Coredo

I have been leading COREDO since 2016 and see every day how quickly the digital assets market is changing. Over the years the COREDO team has carried out dozens of projects for company registration and licensing in the EU, the United Kingdom, Singapore, Cyprus, Estonia, the Czech Republic, Slovakia and Dubai. Clients come with a variety of tasks: from creating an SPV for the tokenization of artworks to building institutional custodial infrastructure for NFTs. In this article I have compiled practical experience and strategic ideas: how to use NFTs as a financial instrument, how to manage risks, comply with MiCA, MiFID II, FATF and GDPR, and how to structure IFRS reporting so that the auditor has no questions left.

When NFTs are in a corporate portfolio

From an investment-logic perspective, NFTs and securities in the EU are different things. Security token vs non-fungible token: this is above all a difference in legal nature: a security token, as a rule, falls under MiFID II and national securities regimes, whereas an NFT is a unique digital token that may be an investment asset depending on its economic function, but does not automatically become a security. Classifying an NFT as an investment asset requires analysis of utility, rights, returns, market-making and liquidity availability.

Brands gain a new channel for audience engagement and licensing economics from NFTs. Our experience at COREDO has shown that strategic use of NFTs for brands pays off when the links between token ownership and utility are formalized in smart contracts, and IP-licensing and exclusivity issues are secured in clear agreements. Then an NFT logically becomes part of the corporate portfolio alongside tokenized lease rights, service vouchers and shares in an SPV.

NFT: a security under MiFID II?

We often use frameworks for assessing the legal nature of a token, where we apply the criteria of an investment contract (Howey test and analogies) specifically as an analytical lens: capital contribution, expectation of profit, efforts of a third party. In the EU this test is not law, but it helps structure arguments for regulators and platform compliance. COREDO’s practice confirms: when an NFT provides passive income or a promise of portfolio management, regulators may qualify such a token as a financial instrument, which brings MiFID II implications for brokers and platforms.

Tokenized securities vs NFTs: the key dividing line. If a token directly embodies a claim against an issuer, an equity share or a debt obligation, it becomes a security token subject to the full body of rules, up to prospectus requirements, provider licensing and reporting. If an NFT records access, a unique digital object or certifies a right of use without an investment component, we remain in a different regulatory zone.

Regulation of NFTs in the EU and secondary markets

Fractionalized NFTs (fractional tokens) and serial issuances with economically interchangeable properties may fall within the scope of MiCA, and in extreme cases: within MiFID II. The solution developed at COREDO: early token qualification and a compliance roadmap before launching smart contracts.

ESMA’s recommendations on digital assets complement MiCA with details on the delineation of services and investor protection. Regulation of NFT secondary markets requires transparency of fees, prevention of manipulation and manageability of listings. Monitoring for manipulation in the NFT market and combating wash trading become part of platforms’ internal controls, especially if they perform the functions of a broker or market operator.

If necessary, we launch the project through regulatory sandboxes for crypto startups in the EU to agree in advance on the approach to token functions and circulation mechanics. Interaction with regulators and supervisory authorities is critical here: it reduces the risk of the instrument being reclassified after launch.

AML/KYC: how to build compliance for NFTs

The COREDO team implemented risk‑scoring of buyers and sellers for marketplaces, sanctions filters and on‑chain analytics to detect links with “tainted” addresses.

Money laundering risks through NFTs are typical: rapid resales with inflated prices, wash trading, transactions through mixers, a high rate of order cancellations.

GDPR when processing NFT clients’ data requires minimization, justified retention periods and transparent information for the data subject.

Cross-border NFT sales and currency regulations add another layer. Our lawyers at COREDO set up cross-border compliance for buyers from Asia and the EU, aligning KYC procedures, withholding taxes and interaction with payment systems and PSPs. Banking oversight is also important: interaction with the banking system and banking supervision requires source of funds policies, invoicing standards and clear contractual documentation between the platform, the issuer and the buyer.

