols and the licensing question represent an emerging area of regulatory uncertainty. A decentralized finance protocol that allows users to trade digital assets automatically without any central entity matching trades or taking custody might not trigger money transmitter licensing in any state because no single entity is taking custody or control. The protocol is automatic and decentralized. But if a company runs the smart contracts, operates the interface, or exercises any control over the protocol, regulators may view that company as a money transmitter.
This is where the distinction between the protocol and the operator matters. A DeFi protocol might be decentralized and not require licensing. But if a company created that protocol, continues to develop it, collects fees from it, or exercises governance authority, that company might need licensing even if the protocol itself doesn't. This is still an active area of regulatory development, and there are no definitive answers yet.
AML/KYC for crypto transactions is not optional, but the specific requirements depend on the regulatory framework in your jurisdiction. FinCEN requires money transmitters to conduct customer due diligence and maintain records of transactions. For crypto transactions, this creates a practical challenge: how do you conduct KYC on someone before they use your exchange if they haven't yet created an account?
Most exchanges have implemented tiered KYC. New customers can access basic functionality with minimal information—perhaps just an email address. But to deposit fiat currency or withdraw assets, customers need to provide more information. To conduct larger transactions, they need to provide more documentation. This tiered approach balances customer friction with regulatory requirements.
The specific KYC requirements vary by state, but FinCEN's framework provides the baseline. You need to verify customer identity. You need to understand the nature of the customer's intended transactions. For significant customers or transactions, you might need to determine the source of funds or the beneficial owner of accounts. For crypto transactions, this is complicated by the pseudonymous nature of blockchain addresses. You can verify that a customer sent funds from a specific address, but tracing those funds to an ultimate source is technically difficult and often impossible.
The Travel Rule for virtual asset service providers has emerged as a significant compliance obligation. FinCEN's Travel Rule, implemented in 2020, requires that when you transmit funds to another financial institution, you include information about the originator of the transfer, the beneficiary, and the amount. For crypto transactions, implementing the Travel Rule is technically challenging because blockchain is pseudonymous. You need to identify your customer and then track where their funds are going, which creates a chain of identity information that needs to be transmitted along with the value.
The Travel Rule for crypto has created significant operational and technical challenges for exchanges. If your customer sends Bitcoin to a wallet on another exchange, you need to ensure that you're transmitting information about your customer to the receiving exchange. But what if the receiving exchange doesn't support the standard Travel Rule format? What if they're in a jurisdiction that hasn't implemented the rule? What if they're a decentralized exchange with no single entity to send information to?
Multiple companies have emerged to address Travel Rule compliance, offering middleware solutions that facilitate information transmission between exchanges. But the compliance burden remains substantial. Some exchanges have responded by implementing policies that restrict transfers to certain exchanges or require customers to complete additional verification before withdrawal.
Transaction monitoring for crypto is another critical compliance function. For traditional money transmitters, transaction monitoring involves reviewing transactions for suspicious patterns—structuring, large cash transactions, transactions to high-risk jurisdictions, transactions that match known sanctions lists. For crypto, transaction monitoring is more complex because you're monitoring digital assets whose movement can be tracked on a public blockchain.
The practical approach to crypto transaction monitoring involves several layers. First, you monitor transactions within your own platform for suspicious patterns. If a customer deposits $100,000 and immediately attempts to withdraw it to a different person's wallet, that's potentially suspicious. If a customer conducts a series of transactions below reporting thresholds that clearly add up to a larger transaction, that's structuring.
Second, you're expected to monitor the movement of digital assets through the blockchain itself. If a customer receives Bitcoin from a known ransomware wallet, you should be aware of that and should probably freeze the account pending further investigation. If a customer is sending digital assets to a sanctioned jurisdiction, you should prevent that transaction.
This creates a significant technical and operational burden. You need access to blockchain analysis tools that can track the origin and destination of digital assets. You need systems that can automatically flag transactions based on chain analysis. You need staff who understand cryptocurrency and blockchain analysis. The cost of this infrastructure is substantial.
