AML for Virtual Assets and Cryptocurrency Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends AML Compliance Managers, Financial Crime Investigators and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-FFC-002

Before you join: Participants should understand core AML concepts, including customer due diligence, beneficial ownership, transaction monitoring, suspicious activity reporting and sanctions screening.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Virtual assets create new routes for laundering proceeds, sanctions evasion, fraud proceeds movement and rapid cross-border value transfer. Financial institutions, exchanges, payment firms and investigative teams must assess wallet activity, establish customer and beneficial-owner information, identify suspicious blockchain patterns, and make defensible reporting decisions. The challenge is to apply established AML controls where transactions are pseudonymous, counterparties may be unregulated, and funds can move through mixers, bridges, decentralised protocols and multiple asset types.

This course develops the working methods needed to manage virtual-asset financial-crime risk. Participants examine virtual-asset service provider models, FATF Recommendation 15, risk assessment methods, cryptoasset customer due diligence, wallet ownership evidence, transaction monitoring scenarios, blockchain tracing, sanctions screening, Travel Rule controls, investigations and suspicious activity reporting. They learn to interpret transaction graphs, distinguish exposure from attribution, document analytical confidence, and connect blockchain evidence with customer records and case narratives.

Instruction combines focused briefings with realistic cases involving exchange accounts, ransomware payments, pig-butchering scams, sanctioned wallet exposure, self-hosted wallets and cross-chain transfers. Participants work through risk assessments, alert triage, transaction tracing and investigation decisions with instructor feedback. They leave with a practical virtual-asset AML control pack containing reusable assessment, monitoring, investigation and implementation materials, plus a certificate of completion.

The course is suited to professionals who already work in AML, compliance, fraud, investigations, sanctions, audit, risk or virtual-asset operations and need to apply those disciplines to cryptocurrency activity.

What you will be able to do

  • Assess virtual-asset money-laundering risk using FATF-aligned risk assessment criteria
  • Apply cryptoasset customer due diligence and wallet ownership verification methods
  • Design transaction monitoring scenarios for common virtual-asset laundering typologies
  • Trace blockchain transaction flows using transaction graphs, clustering and exposure analysis
  • Evaluate wallet sanctions exposure and document blocking, rejection and escalation decisions
  • Implement Travel Rule controls for VASP counterparties, self-hosted wallets and data exceptions
  • Prepare evidence-based virtual-asset investigation files and suspicious activity narratives
  • Produce a prioritised virtual-asset AML control improvement plan

Benefits of attending

For you

  • Apply AML judgement to cryptocurrency transactions, wallets and counterparties
  • Interpret blockchain tracing results without overstating attribution confidence
  • Write clearer escalation records and suspicious activity narratives involving cryptoassets
  • Assess Travel Rule and sanctions control gaps in virtual-asset operations
  • Build a documented plan for improving virtual-asset AML procedures

For your organisation

  • More consistent risk decisions for virtual-asset customers, products and transactions
  • Earlier identification of ransomware, scam, mixer and sanctions-evasion indicators
  • Better documented investigation files linking blockchain evidence to customer activity
  • Stronger Travel Rule, wallet-screening and counterparty due-diligence controls
  • Clearer ownership and testing evidence for virtual-asset AML governance

Course modules

10 modules over 5 days

Participants can explain how virtual-asset products, wallets and transaction flows create distinct AML exposure.

  • Bitcoin, Ethereum, stablecoins and privacy coins mapped to AML exposure
  • Blockchain consensus, wallets, keys and transaction finality explained for investigators
  • Custodial, self-hosted and smart-contract wallets distinguished through control of keys
  • VASP business models assessed: exchanges, brokers, issuers, mixers and DeFi protocols
  • Fiat on-ramps, off-ramps and peer-to-peer transfers traced through payment flows
  • Illicit finance typologies linked to ransomware, scams, darknet markets and fraud

Participants can produce a risk-based assessment of virtual-asset customers, products, services and transaction exposure.

