Who is accountable when illicit crypto flows pass through a regulated exchange?

Why This Matters for Security Teams

When illicit crypto flows pass through a regulated exchange, accountability is not just a legal question. It is a control question. Exchange leadership must show that customer due diligence, sanctions screening, transaction monitoring, and case management are operating as designed, and that records are strong enough for supervisory review. The relevant burden is not limited to fraud prevention; it also covers how quickly suspicious activity is detected, escalated, and reported.

This is where identity governance and transaction monitoring meet. A regulated exchange may have strong perimeter controls yet still fail if customer identities, beneficiary data, wallet attribution, or privileged service accounts are poorly governed. NHIMG’s research on the Ultimate Guide to NHIs — Regulatory and Audit Perspectives highlights why auditability matters: regulators care about evidence, not intent. That same logic applies to the internal systems that move, screen, or approve crypto transfers.

Current guidance suggests accountability is shared across the exchange, compliance leadership, and the supervisory regime, but operational responsibility sits with the firm that chose the control design. In practice, many security teams encounter failures only after suspicious transactions have already cleared screening, rather than through intentional pre-trade and post-trade control testing.

How It Works in Practice

In a regulated exchange, accountability usually follows the control chain. Front-line operations, compliance analysts, security engineering, and senior leadership all contribute, but the exchange remains responsible for proving that its controls meet licensing and reporting obligations. That means the organisation must be able to explain who owns customer onboarding, who tunes sanctions and AML rules, who reviews alerts, and who can override or approve exceptional transactions.

The practical challenge is that illicit flow detection is only as strong as the weakest identity and data link. Customer verification, wallet risk scoring, device intelligence, and on-chain analytics need to work together. If a high-risk account is linked to a compromised or weakly governed non-human identity, such as an API key used for withdrawal automation or internal reconciliation, the attack surface expands quickly. NHIMG notes that excessive privilege and poor lifecycle control are recurring NHI failures, and that directly affects regulated exchange integrity. See the Top 10 NHI Issues and the Lifecycle Processes for Managing NHIs for the governance side of that risk.

• Define clear ownership for KYC, AML, sanctions screening, alert triage, and regulatory reporting.
• Log and retain decision evidence so reviewers can reconstruct why a transfer was allowed or stopped.
• Monitor both customer behaviour and machine identities that can move funds or alter screening systems.
• Test escalation paths for suspicious activity, including cases that require freezing, filing, or offboarding.

For control design, the NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev. 5 Security and Privacy Controls help anchor identity, logging, monitoring, and incident response expectations. These controls tend to break down when exchanges rely on fragmented vendor tooling without a single accountable owner for alert disposition and regulatory evidence.

Common Variations and Edge Cases

Tighter screening often increases customer friction and operational overhead, requiring organisations to balance faster settlement against stronger compliance assurance. That tradeoff becomes sharper in high-volume exchanges, cross-border operations, and environments that support both retail and institutional clients.

There is no universal standard for this yet when illicit flows involve wallets, mixers, self-custody transfers, or cross-chain bridges. Some regulators focus on whether the exchange had reasonable controls and documented escalation paths; others expect more aggressive monitoring thresholds and faster filing timelines. Best practice is evolving, especially where on-chain analytics and customer identity evidence do not fully align.

Edge cases also arise when the exchange relies on automated service accounts for screening, ledger posting, or wallet management. If those non-human identities are overprivileged or poorly rotated, accountability becomes harder to prove because the platform cannot reliably show which actor initiated the action. That is why NHI governance is relevant here: cryptographically strong controls still fail if service accounts are invisible or unmanaged. For deeper context, NHIMG’s research on regulatory and audit perspectives shows how evidence quality shapes supervisory outcomes. The exchange is still accountable even when a third-party analytics provider, custodian, or liquidity partner contributes to the transaction path.

Related resources from NHI Mgmt Group

• Who is accountable when a crypto exchange account is taken over through recovery abuse?
• How should security teams handle wallet ownership verification in regulated crypto flows?
• Who is accountable when a regulated firm processes sanctioned crypto exposure?
• Should teams prefer passwordless authentication for regulated payment flows?