By Jon Glass, Partner, Financial Crimes Advisory, SolomonEdwards
As digital assets become further ingrained in the financial mainstream, banks are facing a visibility gap when funds leave traditional payment rails. Many underlying financial crimes are familiar, but digital assets have changed the speed, channels and methods used to move and obscure funds. Clearer regulation alone won’t close this gap in data and oversight.
The core BSA/AML framework still applies. What’s changed is the information available to investigators and the speed and reach of the transactions they assess. The onus is on banks to identify digital-asset exposure, connect customer and payment information with on-chain activity and determine risk ownership in multi-party transactions.
The visibility problem
Traditional AML programs are built around information a bank can see, such as customer profiles, account activity, counterparties, and payment data. A bank may see a wire sent to a digital-asset exchange but have little insight into where the funds move, who interacts with them or what they ultimately become.
Adding rules, lowering thresholds, or generating more alerts doesn’t solve this if the underlying data is still incomplete. Banks need to connect their knowledge of the customer and traditional transactions with blockchain analytics and wallet information. Rather than creating more output from existing monitoring scenarios, establishing this connection gives investigators a fuller view of the activity and something they can act on.
Old risks, new channels
The extent of the visibility gap depends on how a bank interacts with digital assets. Direct exposure is easier to identify because the institution knows it exists and can build controls around it from the outset. Directly offering a digital-asset product allows a bank to establish customer requirements, determine what activity to permit and put controls in place before launch.
Indirect exposure is where challenges arise. Customers might send money to exchanges or transact with companies involved in digital assets even when the bank doesn’t offer those products itself. Those relationships may only be visible through payment and counterparty data. If monitoring only captures the fiat leg of a transaction, the bank misses the broader context of where the funds originated and where they went.
Investigators may encounter funds moving rapidly between fiat and crypto, transactions spanning multiple exchanges or wallets, and activity involving mixers or other methods of
obscuring transactions. They also need to assess wallet and counterparty risk and identify potential sanctions exposure, scams and fraud. These risks can overlap, with the same activity raising AML, fraud and sanctions concerns while the relevant data and investigators sit in different parts of the bank.
The existing AML processes still apply, but investigators need monitoring designed to recognize digital-asset indicators and provide them with the information needed to track the activity. A bank can’t assess or control exposure that hasn’t been identified. So while regulatory clarity may define which rules apply to which businesses, it doesn’t remove that responsibility from financial institutions.
What regulatory clarity does and doesn’t change
Clearer rules can help banks answer three practical questions: which regulator oversees an activity, which digital-asset businesses are covered by the BSA and what information needs to accompany a digital-asset transfer. Those answers help institutions understand exchange and custodian obligations, determine what regulatory history to examine, and establish what information to make available for monitoring.
However, clearer rules don’t necessarily diminish financial-crime risk. A license or registration might show which requirements apply to a company, but it doesn’t demonstrate that its AML controls remain effective. Banks still need to perform their own due diligence and determine whether a counterparty’s controls are appropriate for the risk.
The good news is that despite ongoing regulatory uncertainty, much of this work doesn’t require a finalized legislative framework. Banks can still identify their digital-asset exposure, determine whether their risk assessments cover it, address data gaps, and train investigators to recognize and escalate relevant activity. Regulatory developments might change which requirements apply, but they don’t remove the current need for effective controls.
Closing the gap is organizational
I worked with a bank that believed its digital-asset exposure was minimal because it didn’t offer crypto products. Upon closer look, the payment data told a different story, showing regular volume moving to and from exchanges and crypto fintechs. The activity was monitored, but the bank hadn’t examined it in a way that fully captured its exposure.
Closing that gap takes more than adding blockchain analytics. A blockchain analytics team might see wallet activity with no access to a customer’s banking history, while an investigator might see that history without visibility into the chain. Customer, payment, counterparty, and on-chain information need to reach the same investigator in the same case file.
Institutions also need answers when a digital-asset indicator appears. Many of the programs I see implement the tools without deciding what happens next. Would an investigator recognize the activity and know how to follow it? Could the bank create a list of customers and counterparties with digital-asset exposure? Do its risk models distinguish between different businesses like a stablecoin processor or a retail exchange?
Then comes the ownership question. Risks may be split across AML, fraud, sanctions, cyber and the business line, but someone needs to be responsible for the whole picture. Banks don’t need to wait for the regulatory framework to be finalized. They can identify their exposure now, understand what investigators can and can’t see, address the gaps and establish clear ownership of the risk.
Ultimately, effective oversight depends on whether a bank’s data, procedures and accountability enable investigators to recognize and act on suspicious activity.