The cash-to-crypto blind spot: why exchange AML programs miss billions in deposit origins

As cryptocurrency exchanges pursue institutional partnerships and traditional finance integration, Nick Smart from Crystal Intelligence, shares more on how compliance frameworks should evolve to address some of the loopholes these collaborations might create.

Virtual assets service providers (VASPs) and traditional finance face a fundamental visibility problem in their AML programs: they cannot see how their customers' funds originated as cash. This blind spot—the physical infrastructure where fiat currency converts to digital assets—processes billions annually while operating largely outside traditional compliance frameworks, then deposits directly to major platforms.

The gap exists because exchange AML controls monitor transactions that have already been recorded on blockchain networks. By the time funds appear as customer deposits, the critical conversion moment has passed. For crypto businesses facing heightened regulatory scrutiny and pursuing institutional partnerships, this represents a compliance risk that standard blockchain analytics cannot address.

[Note: Figures in this article are based on intelligence analysis combining physical reconnaissance of cash-for-crypto locations across multiple jurisdictions with blockchain transaction tracing. Data represents identified services only; actual market volumes are likely larger.]

The hidden infrastructure

Cash-for-crypto services operate globally, providing walk-in conversion from physical currency to digital assets. Recent mapping has identified over 60 such services processing an estimated USD 3.6 billion annually. These operations range from legitimate remittance alternatives to unlicensed exchanges operating behind unmarked storefronts—and they all send funds to major cryptocurrency platforms.

In cities like London, migrants use these services for faster, cheaper cross-border payments than traditional providers offer. In Hong Kong, tracking shows such services processing over USD 2.5 billion annually, serving as major regional conversion hubs. Across Southeast Asia, Eastern Europe, and Latin America, these operations cluster in commercial districts, often advertising on messaging platforms rather than maintaining traditional business visibility.

The compliance challenge emerges from how these services integrate with the broader crypto ecosystem. Transaction analysis reveals that 33% of their activity involves unlicensed exchanges. Many implement minimal or no KYC requirements. Most significantly, on-chain tracking shows 97% of funds from identified services ultimately flow to major international cryptocurrency exchanges—where they appear as ordinary deposits with no indication of their cash origins.

Why exchange AML controls fail

The problem occurs at a specific point in the transaction lifecycle: AML monitoring begins after cash has been converted to cryptocurrency. Exchange platforms excel at monitoring on-chain transactions and deposit patterns, but they cannot retroactively identify that funds originated from physical cash conversions at unlicensed services.
Consider the typical flow: An individual brings cash to an unlicensed service. The service converts it to cryptocurrency, which the individual receives in a self-custody wallet. Days or weeks later, that individual deposits the cryptocurrency to an exchange or custodial platform.

From the platform's perspective, this appears as a standard deposit from a self-custody wallet. There are no red flags. The transaction looks identical to millions of others. Even sophisticated transaction monitoring systems see nothing unusual—because the risk occurred before the customer reached the platform.

This creates a systemic visibility gap. Cryptocurrency exchanges cannot distinguish between customer deposits that originated from compliant sources and those converted through unlicensed cash services. The ultimate source is invisible to on-chain analysis and standard KYC procedures.

The regulatory implications

For cryptocurrency exchanges and service providers, this blind spot creates several compliance risks:

Direct unlicensed intermediary exposure: Platforms receive these funds directly. Analysis shows top exchanges receiving between USD 114 million and USD 386 million in annual inflows from identified cash-for-crypto operations. Most platforms lack visibility into this exposure, yet it represents direct deposits from services operating outside regulatory frameworks.

Sanctions evasion infrastructure: The same infrastructure enabling convenient remittances also facilitates sanctions evasion, and the funds flow to exchanges. One documented Hong Kong service with direct on-chain links to DPRK-associated wallets deposited approximately USD 20 million to a major exchange between 2024 and 2025. The platform's AML systems saw only a series of cryptocurrency deposits with no obvious red flags.

