Crypto infrastructure is shifting fraud risk into payments and custody

At a glance

What this is: This is a SumSub podcast analysis of how digital finance infrastructure is maturing, with the central finding that better custody and payments rails do not eliminate fraud risk, they relocate it into operational and governance controls.

Why it matters: IAM, PAM, and NHI teams should read this as a warning that new crypto rails require stronger identity, transaction, and third-party governance, not just better technical custody.

Context

Crypto infrastructure now sits closer to production banking than to experimentation, and that changes how fraud is managed. The article argues that once institutions move into custody, payments, stablecoins, and tokenized assets, the risk discussion shifts from price volatility to identity, transaction, and compliance controls.

For identity and access programmes, the important point is not whether blockchain rails work, but who can move value, under what controls, and through which third parties. That makes this relevant to financial-services IAM, PAM, NHI governance, and fraud operations at the same time.

Key questions

Q: How should security teams govern digital-asset custody when third parties are involved?

A: Treat the third party as part of the identity model, not as an external exception. Scope its access to the minimum operational task, review what it can initiate or approve, and require explicit offboarding when the service relationship changes. If the provider can touch value, the lifecycle controls must be as strict as for any other high-risk identity.

Q: Why do safer crypto rails still leave fraud risk in place?

A: Because better custody protects assets from technical compromise, but fraud often exploits the transaction path, user behaviour, or delegated authority. A stronger rail can reduce operational failure while leaving impersonation, misuse, and approval abuse untouched. Teams need both asset protection and fraud controls or the risk simply moves to another layer.

Q: What breaks when stablecoin payments run continuously instead of in batches?

A: Batch-era review habits break first. Continuous rails compress decision time, remove natural settlement pauses, and make post-event review too slow for high-value or jurisdictionally sensitive transfers. Teams that still rely on delayed monitoring will miss the point at which an unusual transaction should have been blocked or escalated.

Q: What should organisations require from third-party crypto service providers?

A: Require explicit scope, approval authority, logging, and offboarding for any third party that can hold or move assets. That means knowing who controls the workflow, what they can touch, when access ends, and how evidence is preserved. Without that discipline, delegated custody becomes an unbounded trust relationship rather than a governed service.

Technical breakdown

Why custody and payments change the fraud model

Crypto custody is not only an asset-holding problem. It is a control plane for who can initiate transfers, approve workflows, and interact with licensed intermediaries across always-on rails. In this article, the distinction between holding assets safely and preventing fraud is explicit: stronger infrastructure can reduce operational fragility while leaving fraud pathways intact. The governance issue is that custody and payments now overlap with compliance decisions, transaction monitoring, and delegated access across institutions and service providers.

Practical implication: Map custody workflows to identity and approval controls, not just wallet security.

Why 24/7 rails expand transaction risk

Traditional payment systems rely on batch windows, settlement cut-offs, and operational pauses that create natural review points. Public-chain and stablecoin rails run continuously, which means fraud controls must evaluate transfers in real time and under compressed decision windows. The article’s point about on-chain analytics and KYT shows that transaction context now matters as much as customer identity. For practitioners, this changes how alerting, escalation, and transaction approval logic must be designed.

Practical implication: Treat continuous settlement as a monitoring design problem, not a post-transaction review problem.

How third-party custody shifts accountability

When institutions outsource stablecoin handling to licensed providers, they are delegating more than a technical function. They are extending trust to a third party that can move, hold, and operationalise assets on their behalf. That creates a governance boundary problem: the institution still owns the risk outcome even when another entity executes the workflow. The article’s discussion of licensed service providers touching stablecoins is a reminder that third-party access needs lifecycle, scope, and oversight controls just as much as direct access does.

Practical implication: Set explicit accountability, offboarding, and review rules for any provider that can move or hold customer assets.

NHI Mgmt Group analysis

Crypto custody is now an identity problem disguised as infrastructure modernisation. The article shows that institutions are no longer asking whether digital asset rails exist, but who can operate them safely and under what governance. That shifts the security question from pure technology to controlled authority over value movement, approvals, and third-party execution. Practitioners should treat custody as privileged access architecture for financial rails.

