Bitcoin card compliance is a critical consideration for financial institutions developing Bitcoin-linked debit, prepaid and credit card programmes. Issuing banks, BIN sponsors, payment processors and digital asset service providers must evaluate applicable anti-money laundering (AML), Know Your Customer (KYC), sanctions screening and consumer-protection obligations. This institutional report examines the US and EU regulatory frameworks, operational controls and risk-management responsibilities that shape compliant Bitcoin card infrastructure.
Bitcoin-linked card programs sit where two rule sets meet: card payments law and digital asset law. For US programs, Bitcoin card compliance starts with one map: every regulated activity (card issuance, custody, crypto-to-fiat exchange, lending, and transfer) is matched to the legal entity that performs it, and each AML/KYC, sanctions, consumer protection, and network control is assigned in writing to an accountable owner. A sponsor bank cannot hand off its Bank Secrecy Act duties. A crypto provider’s license does not let it issue cards. And a processor’s PCI DSS attestation says nothing about wallet risk.
The stakes are rising with volume. Crypto cards grew from about $100 million a month in early 2023 to over $1.5 billion a month by late 2025. That growth runs through the same issuing banks, processors, and card networks that oversee conventional programs. For financial institutions and investors weighing these programs, the useful question is concrete: where in the chain does each digital asset risk enter, and who is positioned to control it?
This is informational research, not legal advice. Requirements depend on jurisdiction, entity type, product design, and the specific activities performed.
Key Takeaways
- Obligations follow activities and entities, so each function in the card chain needs its own legal analysis.
- The sponsor bank keeps ultimate regulatory accountability even when a program manager runs daily controls.
- Card-side and wallet-side monitoring must share data, or conversion points become blind spots.
Executive Summary
Compliance for a crypto card program is a chain-of-custody problem for both money and responsibility. Crypto card regulation in the US and EU does not treat a “Bitcoin card” as one product. It treats it as a bundle of regulated acts: issuing a payment instrument, holding customer assets, exchanging crypto for fiat, extending credit, and moving value across borders.
Five findings shape risk management for institutional participants:
| Finding | Practical implication |
|---|---|
| Activities trigger obligations | Map issuance, custody, exchange, lending, and transfer separately |
| The issuer stays accountable | Contracts can assign tasks but cannot transfer regulatory liability |
| Conversion is the key risk point | Monitoring must link card authorizations to wallet activity |
| Crypto licenses are narrow | MiCA or state crypto licenses do not authorize card issuance |
| Rules change fast | Legal status needs dated, primary-source review each quarter |
Binding law, supervisory guidance, and recommended controls also need to stay separate in program documents. Examiners test against the first, expect the second, and judge the third as evidence of a sound program.
Which Activities Create Regulatory Obligations?
Each function in the card flow can create its own licensing and AML duties. The card structure decides which consumer rules apply, while the crypto functions decide which money transmission, custody, and asset rules apply.
How Do Debit, Prepaid, and Credit Structures Differ?
In a debit structure, the card draws on an account balance, which may be fiat converted from crypto at the moment of purchase. A prepaid structure loads value in advance, often after a separate off-ramp. A credit structure extends a loan, sometimes backed by crypto collateral or paid back from a crypto balance.
The legal effect is direct. Debit and prepaid programs fall under Regulation E, while credit programs fall under Regulation Z, and both regimes set firm dispute response windows that are a common exam finding. Credit programs also bring lending licenses, fair lending rules, and collateral risk when the backing asset is volatile.
When Do Issuance, Custody, Exchange, or Lending Trigger Separate Requirements?
Each activity has a different legal home:
- Issuance: a bank or licensed issuer under network rules and bank supervision.
- Custody: trust charters, state licenses, or bank custody authority, plus safeguarding rules.
- Exchange: money transmission and MSB registration for crypto-to-fiat conversion in the US; CASP authorization in the EU.
- Lending: state lending licenses or bank powers, Truth in Lending, and collateral rules.
One entity may perform several of these. Each still needs its own analysis.
Where Does Crypto-to-Fiat Conversion Occur in a Card Transaction?
Conversion happens at one of three points. In custodial models, the provider converts on its internal ledger at authorization. In self-custody models, the user’s wallet sends funds on-chain to the program’s settlement address, and conversion follows. In pre-funded models, conversion happens before the card is loaded, so the card itself is a plain fiat product.
The entity doing the conversion carries the exchange obligations. Stablecoin programs using USDC shorten the price-risk window, but they still involve a conversion step and its compliance duties.
