Moving from Bank AML, Fraud or Cyber into Crypto Compliance (2026 Guide)
If you've worked in bank AML, fraud investigations or cybersecurity, you already do most of what crypto compliance teams need: spotting unusual activity, documenting it and escalating it. What's usually missing is the on-chain layer. Add blockchain basics, one recognised certification and one or two public case write-ups, and you can realistically apply for transaction monitoring, KYC or investigations roles.
How this guide was put together. It draws on the questions that come up most in AOB's compliance and forensics threads, AOB's interviews with practitioners such as Khagesh Chaturvedi and Gaya Chandrasekaran, and the public regulatory sources listed at the end. It isn't legal advice.
Why crypto compliance is hiring now
EU: MiCA. On 1 July 2026, MiCA's transitional period ended. Crypto firms serving EU customers now need full authorisation as a crypto-asset service provider (CASP), and a pending application isn't enough. Just before the deadline, about 213 firms held that authorisation across 23 EU countries (Elliptic). Staying authorised means running AML checks, Travel Rule data exchange, wallet screening and sanctions controls every day. Compliance analysts do that work.
US: the GENIUS Act. Signed in July 2025, the GENIUS Act brings stablecoin issuers under the Bank Secrecy Act (CRS). Where things stand:
AML rules (draft): FinCEN and OFAC proposed rules in April 2026, still not final as of late October. They would require board-approved AML programs, suspicious activity reporting, sanctions screening and the ability to freeze tokens.
OCC rules (final): on 21 October 2026, the OCC finalised separate rules on reserves, redemption and disclosure for the issuers it supervises.
Timeline: the law takes effect by 18 January 2027 at the latest. Issuers then get 12 months after the final AML rule to have their programs running (Finance Magnates).
Both changes create demand for people who already understand how an AML program works. That's exactly the background most career switchers bring.
Which background fits which role
Your background | Closest crypto role | What carries over | What to add |
Bank AML or KYC | Crypto AML or transaction monitoring analyst | Alert review, KYC/KYB, SAR writing, escalation | Wallet risk, Travel Rule, how exchange flows work |
Fraud investigations | Blockchain investigations analyst | Building a case, handling evidence, writing reports | Tracing funds across wallets, bridges and mixers |
Cybersecurity or threat intel | On-chain investigator, exploit analyst | Incident timelines, attacker behaviour, OSINT | Following stolen funds after a hack, scam patterns |
Legal or regulatory | Licensing and regulatory compliance | Reading rules, writing policy | MiCA, GENIUS Act and Travel Rule specifics |
Payments or operations | Stablecoin operations and reconciliation | Settlement, controls, exception handling | Mint and redemption flows, on-chain reconciliation |
Securities or fund operations | RWA tokenisation operations | Investor onboarding, transfer controls | Token transfer restrictions such as ERC-3643 |
If you're unsure where you fit, transaction monitoring and KYC analyst roles are the most common entry points, because they map most directly to bank work. For deeper reading, see the threads on moving from bank fraud into blockchain forensics, moving from pentesting into crypto fraud investigation, and what RWA jobs actually need.
What changes when the money is on-chain
Cases often start from a wallet, not a customer. At a bank you begin with a known person. In crypto you may start with an address and work backwards.
Everything is visible, but not everything is known. Transactions are public; who controls a wallet often isn't. Good analysts are clear about what's confirmed and what's only likely.
Money moves fast and across chains. Bridges and swaps mean tracing is part of the everyday job, not a specialist task.
The other side of a transfer matters. Under the Travel Rule, you check which exchange or wallet provider sits on the other end.
Tools are taught; judgment is tested. Employers will train you on Chainalysis or TRM. They rarely train you to write a clear escalation note, so that's what interviews probe.
Certifications worth considering (as of November 2026)
One credible certification is enough to show intent. Beyond that, extra badges rarely change a hiring decision. In AOB's certification thread, the common advice is to pair one certificate with practical samples.
CAMS (ACAMS): general AML. Best if you come from banking and want a credential recognised everywhere.
CCAS (ACAMS): crypto-specific AML. Updated with Chainalysis content; the new version launches 19 November 2026 (CoinEdition).
