Crystal Intelligence has identified USD 7.97 billion in transactions moved through nested crypto services across 39 regulated host exchanges since 2017.
The research, published in July 2026 by Crystal Intelligence's Research & Intelligence Unit, examines how third-party crypto exchanges, brokers, and payment processors operate through accounts held at larger, regulated exchanges rather than through their own independent infrastructure. According to the company, this arrangement allows a host exchange to KYC checks and transaction monitoring to the nested service as a direct customer, while having little or no visibility into that service's underlying end users.
Crystal Intelligence's analysis covers 2.275.270 transactions between 2017 and 2025, drawing on 2.052 attributed wallet addresses across more than 330 blockchains. Volume peaked in 2021, at USD 3.12 billion, and nested services were identified across 63 countries. The research found that 87% of total volume was concentrated at a single host exchange, a pattern the report describes as a widening and harder-to-monitor exposure.
Concentration risk also extends to the nested services themselves. In addition, the report states that two licit providers, ChangeNow and SimpleSwap, together account for USD 5.4 billion, or 54.2% of total identified volume.
Sanctioned and unlicensed activity
The research identifies specific categories of higher-risk activity routed through nested arrangements. Iran-facing nested services moved approximately USD 239 million across 17 entities, with at least one remaining active through December 2025. Separately, an unlicensed cash desk processed USD 395 million through a regulated exchange across 11.153 transactions, at an average transaction value of around USD 33.300, which Crystal Intelligence links to over-the-counter (OTC) activity typical of high-net-worth clients. In this case, the host exchange held KYC records only on the cash desk itself, not on its underlying customers.
The report also points to emerging multi-host strategies, in which entities operate simultaneously across several exchanges, leaving no single exchange with a complete view of their activity.
Regulatory relevance
Crystal Intelligence links the findings to the implementation of the EU's Markets in Crypto-Assets Regulation (MiCA) and Travel Rule requirements, arguing that transactions originating from a licensed exchange can no longer be treated as inherently low-risk when the beneficial originator may be an unregistered nested broker operating in a high-risk jurisdiction. The company states that entity-level attribution at the nested-service level, rather than at the host-exchange level, is necessary to make this distinction visible to compliance teams.
Furthermore, the report outlines four areas it says require attention from regulated exchanges and supervisors: optimised detection of nested services using shared infrastructure, mandatory disclosure obligations for permissioned nested arrangements, including know-your-business (KYB) requirements applied to end customers, risk-based monitoring using blockchain analytics capable of entity-level attribution rather than address-level screening alone, as well as cross-exchange information sharing or centralised monitoring for entities operating across multiple hosts.