Who Owns Each Compliance Obligation?
The issuing bank owns regulatory accountability, and everyone else owns defined tasks. Financial institutions sponsoring a program must still oversee the internal controls run by partners.
Responsibility Matrix: Issuers, BIN Sponsors, Managers, Processors, and Crypto Providers
| Control | Issuer / BIN sponsor | Program manager | Processor | Crypto provider (VASP/CASP) |
|---|---|---|---|---|
| BSA/AML program | Accountable | Runs daily operations | Supplies data | Own program for crypto activity |
| CIP/KYC | Approves policy | Performs onboarding | None | KYC for wallet accounts |
| Sanctions screening | Accountable | Screens customers | Screens transactions | Screens wallets and transfers |
| Transaction monitoring | Oversight, SAR filing | Card-side alerts | Authorization data | On-chain monitoring |
| Network rules | Liable to network | Complies under contract | Message compliance | Limited |
| PCI DSS | Validates | If it touches card data | Core scope | If it touches card data |
| Custody and safeguarding | Due diligence | Disclosures | None | Accountable |
| Consumer disputes | Legal issuer | Runs process | Chargeback tooling | Supports asset tracing |
BIN sponsor compliance duties sit in the first column for a reason. The bank lends its BIN and answers to the network for the whole program.
How Should Contracts Allocate Oversight, Escalation, and Reporting?
Contracts should spell out data access, alert handoffs, SAR support, audit rights, and exit terms. Legal commentators suggest tiered liability caps, with higher or uncapped exposure for BSA/AML control failures and standard caps for routine service levels.
Key clauses include:
- Named escalation contacts and set response times for sanctions hits.
- Raw data feeds from the crypto provider to the sponsor, covering wallet addresses and risk scores.
- Notice duties for regulatory inquiries, license changes, and incidents.
- Termination and wind-down rights, including customer asset return plans.
How Should Customer Due Diligence Work?
Customer due diligence should cover both the person and the wallet. Bitcoin KYC that stops at the identity document misses risk that enters through funding sources.
Customer Identification, Identity Verification, and Beneficial Ownership
US banks must run a Customer Identification Program (CIP) that collects name, date of birth, address, and ID number, then verifies them. Identity verification uses document checks, database matches, or both. For legal entities, the CDD rule requires identifying beneficial owners, meaning those who own 25% or more and one person with control.
Program managers run these checks for the bank. The bank must approve the method and test the results.
When Are Enhanced Due Diligence and Ongoing Reviews Warranted?
Enhanced due diligence fits higher-risk profiles. Triggers include politically exposed persons (PEPs), high-risk countries, large or fast crypto funding, ties to mixers, and activity that doesn’t fit the stated purpose. EDD adds source-of-funds and source-of-wealth checks, which for crypto holders may require on-chain tracing.
Ongoing reviews should run on a risk-based schedule. They should also run on events, such as a new sanctions match or a sharp rise in spend.
How Should Business Customers and Higher-Risk Counterparties Be Assessed?
KYB for corporate card programs should verify the legal entity, its owners, its licenses, and its line of business. Counterparties matter too. Liquidity providers, OTC desks, and custodians should be checked for license status, home country risk, AML program quality, and sanctions exposure. A license alone is not enough evidence of sound controls.
How Are Transactions, Wallets, and Sanctions Risks Monitored?
Monitoring must cover two data streams at once: card authorizations and blockchain flows. Cryptocurrency AML for a card program fails when these sit in separate systems.
Screening Customers and Counterparties Against Applicable Sanctions Lists
The Office of Foreign Assets Control expects screening of names, entities, wallets, and transactions. Its virtual currency guidance, first published on October 15, 2021, points to list screening, geolocation, and IP blocking as core controls. Screening should run against the SDN List at onboarding, at each funding event, and when lists update.
Lists change. OFAC removed Tornado Cash from the SDN List in March 2025 after a court ruling, which shows why screening logic needs current data. The EU also adds crypto firms to its regimes, as when EU authorities included the HTX exchange in Russian sanctions.
Connecting Card Activity with On-Chain Risk Signals
Blockchain analytics assign risk scores to wallets based on links to sanctioned services, scams, or darknet markets. These scores should feed card-side rules. A wallet with mixer exposure that funds a card for gift card purchases is a stronger alert than either signal alone.
Model risk is real. Consultants warn that many programs rely on vendor default thresholds without tuning, and that fiat and crypto systems often fail to talk to each other.
