How Mature Is Your Crypto Compliance Operation?

Why is compliance the floor rather than the finish line?

In its seventh targeted update of 15 July 2026, the Financial Action Task Force (FATF) reported that 91 of 109 surveyed jurisdictions had Travel Rule legislation in force, with a further 11 in progress, taking the combined figure to 102 of 109. Adoption at that scale changes what the rule signals, because a control almost every material market has legislated no longer marks an operation out as advanced. It marks it as present.

Legislating the rule and supervising it are not the same thing. The same update found that of the 91 jurisdictions with Travel Rule legislation in force, 55 have not yet issued findings or directives or taken enforcement action against VASPs on Travel Rule compliance.

That gap in compliance operations is what this framework measures. The market has spent years asking crypto businesses which protocol they support and whether they are compliant, and those questions are close to binary. The questions that predict cost, resilience, and growth are harder. How much manual effort does a compliant transfer take? How quickly can the operation absorb a new regulation or a new market? How well do the compliance systems actually work together? This framework turns those into a score.

Regulatory position verified against primary sources on 12 August 2026. Thresholds, effective dates, and scope vary by jurisdiction and change over time. Confirm the current position for your own markets before relying on any figure here.

A program built to clear one obligation, in one jurisdiction, at one threshold, on one messaging rail can be fully compliant today and structurally fragile tomorrow, because it breaks the first time a transfer crosses a border, meets a different threshold, or lands on a counterparty using a different protocol. An operation that meets the baseline is in the game. That says little about whether that operation can carry the load as volume, jurisdictions, and attack patterns multiply.

What is the Crypto Compliance Maturity Model?

The Crypto Compliance Maturity Model is a self-assessment framework that rates a crypto compliance operation across nine capability pillars and five maturity levels, then summarizes the result as a single score from 0 to 100, the Crypto Compliance Maturity Index.

The framework exists to answer the harder questions, the ones about manual effort, speed of adaptation, and how well the systems work together. It gives a compliance leader a structured way to benchmark where an operation sits today, see where the biggest gaps are, decide what capability to invest in next, and understand how to grow without cost and headcount rising at the same rate. It is built for Heads of Compliance, Money Laundering Reporting Officers (MLROs), Chief Compliance Officers, and the operations, risk, and engineering leaders who carry the same responsibility at virtual asset service providers (VASPs), crypto-asset service providers (CASPs), exchanges, and financial institutions.

What are the five maturity levels?

The framework places a compliance operation on a five-level curve, and every level answers one question. What is actually doing the work?

How is a level claimed?

Every cell carries three things.

• Descriptor. How the operation works at that level.
• Gate. The one binary sentence that decides the rating.
• Evidence test. The artifact, measurement, or behavior that proves the gate.

All three sit inside the assessment below. Each option shows its gate, and Show detail, at the top of each step, opens the descriptor and evidence test for all five levels at once.

Four rules for claiming a level

1. 1

   Levels are cumulative. An operation sits at the highest level whose gate it passes, and whose lower gates it also passes, so passing the Level 4 gate while failing Level 3 scores Level 2. Start at Level 2 and climb, then stop at the first gate you fail and score the level below it. Level 1 sits at the bottom of the scale, carries no gate, and uses a recognition test instead.

2. 2

   Compound gates require every clause. Several gates carry more than one condition, and a failure on any single clause fails the whole gate. Partial satisfaction scores the level below, and the partial state should be recorded, because it is usually the most useful finding on that pillar.

3. 3

   A gate whose triggering event has not occurred is not met. Some gates ask what happened the last time the operation launched a market, onboarded a rail, or met a new typology. If that event has never arisen, score the level below and record the pillar as untested, not assumed. An untested capability is a real finding, not an administrative gap.

4. 4

   Instance-based gates test routine practice. Where a gate asks for a documented instance in the last twelve months, that instance is evidence the practice is routine. One deliberate exercise staged to pass the assessment does not satisfy it.

How to score honestly

Score the level the operation has fully achieved today, not the highest level for which some evidence exists somewhere, and not the level the roadmap will deliver. Partial achievement of a level scores the level below. Where the honest answer sits between two levels, take the lower one, because the framework is more useful when it is uncomfortable. Score the operation as a whole, and where a capability is mature in one business line and absent in another, score the weaker one and note the split. That split is itself the finding.

How does the Crypto Compliance Maturity Index work?

The Index summarizes nine pillar ratings into one number from 0 to 100. It is a directional summary rather than a validated benchmark, and its value depends on the honesty of the inputs. The nine-pillar profile is the primary output, and the Index is the shorthand for it.

Rate the operation on each pillar from 1 to 5, average the nine ratings, then convert to a 0 to 100 scale. The assessment below does this for you.

An operation sitting at Level 1 across the board lands at 0, and one at Level 5 across the board reaches 100. The Index is rounded to the nearest whole number before it is banded, and a half value rounds to the higher whole number. All nine pillars carry equal weight in this version.

Overall level throughout this framework means the band the rounded Index falls into, rather than the rounded or floored average of the pillar levels. The critical-gap rule below is measured against it.

How do you read your results?

The framework gives three things to act on, and the order matters.

The Index and level are the headline. They place the operation overall and give a shared language for the board, auditors, and partners. A number and a named level travel further in a governance conversation than a folder of process documents.