Royalties and licensing

Separation of rights: ownership vs right of use must be explicitly recorded in the terms of sale and/or in an on-chain link to the license. In COREDO projects we arrange IP licensing and NFT exclusivity through separate agreements, taking into account moral rights and assignment in EU jurisdictions.

NFT marketplaces and platform liability require clear rules in offers: transparency of fees, refund conditions, secondary NFT sales and fee regulation — all of this becomes a subject of attention for regulators and antitrust authorities if practices appear to restrict competition.

We insist on two-sided duplication of metadata, versioning and recording of hashes in the smart contract to prevent tampering. When IP is wrapped into an SPV and licensed via an NFT, the contractual framework links the rights holder, the custodian and the token holder.

Tokenization of art and real assets

SPV legal structures for tokenized art are a proven scheme: the assets are held by a rights‑holding company, and NFTs sell access to benefits, viewing rights, priority participation in exhibitions, or fractional rights through fractionalized NFT. Fractional ownership legal structures carry particular risks for investors: when ownership is fractionalized, characteristics of a security can sometimes emerge, which may trigger MiFID II.

SPVs and legal wrappers for art tokens are useful for managing taxes, rights, insurance and custody.

investment funds NFTs in the EU can be structured in the form of AIFs with corresponding regulation of the management company, custodian, valuer and auditor – the COREDO team has structured such funds taking ESMA and local supervision into account.

The distinctions between ICO/STO/ITO and the comparison with NFT issuance are needed to understand regulator expectations: STOs are securities; ICOs/ITOs can fall under MiCA; NFT issuance more often does not require a prospectus, but does require disclosure and compliance if investment characteristics are present. COREDO’s experience confirms that early consultation with the regulator reduces costs and speeds up market entry.

Taxes and accounting for NFTs under IFRS

The tax consequences of NFT sales in Europe depend on what is being sold: digital content, access to a service, or usage rights.

Royalty income may be subject to withholding tax in certain jurisdictions: this is taken into account when structuring SPVs and licensing agreements.

Accounting for NFTs on a company’s balance sheet (IFRS) is closer to accounting for crypto assets: they are more often intangible assets under IAS 38, except when held for trading as inventories under IAS 2.

Reporting and disclosure about NFT assets include accounting policies, valuation methodologies, liquidity and concentration risks.

Valuing NFTs for investors is built on three pillars.

The COREDO team sometimes supplements the valuation with option models for rare cases involving buyback rights.

Smart contracts: standards and insurance

Smart contracts (ERC-721, ERC-1155) and security are a central part of legal protection: bugs in code can wipe out rights, reduce royalties to zero, or open the door to an exploit.

Smart contract audits for legal protection should combine static analysis, formal verification, and testing of business scenarios: edge cases for listing, token burns, upgrades, royalties, and pauses. Blockchain code audits and formal verification reduce the risk of smart contract vulnerabilities and exploits, while digital asset insurance and loss coverage close out tail risks. Within companies we insist on corporate access control for wallets, role separation, and multi-factor policies.

Institutional custodial infrastructure for NFTs requires custodian solutions for institutional NFTs, SLAs, key recovery procedures, and controls over corporate transactions. Custody APIs and interaction standards enable integrating NFTs with ERP and accounting systems, automating transfers and tags for accounting. The COREDO team helped clients build cold‑hot‑warm storage architectures and asset movement policies aligned with auditors.

Markets and liquidity: risk control

NFT liquidity risk and exit strategies: this is the main area for the CFO. Exit strategies: listings on exchanges, OTC processes with KYC, buyback agreements and NFT options, as well as framework agreements with marketplaces for prioritized listing. Stress-testing the liquidity of an NFT portfolio models a drop in floor price, widening spreads, departure of market‑makers and regulatory shocks.

counterparty assessment and marketplaces by reputation reduces the risk of failures in settlements and delistings. The commercial model: fees, royalties, listing fees must be transparent and compatible with antitrust and competition-related risks of marketplaces — especially regarding exclusivity and restrictions on parallel sales.

