Implementing an AML/CFT Due Diligence framework for Virtual Assets investments

If you enjoy reading our articles and want to support our mission of sharing valuable insights on AML and investment funds, the easiest way to help is by subscribing to the Fundiligence newsletter.
For us it is very important, for you it is FREE.

In the past decade, virtual assets have grown from a $10 billion niche market to a trillion-dollar industry, reshaping global finance, with Luxembourg emerging as a key hub for their adoption and regulation. As of mid-2024, the Commission de Surveillance du Secteur Financier reported a 30% increase in the number of registered Virtual Asset Service Providers compared to the previous year, highlighting the growing institutional and alternative investment fund interest in digital assets. Luxembourg has also seen a strong rise in transaction volumes, with EUR 23 billion in virtual asset exchanges executed by registered VASPs in 2023, primarily involving Bitcoin, Ethereum, and XRP and EUR 1.8 billion in virtual assets were held under custody services by regulated entities. According to Chainalysis, Luxembourg ranks among Europe’s leading countries for cryptocurrency adoption, with over €600 million in virtual asset transactions processed in 2024.

This growth has been driven by Luxembourg’s regulations, especially after the adoption of the Markets in Crypto-Assets Regulation in June 2023, which came into full effect in December 2024. MiCAR has introduced clear compliance requirements, strengthening investor protection and reinforcing market integrity, leading more virtual asset firms to establish operations in Luxembourg. Given this rapid evolution, AIFMs must understand the regulatory framework and apply robust AML/CFT due diligence measures when engaging with virtual assets.

This article explores the Luxembourg regulatory framework for virtual assets, the risk profiles of different asset classes, and the due diligence processes AIFMs should implement to comply with AML/CFT obligations in this fast-growing sector.

The Legal Framework

The provisions of the European Directive 2018/843 (5AMLD) regarding AML/CFT obligations were incorporated into Luxembourg's legal framework through the Law of 12 November 2004, as amended in March 2020. AIFMs investing in virtual assets must ensure compliance with CSSF requirements, as the regulator enforces strict oversight on governance policies, risk management, and AML/CFT obligations, mandating a robust framework for risk assessment and transaction monitoring.
In accordance with CSSF Circular 18/698, AIFMs must conduct initial due diligence before engaging with virtual asset investments, ensuring that counterparties, service providers, and assets comply with regulatory standards. This process must be complemented by periodic due diligence and ongoing monitoring to reassess risk exposure, detect suspicious activities, and ensure continuous compliance with AML/CFT obligations.
A significant development under 5AMLD was the extension of AML/CFT obligations to entities involved in services related to virtual assets, specifically VASPs, such as cryptocurrency exchanges and custodians. Under the revised AML Law, VASPs are classified as "obliged entities" and are required to meet specific compliance standards. These obligations include filing Suspicious Activity Reports, registering with the relevant local authorities, and conducting thorough AML/CFT due diligence on virtual assets and their transactions. MiCAR, adopted in June 2023 and fully effective by December 2024, has further cemented Luxembourg’s role in Europe's virtual asset market. MiCAR, adopted in June 2023 and fully effective by December 2024, has further cemented Luxembourg’s role in Europe's virtual asset market. In this direction, the CSSF has clarified its expectations regarding virtual asset investments, stating that while UCITS cannot have direct or indirect exposure to virtual assets, AIFs can invest in them, provided they comply with specific regulatory requirements and target only qualified investors. I discussed this in detail in my article Between Innovation and Protection: CSSF's Approach to Digital Asset Investments. Greater regulatory clarity has encouraged VASPs to set up in Luxembourg, reinforcing its position as a financial innovation hub.

Types of Virtual Assets and risk profiles

The risk profile of virtual assets can vary significantly based on their characteristics, and understanding these distinctions is critical for AIFMs when assessing their AML/CFT obligations and determining the necessary due diligence. A compliance officer at an AIFM investing in virtual assets must assess both regulatory implications and exposure to money laundering (ML) and terrorist financing (TF) risks.

Pseudonymous assets like Bitcoin pose higher AML/CFT risks because, while transactions are visible on the blockchain, the identities of involved parties remain largely untraceable without further context. This makes Bitcoin particularly attractive for illicit activities. Similarly, Monero, which offers a higher degree of privacy and full anonymity, presents an even greater compliance challenge. These characteristics necessitate enhanced due diligence, including transaction monitoring and the use of blockchain analytics tools to assess whether assets have been involved in high-risk activities, such as fraud, ransomware, or darknet transactions.

