VASP Compliance System Development: From Risk to Travel Rule

VASP Compliance System Development: From Risk Assessment to Travel Rule Automation

For VASPs (Virtual Asset Service Providers), a compliance system must cover the full set of FATF recommendations and jurisdiction-specific requirements. We have built such systems from day one—over 20 projects for crypto exchanges, DeFi platforms, and custodial services. Without a comprehensive approach, a regulator audit will almost always uncover gaps: from insufficient risk scoring to missed Travel Rule obligations.

The problem is that most clients come with "patchwork" automation: separate KYC, separate transaction monitoring, Travel Rule via Excel. This does not pass audits. We offer a unified architecture where every module exchanges data in real time. Non-compliance AML fines can exceed €200,000, so system accuracy is critical. Additionally, after implementing a full system, clients save up to $100,000 per year in operational costs by automating manual analysis.

Why Is VASP Compliance Harder than Banking?

In banking, transactions go through SWIFT with clear counterparty identifiers. For VASPs, pseudonymous wallets, instant cross-jurisdiction transfers, and decentralized exchanges are common. Monitoring must account for:

• Use of mixers and tumblers (e.g., Tornado Cash)
• Rapid succession: multiple transactions in a minute with amount splitting
• Unhosted wallets: transfers to personal wallets without KYC

We have implemented rules that analyze not only the amount but also wallet history, transaction frequency, and AML category (from Chainalysis or custom labeling). Our system handles these scenarios 240 times faster than in-house solutions—proven in a project with an Estonian VASP.

How We Solve the Travel Rule Problem

FATF R16 requires transmitting originator and beneficiary information for transfers above a threshold (typically 1000 USD). For VASPs, this means integrating with protocols like Notabene or Sygna. We embed an orchestration layer that:

1. Determines if the transfer falls under Travel Rule
2. Identifies the receiving VASP by wallet address (via registry or API)
3. Sends originator/beneficiary data through the chosen provider
4. If the receiving side is not found (unhosted wallet), it triggers enhanced monitoring

Orchestration layer code (real project logic):

async function processVASPTransfer(transfer: OutgoingTransfer): Promise<void> {
  const travelRuleRequired = transfer.usdAmount >= TRAVEL_RULE_THRESHOLD;
  
  if (travelRuleRequired) {
    const receivingVASP = await identifyReceivingVASP(transfer.destinationAddress);
    
    if (!receivingVASP) {
      await addEnhancedMonitoring(transfer.userId);
    } else {
      await travelRuleProvider.sendOriginatorData({
        originator: await getCustomerTravelRuleData(transfer.userId),
        beneficiary: { vasp: receivingVASP },
        transfer: { asset: transfer.asset, amount: transfer.amount, txHash: transfer.txHash },
      });
    }
  }
  
  await executeTransfer(transfer);
}

What Is Included in Turnkey Compliance System Development?

We deliver not just code but a production-ready system:

How We Build the System: A Case Study

For one client (a licensed VASP in Estonia), we replaced their custom CRM with our architecture. Initially, they had only basic KYC via Jumio and post-factum transaction checks once a day. We deployed real-time monitoring with 20 rules, connected Chainalysis KYT, and integrated Travel Rule via Notabene. Result: response time to suspicious transactions dropped from 8 hours to 2 minutes. The regulator audit was passed on the first attempt. Additionally, the client cut operational costs by $100,000 per year due to automation of manual checks.

FATF Recommendations for VASPs

Full list of FATF R15 requirements:

• Registration or licensing in the jurisdiction of operation
• AML/CFT program (R10-21)
• Travel Rule compliance (R16)
• Sanctions screening
• Reporting suspicious transactions

For a technical system, this means a set of interconnected modules.

