When should teams prioritise risk based due diligence over broad network access in crypto platforms?

When risk based due diligence should come before open network access

risk based due diligence should lead whenever the platform is becoming a broad intake point for customers, counterparties, or third parties whose regulatory status is uneven or still being established. In practice, that means screening and control design must scale ahead of convenience. If access expands faster than participant assessment, the platform inherits avoidable compliance exposure and weakens its ability to distinguish legitimate activity from abuse.

Why onboarding scale changes the order of controls

The sequencing matters because network access is not just a technical permission, it is a business exposure decision. Once a platform invites large numbers of participants, the cost of treating everyone as low risk rises sharply: bad actors blend into normal growth, sanctions and AML obligations become harder to enforce, and exceptions multiply faster than review capacity. That is why EBA AML/CFT Guidance is relevant here, because it reflects the need to align access expansion with due diligence and ongoing monitoring rather than letting adoption outpace control maturity.

For crypto platforms, the key question is not whether access should exist, but whether the platform can explain who is gaining it, why they qualify, and what level of scrutiny is proportionate to the activity. The broader and more permissioned the network becomes, the more the platform must rely on participant risk classification instead of assuming a uniform trust level. That is especially true where the platform touches exchanges, custodians, brokers, OTC desks, payment rails, or cross-border users.

What breaks when broad access comes first

Broad access without prior due diligence typically creates three failure modes. First, financial crime controls lag behind user acquisition, so suspicious counterparties enter the system before screening catches up. Second, operational teams end up compensating with manual reviews after the fact, which is slower and less reliable than preventative gating. Third, the platform accumulates policy debt, where access exceptions are preserved because removing them would interrupt revenue or user growth.

Access control and authorisation design still matter, but they do not replace due diligence. A platform can use role boundaries, tiered permissions, and transaction limits, yet those controls work best after participant risk is understood. Authorisation Models Guide is useful here because it helps distinguish permission structure from the separate problem of deciding which counterparties should be trusted enough to enter the environment at all.

In regulated crypto activity, the practical risk is not only fraud or sanctions exposure, but also incomplete coverage. If onboarding is faster than screening, firms may end up with networks that are technically accessible but institutionally fragile, because they cannot consistently justify why one participant was accepted and another was blocked. That is where due diligence becomes a control for both compliance and defensibility.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Covers account and access governance needed when onboarding scales beyond trusted participants.
Recommendation — Restrict access by business need and review accounts before widening network connectivity.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Supports limiting exposure when network access must be staged by participant risk.
	IA-8 — Identification and Authentication (Non-Organizational Users)	Applies to external counterparties whose identity must be established before broad access.
	IA-5 — Authenticator Management	Relevant to credential lifecycle controls that support screening and controlled onboarding.
Recommendation — Enforce least privilege so new participants only receive the access they need. Require strong authentication and proofing before granting external network access. Manage credentials tightly so access does not outpace due diligence.
ISO/IEC 27001:2022	A.5.15 — Access control	Addresses policy decisions for who may enter and use the platform.
Recommendation — Define access rules that depend on participant risk and verified need.

Practitioner Guidance

What to prioritise: Put participant screening, source-of-funds or source-of-wealth checks, sanctions review, and counterparty classification ahead of any move to open network access. If the platform is still learning who its users are, treat access expansion as conditional, not default.

Decision rule: If the network is expected to onboard at scale or to interact with third parties outside tightly regulated institutions, require risk based due diligence before broad connectivity. If the user base is small, tightly known, and operationally contained, you may phase access more gradually, but keep the same review standard in reserve.

What good looks like: Access is granted in tiers, screening outcomes are recorded, exceptions are time bound, and the platform can show that high-risk participants receive stronger controls than low-risk ones. A healthy posture is one where growth does not force the compliance team into retrospective cleanup.

Practitioner takeaway: In crypto platforms, broad access should be the outcome of a risk decision, not the starting assumption. The earlier the platform moves beyond a tightly known participant set, the more important it becomes to prove legitimacy before connection.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.