D1 Sanctions
Sanctions is not yet covered for this jurisdiction in this report.
Financial Integrity Monitor
United States — Colorado US-CO
Domains (D1–D6)
2
Sources
8
Role actions
8
Jurisdiction profile
CompliantTier BRisk: IncreasingMixed
Colorado operates under the federal Bank Secrecy Act/AML framework administered by FinCEN, overlaid by state money-transmitter licensing (Colorado Money Transmitters Act, C.R.S.
Key deficiencies
- Federal CTA rollback exempts all Colorado-domiciled domestic LLCs/corporations from beneficial ownership reporting, and Colorado's own Secretary of State registry does not independently collect BO data
- No identified Colorado Attorney General enforcement action against crypto ATM/kiosk operators despite a nationwide multi-state litigation wave
- Reduced federal (IRS/FinCEN) examiner capacity for MSB and virtual-asset AML supervision nationally, diminishing oversight reach into Colorado-domiciled nonbank financial institutions
- Persistent cash-intensive cannabis banking gap in a state with one of the longest-running legal cannabis markets in the US
Recent developments (18m)
- FinCEN interim final rule (March 21/26, 2025) exempting all US domestic reporting companies, including Colorado-formed entities, from Corporate Transparency Act BOI reporting
- FinCEN Notice FIN-2025-NTC1 (August 4, 2025) on convertible virtual currency kiosk illicit-activity risk, directly implicating Colorado's dense Bitcoin ATM network
- FinCEN Section 311 designation of Huione Group as a foreign financial institution of primary money laundering concern (2025), binding on Colorado banks' correspondent-screening obligations
- Bankruptcy filing of Bitcoin Depot (May 2026), the largest US crypto-ATM operator with machines sited in Colorado, amid multi-state regulatory pressure
- FinCEN AML/CFT Program NPRM (April 7, 2026) proposing to reform risk-based AML/CFT program requirements applicable to all US BSA-regulated institutions, including Colorado-chartered entities
United States federal law that applies in United States – Colorado is covered once, on the United States page. This page covers United States – Colorado’s own layer: its own law, regulators and enforcement.
Brief
Lead signal
Lead Signal
Domain intelligence (D1–D6)
D2 Beneficial Ownership
Beneficial Ownership is not yet covered for this jurisdiction in this report.
D3 Enabler Jurisdictions
Enabler Jurisdictions is not yet covered for this jurisdiction in this report.
D4 Conflict Finance
Conflict Finance is not yet covered for this jurisdiction in this report.
D5 Crypto, Digital Assets, and Financial Innovation
Crypto, Digital Assets, and Financial Innovation
Continue reading
Colorado's Division of Banking issued interim guidance on December 18, 2025 establishing that most crypto exchanges transmitting funds on behalf of users, facilitating fiat-to-crypto conversion, or issuing stablecoins fall within the scope of the Colorado Money Transmission Modernization Act (MTMA), and therefore require a Colorado Money Transmitter License. This is a structurally significant finding: rather than legislating a bespoke crypto framework, Colorado has extended its general money-transmission perimeter to capture virtual-currency businesses, a pattern consistent with the broader US state-level trend of regulating crypto through existing money-transmitter architecture rather than novel statute. The guidance requires FinCEN MSB registration and a documented BSA/AML compliance program as preconditions to state licensure, meaning a crypto business seeking to operate in Colorado must satisfy both the federal registration layer and the state licensing layer before beginning operations.
The architecture-over-incident read here is that Colorado has resolved, at the interim-guidance level, a question that many US states have left ambiguous: whether existing money-transmitter statutes apply to crypto exchanges and stablecoin issuers by default. Colorado's answer is yes, for most virtual-currency businesses, absent a specific statutory exemption. This is a durable structural signal for any crypto-payment intermediary assessing US state-by-state licensing exposure, because it removes interpretive ambiguity that operators in other states may still face. The guidance being labeled interim rather than final, however, means the scope determination could still be refined; the underlying statutory basis (the MTMA, effective August 6, 2025) is not itself in question, but interim guidance historically carries a lower durability profile than final rules or statute text.