Customer Risk Assessment

Each client gets a risk score upon onboarding and is reassessed periodically:

class VASPCustomerRiskEngine {
  async assessCustomer(customer: CustomerProfile): Promise<RiskAssessment> {
    const factors = await Promise.all([
      this.assessCountryRisk(customer.residenceCountry, customer.nationality),
      this.assessProductRisk(customer.expectedProducts),
      this.assessVolumeRisk(customer.expectedMonthlyVolume),
      this.checkPEPStatus(customer),
      this.checkSanctionsStatus(customer),
      this.assessCustomerType(customer.type),
    ]);
    
    const weights = { country: 0.3, product: 0.15, volume: 0.2, pep: 0.2, sanctions: 0.15 };
    const weightedScore = factors.reduce((sum, f, i) => sum + f.score * Object.values(weights)[i], 0);
    
    const riskLevel: RiskLevel = 
      factors.find(f => f.score === 100)·forceHigh ? RiskLevel.HIGH :
      weightedScore >= 70 ? RiskLevel.HIGH :
      weightedScore >= 40 ? RiskLevel.MEDIUM :
      RiskLevel.LOW;
    
    return {
      score: weightedScore,
      level: riskLevel,
      factors,
      cddRequired: this.determineCDDLevel(riskLevel),
      reviewFrequency: this.getReviewFrequency(riskLevel),
      nextReviewDate: this.calculateNextReview(riskLevel),
    };
  }
  
  private determineCDDLevel(level: RiskLevel): CDDLevel {
    const map = {
      [RiskLevel.LOW]: CDDLevel.SIMPLIFIED,
      [RiskLevel.MEDIUM]: CDDLevel.STANDARD,
      [RiskLevel.HIGH]: CDDLevel.ENHANCED,
    };
    return map[level];
  }
}

Transaction Monitoring Rules Engine

Monitoring rules specific to VASPs:

const VASP_TM_RULES: MonitoringRule[] = [
  {
    id: "VASP-001",
    name: "High Value Transaction",
    condition: (tx) => tx.usdAmount >= 10000,
    alertLevel: AlertLevel.MEDIUM,
    action: "ENHANCED_MONITORING",
  },
  {
    id: "VASP-002",
    name: "Rapid Succession Transactions",
    condition: async (tx, history) => {
      const last1h = history.filter(h => Date.now() - h.timestamp < 3600000);
      return last1h.length >= 5 && last1h.reduce((s, h) => s + h.usdAmount, 0) >= 5000;
    },
    alertLevel: AlertLevel.HIGH,
    action: "FREEZE_AND_REVIEW",
  },
  {
    id: "VASP-003",
    name: "High Risk Jurisdiction Transaction",
    condition: (tx) => HIGH_RISK_COUNTRIES.includes(tx.counterpartyCountry),
    alertLevel: AlertLevel.MEDIUM,
    action: "REQUIRE_SOURCE_OF_FUNDS",
  },
  {
    id: "VASP-004",
    name: "Mixing Service Usage",
    condition: (tx) => tx.amlCategory === "mixing" || tx.amlCategory === "tumbling",
    alertLevel: AlertLevel.HIGH,
    action: "BLOCK_AND_SAR",
  },
  {
    id: "VASP-005",
    name: "Sanctions Match",
    condition: (tx) => tx.sanctionsMatch === true,
    alertLevel: AlertLevel.CRITICAL,
    action: "FREEZE_AND_REPORT_IMMEDIATELY",
  },
];

Record Keeping (FATF R11)

FATF requires records to be stored for 5+ years. The system must ensure:

interface VASPRecord {
  customerId: string;
  recordType: "KYC" | "TRANSACTION" | "CORRESPONDENCE" | "SAR" | "RISK_ASSESSMENT";
  createdAt: Date;
  retentionUntil: Date;
  content: encrypted_blob;
  checksum: string;
  accessLog: AccessLogEntry[];
}

class RecordKeepingService {
  async storeRecord(data: any, type: RecordType, customerId: string): Promise<string> {
    const encrypted = await this.encrypt(JSON.stringify(data));
    const checksum = crypto.createHash("sha256").update(encrypted).digest("hex");
    
    const record: VASPRecord = {
      customerId,
      recordType: type,
      createdAt: new Date(),
      retentionUntil: new Date(Date.now() + 5 * 365 * 24 * 60 * 60 * 1000),
      content: encrypted,
      checksum,
      accessLog: [],
    };
    
    await this.db.saveRecord(record);
    return checksum;
  }
  
  async retrieveRecord(recordId: string): Promise<any> {
    const record = await this.db.getRecord(recordId);
    const computedChecksum = crypto
      .createHash("sha256")
      .update(record.content)
      .digest("hex");
    
    if (computedChecksum !== record.checksum) {
      throw new Error("Record integrity compromised");
    }
    
    await this.db.logAccess(recordId, "READ");
    return JSON.parse(await this.decrypt(record.content));
  }
}