Institutional players look at blockchain resilience: PoS vs PoW and energy consumption. Carbon footprint and offsetting NFT emissions are becoming part of ESG policy: we build in compensation mechanisms or choose energy-efficient networks. For collateralized deals, using NFTs as collateral (collateral) requires independent valuation, agreements with custodians and tripartite agreements with lenders.

COREDO: case studies and launch roadmap

• Legal qualification: framework ‘security token vs non-fungible token’, MiCA/MiFID II/ESMA assessment, ICO/STO/ITO comparison.
• corporate structure: SPV, IP agreements, licenses, royalty agreements, option and buyback.
• Technical architecture: ERC-721/1155 standard, IPFS/Arweave, URI strategy, on-chain provenance.
• Compliance: AML/KYC, SoF, travel rule, sanctions and export controls, GDPR, cross-border compliance.
• Infrastructure: custody, insurance, corporate access control to wallets, custody APIs.
• Taxes and accounting: VAT, transactional taxes, IFRS (IAS 38/IAS 2), disclosures and valuation models.
• Market and liquidity: listing rules, fees and royalties, OTC processes, stress testing and exit.
• Interaction with regulators: sandbox, notifications, responses to inquiries, internal reporting and best practices for internal control and reporting on NFTs.

Legal risks in EU practice

Legal disputes and case law on NFTs in the EU are still taking shape, but precedents are already setting the direction. Court precedents regarding the sale of NFTs (European cases) emphasize the importance of clear license terms, fair commercial practice and truthful marketing. Legal enforcement mechanisms in NFT fraud include asset freezes, platform notifications, interaction with custodians and cooperation with law enforcement.

Regulation of secondary NFT markets and marketplace liability require attention to the impact of MiFID II on brokers and platforms, especially when they begin to perform the functions of an organized trading venue.

DAOs as a tool for managing collections and funds have also become relevant in Europe. The role of DAOs in managing collections and funds requires aligning governance tokens and voting rights with off-chain corporate law. We increasingly use a hybrid: DAO voting logic on top of a legal entity (SPV or fund), where mandatory corporate actions are executed by a delegated director.

Payments and banking between on-chain and off-chain

Для корпоративных клиентов COREDO выстраивает мосты: кастоди для хранения, PSP для мерчанта и банковские счета для расчетов, чтобы снимать вопросы у финансового контроля и аудита.

При крупных продажах due diligence чек-лист перед покупкой крупного NFT включает KYC контрагента, проверку provenance, юридический статус IP, анализ маркетплейса, репутационные риски и страхование доставки цифрового актива.

ESG for NFT sustainability and reputation

Clients in the institutional segment increasingly include ESG criteria. Blockchain sustainability: PoS vs PoW and energy consumption affects network choice. Carbon footprint and offsetting of NFT emissions are configured through compensation programs, green certificates, and sustainability reporting. For public companies this becomes part of non-financial disclosure alongside liquidity and compliance risks.

This approach protects the portfolio and accelerates deal approvals at the level of boards of directors and risk committees.

Conclusions

NFTs have moved from an experimental status to a managed asset class where legal qualification, compliance and infrastructure are as important as creativity and community. My position is simple: if NFTs are treated as a financial instrument from the start, a business gains transparent processes, clear economics and access to institutional capital. COREDO’s experience in the EU, the UK, Singapore, Cyprus, Estonia, the Czech Republic, Slovakia and Dubai shows: a well-designed SPV structure, clear IP licenses, proper IFRS accounting and AML/KYC discipline turn NFT initiatives from a risky bet into a sustainable product.

If you plan to launch, start with legal qualification and architecture: choose a standard (ERC-721/1155), describe ownership and usage rights, resolve custody and insurance issues, define the tax model and disclose risks in the white paper. The COREDO team will help build a compliance roadmap, align the approach with regulators, audit smart contracts and integrate accounting. This will preserve your speed and provide the reliability on which long-term value is built.

