Technology risks specific to crypto

Crypto adds a risk category that traditional AML programs barely had to think about: the technology itself. Whether a firm supports a privacy coin, accepts deposits from a bridge or lets customers withdraw to any address changes its exposure as much as who its customers are. The compliance officer has to understand each feature well enough to rate it, control it and explain to the board why the firm accepts, limits or refuses it.

Technology as a risk category

Recommendation 15 requires firms to assess the risks of new products, business practices, delivery mechanisms and technologies before launch, and FATF's 2021 Updated Guidance on virtual assets discusses features that increase anonymity or obscure flows. In the enterprise-wide risk assessment (see the lesson The risk-based approach), the technologies category asks three questions for every feature:

1. Does it break the trail? Can value move without a visible link between source and destination?
2. Does it remove the intermediary? Can value move without any obliged entity applying CDD?
3. Can we see it? Do our screening and analytics tools cover the chain, token or protocol?

A "yes, yes, no" answer is the profile of a high-risk feature.

Privacy coins, mixers and CoinJoin

Privacy coins, which FATF calls anonymity-enhanced cryptocurrencies, hide senders, receivers or amounts by design, for example through ring signatures, stealth addresses or zero-knowledge proofs. Some offer optional privacy, in which case transparent transactions remain traceable. For a VASP the problem is concrete: once funds enter a shielded pool, analytics cannot show where deposits came from.

Mixers pool funds from many users and pay out to fresh addresses. Centralized mixers take custody; smart-contract mixers such as Tornado Cash run without an operator holding the funds. CoinJoin combines inputs from several users into one transaction with equal-value outputs. Mixing has legitimate privacy uses, but mixers have also been central to laundering ransomware and DPRK-linked theft proceeds, and FATF's red flag indicators (September 2020) list funds sourced directly from mixing services. How mixing appears on-chain is covered in the IDFE-BA lesson Mixers, CoinJoin and obfuscation in graphs; sanctions on smart contracts are covered in the lesson Wallet and transaction screening.

Bridges, chain-hopping, DeFi and DEXs

Bridges move value between chains by locking or burning on one chain and releasing or minting on another. Chain-hopping is the use of bridges and swaps to move value across several chains quickly, so each analytics view sees only a fragment. After the 2022 theft of about USD 620 million from the Ronin bridge and the 2025 Bybit theft, both attributed to DPRK-linked actors, stolen assets crossed several chains within days. Bridges are also hacking targets themselves.

DeFi protocols and decentralized exchanges (DEXs) let users swap, lend and borrow without a custodian. The risk for a VASP is indirect: funds arriving from a DEX router or lending pool carry no information about who supplied them, and the protocol applies no CDD. Your controls are on-chain exposure analysis, coverage of the chains involved and the cross-chain tracing methods described in the IDFE-BA lesson Cross-chain tracing.

Unhosted wallets, P2P and OTC

Unhosted wallets are controlled by the user, with no intermediary. Most transfers to and from them are legitimate, but P2P transfers between unhosted wallets take place entirely outside the obliged-entity perimeter, a gap FATF's targeted updates have repeatedly highlighted. VASP controls focus on the edge: collecting counterparty information, proving address ownership where risk requires it and monitoring exposure (see the lesson Unhosted wallets and self-hosted transfers).

P2P platforms and OTC brokers create a related risk: a customer who trades for others in volume may be running an unregistered exchange through your account, known as a nested service. OTC desks that settle large trades in cash or through third parties are a classic route for converting criminal fiat into crypto and back.

Kiosks, NFTs and stablecoins at scale

Crypto ATMs and kiosks combine cash with instant crypto delivery. Their recurring risks are scam victims coached to deposit cash, money mules feeding many small transactions and weak identity checks at low amounts. Operators mitigate with transaction limits, identity verification, warnings at the screen, monitoring for repeated use across kiosks and screening of destination addresses.

