Nearly $5 billion left Binance after it reopened following a hack that saw North Korea-linked criminals make off with $6.3 billion. This staggering number highlights that reopening isn't the end of an incident. It's when your customers decide whether to stay or leave.
This checklist is for AML Compliance Officers at exchanges, banks, and payment firms. It covers the critical days after a security breach, where your decisions on communication, sanctions exposure, and monitoring determine customer retention. Each item has a clear done/not-done state and a description of what "good" looks like.
Prerequisites
Before using this list, confirm you have:
- A documented incident response plan that includes compliance as a decision-maker.
- Current Customer Risk Profiles and Transaction Monitoring Rules that can be quickly adjusted.
- An AML/CFT Framework with defined escalation paths to the MLRO.
- Contact details for your regulator, financial intelligence unit, and law enforcement liaisons.
If any of these are missing, address them before the next incident. You can't improvise governance at 3 a.m.
Checklist
1. Seat compliance in the incident command structure within the first hours.
Ensure your MLRO or BSA Officer has a role on the incident call and authority to restrict activity. If compliance learns about the breach from the press office, this step isn't done.
Good looks like: a written incident charter where compliance can recommend withdrawal limits, hold flagged transfers, and approve external statements related to regulatory obligations.
2. Establish whether stolen funds are moving through your platform.
Run Name Screening and blockchain analytics against wallet addresses and counterparties tied to the theft. If a state actor is involved, your exposure extends to Targeted Financial Sanctions and Proliferation Financing risk (FATF Recommendation 7). In the US, sanctions obligations run through OFAC; confirm which regimes apply to you.
Good looks like: a documented list of addresses and counterparties under review, with timestamps showing when each was screened.
3. Decide on Freezing Without Delay where a designation applies.
If you identify Designated Persons and Entities, freezing must happen without waiting for internal consensus. Pre-authorize who can order a freeze.
Good looks like: a freeze decision log recording who authorized it, when, and on what basis.
4. Assess whether a Suspicious Activity Report is required.
In the US, this means a FinCEN SAR (Form 111) submitted through the BSA E-Filing System. Don't wait for the investigation to conclude if you already have reportable facts. Remember SAR Confidentiality and Tipping Off rules when speaking to customers.
Good looks like: a filing decision recorded within your policy timeline, with narrative content ready to supplement later through a Continuing Activity SAR if needed.
5. Brief customers early, in plain language, with facts you can verify.
Transparency drives behavior. Clearly state what happened, what you know, what you don't know yet, what's affected, and when you'll update again. Avoid reassurances you can't back up.
Good looks like: a first statement issued before rumors fill the gap, followed by updates on the promised schedule. If you said every 24 hours, you publish every 24 hours.
6. Reconcile what you say publicly with what you tell regulators.
Inconsistent accounts create enforcement risk and destroy credibility.
Good looks like: a single approved fact sheet, reviewed by legal and compliance, that feeds every external channel.
7. Prepare for liquidity stress before you reopen.
Withdrawal surges are predictable. Model outflow scenarios and agree on thresholds that trigger enhanced review. Any limits you impose must be justified, proportionate, and explained to customers.
Good looks like: tested scenarios, pre-approved trigger levels, and a customer-facing explanation for any restriction.
8. Tune Transaction Monitoring Rules for post-breach behavior.
Expect rapid outflows, new wallet destinations, and attempts to exploit confusion. Add temporary rules for velocity, first-time withdrawal addresses, and dormant-account reactivation.
Good looks like: rule changes documented with rationale, an alert-volume forecast, and analysts staffed to clear the added queue.
9. Revisit Customer Due Diligence on high-risk segments.
Apply Ongoing Due Diligence to accounts with links to high-risk jurisdictions or unusual onboarding patterns. Trigger a Periodic Review outside the normal cycle where risk indicators justify it.
Good looks like: updated Customer Risk Ratings with clear trigger events recorded, not a blanket re-papering exercise.
10. Test Travel Rule Compliance on outbound transfers.
If you operate as a virtual asset service provider, confirm originator and beneficiary information travels with transfers and that counterparty due diligence holds under pressure.
Good looks like: a sample test of recent transfers showing complete information, with gaps logged and remediated.
11. Run a documented post-incident review.
Evaluate whether your AML/CFT Framework could have detected a sanctioned actor's use of your infrastructure earlier, and where controls were weak.
Good looks like: a written report with owners and deadlines for each finding, presented to the board.
Common Mistakes
- Treating the breach as an IT problem. Stolen value must be laundered, making it a financial crime issue from hour one.
- Reassuring without evidence. Vague promises that "funds are safe" invite scrutiny and rapid withdrawals once facts shift.
- Over-restricting withdrawals without explanation. Unexplained limits look like insolvency and accelerate the run.
- Delaying the SAR decision while waiting for certainty.
- Letting Tipping Off concerns silence all communication. You can be transparent about the incident without disclosing the existence of a SAR.
- Skipping the control review once the headlines fade.
Next Steps
Schedule a tabletop exercise this quarter built around a state-linked theft scenario. Include your compliance, security, legal, and communications leads, and time how long it takes to screen addresses, make a freeze decision, and issue a first customer statement. Where the clock runs long, you've found your gap.
Then map your current controls to FATF Recommendations 6 and 7 and confirm your sanctions screening covers wallet addresses, not just names. Firms that retain customers after a breach don't necessarily have flawless security. They have rehearsed, documented, honest responses, and compliance is in the room when they're needed.