Regulators are tightening requirements, customers expect instant payments, and the compliance team is overloaded with alerts. Over recent years, the COREDO team has implemented dozens of KYT (Know Your Transaction) projects for fintech companies in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus and Estonia, as well as in Singapore and Dubai. In this article I systematize the approach that has proven effective at COREDO: from architecture and risk-scoring models to legal liability and the AML team’s KPIs.

What is KYT and how does it integrate into AML processes?

KYT (Know Your Transaction) for fintech is the continuous analysis of blockchain transactions in real time with risk scoring at the level of each operation. Unlike KYC, which answers the question «who is the client», KYT answers the question «what is happening with their transaction right now». For payment and crypto services this is the foundation of blockchain payments compliance and the key to managing operational risk.

Regulatory frameworks: AMLD5/AMLD6, FATF and the Travel Rule

European AMLD5 and AMLD6 have shaped expectations for transaction monitoring policies, sanctions screening obligations and suspicious activity reporting. Recommendations of FATF, including the Travel Rule, require matching on‑chain and off‑chain data and transmitting payer/beneficiary attributes between providers. In practice this means the need for on‑chain sanctions screening, compliance with watchlists (OFAC, EU, UN) and automation of SAR/STR reporting.

Architecture: from streaming to investigations

The solution developed at COREDO is typically built as a streaming pipeline. Block indexing and mempool parsing provide minimal latency, and data streaming (Kafka, Kinesis) delivers events to the risk-scoring core. We enrich transactions with additional data: address attribution, exchanges, OTC entities, cascades of transit wallets. This increases accuracy and reduces false positives when monitoring on-chain.

For graph analytics of transactions we often use Neo4j or TigerGraph, and for full-text search and event analytics: ElasticSearch. Such a stack delivers performance benchmarks for latency/throughput at millions of transactions per day and the ability to scale monitoring for cross-chain payments. SLAs are important for transaction monitoring: alert latency, API availability, incident handling time, and the speed of sanctions updates.

Blockchain fraud detection systems integrate via API and webhooks for alerts with subsequent processing in case management and analyst workflows. Audit trail, multi-level access control, encryption and key management form a secure perimeter. For global providers, SaaS KYT multi-tenancy and a clear policy on TCO, CAPEX and OPEX are useful when implementing KYT.

Analytics and models: a hybrid of rule-based and ML

COREDO’s practice confirms: the best effectiveness is achieved by a hybrid of rule-based detectors and machine learning models for KYT. Heuristic rules quickly catch known patterns, while unsupervised training detects anomalies in new flows. Supervised models for risk scoring increase the prioritization of investigations and reduce the conversion of alerts into SARs where justified.

Feature engineering for transaction scoring takes into account the degree of connectivity to sanctions tags, the depth and breadth of paths, temporal patterns, amounts, and repeatability. Backtesting of the transaction risk-scoring model is necessary before go-live: we check metrics on historical data and stress scenarios (for example, spikes after a token listing). As a result, the client gets a reduction in alert fatigue and an increase in the operational efficiency of the AML team.

On-chain risks: DeFi, mixers and privacy coins

On‑chain analytics of transactions must take DeFi specifics into account. Monitoring DeFi transactions focuses on DEX and AMM transaction patterns, bridges and token transit flows, wrapped tokens and multichain tracking. The impact of L2 and rollup on transaction monitoring is expressed in increased speed and the need to index smart contract events.

We track leaked wallets and key leaks, and also build an incident response plan upon detection of money laundering. For legal investigations, chain‑of‑custody for on-chain evidence is important: immutable logs, hash fixations and procedural integrity. This simplifies interaction with lawyers and regulators and reduces the risk of disputes over the evidentiary base.

Integrating KYT into processes: from onboarding to SAR

Integration with wallets and payment gateways provides pre-credit holds and real-time operation of the KYT API. AML/KYC orchestration platforms help tie KYT to KYC and sanctions screening, and also implement automated decisioning for low-risk scenarios. Proper implementation of a transaction monitoring policy formalizes thresholds, roles, and escalations.