The compliance implication for affected firm types — crypto-asset operators and payment companies — is that Colorado licensure is not a standalone requirement but sits atop an existing federal AML/CFT foundation. A firm cannot obtain a Colorado MTL for virtual-currency transmission without first (or concurrently) satisfying FinCEN Money Services Business registration and demonstrating a functioning BSA/AML program, which effectively imports federal Bank Secrecy Act customer due diligence obligations into the state licensing gate. This dual-layer structure is typical of the US money-transmission regulatory model but is worth stating explicitly for stablecoin issuers and exchange operators newly assessing Colorado as an entry jurisdiction: the state licence and the federal AML infrastructure are not sequential options but a combined precondition.
This cycle's research was concentrated on D5/D7 and did not extend to a fresh review of D1-D4 for Colorado; no sanctions, beneficial-ownership, enabler-jurisdiction or conflict-finance material specific to Colorado was surfaced or is being asserted here.
Outlook
The interim status of the Division of Banking's December 2025 guidance is the key item to watch: a transition from interim to final guidance could adjust the precise scope of which virtual-currency business models require MTL licensure, particularly around any stablecoin-specific exemption structure. Operators and compliance teams tracking Colorado as a crypto-payments jurisdiction should monitor the Division of Banking's guidance page for a finalized version, and should not assume the interim scope determination is the last word on which crypto business models are captured.
D6 Compliance Technology & Active Defence
Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.
D7 AML/CTF Regime
AML/CTF Regime
Continue reading
Two distinct developments define this cycle's D7 picture for Colorado, operating at different regulatory layers. At the state layer, Colorado's Money Transmission Modernization Act, as clarified by the Division of Banking's December 18, 2025 interim guidance, requires most virtual-currency money transmitters to maintain a BSA/AML compliance program and FinCEN MSB registration as a precondition to state licensure — establishing AML/CFT program requirements for crypto businesses as a standing baseline feature of Colorado's regulatory architecture, layered on top of (not separate from) the federal Bank Secrecy Act framework.
At the federal layer, FinCEN published a Notice of Proposed Rulemaking on April 10, 2026 that would materially raise the AML/CFT program bar specifically for casinos and card clubs nationally, a category that directly captures Colorado's licensed casino and sports-betting operators as BSA-defined financial institutions. The NPRM would require these operators to maintain programs assessed as genuinely "effective" on a risk basis, explicitly distinguishing between a program that is well-designed on paper and one that functions effectively in practice — a distinction that raises the evidentiary bar for demonstrating compliance beyond simply having a written program. The proposal also requires governance and board-level approval of the AML/CFT program and mandates a US-located responsible officer, both of which are new structural requirements not uniformly present in current casino AML programs, which have historically followed banking-modeled practice under existing Part 1021 rules without an explicit program-execution effectiveness test.
The three-pillar balance point worth surfacing is that both developments this cycle sit within the AML pillar; no Colorado-specific CTF or CPF development was identified this cycle, and this absence should be read as a research-scope limitation (search effort was concentrated on D5/D6/D7) rather than as an indication that no CTF/CPF exposure exists in Colorado's gaming or payments sector.
The FinCEN NPRM remains at the proposed-rulemaking stage; it has not been finalized, and Colorado-licensed operators are not yet bound by its specific program-execution and governance requirements. The confidence in the NPRM's existence and April 2026 date rests on two independent Tier-3 law-firm analyses rather than a directly retrieved FinCEN primary text this cycle, which is reflected in the Probable confidence tier rather than Confirmed. By contrast, the Colorado MTMA/virtual-currency AML requirement is Confirmed, resting on direct retrieval of the Division of Banking's own interim guidance document.
Outlook
The FinCEN NPRM comment period closed June 9, 2026. Whether and when FinCEN finalizes the casino AML/CFT program rule is the central item to watch: a final rule would convert the current Probable-confidence proposed requirement into a binding federal compliance floor for Colorado's licensed casino and sports-betting operators, with governance and US-located-officer requirements that would need to be built into existing compliance programs. Separately, watch for the Colorado Division of Banking to move its interim virtual-currency guidance to final status, which would settle the current standing baseline with greater durability.
D8 Commercial Activity
Commercial Activity is not yet covered for this jurisdiction in this report.
Regulatory horizon
No dated horizon items this cycle. 4 items tracked without a confirmed date.
4 pending date · baseline financial-integrity-2026-07-05
Role action cards
MLRO
Colorado's MTMA interim guidance requires BSA/AML programs and FinCEN MSB registration as a precondition to state crypto-money-transmitter licensure.