The pillar profile is the diagnosis. Viewed as a nine-spoke radar, it shows where the operation leads and where it lags. Two operations can share an Index and look nothing alike, which is why the profile matters more than the number. Three short examples make the point, and the first and last share an Index of 44.

A. The hidden gap · Index 44 B. The even climber · Index 50 C. The uneven build · Index 44

A · The hidden gap

Index44

Critical gap

Eight pillars at Level 3, wallet and transaction assurance at Level 1. Average 2.78.

The Index reads as a solid Level 3. The wallet pillar two levels below everything else is a critical gap, and it exposes the business where a crypto operation can least afford it. The number flatters the operation, and the profile tells the truth.

B · The even climber

Index50

No flag

All nine pillars at Level 3.

A clean Level 3 with no critical gap and no uneven-profile flag. This operation is genuinely level, and its next move is to raise every pillar rather than patch a hole.

C · The uneven build

Index44

Uneven profile

Regulatory readiness and counterparty operations at Level 5, reporting at Level 3, the remaining six pillars at Level 2.

The same Index as Profile A. No pillar sits two or more levels below the overall level, so no critical gap fires. The spread of three levels between the strongest and weakest pillars triggers the uneven-profile flag instead. This operation has invested hard in two capabilities and left seven behind.

The flags are the sequence. Any pillar two or more levels below the overall level is a critical gap, and a weak link caps real-world resilience no matter how strong the rest of the operation looks. In compliance, a single hole, such as no real wallet screening, is a risk that strength elsewhere cannot offset. Where no critical gap fires but the highest pillar sits three or more levels above the lowest, the profile is flagged as uneven instead, which says the operation has invested unevenly.

The most efficient way up is usually to lift the lowest pillars to the median before pushing the whole operation to the next level, because filling a gap tends to reduce more risk and free more capacity per unit of effort than improving a pillar that is already strong. Close the gaps, then raise every pillar. That sequence repeats at every level, and it is the roadmap.

The cycle repeats at every level. Close any critical gap, raise every pillar to the level above, then take on the next level’s organizing principle.

What are the nine capability pillars?

Maturity is not one thing, so the framework measures nine capabilities, grouped in three domains. The assessment above rates each one, and every option there carries the full descriptor, gate, and evidence test for that level.

Three pillars carry a metric you can use as a second check on your rating. Take the highest level whose band the operation meets. The bands start at Level 2 because a Level 1 operation has no consistent process to measure. Its numbers land in the Level 2 band.

Band widths are drawn to scale on each metric’s own axis. Time uses a logarithmic scale.

These are reasoned anchors derived from the logic of the levels, not measured industry benchmarks, and where an anchor and a gate disagree the gate wins. A gate is a structural fact about how the operation works, whereas a metric can be distorted by product mix, customer base, or volume.

For example, an operation serving mostly low-risk retail customers can show a manual-review rate under 15% while still routing every exception to a person by hand. The metric reads Level 4. The gate, which asks whether policy makes the decision, does not.

What does higher maturity actually buy?

The nine pillars describe what an operation builds. They do not, on their own, prove the building was worth it. That proof lives in a second layer of measures the framework tracks but does not score. An operation does not become efficient by aiming at efficiency. It becomes efficient because the capabilities beneath it matured.

If an operation climbs the pillars and these numbers do not move, it has added sophistication without adding value, and the framework has surfaced a finding that matters. Maturity that does not show up in cost, scale, and customer experience is not yet doing its job.

Two of these metrics also appear as indicative bands inside the pillars they most directly reflect. Manual-review rate anchors Pillar 2, and time to stand up a new jurisdiction anchors Pillar 3. Those bands are reasoned anchors to calibrate against rather than measured industry benchmarks, and where a band and a gate disagree, the gate wins. The gate is a structural fact about how the operation works, whereas the metric is an outcome that product mix, customer base, or volume can distort.

Does higher maturity require a single platform?

Trace any pillar from Level 1 up to Level 5 and the same pattern emerges. Maturity is in large part a story about consolidation. Reactive operations are fragmented, with many systems, many manual seams, and no shared view of a customer or a transfer. Adaptive operations run on one unified data layer, where identity, screening, monitoring, counterparty, wallet, and messaging draw on the same record and inform the same decisions.

That pattern helps explain why so many operations stall between Enabled and Optimized. The problem is usually not a missing point system. It is that the point systems do not operate as one. Every disconnected system can add another silo to reconcile, another integration to maintain, and another seam where risk hides and audit trails break.

Past a certain point, more capability on a fragmented stack can lower maturity rather than raise it, because it adds coordination cost faster than it adds coverage.

The pillars, though, score outcomes rather than architecture. What the framework rewards is unified data, low coordination cost, and decisions that draw on shared context. A single platform is one way to reach that. A well-governed modular estate, with disciplined integration and a genuine shared data layer, can reach the same place. Consolidation is the common route to high maturity, not the only one, so read the pillars as a description of the destination and choose the architecture that gets there.

What does this model not cover?

This framework covers the financial crime compliance operation of a virtual asset service provider, crypto-asset service provider, exchange, or financial institution handling crypto. Several adjacent disciplines sit outside it deliberately.

Glossary