Investigations, Escalation, and Suspicious Activity Reporting
Alerts should move through set tiers: analyst review, case file, decision, and SAR filing where needed. The bank files SARs under the BSA, so partners must deliver complete case data quickly. The crypto provider may have its own SAR duty as an MSB. Coordinated filing avoids gaps and conflicting narratives.
When Do Travel Rule Obligations Apply to Associated Asset Transfers?
The FATF Travel Rule applies to transfers between virtual asset service providers, not to card purchases themselves. The FATF found that Travel Rule frameworks were adopted or in progress across 99 jurisdictions as of June 2025. In the US, the funds Travel Rule applies at $3,000. Transfers from unhosted wallets have no counterparty VASP, so programs should collect wallet ownership details and apply risk-based checks.
What Must US Programs Assess?
US programs face overlapping federal and state rules, applied by activity. The GAO notes that FinCEN administers the Bank Secrecy Act and its AML rules for financial institutions.
FinCEN, the Bank Secrecy Act, and Activity-Based MSB Analysis
FinCEN treats an entity as a money services business based on what it does. A crypto provider that accepts and sends value or converts crypto to fiat for customers is likely a money transmitter. MSBs must register with FinCEN, run an AML program, and file reports. Banks follow their own BSA rules under bank supervisors.
Banking Supervision, State Licensing, and Sponsor Oversight
Bank regulators apply the same risk standards to crypto activity as to other lines. The Federal Reserve sunset its Novel Activities Supervision Program in August 2025, returning bank crypto work to normal supervision. States license money transmitters. New York’s BitLicense covers virtual currency business with New York residents. Market structure law is still moving, as the crypto market structure bill headed for congressional markup shows.
Consumer Protection, Tax Reporting, and Stablecoin-Specific Rules
The CFPB enforces Regulation E and Regulation Z, while the FTC polices unfair and deceptive practices. Debate over consumer protection rules in the CLARITY bill signals more change ahead.
For tax, the IRS treats virtual currency as property, so spending crypto can trigger a taxable gain or loss. Broker reporting on Form 1099-DA adds data duties for some providers. The GENIUS Act sets a federal regime for payment stablecoin issuers, with reserve, reporting, and redemption rules. Card programs settling in stablecoins should review issuer status under that regime.
How Do EU Rules and Cross-Border Restrictions Interact?
EU card programs need two kinds of permission: crypto authorization and payment authorization. One does not replace the other.
MiCA Authorization and the Activities It Covers
The Markets in Crypto-Assets Regulation became fully applicable on 30 December 2024. MiCA authorization covers crypto-asset services such as custody, exchange for fiat, and transfer. Authorized CASPs can passport across the EU. MiCA has no third-country regime, so non-EU firms can’t serve EU clients from abroad under it.
Payment Services, AML, Transfer Rules, DORA, and GDPR
Issuing a card in the EU requires a payment institution, e-money, or bank license under PSD2. The Transfer of Funds Regulation applies to crypto transfers, but card payments for goods and services are exempt when the card number accompanies the transfer. DORA, applied from January 2025, sets ICT risk and outsourcing rules. GDPR governs personal data, including wallet data linked to a person.
US-versus-EU Regulatory Comparison
| Area | United States | European Union |
|---|---|---|
| Crypto exchange license | FinCEN MSB plus state licenses | MiCA CASP authorization |
| Card issuance | Bank or sponsor under bank supervision | PSD2 or e-money license |
| AML framework | BSA, FinCEN rules | AMLD, AMLR, TFR |
| Crypto transfer rule | $3,000 funds Travel Rule | TFR, no minimum for CASP transfers |
| Stablecoins | GENIUS Act | MiCA e-money token rules |
| Operational resilience | Bank guidance, third-party rules | DORA |
| Cross-border access | State-by-state | Single passport |
Issuance Restrictions, Outsourcing, and Other Jurisdictions
Outsourcing does not move accountability under DORA or bank rules. Enforcement shows the cost: Ireland’s central bank fined Coinbase €21.5 million over monitoring failures. In the UK, the FCA requires crypto AML registration, and card services fall under the Payment Services Regulations. In Singapore, the Monetary Authority of Singapore licenses providers under the Payment Services Act by service type.
What Do Card Networks and Payment Operations Require?
Network rules bind the issuer by contract, and they apply to crypto programs as they do to any card. Payment card security, fraud prevention, and dispute handling all flow from these rules.