MLROs overseeing Colorado-licensed or Colorado-entering crypto-payment businesses must ensure FinCEN MSB registration and a documented BSA/AML program are in place before state licensure is sought, not treated as a parallel or later-stage requirement.
1 evidence refs
Compliance
FinCEN's proposed casino AML/CFT overhaul would raise the program-effectiveness bar for Colorado-licensed casino and sports-betting operators.
Compliance functions at Colorado casino and sports-betting operators should track the NPRM's distinction between program design and program execution, since a finalized rule would require demonstrable effectiveness, not just a written policy, plus board approval and a US-located responsible officer.
1 evidence refs
Legal
No material change this cycle.
No material change for this persona this cycle
Board
Colorado's gaming and crypto-payments sectors face converging federal and state AML/CFT compliance escalation.
Boards overseeing Colorado-exposed gaming or crypto-payment operations should be aware that both the state (crypto MTL/BSA precondition) and federal (proposed casino AML/CFT NPRM) layers are tightening concurrently, representing a structural rather than episodic increase in compliance investment need.
2 evidence refs
CTO
Colorado's crypto money-transmission licensing regime requires BSA/AML program infrastructure to be built before state licensure is granted.
Technology teams building compliance infrastructure for a Colorado-facing crypto exchange or stablecoin issuance product must integrate FinCEN MSB registration workflows and BSA/AML monitoring capability as a precondition to launch, not as a post-launch enhancement.
1 evidence refs
Risk
Colorado applies its general money-transmission statute to virtual-currency businesses, a structural rather than episodic finding relevant to cross-jurisdictional US licensing risk models.
Risk functions modeling US state-by-state crypto licensing exposure should note Colorado resolves the money-transmitter-applies-to-crypto question at the interim-guidance level, reducing interpretive ambiguity risk in this jurisdiction relative to states without equivalent guidance.
1 evidence refs
Operations
No material change this cycle.
No material change for this persona this cycle
Audit
The FinCEN casino NPRM's program-execution effectiveness standard would change the evidentiary bar auditors apply to Colorado casino AML/CFT programs.
Internal audit functions reviewing Colorado casino operators' AML/CFT programs should anticipate a future shift from design-adequacy testing to effectiveness/execution testing if the NPRM is finalized, requiring updated audit-testing methodology.
1 evidence refs
Decision lens
MLRO
Colorado's MTMA interim guidance requires BSA/AML programs and FinCEN MSB registration as a precondition to state crypto-money-transmitter licensure.
Compliance
FinCEN's proposed casino AML/CFT overhaul would raise the program-effectiveness bar for Colorado-licensed casino and sports-betting operators.
Legal
No material change this cycle.
Board
Colorado's gaming and crypto-payments sectors face converging federal and state AML/CFT compliance escalation.
CTO
Colorado's crypto money-transmission licensing regime requires BSA/AML program infrastructure to be built before state licensure is granted.
Risk
Colorado applies its general money-transmission statute to virtual-currency businesses, a structural rather than episodic finding relevant to cross-jurisdictional US licensing risk models.
Operations
No material change this cycle.
Audit
The FinCEN casino NPRM's program-execution effectiveness standard would change the evidentiary bar auditors apply to Colorado casino AML/CFT programs.
Shared evidence: 2 refs
Scenario sketches
AMLA transition and cross-border obliged-entity supervision
Illustrative orientation only: as the EU AML Package moves from purely national AML supervision toward AMLA direct and indirect supervision of cross-border obliged entities under the AMLA Regulation (Reg (EU) 2024/1620), alongside the directly-applicable AMLR (Reg 2024/1624) and per-Member-State 6AMLD transposition, the supervisory perimeter for cross-border financial institutions could shift materially. A hybrid EU-level and national supervisory model may change where evasion pressure concentrates, potentially pushing layering activity toward non-EEA jurisdictions with less harmonized supervision, such as US state-level money-transmission regimes that have not yet adopted an equivalent cross-border coordination architecture. This is architecture-over-incident illustration, not a prediction of a specific event.
Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.
