What should banks evaluate before deciding whether to do business with a cryptocurrency exchange?

What banks should evaluate before onboarding a cryptocurrency exchange

Banks should treat a crypto exchange as a higher-risk counterparty review, not a simple vendor check. The decision turns on whether the exchange can operate with credible compliance, transparent ownership and jurisdictional oversight, and a risk profile that does not create unacceptable AML, sanctions, or supervisory exposure through its own customer base and counterparties.

Why the exchange’s business model and operating footprint matter

The first question is how the exchange actually makes money and where it is legally and operationally based. A spot-only exchange with a narrow customer base and clear controls presents a different risk profile from a venue that mixes custody, brokerage, lending, staking, or cross-border activity. The bank needs to understand whether those lines are segregated, who has control over customer assets, and which entities sit inside the transaction chain.

Jurisdiction matters because it shapes licensing expectations, enforcement posture, and the bank’s own supervisory narrative. An exchange that operates across multiple jurisdictions may be lawful in one place and problematic in another if its products, customer onboarding, or asset flows are not aligned with local rules. Banks should also understand whether the exchange can support clear source-of-funds, source-of-wealth, and customer-activity explanations when asked.

Business-model review should include the exchange’s exposure to intermediaries, market makers, OTC desks, payment processors, and other counterparties that can expand the bank’s indirect risk. If the exchange relies on opaque funding paths or high-risk counterparties, the bank may inherit harder-to-manage AML and sanctions questions even if the exchange itself looks superficially reputable.

What a bank should expect from the compliance program

The compliance program should be assessed as an operating control, not a document set. Banks should look for governance, escalation paths, transaction monitoring capability, sanctions screening, customer due diligence standards, suspicious activity handling, and evidence that the program is actually used to stop or review risky activity. A written policy without testing, tuning, or audit evidence should not be treated as maturity.

The strongest signal is whether compliance decisions are explainable and repeatable. That includes how the exchange handles high-risk geographies, enhanced due diligence, wallets linked to illicit activity, and transactions that involve mixers, layering patterns, or other indicators of concealment. Banks should ask for the exchange’s risk methodology, independent review outcomes, and how quickly it can produce records when regulators or counterparties ask.

For banks, this is also a control assurance issue. If the exchange cannot show disciplined customer screening and transaction oversight, the relationship may be difficult to defend even when no specific incident has occurred. The bank should judge whether the exchange’s controls are strong enough to support ongoing monitoring, not merely initial onboarding.

How to assess ecosystem exposure and counterparty contagion

One of the most important questions is how far the exchange extends into risky parts of the crypto ecosystem. A venue can appear compliant on paper while still being heavily connected to high-risk traders, offshore services, or counterparties with weak controls. That network exposure matters because the bank may be expected to manage the downstream consequences of activity it does not directly control.

Banks should therefore examine transaction counterparties, settlement rails, custody partners, and the exchange’s relationships with other platforms. The key issue is concentration and contagion: if the exchange is deeply entangled with risky actors, the bank may face elevated investigative burden, account closure pressure, or supervisory concern even when the bank’s own direct relationship seems narrow.

This is where evidence matters more than claims. Banks should ask for meaningful visibility into customer and counterparties’ risk tiers, not just marketing language about “institutional grade” controls. A defensible decision depends on whether the exchange can demonstrate a manageable exposure profile and enough transparency to support the bank’s ongoing AML obligations.

Risk and Threat Considerations

Crypto exchange relationships can create both direct financial crime exposure and indirect supervisory risk. The bank may be pulled into enhanced scrutiny if the exchange has weak customer controls, opaque ownership, or high exposure to sanctioned, illicit, or otherwise risky counterparties. The practical concern is not only whether the exchange is compliant today, but whether its transaction flows can quickly make the bank look like it failed to assess foreseeable risk.

Failure mechanism: Weak onboarding, poor monitoring, or opaque ecosystem relationships can allow risky flows to pass through the exchange undetected, which then raises the bank’s exposure to AML breaches, sanctions screening failures, and difficult-to-defend correspondent or vendor decisions.

Impact: The bank may inherit investigation burden, account restrictions, regulatory queries, or reputational damage if the exchange later becomes associated with illicit activity or inadequate controls.

Practitioner Guidance

What to verify: Confirm that the exchange can produce a current licensing map, compliance governance structure, transaction-monitoring summary, and a clear explanation of its highest-risk counterparties and jurisdictions. If those artifacts are vague, stale, or inconsistent, the relationship should be treated as elevated risk until proven otherwise.

Decision rule: If the exchange cannot explain why its business model, counterparties, and control framework keep AML exposure within the bank’s risk appetite, do not rely on brand recognition or trading volume as a substitute for diligence. The better the exchange appears commercially, the more important it is to test the actual control environment.

Practitioner takeaway: The bank is not just evaluating a customer, it is evaluating the quality of the exchange’s risk perimeter and whether that perimeter is strong enough to prevent the bank from inheriting hidden AML and supervisory exposure.

Related resources from NHI Mgmt Group

• What should organisations evaluate before deciding whether to automate PKI?
• How should security teams make NHI best practices usable across the business?
• How can organisations evaluate whether their email security controls are stopping attacks before employees engage?
• How do security teams evaluate whether TLS is actually protecting business communications?