Who is accountable when a crypto laundering network uses exchanges, front companies, and cross-border payments to hide criminal proceeds?

Why This Matters for Security Teams

Accountability in a crypto laundering network is rarely confined to the people moving illicit funds. It often extends to exchange operators, payment processors, shell entities, and any intermediary that ignored red flags, failed to screen counterparties, or allowed suspicious activity to pass without escalation. For security, fraud, compliance, and investigations teams, the practical issue is not just “who committed the crime,” but “where did detection and control fail across the transaction chain.” That is why control design, case management, and evidence preservation matter as much as transaction monitoring. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it ties governance, auditability, and monitoring to operational accountability. In practice, many security teams encounter laundering networks only after funds have already crossed multiple jurisdictions and the trail has been fragmented by weak escalation, poor recordkeeping, or delayed suspicious activity reviews.

How It Works in Practice

Laundering networks usually rely on a chain of actors with different levels of knowledge and control. Criminals create the proceeds, front companies lend apparent legitimacy, exchanges provide liquidity, and cross-border payment rails move value into new jurisdictions. Accountability depends on proving both intent and failure to act. Investigators generally separate the core laundering actors from the organisations that may have enabled movement through weak controls, poor due diligence, or ignored alerts. In operational terms, the question becomes whether each participant had reasonable visibility into the risk and whether they had controls that should have detected it. Common control points include customer due diligence, beneficial ownership checks, transaction monitoring, sanctions screening, unusual pattern detection, and alert escalation. Where those controls are effective, they help establish whether an organisation acted responsibly or tolerated suspicious activity. Key operational considerations include:

• Tracing the flow of value across exchanges, intermediaries, and payment providers.
• Linking account activity to beneficial owners, devices, and access paths.
• Preserving logs and evidence so investigators can reconstruct timing and intent.
• Correlating alerts across jurisdictions and institutions rather than treating each event in isolation.

A zero trust approach, outlined in NIST SP 800-207 Zero Trust Architecture, is relevant because it reinforces continuous verification instead of assuming that a transaction, user, or counterparty is trustworthy once inside a trusted boundary. These controls tend to break down when institutions operate with fragmented customer records across subsidiaries and correspondent channels, because no single team has enough context to connect the suspicious pattern end to end.

Common Variations and Edge Cases

Tighter monitoring often increases friction for legitimate customers and counterparties, so organisations have to balance faster payments and user experience against stronger screening and investigation depth. That tradeoff is especially visible in crypto markets, where transaction speed, pseudonymous wallets, and multi-jurisdiction routing can overwhelm manual review. Best practice is evolving for cases involving decentralised exchanges, mixers, DeFi protocols, and nested service providers, and there is no universal standard for this yet. Some participants may have only partial visibility into the source or destination of funds, which complicates accountability assessments. In those environments, responsibility often depends on whether the organisation had proportionate controls, whether it recognised red flags, and whether it acted on them in time. Where the case touches identity governance, the core issue is not just wallet attribution but whether access, custody, and approval rights were restricted to the right people at the right time. Investigators and compliance teams should also expect exceptions involving:

• Shell companies used only to obscure ownership rather than to move funds directly.
• Cross-border payment chains where local law affects reporting thresholds and disclosure duties.
• Hosted wallet and exchange relationships where one party controls records but not the full flow.

For this reason, accountability is usually established through a combination of conduct, control failures, and evidence quality, not by a single transaction event alone.

Related resources from NHI Mgmt Group

• How should organisations handle sanctions risk when crypto is used for cross-border payments?
• Who is accountable when cross-border crypto recovery fails?
• Who is accountable for tracing cross-chain laundering after a major crypto drain, and what skills do teams need?
• When does one-time verification stop being enough for cross-border payments?