NFTs are generally outside the VA definition when used as collectibles (see the lesson The VASP as an obliged entity), but marketplaces see wash trading, price manipulation and high-value sales between linked wallets that can disguise transfers of value.

Stablecoins are now the main settlement asset for many legitimate and illicit flows. FATF's targeted report on stablecoins and unhosted wallets (March 2026) drew on industry data showing that they have become the asset class most used in illicit virtual asset flows, a shift explained by their price stability, liquidity and reach across chains. For the risk assessment this means stablecoin exposure, by token and by chain, is a major factor in its own right. Stablecoins also offer a mitigation that most assets lack: many issuers can freeze addresses, and the same report listed as good practice requiring issuers to be able to freeze, burn or withdraw tokens in the secondary market. A compliance team should know which stablecoins it supports, on which chains, and whether their issuers freeze in practice.

How each feature enters the risk assessment

Ratings should rest on your own data, not on a generic table. The query below measures how much monthly inbound volume comes directly from each analytics category, which gives the EWRA a factual basis and lets the board see trends.

-- Monthly inbound volume by direct-exposure category (fictional schema)
SELECT DATE_TRUNC('month', d.block_time)          AS month,
       COALESCE(e.category, 'unlabeled')          AS category,  -- mixer, bridge, dex...
       COUNT(*)                                   AS deposits,
       SUM(d.amount_usd)                          AS volume_usd,
       SUM(d.amount_usd) * 1.0 / SUM(SUM(d.amount_usd))
         OVER (PARTITION BY DATE_TRUNC('month', d.block_time)) AS share_of_month
FROM deposits d
LEFT JOIN address_exposure e
  ON  e.address = d.source_address
  AND e.exposure_type = 'direct'
  AND e.snapshot_date = d.screened_on          -- label as known at screening time
GROUP BY DATE_TRUNC('month', d.block_time), COALESCE(e.category, 'unlabeled')
ORDER BY month, volume_usd DESC;

The query joins each deposit to the analytics label that applied to its source address on the day it was screened, so the figures reflect what the firm knew then. A left join keeps unlabeled deposits in the total, which prevents the shares from being inflated, and the window function divides each category's volume by the month's total. Date functions differ between engines (some use DATETRUNC or DATE_FORMAT). Indirect exposure and the limits of labels are covered in the lesson Blockchain analytics for compliance.

Mitigation versus wholesale de-risking

Faced with a risky feature, a firm has a ladder of options: accept with monitoring, apply limits or enhanced due diligence, restrict the feature (for example, allow deposits but not withdrawals to certain protocols), or decline it entirely. The RBA expects the choice to follow the assessment, case by case.

FATF has warned repeatedly against wholesale de-risking, meaning cutting off whole categories of customers or activities to avoid risk rather than managing it. Its October 2014 statement said the RBA means case-by-case decisions, not wholesale de-risking, and its October 2021 stocktake of the unintended consequences of the standards found that de-risking pushes activity into less transparent channels and harms financial inclusion. The February 2025 amendments to the Interpretive Note to R.1 ask supervisors to watch for overcompliance based on a partial understanding of risks.

Declining a feature is still legitimate when the firm genuinely cannot control it, such as a privacy coin whose transactions its tools cannot screen. The test is whether the decision is documented, based on the firm's own assessment and reviewed when tools or facts change. "We blocked all transfers to unhosted wallets because it was easier" fails that test; "we do not list asset Z because no screening coverage exists, reviewed quarterly" passes it.

Exam focus: the R.15 duty to assess new technologies before launch; the three questions (trail broken, intermediary removed, visibility) for rating a feature; the risks of privacy coins, mixers and CoinJoin, bridges and chain-hopping, DeFi and DEXs, unhosted wallets and P2P, OTC and nested services, kiosks, NFTs and stablecoins; why stablecoins are both a major illicit channel and a source of mitigation through issuer freezes; measuring exposure with point-in-time labels; the ladder of mitigation options and why FATF rejects wholesale de-risking while allowing documented refusals.