Fraud controls do not disappear when infrastructure improves, they become more operationally dependent. SumSub’s discussion makes clear that secure asset handling does not automatically stop fraud, because fraud follows the transaction path, not just the wallet. This is where transaction monitoring, KYT, and behavioural controls intersect with access governance. The field should stop assuming that stronger plumbing equals lower fraud exposure.

Licensed intermediaries create a delegated trust surface that must be governed like any other high-risk access path. The move toward outsourced stablecoin handling, payments, and custody expands the number of actors that can influence asset movement. That is not just a vendor management issue, it is a lifecycle and privilege issue. The practitioner conclusion is simple: if a third party can touch the asset, it needs explicit scope, review, and offboarding discipline.

Distribution, not tokenization, is where governance pressure concentrates. The article correctly argues that the harder problem is not creating digital assets, but making them usable in compliant ways. That means identity proofing, sanctions handling, fraud screening, and access policy design sit at the center of adoption. The practical lesson for the market is that infrastructure maturity raises the governance bar instead of lowering it.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Delegated asset movement is becoming the new privileged access problem. As institutions adopt payments, custody, and stablecoin workflows, the governance focus shifts to who can move value and under what authority. That is a direct fit for IAM and PAM teams, but it also pulls NHI governance into the picture when service providers and automated workflows participate in transfers.

Crypto infrastructure does not remove fraud controls from the stack. It makes them more time-sensitive and more dependent on real-time identity and transaction context. For practitioners, the important question is no longer whether the rail is secure in isolation, but whether every actor that can trigger movement is constrained, monitored, and accountable.

Third-party custody will keep expanding the trust boundary. That means offboarding, delegated authority, and evidence retention need to be written into operating models before adoption scales further. Teams that still treat custody providers as simple vendors will underestimate how much access they actually have.

For practitioners

• Model custody as privileged access Map every workflow that can move, approve, freeze, or release digital assets to named roles, approval paths, and service providers. Treat those paths as high-risk access, not just operations.
• Separate asset safety from fraud controls Do not assume secure custody eliminates fraud exposure. Pair wallet and key controls with transaction monitoring, KYT, sanctions screening, and anomaly detection for payment flows.
• Review third-party custody boundaries Document which licensed providers can hold, transfer, or intermediate assets on your behalf and verify that offboarding, scope review, and evidence retention are explicit.
• Design for continuous monitoring Replace batch-oriented review assumptions with real-time controls for 24/7 rails, including step-up approval triggers for unusual value movement, destination changes, and jurisdictional risk.

Key takeaways

• Crypto infrastructure is shifting the security conversation from market volatility to governance over who can move value, approve transactions, and touch custody workflows.
• The article makes clear that better custody does not remove fraud risk, because fraud now concentrates in payment paths, compliance checks, and delegated authority.
• Institutions should govern crypto rails as privileged access paths, with continuous monitoring, third-party scope control, and explicit offboarding rules.

Key terms

• Custody Workflow: The operational path used to hold, approve, transfer, or sign crypto assets. It is an identity-sensitive process because the people, services, and approvals inside it determine whether value movement is legitimate or abusive.
• KYT: Know Your Transaction is the practice of analysing digital asset movement for risk, purpose, and pattern. It extends beyond onboarding because the same account can behave differently over time, so teams use behavioural and flow analysis to detect sanctions exposure, fraud, laundering, and unusual cross-border activity.
• Delegated Trust Boundary: The line where an organisation relies on a third party or system to make decisions on its behalf. In agentic workflows, this boundary matters because a vendor-hosted agent may carry enough authority to expose data or trigger account actions without direct enterprise control.
• Continuous Transaction Monitoring: Continuous transaction monitoring is the practice of checking business activity as it happens, rather than after a review cycle ends. It uses rules, analytics, and workflow to spot exceptions, route them to owners, and preserve evidence so control assurance stays current across systems and business units.

Deepen your knowledge

NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.