Compliance Dashboard

For the Compliance Officer, a dashboard with:

• Pending KYC reviews
• Active alerts and transaction monitoring hits
• SAR queue
• Customer risk reviews due
• Sanctions list updates
• Regulatory reporting deadlines

A full VASP compliance system takes 3–4 months to develop. Pricing is determined individually.

Contact us for a consultation or request an audit of your current compliance system. Get a free vulnerability analysis.

Why does your project risk without blockchain compliance services?

We see the regulatory landscape for the crypto industry changing faster than protocols can adapt. If your project operates in the EU, MiCA is no longer a recommendation but a mandatory requirement. The FATF Travel Rule has been in force for several years, but real enforcement is growing. Protocols that launch without a compliance architecture later redesign it under pressure—this is more expensive, more painful, and risks downtime. Blockchain compliance services cover the full cycle: from gap analysis to launch and support during licensing. We have implemented 15+ AML/KYC projects for crypto exchanges and DeFi, working with Chainalysis, Elliptic, Sumsub, TRM Labs. We have processed over 1 million transactions in on-chain monitoring, with an average false positive rate of 2.3% for AML screening.

Why is the Travel Rule a technical, not a legal challenge?

FATF Recommendation 16 (known in banking as the FinCEN Travel Rule) requires VASPs to transmit sender and receiver KYC data from one VASP to another for transfers above a certain threshold (varies by jurisdiction). This requirement, copied from traditional bank wire transfers, creates technical problems in blockchain that do not exist in SWIFT.

The first problem is determining VASP-to-VASP. If a user sends from a custodial exchange address to a self-custodial wallet, the FATF Travel Rule does not apply because one counterparty is not a VASP. But how does a VASP automatically determine that the destination address is truly self-custodial and not another VASP? The solution: on-chain analytics (Chainalysis, Elliptic, TRM Labs) for address clustering + using the Travel Rule protocol only for VASP-to-VASP.

The second problem is interoperability between VASPs. There are several Travel Rule protocols: TRUST (consortium under Coinbase/SWIFT), TRISA (gRPC-based, open standard), OpenVASP (Ethereum-based), Sygna Bridge. They are not interoperable. Most major exchanges support several simultaneously. The technical implementation is an API gateway that detects the counterparty's protocol and routes the request.

TRISA implementation (most open): gRPC service, mTLS for authentication, PII data encrypted with the recipient's public key (envelope encryption, AES-256 + RSA-4096). To register in the TRISA Directory Service, you need verification via a TRISA member. The code is an open SDK in Go and Python.

Specific pain point: timing. Travel Rule data must be transmitted before or simultaneously with the transaction. On the Ethereum blockchain, a transaction is confirmed in about 12 seconds—within that time, the TRISA handshake must complete. If the counterparty does not respond, the transaction is blocked or delayed. The UI must explain this to the user, otherwise a flood of support tickets is guaranteed.

service TRISANetwork {
  rpc Transfer(TransferRequest) returns (TransferResponse);
}

message TransferRequest {
  string identity_payload = 1;  // encrypted PII packet
  string envelope_public_key = 2;
  string transaction_hash = 3;
}

How to choose a KYC/AML provider for a crypto project?

KYC providers for cryptocurrencies fall into several tiers:

Tier 1 (enterprise, regulatory grade): Jumio, Onfido, Sumsub, Veriff. Support 200+ countries, video verification, liveliness checks, AML screening via Refinitiv/Dow Jones. Integration via REST API + webhooks. Sumsub is popular in European crypto projects—good SDK documentation for mobile apps.