At COREDO we set up SAR automation and regulator reporting, which reduces manual delays and improves submission quality. SOC/AML team organization and processes include triage levels, playbooks, and SLAs for incident closure. Key metrics — alerts-to-SAR ratio, analyst efficiency, average investigation time, and repeat-alert rate.

How to choose a KYT platform and assess ROI

We perform Due Diligence on blockchain analytics providers, including open sources and commercial solutions, as well as open source tools for blockchain analytics as a supporting layer. It is critical to check which SLAs matter for monitoring transactions in fintech: RPO/RTO, alert latency, tag update frequency, support for new networks and the quality of customer support. Vendor comparison: this is not a feature race, but a check of alignment with your risk scenarios and jurisdictions.

Implementation plan: from pilot to production

The pilot begins with defining target risks and selecting networks/tokens. Next: configuring sanctions lists and watchlists, integrating with enrichment sources and setting up API integrations and webhooks for alerts. After that, backtesting on historical data, determining thresholds, training staff and running in parallel mode with manual oversight.

Implementing a real-time KYT API requires performance testing, latency/throughput benchmarks and fault-tolerance plans. We build in model risk governance (model governance), regular testing and rule validation, as well as drift detection and model monitoring. DevOps and MLOps for production KYT systems simplify releases, disaster resilience and traceability of changes.

COREDO case studies: what worked in practice

• European payments provider with expansion into the United Kingdom and Singapore. The COREDO team implemented KYT integration with internal KYC and sanctions screening, deployed on‑chain sanctions screening and SAR automation. We combined graph algorithms for on‑chain investigations with rule‑based detectors, achieving a double‑digit reduction in false positives and shortening investigation time. As a result the company accelerated PI/EMI licensing and preserved SLAs for client‑facing payments.
• An OTC desk in Dubai with multichain flows. The solution developed at COREDO emphasized on‑chain transaction analytics to detect bridges, wrapped tokens and AMM anomalies. We set up address and wallet tracking, address attribution and clustering, as well as an incident response plan for detected money laundering. This enabled proper handling of cross‑chain flows and meeting the local regulator’s AML requirements for fintech companies.
• Fintech in the Czech Republic/Slovakia expanding into the EU. COREDO’s practice confirmed that integrating KYT into the onboarding process speeds up KYC through dynamic risk scoring of initial transactions. We ensured compliance with AMLD5/AMLD6, correlation of on‑chain and off‑chain data and automated reporting. The company gained transparency of chains and reduced incident costs.
• Licensing of a crypto service in Estonia and launch in the United Kingdom. The COREDO team prepared an AML policy, implemented address identification and wallet tagging, and deployed case management and workflow for analysts. A key element was explainable AI for fintech compliance: the regulator valued the transparency of scoring and the completeness of logs, which simplified the audit process.

Legal aspects: liability and cross-border data

Processes and team: how to avoid overload and burnout

Case management and workflow for analysts with investigation templates and playbooks reduce cognitive load. SOC/AML team organization and processes increase predictability and manageability of SLAs. COREDO’s experience shows that clearly defined roles, task rotation and quality control reduce turnover and increase the resilience of the AML function.

Data, vendors and security

Multi‑tenancy of SaaS KYT and data security require segmentation, encryption, access management and monitoring. DevOps and MLOps for production KYT systems help maintain release quality and rollbacks. Log auditability and an immutable trail simplify audits and build trust with the regulator and partners.

Cross-chain and the future: L2, rollups and new risks

The impact of L2s and rollups on transaction monitoring is growing: the volume of smart contract events increases, speed rises and attribution becomes more complex. Best practices for building a blockchain monitoring pipeline include deterministic indexing, retry queues, schema versioning and consistency checks. Scaling to millions of transactions per day requires horizontally scalable shards and backup strategies.

Total on‑chain traceability versus privacy‑enhancing tech is a balance between compliance and privacy. At COREDO we follow the principle of ‘minimum necessary’ storage of personal data and maximally preserve technical signals for risk detection. Past cases of address sanctioning and lessons learned help adjust rules and models in advance for new patterns.