Network Rules, Payment Data Security, and PCI DSS
Visa and Mastercard rules cover issuance, branding, chargebacks, and data security. They also set specific terms for crypto programs, which the sponsor must confirm with each network. PCI DSS sets requirements for any environment where payment account data is stored, processed, or transmitted. That scope includes issuers, processors, and service providers. A crypto provider that never sees card data may sit outside scope, but its wallet keys need separate controls.
Fraud Controls, Chargebacks, and Dispute Resolution
Crypto cards draw account takeover, card testing, and scam-driven spending. Reg E sets liability limits and error resolution timelines for debit and prepaid programs. A crypto card dispute adds a step: the refund is in fiat, but the customer spent a converted asset whose value may have moved. Disclosures should state how refunds are valued.
Reconciling Authorization, Asset Conversion, and Fiat Settlement
Each card transaction creates three records: the authorization, the asset debit, and the fiat settlement. These must match daily. Gaps come from partial captures, reversals, price moves between authorization and clearing, and failed on-chain transfers. Reconciliation breaks should become alerts with owners and deadlines.
How Do Custody Models Change the Risk Profile?
Who controls the keys decides who carries safeguarding duties. Digital asset regulatory risk shifts with each model.
Safeguarding, Segregation, and Private-Key Governance
Custodians should segregate customer assets from their own and keep clear books. Key governance covers key creation, storage, signing approvals, and recovery. Bank supervisors now expect documented key ceremonies and wallet controls they can test.
Custodial and Self-Custody Integrations
Custodial programs hold assets from deposit through spend, so the provider owns the full AML view. Self-custody programs leave keys with the user until payment, when funds move on-chain to the program. With non-custodial wallets, the program cannot freeze assets before spend and must screen each incoming transfer. Bitcoin wallets linked to a card also become publicly tied to the program address.
Liquidity, Counterparty, and Third-Party Failure
Programs need fiat on hand to settle with the network before crypto sales complete. That gap creates liquidity and price risk. Failure of a custodian or liquidity provider can halt spend and trap customer assets. Contingency plans should name backup providers and set out customer asset return steps.
How Can Institutions Test and Govern the Program?
Testing proves controls work, and governance proves someone is watching. Regulatory compliance in this area is judged on evidence.
Institutional Compliance Checklist
- Activity map linking each function to a licensed entity
- Signed responsibility matrix with named owners
- Written BSA/AML program covering card and crypto flows
- CIP, CDD, and EDD procedures approved by the sponsor
- Sanctions screening for names, wallets, and transfers
- Linked card and on-chain monitoring with tuned thresholds
- SAR workflow with partner data duties
- Travel Rule process for associated transfers
- PCI DSS validation for in-scope parties
- Custody, segregation, and key governance standards
- Daily three-way reconciliation
- Consumer disclosures and dispute procedures
- Exit and wind-down plan
Key Risk Indicators, Audit Trails, and Control Testing
Useful KRIs include:
- Share of funding from high-risk wallets
- Sanctions alert volume and time to clear
- Alert backlog age
- SAR filing timeliness
- Reconciliation breaks per day
- Chargeback and fraud rates
- Dispute response time against Reg E windows
- Partner license or audit findings
Audit trails should log every alert decision and every policy change. Independent testing should sample alerts, recheck thresholds, and confirm data feeds are complete.
Incident Response, Board Oversight, and Regulatory Change Management
Incident plans should cover data breaches, key compromise, sanctions hits, and partner failure, with notice duties to banks, networks, and regulators. Boards should get regular KRI reports and approve risk appetite. A change process should log new rules, assign owners, and set effective dates.
Building a Defensible, Activity-Based Compliance Framework
A defensible program starts with an activity map and ends with tested evidence. Issuance, custody, exchange, lending, and transfer each carry their own duties, and each needs a named owner in contract and in practice. The sponsor bank keeps accountability, so it needs data rights and audit access across the chain. Card and wallet monitoring must work as one system at the conversion point. Crypto authorizations such as MiCA should never be read as card issuance rights. Card-Bitcoin’s research treats these programs as payments infrastructure, and institutions reviewing one should date-stamp every legal finding and recheck it against primary sources each quarter.
