Digital Assets & Crypto
Emerging frameworks for blockchain, DeFi, and digital currencies
Digital asset platforms operate in a rapidly evolving regulatory landscape spanning securities, banking, and money transmission requirements. Thalorin helps digital asset companies navigate emerging frameworks while maintaining security controls appropriate for high-value digital systems.
Digital asset businesses face a compliance surface assembled from regimes that were not designed for them. Money transmission licensing is state-by-state, with New York's BitLicense the most demanding and most imitated. FinCEN treats many digital asset businesses as money services businesses, bringing Bank Secrecy Act obligations including anti-money-laundering programmes, suspicious activity reporting, and the funds Travel Rule.
The Travel Rule is where the technical and regulatory problems meet. Transmitting required originator and beneficiary information alongside qualifying transfers is straightforward in correspondent banking and genuinely hard across heterogeneous blockchain infrastructure and counterparties with different systems, which is why interoperable solutions emerged from industry rather than from regulation.
Custody carries its own weight. Institutional counterparties expect demonstrable key management, segregation of customer assets, and increasingly proof-of-reserves attestations — and they expect a SOC 2 Type II report as table stakes rather than as a differentiator.
Thalorin holds custody, AML, and information security controls as one state, so an examiner question, a counterparty diligence request, and a SOC 2 sample can be answered from the same evidence rather than three parallel efforts.
Financial institutions operate under intense scrutiny
Fifty licensing regimes, not one
Money transmission is licensed state by state with divergent requirements, and New York's BitLicense adds obligations most states do not. National coverage means maintaining a matrix of conditions, reports, and examination cycles.
Travel Rule across incompatible counterparties
Transmitting required originator and beneficiary data for qualifying transfers depends on counterparties using compatible systems. Compliance is partly a function of who you transact with.
Custody evidence beyond policy
Institutional counterparties want demonstrated key management, asset segregation, and often proof of reserves. Policy documents do not satisfy diligence at this level.
Regimes designed for something else
BSA, state money transmission, and securities regimes were written for intermediated finance. Applying them to on-chain settlement produces genuine interpretive ambiguity that compliance programmes have to resolve and document.
How Thalorin helps
Multi-jurisdictional compliance tracking
Track state money transmission licensing obligations, including BitLicense conditions, as a jurisdictional matrix.
Custody security controls
Maintain BSA/AML programme evidence including suspicious activity reporting and Travel Rule compliance.
Smart contract security documentation
Evidence key management and custody controls in the form institutional diligence actually asks for.
Key management compliance
Support SOC 2 Type II examination from the same control state rather than a separate readiness exercise.
Regulatory change monitoring
Carry sanctions screening obligations against on-chain and off-chain counterparties.
Blockchain audit support
Document interpretive positions where regimes designed for intermediated finance are applied to on-chain activity.
Digital Assets & Crypto: common questions
Do we need money transmitter licences in every state?
It depends on the activity and the state, and the analysis is genuinely state-specific — some states exempt certain digital asset activity, others regulate it explicitly, and New York requires a BitLicense for virtual currency business activity. Firms operating nationally generally maintain a licensing matrix rather than a single answer, and treat it as an ongoing obligation because state law changes.
What is the Travel Rule and how does it apply?
It requires transmitting specified originator and beneficiary information alongside qualifying funds transfers. For digital assets the obligation is conceptually simple and operationally hard, because it depends on counterparty institutions being able to receive and act on that information. Interoperable industry solutions exist precisely because the regulation assumed infrastructure that did not exist on-chain.
Is a SOC 2 report enough for institutional counterparties?
It is usually necessary and rarely sufficient. Institutional diligence typically asks for SOC 2 Type II plus specific evidence around key management, asset segregation, insurance, and increasingly proof of reserves. Treating SOC 2 as the finish line tends to surface as a stalled diligence process rather than as a rejection.
How do BSA obligations differ for digital assets?
The obligations themselves — AML programme, suspicious activity reporting, recordkeeping, Travel Rule — are the familiar ones. What differs is the evidence: blockchain analytics, address attribution, and on-chain tracing replace some traditional transaction monitoring inputs, and examiners increasingly expect that capability rather than accepting conventional monitoring alone.
Does proof of reserves prove solvency?
No, and conflating the two is a well-known criticism of the practice. Proof of reserves attests to assets held at a point in time; without a corresponding and equally verified statement of liabilities, it does not establish solvency. Sophisticated counterparties know this, so presenting it as a solvency guarantee tends to damage credibility rather than build it.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.
Talk to us about Digital Assets & Crypto.
See how one evidence artifact satisfies Digital Assets & Crypto requirements alongside every other framework you carry.