Regulatory reporting gaps: When regulators examine crypto exchange AML programs, they expect visibility into the source of funds. If significant volumes enter through unmonitored cash conversion points before reaching platforms, reporting is inherently incomplete—regardless of how sophisticated the on-chain monitoring may be.

Nested service risk: Many cash-for-crypto operations function as nested services, allowing end users to bypass exchange KYC requirements entirely while still accessing platforms. This creates exposure to terrorism financing and other financial crime risks that compliance programs cannot detect through standard transaction monitoring or customer onboarding.

The scale of the problem

The USD 3.6 billion in tracked annual volume represents only identified services. The actual market is likely substantially larger. Services operate across high-risk jurisdictions where cryptocurrency adoption is growing but regulatory frameworks remain underdeveloped—and they all channel funds to major platforms.

Geographic patterns reveal concentration in areas with currency restrictions, large migrant populations, and developing payment infrastructure. This creates particular challenges for exchanges expanding into emerging markets, where cash-for-crypto services may represent a significant portion of local deposit volumes.

Regulatory focus is intensifying. The Financial Action Task Force has emphasised the importance of monitoring virtual asset service providers, including informal conversion services. National regulators are increasingly focused on unlicensed cryptocurrency operations. Exchanges that unknowingly enable significant volumes from these services face potential enforcement action.

Addressing the visibility gap

Traditional blockchain analytics cannot solve this problem because the issue exists in physical space before transactions reach platforms. Addressing it requires different intelligence approaches:

Physical intelligence collection: Understanding the cash-for-crypto ecosystem requires mapping physical locations, documenting operations, and identifying which services implement adequate controls versus those operating outside regulatory frameworks—and which ones send funds to specific platforms.

Enhanced deposit screening: Exchanges need mechanisms to assess whether deposits originated from cash conversion services, even when transaction patterns appear normal and customers pass standard KYC checks.

Geographic risk assessment: Knowing where cash-for-crypto services cluster and how they operate in different jurisdictions enables more sophisticated risk-based approaches to customer onboarding, deposit monitoring, and market expansion decisions.

Regulatory engagement: Crypto businesses and regulators need a shared understanding of this infrastructure. Demonstrating awareness of these risks and implementing appropriate controls positions exchanges favourably with regulators and institutional partners.

The path forward

AML programs built exclusively on digital transaction monitoring will miss risks that occur at the cash conversion point—before funds reach platforms. As regulatory expectations increase and institutional adoption grows, this gap becomes more significant.

The challenge is not replacing existing compliance tools but complementing them with intelligence about the physical infrastructure where cash enters the cryptocurrency ecosystem. This requires moving beyond purely algorithmic approaches to incorporate real-world intelligence about how these services operate, where they're located, and which ones present elevated risks.
Crypto businesses that recognise this structural limitation can adapt their risk management approaches accordingly. Those that rely solely on traditional blockchain analytics will continue to have significant blind spots—with the regulatory and reputational risks that entails.

As cryptocurrency exchanges pursue institutional partnerships and traditional finance integration, the question becomes how quickly compliance frameworks will evolve to address these gaps.

About the author

Nick Smart is Chief Intelligence Officer at Crystal Intelligence, specializing in blockchain forensics and financial crime investigation. His work focuses on mapping cryptocurrency infrastructure and developing intelligence methodologies for law enforcement and financial institutions. For more information about cash-for-crypto infrastructure and compliance approaches, visit crystalintelligence.com.

 

 

About Crystal Intelligence

Crystal is a leading blockchain intelligence firm empowering financial institutions, law enforcement, and regulators with real-time blockchain analysis, investigative, and compliance solutions. Our solution helps financial institutions comply with global anti-money laundering regulations efficiently. Investigators and government agencies use Crystal’s cutting-edge technology and unique real-time intelligence to solve crypto investigations. Available as a free blockchain explorer, SaaS, or API.