Crypto compliance for brokers who accept crypto deposits

Crypto funding is now table stakes for brokers, prop firms and trading platforms — clients expect to deposit USDT in minutes, not wire money in days. But a regulated firm that credits a crypto deposit takes on a question banks have asked for decades: where did this money come from, and can you prove you checked?

Why broker funding is different from an exchange

Most compliance tooling is built for exchanges and VASPs — firms whose whole business is crypto custody. A broker's lifecycle is different: the deposit arrives in crypto (often via a payment processor), is converted, credited to a trading account as fiat or USD margin, traded on MT5 or similar, and eventually withdrawn — sometimes to a completely different wallet. Each of those seams is where the risk lives: third-party funding, pass-through accounts with no real trading, deposits split just under reporting thresholds, withdrawal wallets that never matched the deposit wallet.

Screening the wallet once at deposit is not enough. The obligation runs across the whole funding lifecycle — and it doesn't disappear because a payment processor sits in the middle. Under FATF's reliance framework, your firm keeps responsibility for monitoring even when a licensed third party does the conversion.

What regulators actually expect

Across jurisdictions — FSC Mauritius under FIAMLA, CySEC, FSA Seychelles, Labuan FSA — the expectations converge on four things: screen every funding event against sanctions data; decide using a documented, consistently-applied policy; monitor continuously, including re-checking past deposits when lists change (OFAC explicitly recommends lookback); and keep records — typically 5–7 years — that let you reconstruct any decision on demand.

The trap most small firms fall into is the last one. A screening PDF from a vendor proves a check ran; it does not prove what policy was in force, who approved the exception, or that the record wasn't edited later.

MINIMUM VIABLE CHECKLIST

✓ Sanctions screening on every deposit and withdrawal address — with list freshness you can show

✓ Stablecoin issuer freeze checks (a USDT address Tether has frozen is a red flag no score captures)

✓ Verification that the claimed deposit transaction actually exists and confirmed on-chain

✓ A written policy mapping findings to actions — and versioning when it changes

✓ Automatic case creation for anything not clean, with an append-only audit trail

✓ Daily re-screening of past counterparties against updated lists

✓ Tamper-evident records: if a decision record can be silently edited, it proves little

Score vendors, enterprise platforms, or build it yourself?

Per-check screening APIs are cheap and useful — but they hand you a risk score and leave the decision logic, case handling and record-keeping to you. Enterprise analytics platforms cover everything, at contracts that start where a small broker's entire compliance budget ends. Building in-house means owning list updates, policy versioning and audit mechanics forever.

KYTGate takes the fourth path: the decision and evidence layer as a product. Official sanctions data and on-chain checks built in; your processor's KYT results and any commercial vendor plugged in alongside; your policy applied deterministically; every outcome recorded as a signed, replayable Decision Receipt. Keep your vendors — switch them freely.

Where to start

Two minutes of due diligence costs nothing: run any deposit address through our free wallet sanctions check — it screens against OFAC and UK data and reads USDT/USDC freeze status live on-chain. When you're ready to automate the whole lifecycle, request early access: new tenants run 30 days in shadow mode, so you see decisions on your own traffic before anything is enforced.

This page is general information, not legal or compliance advice. Requirements vary by jurisdiction and licence class — confirm your obligations with your counsel or MLRO.