Standing trackers (T1–T6)
| Tracker | Status | Note |
|---|---|---|
| T1 · Russian Sanctions-Evasion Architecture | stable | No material change found this cycle; not independently re-searched. |
| T2 · EU AML Package / AMLA | no_change | Not applicable to US-CO. |
| T3 · FATF Grey List | material_change | June 19, 2026 plenary added Bosnia and Herzegovina and Iraq while removing Algeria and Namibia; Laos remains listed throughout. |
| T4 · Beneficial-Ownership Register Status | stable | No BO-register material surfaced for US-CO this cycle. |
| T5 · Crypto & Digital-Asset Integrity | material_change | Colorado's MTMA now explicitly governs virtual-currency money transmission (Dec 2025 interim guidance), reflecting a broader US state trend toward regulating crypto-gambling-adjacent flows. |
| T6 · Sanctions Regime Divergence | stable | No US-CO-specific sanctions-divergence signal this cycle. |
Registers
Enforcement actions
- FinCEN issued Notice FIN-2025-NTC1 urging financial institutions to identify and report suspicious CVC kiosk activity, citing a 99% year-on-year rise in kiosk-related fraud complaints and directly binding Colorado-based Bitcoin Depot, CoinFlip and Athena Bitcoin machines to enhanced BSA reporting expectations. 4 Aug 2025
- FinCEN designated Huione Group a foreign financial institution of primary money laundering concern, triggering Section 311 special measures that require Colorado-domiciled banks and MSBs to sever or restrict correspondent and processing relationships tied to the entity, which received over $39.6 billion in 2025. 1 Oct 2025
- Following the January 2025 designation of major cartels as Foreign Terrorist Organizations under EO 14157, FinCEN issued a supplemental alert alongside an OFAC sanctions action targeting fiscal fuel theft schemes, part of a broader financial-intelligence campaign against cartel non-drug revenue streams that traverse Colorado as a distribution corridor. 1 Jun 2026
Sanctions changes
- Huione Group designated a foreign financial institution of primary money laundering concern under Section 311, requiring Colorado-domiciled BSA-regulated institutions to implement correspondent-account restrictions. 1 Oct 2025
- FATF's June 2025 plenary added the British Virgin Islands and Bolivia to its Jurisdictions Under Increased Monitoring list and removed Croatia, Mali and Tanzania; FinCEN issued a notice instructing US financial institutions, including those in Colorado, to factor the update into risk-based due diligence. 13 Jun 2025
- Executive Order 14157 (January 20, 2025) designated major Mexican drug cartels as Foreign Terrorist Organizations/Specially Designated Global Terrorists, exposing Colorado financial institutions to expanded material-support liability for any dealings traced to cartel-linked fuel-theft or trafficking proceeds moving through the state's distribution corridors. 20 Jan 2025
Regulatory horizon (register)
- FinCEN AML/CFT Program NPRM finalization
- GENIUS Act stablecoin Customer Identification Program rule
- Corporate Transparency Act interim rule finalization
- FATF next plenary review of grey/high-risk lists
Active schemes
- [HIGH] Crypto ATM/kiosk elder-fraud-to-offshore laundering pipeline
- Cannabis cash-intermediation and revenue-inflation typology
- [HIGH] Domestic LLC beneficial-ownership opacity post-CTA rollback
Sources
- Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury
- Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury
- Colorado Department of Regulatory Agencies (DORA) — Division of Banking
- International Consortium of Investigative Journalists (ICIJ)
- U.S. Department of the Treasury
- Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury
- TRM Labs
- International Consortium of Investigative Journalists (ICIJ)
Coverage gaps
Evidence
Confidence-tiered claims
FinCEN's Aug 2026 final rule permanently exempts US domestic companies from CTA beneficial-ownership reporting; Colorado has no independent state BO registry to offset this federal rollback. SRC-fim-US-CO-001
Probable · 1 sourceColorado's MTMA (C.R.S. §11-110-101 et seq., HB25-1201) requires money-transmitter licensees and agents to affirm understanding of state and federal money-laundering laws under 3 CCR 701-7 Rule MO-2/MO7; no virtual-currency-specific carve-out exists. SRC-fim-US-CO-003
Confirmed · 1 sourceSB25-079 (Colorado Vending of Digital Assets Act) imposes daily transaction limits ($2,000 new / $10,500 existing customer), mandatory fraud disclosures, and a fraud-refund mechanism on virtual-currency kiosk operators, effective 2026-01-01. SRC-fim-US-CO-005
Confirmed · 1 sourceNo US-CO-specific sanctions divergence this cycle; US sanctions posture is set federally (OFAC) and Colorado carries no independent sanctions list or enforcement power.
ProbableUnited States is not FATF grey-listed; no change to US mutual-evaluation status affecting US-CO this cycle.
Probable