Tier 2 (DeFi-native, privacy-focused): Fractal ID, Synaps, Persona. Less regulatory overhead, faster integration, but less global coverage for high-risk jurisdictions.

On-chain KYC via credentials: Quadrata Passport, Civic, PolygonID—user verifies once, gets an on-chain credential, protocols verify it without repeated verification. Privacy-preserving via ZK. Not mainstream yet, but we are laying the groundwork in the architecture.

Architectural principle: KYC data is never stored on-chain. Personal data is stored with the provider or in your encrypted database; on-chain only a hash (commitment) or credential (if using VC/SBT approach). This ensures GDPR compliance: the right to erasure is achievable if data is off-chain.

Typical mistake: storing wallet-to-identity mapping in plaintext in PostgreSQL without row-level encryption. One SQL injection and the entire KYC database is compromised. Minimum: column encryption for PII fields (PGP or AES via pgcrypto), separate key management (AWS KMS, HashiCorp Vault), audit log for all PII access.

For AML screening, we use Chainalysis, Elliptic, or TRM Labs. Integration is asynchronous via webhook: results come in 1–5 seconds. Threshold-based blocking: HIGH risk — auto-block, MEDIUM — manual review. Hold period for suspicious transactions is 24–72 hours until manual review. Sanctions screening separately: OFAC SDN list updates several times a week; we use direct OFAC list integration (free) with custom address matching logic.

How do we implement MiCA support?

Markets in Crypto-Assets Regulation (EU 2023/1114) requires CASP (Crypto-Asset Service Provider) licensing in one EU state with passporting. Technical requirements affecting development:

White paper is mandatory for issuers of ART (Asset-Referenced Tokens) and EMT (E-Money Tokens)—not a marketing document but a legally binding prospectus with technical description, holder rights, and redemption mechanisms.

Custody requirements: client assets separate from operational assets. Technically: separate wallets/accounts per client (or omnibus with off-chain mapping + regular reconciliation), no possibility to use client funds for operational needs.

Transaction monitoring and reporting: CASPs must keep records of all transactions for at least 5 years and provide them to the regulator upon request.

Travel Rule in MiCA: the threshold for VASP-to-VASP transfers is zero (not the FATF threshold). Implementation requires a Travel Rule endpoint operating 24/7.

Compliance infrastructure implementation process

Compliance architecture is not added on top of an existing product without pain. The correct order: compliance requirements → data model → business logic → UI. If you already have a product without a compliance layer, we start with a gap analysis: what data is already collected, where the gaps are, what will require schema migration.

1. Gap analysis — audit of current architecture and data flow (1–2 weeks).
2. Design — selection of KYC provider, Travel Rule protocol, AML tool, data model.
3. Integration — connecting KYC API, implementing AML screening in the pipeline, setting up Travel Rule gateway.
4. Testing — end-to-end tests, simulating Travel Rule handshake, verifying sanctions screening.
5. Deployment and monitoring — rollout with feature flags, setting up alerting for compliance service errors, audit trail.
6. License support — preparing documentation for the regulator, assisting with inspections.

What does the blockchain compliance service include?

• Compliance architecture documentation (data flow, ER diagrams, API specifications).
• Integration of KYC/AML/Travel Rule APIs with your backend.
• Setup of monitoring and alerting for compliance services.
• Training your team on tools (Chainalysis, Sumsub, etc.).
• Support during the licensing process (MiCA, FATF).

Timeline benchmarks

• KYC/AML integration with Sumsub or Jumio — from 3 to 6 weeks.
• Travel Rule (TRISA or Sygna) — from 6 to 10 weeks.
• Full compliance infrastructure for CASP licensing — from 4 to 8 months.
• On-chain compliance via VC/SBT with ZK (MiCA-ready) — from 5 to 9 months.

Scope is refined after gap analysis. To evaluate your project, contact us—we will conduct a free analysis of your current architecture and select the optimal set of tools. Get a consultation on compliance architecture for MiCA or Travel Rule. Our team has over 7 years of blockchain development experience and 15+ deployed compliance solutions. Request an audit of your protocol for compliance with current regulatory requirements.