Chainalysis certifications: Digital Asset Fundamentals, Certified Compliance Analyst and Certified Investigator. Full tracks are included for staff at Chainalysis customers; the foundational modules are open to everyone (Chainalysis).
Courses teach you the vocabulary. They don't replace showing how you think.
The proof that gets you shortlisted
The most consistent point across AOB's compliance threads is that a one-page sample of your reasoning carries more weight than a list of tools.
Pick the one that matches the role you want:
AML analyst: a mock case note on a suspicious pattern: what triggered the review, what you checked, what you'd escalate, and what you'd ask the customer.
Investigator: a trace of funds from a public hack using a block explorer, from the exploit to the point where funds reached an exchange or bridge.
Stablecoin operations: a reconciliation checklist for cross-border USDC payouts, including what to do when a payout rail fails.
RWA operations: a short memo on how transfer restrictions stop an ineligible wallet from receiving a tokenised asset.
Regulatory: a one-page brief comparing how MiCA and the GENIUS Act treat stablecoin issuers.
A few ground rules: use only public or invented data, and never anything from a past employer. Keep what you saw, what you think and what you'd do next clearly separate. Don't call a wallet criminal; say what the evidence suggests. There's a full discussion on showing case notes without exposing client data.
A 60-day plan (about an hour a day)
Days 1–14: learn the basics: how Bitcoin and Ethereum transactions work, how to read a block explorer, and what bridges and mixers do. Chainalysis's free foundational modules cover much of this.
Days 15–30: start one certification, or finish the free fundamentals if budget is tight.
Days 31–45: write two proof samples from the list above. Post one in AOB's compliance threads and ask for feedback.
Days 46–60: rewrite your CV in crypto terms and apply for transaction monitoring, KYC/KYB and junior investigations roles on the AOB job board.
Where career switchers get filtered out
The CV still reads like a bank job description. "Reviewed alerts" says little. "Reviewed 40 alerts a day and wrote escalation notes", plus one crypto sample, says much more.
Tool lists with nothing behind them. Plenty of CVs list Chainalysis, TRM and Elliptic. Far fewer show the person can reason about a wallet.
Overclaiming. A sample that calls a wallet "criminal" worries hiring teams more than an unfinished trace.
Ignoring location. Many roles sit with a licensed entity in a specific country, and you may need to be there.
If your CV isn't getting replies, AOB offers a CV review focused on making this kind of experience readable.
Remote work and pay
Monitoring and investigations roles are often remote-friendly. Senior compliance, MLRO and regulator-facing roles are usually tied to where the company holds its licence, and after MiCA and the GENIUS Act that matters more than it used to. Pay varies widely by country and company. The compensation hub collects current discussions.
Frequently asked questions
Can a bank AML analyst move into crypto compliance?
Yes. Alert review, KYC and SAR writing all carry over. Add wallet-risk basics and one crypto case sample.
Do I need to code?
No, not for compliance or entry-level investigations. SQL and Python help later, mainly in senior investigations.
Is a law degree needed?
No. It helps for licensing and policy roles, not for monitoring or investigations.
Which certification should I do first?
CAMS if you need a general AML credential; CCAS if you already have AML experience and want crypto depth; Chainalysis's free foundational modules if budget is tight.
How can I show experience without breaking confidentiality?
Use public blockchain cases or invented scenarios, and say at the top of the sample that it contains no client data.
Related on AOB: Crypto compliance and forensics career hub · Crypto compliance jobs: roles, pay and certifications · Can a bank AML analyst move into exchange or stablecoin compliance?
Sources (checked 5 November 2026)
Elliptic, What the end of MiCA's transitional period means for crypto businesses, 29 June 2026
Congressional Research Service, Stablecoin Legislation: An Overview of the GENIUS Act, updated 20 August 2026
Finance Magnates, Ten days to the GENIUS Act deadline, 10 July 2026
Chainalysis, Certification programs and Academy catalog
CoinEdition, ACAMS and Chainalysis expand crypto crime training, October 2026
FinCEN and OFAC, Permitted Payment Stablecoin Issuer AML/CFT and Sanctions Compliance Program Requirements (proposed rule), Federal Register, 10 April 2026
COTI, GENIUS Act Final Rule: What the OCC Decided for Stablecoins, 22 October 2026
