OTC desks and exchanges can aggregate, fragment, and re-route value in ways that make provenance harder to assess. That does not make them inherently risky, but it does mean compliance teams need richer ownership evidence, transaction context, and alert correlation to distinguish legitimate activity from laundering patterns.
Why This Matters for Security Teams
OTC desks and exchanges change the aml problem because they compress time, combine many counterparties, and introduce routing paths that can obscure who ultimately controls value. That creates a governance challenge as much as a transaction-monitoring one: teams need to understand beneficial ownership, source of funds, and whether activity aligns with expected customer behaviour. FATF’s FATF Recommendations — AML and KYC Framework remain the baseline, but the operational burden rises quickly when liquidity, custody, and execution are split across venues.
This is also where identity and access control intersect with financial crime. Customer identity checks are only part of the picture; desks and exchanges increasingly depend on account provenance, device trust, API access governance, and alert correlation across systems. NHIMG’s research on the Ultimate Guide to NHIs shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which matters because exchange integrations often rely on machine credentials to move quickly. In practice, many compliance teams encounter suspicious flow patterns only after a routable account, API key, or intermediary relationship has already been abused, rather than through intentional prevention.
How It Works in Practice
OTC desks typically settle negotiated trades outside a public order book, so the compliance picture depends on the quality of customer due diligence, counterparty mapping, and post-trade review. Exchanges, by contrast, can generate very high transaction volume and rapid order changes, which makes pattern recognition harder unless monitoring is tuned to customer segment, jurisdiction, and product type. The core issue is not that these venues are inherently non-compliant; it is that they create more permutations of legitimate activity that can resemble layering, structuring, or rapid movement of funds.
Effective AML controls usually combine:
- Beneficial ownership checks and refreshed KYC for high-risk counterparties.
- Transaction monitoring that correlates deposits, withdrawals, order behaviour, and wallet exposure.
- Sanctions screening and travel-rule handling where applicable.
- Case management that links alerts across accounts, devices, and related entities.
- Privileged access controls for operators, bots, and settlement workflows that can move funds or change routing.
For desks that rely on automation, machine identities deserve explicit governance. Service accounts, API keys, and signing credentials can act like financial control points, so they need inventory, rotation, and offboarding discipline similar to human access. NHIMG’s Hugging Face Spaces breach research is a useful reminder that compromised secrets can turn trusted automation into an exfiltration path. Current guidance suggests pairing AML rules with access analytics, because a transaction that looks normal in isolation may be suspicious once the initiating identity, infrastructure, and timing are considered together. That guidance breaks down in high-latency cross-border settlement environments where incomplete counterparty data prevents timely correlation.
Common Variations and Edge Cases
Tighter monitoring often increases false positives and onboarding friction, requiring organisations to balance detection sensitivity against client experience and operational throughput. That tradeoff is especially visible in OTC markets, where legitimate large-ticket trades, market-making, treasury rebalancing, and brokered liquidity can all look unusual to a rules engine built for retail behaviour.
There is no universal standard for this yet, but best practice is evolving toward risk-based segmentation. Low-risk customers may be monitored with baseline scenarios, while higher-risk relationships need enhanced due diligence, source-of-wealth checks, and more frequent review of wallet links, counterparties, and funding rails. Exchanges also need to treat programmatic access as part of the AML surface: a compromised trading bot, withdrawal automation, or admin credential can produce activity that appears customer-driven when it is actually machine-driven. That is one reason why machine identity governance is increasingly relevant to financial crime controls, not just cybersecurity.
Jurisdiction matters as well. Cross-border desks may face overlapping obligations under local AML rules, sanctions regimes, and data-residency constraints, which can limit how much context is available to investigators. In those cases, teams should document what evidence is required, what can be shared, and how exceptions are approved. The practical goal is not perfect certainty, but enough provenance and control evidence to justify a risk decision and escalate the right cases sooner.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the technical controls, and PCI DSS v4.0 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 | Understanding venue risk and ownership context is key to AML governance. |
| NIST SP 800-63 | IAL2 | Stronger identity proofing supports customer due diligence and account trust. |
| NIST AI RMF | GOVERN | AI-assisted monitoring needs governance, accountability, and model oversight. |
| OWASP Non-Human Identity Top 10 | NHI-1 | API keys and service accounts are material AML control points on exchanges. |
| PCI DSS v4.0 | 7.2.1 | Access restriction principles map well to privileged exchange operations and settlement workflows. |
Define business context for OTC and exchange AML risk before tuning monitoring and escalation rules.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