Stablecoins, such as Tether (USDT) and USD Coin (USDC), are pegged to fiat currencies, reducing market volatility. However, they still present significant AML/CFT risks. These risks often stem from potential regulatory gaps in their issuance and use, as well as concerns around transparency in the reserve assets backing the stablecoin. For AIFMs investing in stablecoins, it is crucial to assess the governance structures of the stablecoin issuers, conduct enhanced due diligence on counterparty relationships, and evaluate their adherence to applicable AML regulations. Additionally, stablecoins may still be subject to significant price fluctuations, and the regulatory environment surrounding them is evolving, which requires continuous monitoring.

Utility tokens, which are often used within specific ecosystems or platforms for services such as access to products or services, generally carry a lower risk profile compared to more volatile assets like Bitcoin. However, they are not without risk. Depending on the market liquidity, the issuance process (e.g., Initial Coin Offerings or ICOs), and the potential for speculative investment, utility tokens may still pose risks related to fraud or misrepresentation. It is also needed an evaluation of the legitimacy of the platform and the economic utility of the token to ensure that it does not fall under the radar of AML/CFT scrutiny.

Security tokens, which are often aligned with traditional financial instruments like shares or bonds and may grant voting rights or dividends, are typically subject to more regulated frameworks, such as MiFID II. As such, they present a relatively lower risk in terms of AML/CFT compliance compared to cryptocurrencies. However, their regulation is still developing, and for AIFMs, it is vital to ensure that any security token acquisitions comply with local and EU regulations, including investor protection standards, and that appropriate AML procedures are in place. This may involve thorough due diligence on the issuers and operators, as well as a clear understanding of the regulatory environment governing security tokens.

As an AIFM compliance officer, it is crucial to apply a risk-based approach to virtual assets, evaluating each asset’s risk profile based on its characteristics, underlying technologies, market behaviors, and regulatory framework. Due diligence should not only focus on the asset itself but also on the parties involved, such as issuers, intermediaries, and service providers, to ensure full compliance with AML/CFT obligations.

Due Diligence process

Effective AML/CFT compliance in virtual asset investments requires rigorous due diligence on each asset in an AIFM’s portfolio.
To mitigate AML/CFT risks, AIFMs must implement a robust enhanced due diligence framework. This process begins with transaction monitoring and blockchain analytics, utilizing tools such as Chainalysis, Elliptic, or CipherTrace to trace the origins and destinations of funds. These tools help identify whether assets have passed through high-risk wallets, darknet markets, or entities flagged for illicit activities. However, an effective due diligence framework should go beyond simple transaction tracking by incorporating a risk-scoring model. Assigning a risk score to virtual assets and their counterparties allows AIFMs to apply proportionate controls, ensuring that enhanced due diligence measures are only deployed where necessary. Risk factors include an asset’s level of anonymity, volatility, liquidity, regulatory classification, and jurisdictional exposure. This structured approach reduces administrative burdens on lower-risk transactions while focusing compliance resources where the risk of financial crime is higher.

In addition to monitoring transaction flows, AIFMs should leverage advanced blockchain analytics capabilities that extend beyond basic wallet screening. Tools such as Chainalysis Reactor, Elliptic Lens, or TRM Labs provide in-depth transactional mapping, clustering wallet addresses to uncover hidden relationships between counterparties. This is particularly relevant when dealing with pseudonymous assets like Bitcoin, where these tools can reveal whether a transaction has been funneled through mixing services, gambling platforms, or darknet marketplaces. For privacy-enhanced assets such as Monero, blockchain tracing is more challenging due to its obfuscation techniques. However, heuristic analysis and behavioral pattern detection can still provide valuable insights into transaction patterns and counterparties. Combining these advanced analytical methods with conventional KYC and KYT procedures ensures that AIFMs can effectively assess and manage virtual asset-related risks. By integrating a structured risk-based assessment with cutting-edge blockchain analytics, AIFMs can enhance their due diligence processes, reducing exposure to financial crime while maintaining compliance with Luxembourg’s evolving AML/CFT regulatory framework.