Institutional Crypto Compliance: AML, CASPs and Regulatory Accountability
Effective crypto compliance requires a coordinated approach across card issuers, sponsoring banks, payment processors, custodians and crypto-asset service providers (CASPs). In the European Union, CASPs operating within the scope of MiCA must assess their authorization, governance and operational obligations alongside applicable anti-money laundering (AML) requirements. Bitcoin-linked card programmes should establish risk-based customer due diligence, transaction monitoring, sanctions screening, beneficial ownership verification and suspicious activity reporting controls where legally required. Institutional crypto compliance must also address the division of responsibilities between CASPs and regulated financial institutions, particularly when digital assets are converted into fiat currency to fund payment card transactions. A documented AML governance framework, supported by internal controls, independent testing and appropriate supervisory reporting, is essential to sustainable institutional card operations.
EU Transfer of Funds Regulation (TFR): Traceability and Cross-Border Payment Controls
The European Union’s Transfer of Funds Regulation (TFR), Regulation (EU) 2023/1113, establishes traceability requirements for specified transfers of funds and crypto-assets. Its crypto-asset transfer provisions include information obligations for crypto-asset service providers (CASPs), subject to the regulation’s scope and applicable exceptions. Institutions operating Bitcoin-linked card programmes must distinguish between card payments processed through traditional financial networks and underlying crypto-asset transfers involving regulated service providers. Effective crypto compliance includes identifying which transactions fall within the TFR, implementing relevant originator and beneficiary information controls, and coordinating anti-money laundering (AML) monitoring with sanctions compliance and transaction risk assessment. Institutions should also evaluate cross-border operating models, data protection requirements and recordkeeping arrangements to ensure that regulatory responsibilities are allocated appropriately across issuing banks, processors, custodians and CASPs.
US Regulatory Compliance: BSA, KYC and Enhanced Due Diligence
In the United States, institutional crypto compliance programmes must evaluate their obligations under the Bank Secrecy Act (BSA) and applicable anti-money laundering requirements. The Bank Secrecy Act (BSA) provides a foundational framework for financial crime prevention, while Know Your Customer (KYC) procedures help regulated institutions verify customer identities and assess associated risks. Where higher-risk customers, transactions or business relationships are identified, Enhanced Due Diligence (EDD) may be necessary under applicable requirements or risk-based institutional policies. Effective Know Your Customer (KYC) controls should integrate customer identification, beneficial ownership assessment where applicable, transaction monitoring and periodic reviews. Enhanced Due Diligence (EDD) can involve additional investigation of source of funds, ownership structures and transaction patterns. For Bitcoin-linked card issuers and their financial partners, a coordinated BSA/AML compliance framework supports regulatory accountability, risk mitigation and responsible programme governance. The precise requirements depend on each institution’s regulatory status and activities.
Bitcoin Card Compliance: Institutional Governance and Regulatory Priorities
Effective Bitcoin card compliance depends on clear accountability across issuing banks, programme managers, custodians and payment processors. Institutions should establish risk-based customer due diligence, transaction monitoring, appropriate enhanced due diligence, sanctions controls and documented oversight of third-party providers. In the United States, the Bank Secrecy Act (BSA) and applicable FinCEN rules form part of the regulatory framework. In the European Union, MiCA, the Transfer of Funds Regulation (TFR) and applicable anti-money laundering requirements create obligations that depend on each entity’s activities and regulatory status. Strong governance requires ongoing regulatory monitoring, audit procedures, operational resilience and transparent allocation of compliance responsibilities.
Frequently Asked Questions
Do Bitcoin card programs require KYC?
Yes, regulated US and EU card programs require KYC. Banks run CIP under the BSA, and crypto providers run their own checks as MSBs or CASPs. The depth of checks scales with risk.
Can a crypto prepaid card operate without KYC?
Programs marketed as no-KYC face serious legal and network risk in the US and EU. Some regimes allow low-value prepaid products with reduced checks, but crypto funding adds exchange obligations that need identification. Sponsors should treat these offers as high risk.
Who is responsible for AML controls in a crypto debit card program?
The issuing bank is accountable for the card program’s BSA/AML compliance. The program manager runs daily controls, and the crypto provider runs AML for its own exchange and custody work. Contracts should define each role.
Does MiCA authorization cover a card issuer’s payment-services obligations?
No, MiCA covers crypto-asset services only. Issuing a card needs a separate payment institution, e-money, or bank license under PSD2. Programs often combine two licensed entities.
Can blockchain analytics identify the owner of every Bitcoin wallet?
No, blockchain analytics cannot identify every wallet owner. Tools link addresses to known services and risk categories, and those links are estimates. Identity still comes from KYC at regulated entry points.