Can a clean audit sample hide a control gap?
A review is only as useful as its scope. Examine how excluded customers and untested transaction types can undermine assurance.
Binance · Intermediate · About 6 minutes
What the official sources say
FinCEN announced a $3.4 billion civil penalty and a five-year monitorship in its Binance resolution on 21 November 2023. [1]
Its consent order criticised an independent review that examined 31 accounts, excluded no-KYC customers and did not include transaction testing. It also identified failures to report suspicious activity. [2]
The order states that Binance admits the facts admitted in its specified DOJ plea agreement and neither admits nor denies the remainder. The order distinguishes Binance.com from Binance.us. [2]
This file addresses the entities and historical conduct in FinCEN’s 2023 order. It does not describe all Binance-branded entities or current controls. The penalty is not a measure of criminal proceeds and is not an additional amount to sum mechanically with other resolutions.
What to learn from it
Original LearnAML teaching analysis. The following controls and exercises are not additional findings against the named parties.
- Identify why an apparently successful audit may not support a platform-wide conclusion.
- Design a risk-based test population and explain its limits.
- 01Define the population
- 02Select by risk
- 03Test actual transactions
- 04Report coverage limits
LearnAML assurance sequence, rather than a map of cryptocurrency movement.
Ask who was left out
A random sample of a convenient database is not necessarily representative of the service. Reconcile the customer population against products, account tiers and transaction types before drawing assurance conclusions.
Connect identity to behaviour
An identity check and a transaction review answer different questions. For a fictional exchange review, combine customer records with activity, risk indicators, alert handling and documented disposition. Do not assume an address label establishes the identity or intent of every counterparty.
Describe assurance honestly
A report should distinguish a control’s design, its implementation and its operating effectiveness. Record untested areas explicitly. When access to data is incomplete, qualify the conclusion and escalate the limitation rather than presenting a platform-wide pass.
What would you do next?
Fictional exercise: an exchange asks you to sign off its annual AML review. The reviewer examined 40 fully verified retail customers and found complete identity files. Institutional accounts and crypto-to-crypto trades were out of scope. Those segments account for most trading volume. You have not yet tested alert investigations.
Put the decision into words
Use fictional details only. Do not enter customer information. Optional saves remain on this device, not your LearnAML account.
Use this checklist to improve your answer. It is not an automatically marked essay.Compare your reasoning
Take one lesson back to work
Before relying on any assurance report, read its exclusions and reconcile its sample frame to the activities generating the greatest exposure.
Educational analysis, not instructions for a live customer or transaction. Consider your role, authorised procedures and current local requirements.
Sources and editorial record
- FinCEN: Binance resolution announcement ↗FinCEN · 21 November 2023Evidence location: Opening announcement
- FinCEN Consent Order 2023-04 ↗FinCEN · 21 November 2023Evidence location: Printed PDF pages 42–43, sections II.E and II.F; Printed PDF pages 1 and 4, opening paragraph and section II.A.2
Sources accessed and educational analysis prepared: 27 October 2026. Historical snapshot; subsequent proceedings, present custody, current controls and present law are not asserted. Original LearnAML educational analysis. Version 1.0.