  • FATF Recommendation 15 obligations translated into virtual-asset risk assessment criteria
  • Customer, product, geography, channel and transaction risks scored using matrices
  • Inherent and residual risk ratings documented with control effectiveness evidence
  • DeFi, mixers and privacy-enhancing coins assessed using typology-led indicators
  • Risk appetite thresholds defined for prohibited, restricted and accepted relationships
  • Annual risk-assessment refreshes triggered by products, events and intelligence changes

Participants can apply CDD, enhanced due diligence and wallet verification methods to virtual-asset relationships.

  • Customer identification requirements applied to individuals, entities and beneficial owners
  • Source-of-funds and source-of-wealth checks tailored to cryptoasset activity
  • Wallet ownership evidence evaluated through signed messages, deposits and challenge transfers
  • Enhanced due diligence triggered by high-risk jurisdictions, PEPs and anonymity features
  • Beneficial ownership discrepancies escalated using documentary, registry and blockchain evidence
  • Customer risk profiles updated from adverse media, behaviour and transaction data

Participants can create and tune monitoring scenarios for suspicious virtual-asset transaction activity.

  • Transaction monitoring scenarios built around velocity, structuring and rapid movement
  • Behavioural baselines separate expected wallet activity from anomalous transaction patterns
  • Alert thresholds calibrated using customer risk, asset type and exposure
  • Red-flag indicators identify layering, chain-hopping, dusting and mule-wallet activity
  • Scenario tuning uses alert outcomes, false positives and investigator feedback
  • Case prioritisation combines risk scores, monetary value and sanctions proximity

Participants can trace transaction flows and document findings, limitations and attribution confidence.

  • UTXO and account-based blockchains compared for tracing and attribution methods
  • Transaction graphs constructed from addresses, entities, hops and temporal patterns
  • Clustering heuristics tested against common-input ownership and change-address assumptions
  • Exposure analysis measures direct, indirect and counterparty links to illicit wallets
  • Attribution confidence recorded with source reliability, corroboration and analytical limitations
  • Chain-hopping paths reconstructed across bridges, swaps, exchanges and stablecoins

Participants can assess virtual-asset sanctions exposure and apply proportionate escalation actions.

  • OFAC virtual-currency guidance applied to screening and blocking decisions
  • Sanctions exposure distinguished between direct ownership, indirect exposure and facilitation
  • Wallet screening controls evaluated for list coverage, timeliness and matching logic
  • Jurisdictional nexus assessed through counterparties, IP data and payment routes
  • Freezing, rejection and reporting actions aligned with legal escalation procedures
  • Sanctions evasion typologies include mixers, proxies, bridges and nested services

Participants can establish Travel Rule processes and evaluate virtual-asset service provider counterparties.

  • FATF Travel Rule data elements mapped to originator and beneficiary records
  • Sunrise issues assessed when counterparties operate under different implementation timelines
  • Counterparty due diligence covers VASP licensing, ownership, controls and reputation
  • Travel Rule messaging exceptions documented for self-hosted wallets and unhosted transfers
  • Interoperability models compared: direct APIs, consortia networks and secure messaging
  • Transfer holds and escalation decisions governed by data-quality and risk rules

Participants can manage cryptoasset alerts from triage through evidence preservation and suspicious activity reporting.

  • Alert triage follows documented disposition codes, evidence standards and service levels
  • Case narratives connect blockchain findings, customer records and suspicion rationale
  • Suspicious activity reports distinguish facts, inferences, amounts, dates and identifiers
  • Evidence preservation maintains transaction hashes, screenshots, tool outputs and audit trails
  • Law-enforcement requests managed through lawful disclosure, preservation and confidentiality protocols
  • Post-case feedback improves scenarios, customer reviews and control documentation

Participants can define governance, testing and reporting arrangements for virtual-asset AML controls.

  • Three-lines model assigns ownership across operations, compliance, audit and boards
  • Policies define asset coverage, prohibited activity, escalation and record retention
  • Control testing samples onboarding files, alerts, Travel Rule records and cases
  • Management information reports exposure, alert ageing, filings and remediation status
  • Outsourced analytics providers governed through due diligence, validation and oversight
  • Audit trails demonstrate decisions, approvals, exceptions and model-change governance

Participants can prioritise practical control improvements and set an implementation plan for their organisation.