Practical checklist: where to start and what to measure

• Determine target risk scenarios: sanctions, mixers, DeFi bridges, privacy coins, leaked keys.
• Choose the architecture: SaaS KYT vs on‑prem considering CAPEX/OPEX, GDPR and multi‑jurisdictional constraints.
• Build the pipeline: mempool parsing, streaming (Kafka/Kinesis), graph database (Neo4j/TigerGraph), search (ElasticSearch).
• Configure sanctions lists: OFAC, EU, UN, local watchlists, and the policy for updating them.
• Enable hybrid analytics: rule‑based detectors + ML (supervised/unsupervised), explainable AI.
• Run a backtest: precision/recall/F1 metrics, false negative tests, drift detection.
• Launch a pilot: TTV, SLA, reduction of false positives, alerts‑to‑SAR ratio, analyst efficiency.
• Formalize processes: case management, playbooks, incident plan, SAR automation.
• Prepare for audit: immutable logs, chain‑of‑custody, data‑sharing regulations between branches.
• Plan for growth: L2/rollups, DeFi risks, new networks, regular validation of rules and models.

How COREDO supports a project from licensing to production

COREDO covers the entire cycle: from registering legal entities in the EU, the UK, the Czech Republic, Slovakia, Cyprus and Estonia, to structuring in Singapore and Dubai. We assist with obtaining licenses (crypto, payments, forex and banking), develop AML policy, design KYT architecture and implement blockchain payments compliance. This approach eliminates gaps between the legal framework, processes and technology.

Conclusion

KYT is not just real-time analysis of blockchain transactions. It is the foundation of your license, payment speed, and market trust. When transaction monitoring is linked with KYC, sanctions screening, and clear investigation processes, fintech gains control over risk and predictable economics. COREDO’s experience in the EU, Asia, and the CIS shows: a well-designed KYT reduces operational costs, speeds time-to-market, and stands up to audits.

If you are building a payment service, a crypto platform, or expanding presence across multiple jurisdictions, start with a clear architecture, transparent metrics, and a pilot on real-world scenarios. The COREDO team has walked this path dozens of times and knows how to reconcile the requirements of AMLD5/AMLD6, the FATF Travel Rule, GDPR, and the specifics of DeFi. That way you’ll gain not just compliance but a competitive advantage—a resilient, scalable risk control built into the product.

When I launched COREDO in 2016, entrepreneurs had an obvious request: to enter new markets quickly, safely and transparently. Over the past few years the puzzle has become more complex: requirements for company registration, licensing and AML compliance have tightened. Today it is impossible to build an international business without a well-designed compliance function, and the EU AML Package 6.0, the launch of AMLA and 6AMLD are turning “due diligence” from a formality into a strategic discipline. In this article I systematize our experience and explain how to build a working AML and KYC/KYB system without losing scaling momentum.

EU regulatory map: AMLA and 6AMLD

The EU AML Package 6.0 formalizes the shift toward more unified regulation: it creates AMLA (the European Anti‑Money Laundering Agency), the provisions of 6AMLD come into force, and the main body of requirements is consolidated into pan‑European AML regulation. For businesses this means uniform technological and procedural standards across the EU and fewer gray areas in the interpretation of rules. At the same time, the role of national regulators remains: they will interact with AMLA by sharing data, coordinating inspections and harmonizing local procedures.

Company registration with AML considerations

Registration of legal entities in the EU with AML requirements in mind is not just articles of association and an address. Competent preparation of a UBO dossier, analysis of source of funds, assessment of the business model from the AML-risk perspective, and the mandatory elements of the starter package. I recommend starting with a jurisdiction map: the Czech Republic, Slovakia and Cyprus are convenient for trading and holding structures; Estonia and United Kingdom — for tech and service companies; Singapore and Dubai — for regional headquarters and structures with active payment activity.

Registration and support of companies in the EU from an AML perspective includes alignment with future licenses and banking needs. If the goal is: payment services, it is worth building in advance a functional compliance structure, the allocation of responsibilities of “obligated persons” for AML, and an initial set of CDD/EDD controls. When these elements are embedded before applying for an account or a license, the process proceeds noticeably faster.

