Cryptoasset risk is now an explicit supervisory expectation. Banking supervisors worldwide expect financial institutions (FIs) to identify and manage cryptoasset-related risk wherever cryptoasset activity, products or counterparties are in scope, across anti-money laundering and countering the financing of terrorism (AML/CFT) regulation, sanctions compliance and governance.

The reflex for many FIs is to stand up a separate, parallel compliance program. But that instinct produces one of two failure modes: over-engineering or disengagement. Most cryptoasset risk maps directly onto the categories an FI’s framework already covers.

What needs adapting is narrower than most teams assume, and it comes down to two things: understanding how…