  • Control gaps prioritised using likelihood, impact, ownership and target dates
  • Virtual-asset AML operating model aligns onboarding, monitoring, investigations and reporting
  • Minimum viable procedures drafted for wallet screening, escalation and recordkeeping
  • Implementation milestones sequence policy changes, vendor decisions, testing and training
  • Key risk indicators set thresholds for exposure, alerts, ageing and exceptions
  • Personal application plans specify first actions, stakeholders, evidence and deadlines

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Virtual-asset AML risk assessment template
  2. Cryptoasset customer due-diligence checklist
  3. Wallet transaction monitoring scenario library
  4. Blockchain tracing and attribution worksheet
  5. Travel Rule counterparty assessment model
  6. Virtual-asset AML implementation plan

Who should attend

  • AML Compliance Managers — need controls for virtual-asset products, customers and transactions
  • Financial Crime Investigators — need to connect blockchain evidence with customer and case records
  • MLROs and Deputy MLROs — need defensible escalation and reporting decisions
  • Sanctions Compliance Officers — need to assess wallet exposure and evasion indicators
  • Cryptoasset Exchange Compliance Staff — need operational CDD, monitoring and Travel Rule procedures
  • Internal Auditors and Risk Managers — need to test virtual-asset AML governance and controls

Skills and tools covered

Cryptoasset risk assessmentWallet due diligenceBlockchain transaction tracingSanctions exposure analysisTravel Rule complianceSuspicious activity reporting

Tools and standards

FATF Recommendation 15, FATF Travel Rule, OFAC Sanctions List Search, Chainalysis Reactor

How the course runs

Training methodology

The instructor uses short technical briefings to establish key concepts, followed by guided case work based on exchange activity, scam proceeds, ransomware payments, mixers, cross-chain transfers and sanctioned wallet exposure. Small-group analysis applies risk scoring, customer due diligence, alert triage, blockchain tracing and reporting methods. Simulations test decisions on escalations, transaction holds and evidence quality. Participants complete application planning using their own control environment, with instructor feedback on practical priorities and documentation.

Requirements and prerequisites

Participants should understand core AML concepts, including customer due diligence, beneficial ownership, transaction monitoring, suspicious activity reporting and sanctions screening. Experience in compliance, investigations, fraud, payments, banking, fintech or cryptoasset operations is expected. Familiarity with wallets, exchanges and blockchain transactions is helpful but not essential; these concepts are introduced before analytical work begins. No coding, cryptography, blockchain development, data-science qualification or prior use of blockchain analytics software is required. The course is not an introductory AML programme.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should already understand the fundamentals of AML, including CDD, transaction monitoring and suspicious activity reporting. Prior cryptocurrency experience is useful but not required; the course introduces the relevant blockchain, wallet and transaction concepts.

Bring a laptop for live online delivery and, if permitted by your employer, examples of your current virtual-asset policies, risk questions or control gaps. No specialist software licence, coding tool or blockchain wallet is required.

It is designed for intermediate AML, financial-crime, sanctions, fraud, investigations, audit, risk and cryptoasset operations professionals. It is particularly relevant to staff supporting banks, payment firms, exchanges, fintechs and supervisory bodies.

General AML courses focus on standard financial-crime controls, while technical blockchain courses focus on architecture or development. This course applies AML, sanctions, investigation and reporting methods specifically to virtual assets and cryptocurrency transaction evidence.

Participants can use the templates to assess virtual-asset risk, review wallet-screening arrangements, tune monitoring scenarios and improve investigation records. The final application plan identifies actions, accountable stakeholders and evidence needed for implementation.

Training runs from 08:30 to 16:30 each day, providing approximately 6.5 contact hours daily. The five days progress from virtual-asset fundamentals and risk assessment through CDD, monitoring, tracing, sanctions, Travel Rule, investigations, governance and implementation planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Fraud & Financial Crime