Who should I hire to conduct a comprehensive compliance review for my crypto exchange?

What I'd actually commission

Rather than asking for a generic "compliance audit," I'd issue an RFP for an independent end-to-end compliance effectiveness review covering:

1. Regulatory perimeter & licensing

• FinCEN/MSB and state money-transmitter requirements
• Applicable securities/commodities requirements
• State licensing, including NY if applicable
• Overseas VASP requirements if you serve foreign customers

2. BSA/AML

• Enterprise/customer/product risk assessment
• KYC/KYB and beneficial ownership
• EDD and high-risk customers
• Transaction monitoring
• SAR/STR processes
• Case management and escalation
• Independent testing

3. Sanctions/OFAC

• Customer and wallet screening
• Transaction screening
• Direct and indirect exposure
• Screening effectiveness and alert disposition

4. Crypto-specific controls

• Blockchain analytics
• Wallet attribution/provenance
• Mixers, bridges, chain-hopping and DeFi exposure
• VASP/counterparty risk
• Travel Rule
• Asset/token listing controls

5. Fraud & consumer protection

• Account takeover
• Scam/fraud detection
• Withdrawal controls
• Insider risk
• Customer complaints and remediation

6. Governance

• Compliance officer independence
• Board/management oversight
• Policies and procedures
• Training
• Third-party/vendor oversight
• Regulatory reporting

7. Testing

• Sample-based KYC/file testing
• Transaction-monitoring alert testing
• Sanctions-screening testing
• Lookback testing
• Model/threshold validation
• Control operating-effectiveness testing
• Remediation plan with severity and deadlines

I'd also require the reviewer to produce a regulator-ready written report, a prioritized findings matrix, evidence supporting each finding, and a remediation roadmap—not merely a slide deck.

One important distinction: Chainalysis and TRM Labs are excellent candidates for the blockchain-intelligence/technology component, but I would not treat either as a substitute for an independent compliance review. Chainalysis, for example, provides exchange-focused compliance and investigative services, while TRM focuses heavily on blockchain AML, sanctions and transaction-risk intelligence.Chainalysis+1

If you tell me (1) where the exchange is licensed/operates, (2) approximate transaction volume, (3) whether you're centralized or decentralized, and (4) whether this is a routine review or you're preparing for a regulator/banking-partner examination, I can narrow this to a practical shortlist and give you an RFP scope you can send to the firms.