Coinbase Compliance / Risk Analyst Interview Questions

1.Tell me about a compliance decision you made that was the right call for long-term trust or regulatory standing, but created real friction in the short term — maybe slowed a product launch or upset a business team.

2.Describe a time you spotted a compliance or risk gap that wasn't technically your responsibility and decided to own it anyway. What did you do and how far did you take it?

3.Tell me about a time you found that your team's compliance reviews or risk assessments were inconsistent or substandard. What specifically did you change and how did you measure that things improved?

4.Describe a time a compliance control or review process was technically correct but was creating a frustrating or confusing experience for customers. What did you do about it?

5.Tell me about a time you had to push back on a legal, product, or senior business stakeholder who wanted to move forward with something you believed posed a serious compliance or regulatory risk. How did you make your case and what happened?

6.Walk me through a time when a critical compliance deadline — a regulatory response, audit deliverable, or exam — was in jeopardy and the key person or data source you depended on went dark. How did you handle it?

7.Estimate how many Coinbase Exchange retail accounts you'd expect to require enhanced due diligence reviews in a given month. Walk me through your assumptions.

8.Your transaction monitoring system shows a sudden 40% spike in alerts over the past two weeks, but there's been no known rule change or major market event. How do you diagnose what's happening?

9.Coinbase is considering expanding Exchange to a new emerging market with 50M potential users but limited AML infrastructure and high FATF grey-list risk. How would you assess whether the compliance program can support that expansion?

10.A data analyst tells you that 0.3% of Coinbase Exchange transactions in the last quarter touched wallets that were later flagged by a blockchain analytics tool — but the flagging happened after the transactions cleared. How do you think through the compliance implications?

11.Coinbase is planning to onboard a crypto hedge fund onto Prime — $2B AUM, registered in the Cayman Islands, with complex layered fund structures and three of its five board members are PEPs. Design the risk assessment framework you'd use to make the onboarding decision.

12.You're reviewing Coinbase's last 12 months of SAR filings and notice that your team's filing rate on Base-related activity is effectively zero, even though on-chain DeFi volume through Base has grown 400%. How do you investigate whether that's a gap or a legitimate outcome?

13.Walk me through how you'd conduct a transaction monitoring review on a customer flagged for structuring activity. What data points are you pulling and what's your decision framework?

14.How do you assess whether a new crypto asset should be listed on Coinbase Exchange from a compliance standpoint — what's your review checklist and which factors are deal-breakers?

15.You're reviewing KYC/CDD documentation for a corporate customer onboarding to Coinbase Prime, and beneficial ownership disclosure is incomplete — some UBOs are listed but documentation is missing for two. The relationship manager says the deal is time-sensitive and wants to onboard provisionally. How do you handle it?

16.Coinbase's sanctions screening just generated a 300% spike in false positives after a ruleset update — the ops team is drowning and real risk is getting buried in noise. How do you approach tuning it down without creating regulatory exposure?

17.Regulators are asking Coinbase to produce five years of transaction records for a specific set of customers across both Exchange and Prime, with a 30-day deadline. You discover the records exist in three different systems with inconsistent data formats and some gaps. How do you manage this?

18.You're asked to build a risk-tiering model for Coinbase's retail customers on Exchange — segmenting them by AML risk to drive review frequency and EDD thresholds. What variables go in, how do you weight them, and how do you validate it actually works?

19.A retail customer on Coinbase Exchange contacts support saying they've been locked out of their account during a rapidly rising market and are losing money every minute. Your team flagged the account for an AML review that's still open. What do you do?

20.You're reviewing a batch of SAR filings your team submitted last quarter and realize three of them were filed on activity that, on closer look, doesn't clearly meet the suspicious activity threshold. The filings are already submitted to FinCEN. What do you do?

21.A product team wants to launch a new peer-to-peer feature on Coinbase Wallet that allows users to send crypto directly to contacts without a formal review step. Your initial read is that it introduces meaningful AML risk, but the PM argues the volume will be low at launch and review can be added later. How do you respond?

22.You discover that a geographic market Coinbase serves has just been added to OFAC's SDN list — not a person or entity, but the entire jurisdiction. You have active customers with verified addresses in that country. What's your next move and what are the downstream implications?

23.Coinbase is preparing for a state money transmitter license exam in a jurisdiction where your AML program has known gaps that are being remediated. The exam starts in three weeks. Your manager asks you to prepare the examiner-facing documentation. How do you approach it?

24.A pattern in your transaction monitoring data suggests that a group of accounts may be coordinating to manipulate the price of a low-liquidity asset on Coinbase Exchange. You don't have enough to file a SAR yet, but waiting means the manipulation may continue. What do you do?

25.Tell me about a time you had to explain a compliance requirement or risk finding to a non-compliance stakeholder — someone in sales, product, or finance — and they just didn't get it at first. How did you bridge the gap?

26.Describe a time when you were the compliance or risk voice in a room full of people who all wanted to move faster than you were comfortable with. How did you hold your position without becoming a blocker?

27.Tell me about a time you were managing a compliance workstream that depended on data, systems access, or resources owned by another team — and that team had competing priorities. How did you get what you needed?

28.You've completed a risk assessment and your conclusion is that a business line needs a significant process change — but the business leader disputes your findings and believes your risk rating is too conservative. How do you handle that disagreement?

29.Tell me about a time you had to coordinate a compliance response that required buy-in from multiple teams simultaneously — legal, ops, product, or finance — where each team had a different view of urgency or priority. How did you align them and drive it to closure?

30.You've identified a material compliance gap in a business area where you don't have a formal mandate — it sits under a different compliance team or a business unit that manages its own risk. How do you raise it and what happens if they don't act?