AML Program Architecture

Compliance program AML for companies is a managed system of policy, procedures, a technology platform and metrics. I recommend starting with a risk-based approach: conduct an AML risk assessment, identify client and country risk profiles, determine high-risk scenarios, and then embed them in the corporate policy. It is important to describe roles and the chain of responsibility, including the director’s and corporate structure’s responsibility for AML, and an internal control plan.

From a cost perspective, a cost-benefit analysis of implementing AML platforms is needed already at the RegTech selection stage. AML effectiveness metrics (KPIs and ROI) are not only about reducing fines and administrative measures for AML non-compliance, but also accelerating M&A, access to correspondent banking and reducing operating costs. Scaling AML processes as the business grows becomes a routine task when the architecture already supports new jurisdictions, languages and data sources.

How to implement KYC, KYB, CDD and EDD?

KYC and KYB requirements in the EU are based on 6AMLD and national laws, but expect the same logic: verification of identity, address, tax residency status, source of funds and UBO/BO status. For corporate clients, KYB includes checking registers, the charter, ownership structure, as well as assessing the business reputation of executives. We use automation of KYC processes and tools for VASP/PSP to reduce document collection time and minimize human errors.

Transaction monitoring and risk assessment

risk assessment for AML is a living document that is tied to transactional behavior models. We apply customer profiling and risk scoring, using historical and behavioral parameters: geography, average transaction amounts, types of counterparties, temporal patterns. Technologies for AML, transaction monitoring, screening, analytics: form an observation framework that operates in real time while also supporting off-chain monitoring for non-standard scenarios.

Monitoring the risks of counterparties and supply chains complements transactional rules. For cross-border companies we implement off-chain indicators: reputation in industry databases, court cases, changes in ownership structure. This layer improves the accuracy of EDD and helps promptly identify triggers for revising the risk profile.

Strategies for crypto and VASP

Regulation of virtual assets and VASP under the AMLA aligns the framework for crypto services with traditional financial institutions. Virtual asset service providers (VASP) and KYC requirements should cover customer identification, source-of-funds verification, sanctions screening, and monitoring of on-chain and off-chain transactions. Blockchain chain analysis and blockchain analytics help build a link-based risk model for addresses, wallets, and exchanges, and identify mixers, obfuscation, and connections to the darknet.

risk management when working with crypto assets requires correlating on-chain signals with off-chain customer profiles. For tokens and stablecoins, an additional layer evaluates the issuer, reserve model, and counterparties involved in redemptions. Regulatory tests and pilot projects (sandboxes) are a useful option if the market allows testing new compliance models under controlled risk. In several projects the COREDO team supported KYC pilots for VASP in the EU and Dubai, which enabled clients to obtain licenses faster and establish a dialogue with the regulator.

STR/SAR: interaction with the FIU

The obligations of obliged persons (obliged entities) under AML include detection and reporting of STR/STRs (or SAR), record keeping and cooperation with the FIU. Preparing and submitting STR/SAR requires a clear checklist: indicators of suspiciousness, escalation logic, the level of detail in the description of the pattern and attachments. We configure signal handling routes from first line to the MLRO to eliminate delays and improve the quality of reports.

Licensing: payments, forex, crypto

obtaining financial licenses – is an assessment of the maturity of your AML system. For payment providers and PSPs, regulators assess governance, the independence of the compliance function, the quality of KYC/KYB, EDD and transaction monitoring. For forex and investment licenses, particular attention is paid to sources of liquidity, policies on high-risk jurisdictions and stress testing. Crypto licensing in the EU and Dubai integrates requirements for VASPs, blockchain analytics and counterparty risk management.

The impact of AML obligations on corporate transactions and due diligence has noticeably increased. The integration of AML requirements into M&A and corporate transformation includes audits of the client base, retrospective analysis of STRs, assessment of regulatory history and vendor due diligence. The participation of banks and non-bank institutions in AML is now assessed in the context of the single EU AML Package, and the alignment of national legislation with the AMLA reduces divergences in requirements for cross-border licensing.

