Because the same compromised account or wallet can be used for theft, laundering and sanctions evasion. If monitoring is split between cyber teams and financial crime teams, the organisation sees fragments of the abuse but misses the full movement of value.
Why AML and operational security get combined in crypto supervision
Crypto regulators combine anti-money-laundering oversight with operational security because the abuse path is shared. A compromised wallet, account or API key can move value, disguise provenance, trigger sanctions evasion, and defeat both financial-crime monitoring and security controls at once. Treating those as separate problems leaves blind spots between fraud, cyber, and compliance teams.
The practical reason is that the same trust boundary is being protected from two directions. AML controls look for suspicious movement and counterparties, while operational security controls protect the access paths, signing authority and infrastructure that make that movement possible. When one side sees only transactions and the other sees only system health, the organisation can miss the full abuse chain.
That convergence is especially obvious in exchanges, custodians and payment workflows where identity, access, and transaction monitoring all touch the same execution path. If an attacker steals session tokens, resets a password, or compromises a signing workflow, the event is both a cyber incident and a potential financial-crime event. Regulators combine the lenses because the loss path does not respect internal team boundaries.
What controls need to work together
Combined oversight usually means correlating alerting across access logs, transaction monitoring, privilege changes, and incident response. A suspicious withdrawal by itself may not explain much, but paired with a new device login, a dormant admin account, or an unusual beneficiary, it becomes materially different. The value is in joining operational telemetry with AML indicators so the organisation can reconstruct intent, not just detect isolated events.
It also means protecting the account, wallet, and key lifecycle rather than relying on one control layer. Strong customer authentication, withdrawal controls, key management, segregation of duties, and auditability reduce the chance that a single compromised pathway can be used for theft and laundering together. Where virtual assets are involved, provenance and access control are not separate disciplines, they are complementary evidence sources.
For regulated firms, this is why KYC, suspicious activity reporting, access governance, and security monitoring often converge in the same control environment. The regulator is less interested in which internal team owns the alert than in whether the firm can detect abuse early, stop value movement, preserve evidence, and explain why the activity was or was not escalated.
Why split teams miss the abuse pattern
When cyber teams and financial-crime teams operate independently, each sees a partial story. Security analysts may observe unusual logins, impossible travel, token theft, or key misuse without knowing that the next step is layering, mule accounts, or sanctions evasion. Compliance teams may see unusual flows but not the credential compromise that caused them. The combined control model is meant to close that investigative gap.
This is also why regulators care about monitoring quality, escalation paths, and evidencing decisions. If suspicious access events are not linked to movement of value, the firm may under-react. If AML alerts are not linked back to compromised access, the firm may keep the same attacker path open and allow repeat abuse. The risk is not only missing one event, but missing the pattern that explains why the event matters.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Compromised user access can drive both theft and laundering workflows. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Joined access and transaction evidence is needed to spot abuse chains. | |
| AC-6 — Least Privilege | Reducing access and signing authority limits the blast radius of account compromise. | |
| Recommendation — Enforce strong user authentication and monitor suspicious account access tied to value movement. Correlate security and transaction logs to detect compromise plus transfer activity. Limit wallet and admin privileges to reduce the amount of value a single compromise can move. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control underpins the account and wallet protections regulators expect. |
| A.8.15 — Logging | Logging is needed to connect access events to suspicious financial activity. | |
| Recommendation — Define and enforce access rules for accounts, wallets, and privileged workflows. Log authentication, privilege, and transaction events so investigators can reconstruct abuse. | ||
Practitioner Guidance
What to prioritise: Build one incident view that joins wallet or account access, key and credential changes, and transaction or withdrawal activity. A standalone cyber alert or a standalone AML alert is often insufficient; the useful question is whether the same actor can still move value after detection.
What to verify: Confirm that the teams responsible for access control, fraud, AML, and incident response can share evidence quickly and consistently. The minimum test is whether an analyst can trace an alert from initial compromise through to value movement without switching systems or losing timestamps.
Common mistake: Treating transaction monitoring as a substitute for operational security, or treating security monitoring as a substitute for AML coverage. Neither layer is complete on its own when the asset being abused is both an access path and a value transfer mechanism.
Practitioner takeaway: The objective is not just to detect suspicious transfers, but to preserve a continuous view of how access compromise becomes financial abuse, because that is where most investigative blind spots appear.