The due diligence process for virtual assets begins with AML risk scoring, which involves evaluating each asset through a risk-based approach (RBA). This assessment considers key factors such as volatility, liquidity, anonymity, and security features to determine the potential financial crime risks associated with the asset. Based on this evaluation, AIFMs assign a risk score to each virtual asset, defining the level of scrutiny required for transactions involving that asset. Higher-risk assets, particularly those with strong anonymity features or high market volatility, necessitate enhanced monitoring and additional compliance measures.

Another critical component is the Know Your Customer process, which ensures the legitimacy of all parties involved in a transaction. This step involves verifying the identities of buyers, sellers, issuers, and intermediaries while screening them against watchlists for politically exposed persons (PEPs) or individuals linked to financial crimes. By implementing thorough KYC procedures, AIFMs can mitigate the risk of engaging with entities involved in illicit activities and strengthen their compliance with AML regulations.

To further enhance due diligence, AIFMs should employ blockchain investigation tools to monitor transactions and trace the movement of funds. Platforms such as Chainalysis, Elliptic, and Coinfirm provide fund managers with the ability to analyze transaction histories, identify suspicious activity, and determine whether assets have been associated with illicit activities such as fraud, ransomware, or money laundering. These tools play a crucial role in detecting and mitigating risks within virtual asset portfolios. Transactions involving un-hosted wallets, where the counterparty controls their own private keys, also pose unique challenges, as these wallets are harder to trace. In such cases, the AIFM must collect detailed information about the counterparty, perform transaction monitoring, and apply enhanced risk controls.

Additionally, the compliance officer should verify the wallet ownership to ensure the legitimacy of counterparties. AIFMs must implement proof-of-ownership measures by requiring the counterparty to sign a cryptographic message with their private key or conduct a small test transaction to confirm control over the wallet. These verification methods help prevent fraudulent claims of ownership and reduce the risk of dealing with illicitly obtained assets. By integrating these due diligence measures, AIFMs can establish a robust framework for assessing virtual asset risks while ensuring compliance with Luxembourg’s AML/CFT regulatory requirements.

Ongoing Monitoring and Reporting

Due diligence doesn’t end once an initial investigation is completed. Ongoing monitoring is important to detect any changes in risk exposure and to ensure that transactions involving virtual assets remain fully compliant with AML/CFT regulations. AIFMs must implement real-time surveillance mechanisms to identify unusual patterns, assess counterparty behaviors, and flag any activities that may indicate potential financial crime risks. A proactive approach helps detect red flags like rapid fund transfers, large transactions in high-risk jurisdictions, or repeated interactions with illicit wallets.

In cases where a transaction is identified as suspicious, the AIFM has a regulatory duty to file a Suspicious Activity Report (SAR) with the relevant authorities, such as the CSSF. The SAR must provide details on the nature of the transaction, the involved parties, and any supporting evidence that suggests potential money laundering, terrorist financing, or other illicit activities. This reporting process is a critical safeguard in preventing the misuse of virtual assets for financial crimes, enabling regulatory bodies to conduct further investigations and take appropriate enforcement actions. Failure to comply with these reporting obligations could result in regulatory penalties and reputational risks for the AIFM, reinforcing the need for robust monitoring and a clear escalation framework for handling suspicious transactions

Conclusion

The process of conducting AML/CFT due diligence in virtual asset investments is complex and evolving, but it is crucial for ensuring compliance with both local and international regulations. AIFMs can mitigate virtual asset risks by adopting a robust due diligence framework, incorporating risk scoring, KYC, blockchain analysis, and continuous monitoring. Additionally, they must remain proactive in adapting to new regulations, such as the MiCA framework, which will further shape the regulatory environment for virtual assets in Europe.

As virtual assets continue to become a larger part of investment portfolios, AIFMs must maintain vigilance in monitoring these assets to ensure the integrity of their operations and protect against financial crimes.

If you arrived until here, it means that you potentially enjoyed this article. I personally thank you and I invite you to subscribe to the newsletter. Also, feel free to get in contact and suggest any particular topic for the next release.

The views and opinions expressed in this article are my own and do not reflect the official policy, position, or opinions of any financial institution, or other organization.
The content of this article is based on personal research of the author and understanding of AML (Anti-Money Laundering) and compliance topics.