Outsourcing third-party compliance

Outsourcing compliance functions and its risks are often underestimated. Outsourcing vs in-house – it’s not about “cheaper”, but about control, competencies and resilience. We usually set up a hybrid: key roles and decision-making in-house, while part of monitoring and screening is with external providers under clear SLAs and with audit rights. This approach simplifies scaling the AML infrastructure when entering new markets, while maintaining manageability.

COREDO: access to banks and de-risking

One of the recent projects was a fintech from Central Europe with a payment model for cross-border e-commerce. The client faced difficulties accessing banking services due to de-risking. The COREDO team rebuilt the compliance package: detailed suppliers’ KYB, strengthened sanctions screening, and implemented transaction profiling with adaptive thresholds. The bank reconsidered its decision, opening correspondent accounts after a pilot period with KPIs on false positives and alert handling time.

AML Package 6.0 Compliance Plan

Every compliance officer benefits from a pragmatic roadmap. Below is the checklist we use during implementation.

1. Conduct an AML risk assessment and record the risk appetite. Ensure that client, country, product and sales channel profiles reflect the current strategy and growth plans. Update the risk map at least once a year and after major business changes.
2. Update the AML compliance program, roles and accountability. Define MLRO authorities, describe escalation and independence of control. Document the corporate policy on anti-money laundering and sanctions screening.
3. Review KYC/KYB, CDD/EDD and PEP procedures. Include automation of KYC processes, regular sanctions screening and relationship checks. Clarify the practical implementation of UBO identification and the frequency of data updates.
4. Reconfigure transaction monitoring and rules tuning. Introduce metrics for false positives, average alert handling time and the share of escalations to STR/SAR. Conduct transaction analysis in real time and off-chain monitoring for atypical scenarios.
5. Approve the STR/SAR playbook and interaction with the FIU. Describe suspicion criteria, the quality of the evidentiary base and filing deadlines. Check legal data-exchange mechanisms and GDPR compliance.
6. Check AML integration into ERP/accounting and dashboards. Ensure data integrity, access log audits and consistency of reporting standards. Set compliance KPIs and ROI to demonstrate business impact.
7. Organize training and testing for staff. Run targeted modules for the front office, analysts and management every six months. External certification and participation in industry programs are useful for compliance officers.
8. Agree the outsourcing process and third-party controls. Document SLAs, audit rights, security requirements and continuity plans. Verify vendor approaches’ compatibility with 6AMLD and local regulations.
9. Prepare a high-risk and sanctions policy. Develop a policy for working with high-risk jurisdictions and client profiles. Clarify the approach to tokens, stablecoins and VASPs, if relevant.
10. Plan regulatory engagement and pilots. If the product is innovative, consider participation in sandboxes and supervised pilots. This will speed up feedback and reduce regulatory uncertainty.

What to consider when entering new countries

AML analysis when entering the markets of Asia and the CIS must take into account local standards and the FATF’s international recommendations. Differences in access to UBO registries, document retention periods and STR formats can affect process design. The impact of AMLA on fintech and payment services in the EU makes the European part of the infrastructure more predictable, which simplifies integration with Singapore and Dubai.

Why I support systemic compliance

Compliance is not an “insurance against fines”, but an operational discipline that increases a company’s capitalization. AML Package 6.0, the EU Directive on anti-money laundering and the launch of AMLA are creating a common playing field with clear rules, and those who adapt their processes earlier will gain an advantage. I see COREDO clients opening accounts faster, obtaining licenses with confidence, and shortening deal cycles when compliance is integrated into the business architecture.

The COREDO team has implemented projects in the EU, the UK, Singapore and Dubai, from registration and licensing to setting up monitoring and providing full AML support for companies. I continue to personally oversee complex cases and am convinced: transparency, technological sophistication and discipline deliver the best results. If you plan to scale, pursue M&A, or expand into new markets, build compliance into your growth strategy: it will save time and strengthen the trust of partners, banks and regulators.