Banking challenges specific to crypto MSBs represent a major operational obstacle. Even when a crypto exchange has all the necessary licenses and compliance infrastructure, finding a bank willing to work with them is often the hardest part. Banks remain risk-averse with cryptocurrency companies. Many large banks have stated explicitly that they won't work with crypto businesses. Smaller banks may work with crypto companies but charge higher fees or impose restrictions.
The practical result is that crypto exchanges often end up using smaller institutions or credit unions that are willing to accept the risk. These relationships are fragile—a regulatory action against the bank, a change in bank management, or a shift in regulatory interpretation can end a banking relationship overnight. Multiple exchanges have had their banking relationships terminated with little notice.
Some crypto companies have responded by building their own banking infrastructure. A few companies have become bank holding companies or have acquired banks specifically to eliminate their banking dependency. This is an extreme response available only to companies with significant capital, but it reflects how critical banking relationships have become.
Building a compliant on/off ramp from scratch requires addressing multiple components. You need to determine your licensing requirements across all states where you'll accept customers. You need to establish banking relationships and payment processing infrastructure. You need to build out your compliance program with KYC, AML, transaction monitoring, and Travel Rule compliance. You need to implement technical controls to prevent fraud and ensure the security of customer assets.
A real-world example illustrates the scope. In 2020, I advised a team that wanted to launch an on/off ramp for a specific developing country. The team was based in the United States and wanted to allow customers in country X to convert their local currency to USD stablecoins. This required:
- Obtaining money transmitter licenses in multiple US states where the founders were incorporated and where they anticipated a small number of US customers
- Establishing banking relationships to process fiat currency from customers
- Integrating with payment processors that could handle transfers to and from country X
- Implementing KYC that could accommodate customers in country X who might have limited documentation
- Building AML/CFT controls specifically calibrated to country X's risk profile
- Implementing transaction monitoring systems
- Establishing compliance processes for Travel Rule compliance
- Building out their customer service infrastructure to handle dispute resolution
The project took 14 months from start to launch and required $3 million in funding before they processed their first transaction. Once launched, the economics were challenging—payment processing costs were high, and the margin on each transaction was thin. But the regulatory framework was achievable.
Common enforcement actions against crypto operators have revealed the regulatory priorities. When the SEC has taken enforcement actions against exchange platforms, the cases have focused on: (1) operating as unregistered securities exchanges, brokers, or investment managers; (2) conducting business without money transmitter licenses; (3) misrepresenting compliance or regulatory status; (4) inadequate customer protections; and (5) commingling customer and company funds.
When state regulators have taken enforcement actions, the focus has often been on: (1) operating without required money transmitter licenses; (2) inadequate net worth or bonding; (3) failure to conduct AML/KYC; (4) inadequate transaction monitoring; (5) misrepresenting customer protections; and (6) failure to maintain required records.
When FinCEN has taken enforcement actions, cases have involved: (1) willful violations of money transmitter registration requirements; (2) failure to conduct proper KYC; (3) inadequate AML/CFT programs; (4) failure to file Suspicious Activity Reports; (5) Travel Rule violations; and (6) operating to evade sanctions.
These enforcement patterns reveal that the basics matter. If you're operating an exchange that touches fiat currency or if you're taking custody of digital assets, you need to get licensed. You need a real compliance program, not just paperwork. You need to actually monitor transactions, not just claim you do. You need to know who your customers are. The regulatory framework for crypto exchanges is not fundamentally different from the framework for traditional money transmitters—it's just applied to novel technology.
Practitioner's Bottom Line: Crypto exchanges, on-ramps, and off-ramps require money transmitter licensing in most states; the primary strategic question is whether to structure the business as custodial or non-custodial, though this distinction provides limited shelter. Compliance requirements include KYC/AML, transaction monitoring, blockchain analysis, Travel Rule compliance, and often requires expensive banking relationships with institutions willing to accept crypto risk. Building a compliant, operational exchange platform requires 12-24 months and $2-5+ million in capital before generating revenue, and the business economics remain challenging due to payment processing costs and transaction margins.