How should firms balance fraud prevention duties across banks, crypto businesses, and platforms?

How firms should divide fraud prevention across banks, crypto businesses, and platforms

fraud prevention works best when each party is responsible for the part of the lifecycle it controls, rather than assuming one institution can stop every abuse path. Banks, crypto businesses, and platforms each hold different signals, permissions, and intervention points, so the balance is really about coordinated accountability, shared evidence, and timely escalation across organisational and jurisdictional boundaries.

Where the control boundary actually sits

Firms should assign duties to the entity that can most directly verify the customer, transaction, or device state at the relevant moment. Banks usually control account funding, payment rails, and adverse action decisions; crypto businesses often control wallet exposure, chain analytics, and transfer restrictions; platforms may own onboarding, behavioural signals, and marketplace abuse detection. The practical mistake is to define responsibility only by product type instead of by the point where fraud can be observed and interrupted.

That boundary matters because fraud is often multi-stage. A bad actor may create the account on one platform, move value through another, and cash out through a bank or exchange. When the control model is aligned to the lifecycle, firms can reduce duplicated checks while still preserving the checks that are unique to each stage, such as identity proofing, device risk, transaction monitoring, sanctions screening, and account take-down.

For control design, Segregation of Duties (SoD) Guide is a useful reminder that fraud prevention is not only about detection, but also about preventing one actor from concentrating too much power across onboarding, approval, and movement of funds.

The same accountability logic is reflected in external regimes that push firms toward stronger customer due diligence and suspicious activity handling, including FATF Recommendations, the AML and KYC framework and FinCEN guidance for reporting and escalation.

Why coordination and data-sharing are part of the control, not an optional extra

Shared fraud pressure means the control plane has to extend beyond the walls of any one business. If a bank sees suspicious cash-out behavior but the upstream platform or crypto venue cannot share corroborating indicators, the response is slower and less accurate. Likewise, if a platform detects bot-driven account creation but cannot escalate linked attributes, the downstream financial institution may inherit the loss.

Coordination should therefore cover three things: what can be shared, how quickly it can be shared, and who is allowed to act on it. Good practice is to share the minimum necessary evidence needed to correlate cases, confirm patterns, and block repeat abuse, while still respecting privacy, secrecy, and cross-border constraints. This is where governance matters as much as analytics, because poor handoffs create false negatives even when each organisation has strong internal detection.

Identity Fraud Prevention Guide is relevant here because it shows how fraud signals, device intelligence, and linked attributes become materially more valuable when they are connected across the customer lifecycle rather than used in isolation.

For broader regulatory alignment, eIDAS 2.0, the EU Digital Identity Framework is a strong example of how cross-border identity verification is increasingly treated as a shared infrastructure problem, not a single-firm capability.

What good cross-border fraud prevention looks like in practice

Effective programmes use tiered interventions. Low-confidence signals trigger stepped-up verification or velocity checks; high-confidence signals trigger holds, freezes, or offboarding actions; repeated patterns trigger network-level sharing and law-enforcement escalation. The point is not to over-block legitimate customers, but to ensure each actor can intervene at the level of risk it can actually evidence.

That approach also means firms should predefine who owns the decision when signals conflict. A platform may have stronger behavioural evidence, while a bank may have stronger transactional evidence. A crypto business may have superior visibility into destination wallets but limited visibility into the source customer’s history. The balancing act is to avoid both duplication and gaps by writing down who leads on verification, who leads on blocking, and who must be notified before value exits the system.

Segregation of Duties (SoD) Guide also applies here because fraud prevention fails when the same process owner can both create exposure and approve remediation without independent review.

On the regulatory side, the expectation for suspicious activity handling and AML controls is reinforced by FATF Recommendations, the AML and KYC framework, which remains the most useful international reference point for shared fraud and financial-crime duties.

Practitioner Guidance

What to prioritise: Start with the control points where fraud becomes irreversible, such as account opening, beneficiary change, withdrawal approval, and high-risk cross-border transfer. Those are the places where shared accountability needs to be explicit, because later-stage analytics cannot recover value once funds have left.

What to verify: Confirm that each partner can show a clear ownership map for onboarding, monitoring, escalation, and case handoff. If responsibilities are documented only at a policy level but not at the transaction level, the programme will look coordinated while still failing in practice.

Decision rule: If one firm has the best evidence but another firm has the power to stop the action, both need defined obligations. Evidence without action is insufficient, and action without evidence creates arbitrary blocking and customer harm.

What good looks like: The strongest operating model is one where alerts can move quickly between institutions, controls can be applied at the right stage, and exceptions are visible enough to explain why a case was allowed, held, or escalated.

Practitioner takeaway: Balance is not achieved by giving every firm the same duties, but by making each firm accountable for the fraud it can actually see, stop, and evidence, while ensuring the handoff between firms is fast enough to matter.

Related resources from NHI Mgmt Group

• How should travel platforms balance fraud prevention with booking conversion?
• How should European financial services firms balance compliance, fraud prevention, and onboarding efficiency at scale?
• Why do identity verification programmes in crypto need to balance fraud prevention with user friction?
• Who is accountable when fraud losses move across banks, fintechs, and online platforms?