Course

Regulation, Compliance & Forensics

How the rules reach crypto: KYC, AML and securities law, how transactions get traced, privacy coins and mixers, and central bank digital currencies.

Intermediate4 units · 21 lessons~44 min

Certificate

Not earned yet · 0 of 4 unit checks passed

Regulated crypto firms must do KYC, AML, and CFT; the FATF Travel Rule requires passing sender/beneficiary info with transfers.
Sanctions (OFAC) screening applies even to self-custody users — interacting with sanctioned addresses can be illegal.
The Howey test decides if a token is a US security (investment in a common enterprise expecting profit from others’ efforts).
Bitcoin/Ether are treated as commodities (CFTC); spot and futures ETFs give traditional investors exposure.
MiCA is the EU’s comprehensive framework; qualified custodians affect segregation and bankruptcy treatment.
Stablecoin reserve attestations support the peg; tax/record-keeping is required in most jurisdictions. This is educational, not legal advice.

Crypto is pseudonymous, not anonymous: every transaction is on a public ledger forever.
UTXO chains (Bitcoin) trace via transaction graph + common-input heuristic; account chains (Ethereum) trace via account activity graphs.
De-anonymization comes from off-chain linkage: exchange KYC, IP/timing metadata, reused addresses, dusting, and known-wallet attribution.
Privacy tools (CoinJoin, mixers, Zcash/Monero) raise the cost of tracing but are not perfect and increasingly attract legal attention (Tornado Cash was sanctioned in 2022 and delisted in March 2025 after a November 2024 court ruling; Blender.io remains sanctioned).
Chain-analysis firms (Chainalysis, TRM Labs, Elliptic, Ciphertrace) build attribution datasets that exchanges, banks, and law enforcement use for AML/sanctions screening.
For professionals: assume on-chain activity is observable, maintain clear records, and screen counterparty addresses — sanctioned-address interaction can be illegal.

Bitcoin and Ethereum are pseudonymous, not anonymous: every transaction is public and linkable to an address, which KYC ties to a real identity at the on/off-ramp.
Privacy coins (Monero, Zcash) hide sender, recipient, and/or amount at the protocol level using ring signatures, stealth addresses, or zk-SNARKs.
CoinJoin and mixers break common-input-ownership heuristics at the transaction level — but mixers that re-consolidate funds at a KYC’d exchange still leave a traceable off-ramp.
Regulators have responded to privacy tech with sanctions (Tornado Cash, 2022), exchange delistings of privacy coins, and Travel Rule obligations on VASPs.
The March 2025 Tornado Cash delisting (after a November 2024 court ruled immutable contracts aren’t "property" under IEEPA) is a landmark on the limits of crypto sanctions — but mixer use still carries compliance risk.
The privacy-vs-tracing debate is a policy choice, not purely a technical one. This is educational, not legal advice.

A CBDC is a digital form of a sovereign currency issued and controlled by the central bank — distinct from crypto (decentralized) and stablecoins (private).
Retail CBDCs serve households/businesses; wholesale CBDCs serve institutions for settlement. Most designs use a permissioned ledger, not a public chain.
Motivations include payment modernization, financial inclusion, and offering a public alternative to private stablecoins and foreign payment rails.
The e-CNY (China) is the largest live deployment; India e-Rupee, Nigeria eNaira, and the Bahamas Sand Dollar are also live; the digital euro is moving toward possible issuance around 2029.
Privacy is the defining tension: a centrally issued, centrally recorded currency is traceable by design, raising surveillance and programmability concerns.
Cross-border CBDC interoperability (e.g. BIS Project mBridge) is an active frontier with geopolitical implications. This is educational, not financial or legal advice.