Crypto exposure in banks and PSPs: beyond the wallet risk score

Elvis Galickis of Finchecker explains why crypto-linked payments require institutions to link wallet activity to customer identity and source of funds.

He discusses the limits of analytics, AI's role in onboarding, and practical steps to prepare for the EU’s changing AML framework.

Many banks, merchants, and PSPs don't consider themselves crypto businesses, yet they already process transfers to exchanges or serve corporate clients with crypto-linked activity. Why is this small share of transactions attracting so much regulatory attention, and what is the real risk of treating it as an edge case?

The risk comes from the connection between two financial systems. A payment that begins in a bank account can become a crypto asset and move through several wallets or services. Understanding the original customer does not necessarily explain who ultimately receives the funds or why. That matters for investment scams, money laundering, and sanctions evasion. A legitimate customer can be a scam victim; a corporate client can have crypto activity that was never disclosed during onboarding.

Treating this as an edge case creates an operational gap. Who reviews payments to exchanges? What activity should trigger questions? What evidence would resolve those questions? If those responsibilities are unclear, a small transaction category can become a significant blind spot.

The answer is proportionate assessment. A payment to an exchange is not inherently suspicious, but it should make sense in the context of the customer’s business and expected activity.

From what you see in practice, what do institutions most often miss when a transaction involves a crypto wallet?

I would focus on two gaps: interpreting the risk score and establishing the source of funds.

A low wallet score does not establish that funds came from a legitimate economic activity. It may mean that the analytics provider has not identified a relevant connection. Institutions need to understand the underlying signals, attribution confidence, and coverage limitations.

Equally, a withdrawal from a licensed exchange explains the immediate route, but not necessarily how the customer acquired the assets. Were they bought using accumulated savings, received as business revenue, borrowed, or transferred by somebody else?

The useful question is whether the customer’s explanation matches the available evidence. Exchange statements, bank records, contracts, and wallet history can help build that picture. None should be treated as conclusive in isolation.

What are the hardest parts of due diligence when onboarding a crypto exchange, VASP, or crypto-active corporate client, from verifying licences and ownership to researching wallet activity?

Source of funds is particularly difficult because the evidence spans systems. The blockchain records transfers; bank statements record fiat movements; contracts explain the claimed commercial purpose. Connecting those records to the same customer and economic activity is the hard part.

For an exchange or virtual asset service provider, the institution also needs to distinguish customer funds from the company’s own funds. A busy wallet may pool assets belonging to many customers. Its transaction volume is not automatically the company’s revenue, and wallet activity alone cannot validate the business model.

Authorisation and ownership checks remain essential. Verify the actual contracting entity, permitted services, and relevant jurisdiction. Then establish who owns and controls the business, including whether that information has changed.

Finchecker provides software, including live wallet screening and VASP due diligence. The institution’s compliance team assesses the evidence and owns the decision. Technology can organise the research, but it cannot turn missing evidence into a verified source of funds.

Could you walk us through an anonymised case where fraud or illicit activity was uncovered? What did the technology flag, and what could only be caught by an experienced investigator connecting the dots?

To illustrate the process, consider a hypothetical sanctions-evasion scenario, rather than a Finchecker client case.

An EMI serves an EU trading company selling electronic components. The company requests a substantial payment to an exchange, describing it as treasury diversification. Its supporting records include wallet addresses associated with recent stablecoin receipts.

Wallet analytics flags an indirect connection to a sanctioned service. Transaction monitoring also identifies a sharp increase in activity compared with the company’s declared profile. These signals justify further review; they do not establish sanctions evasion.

The analyst asks for exchange records, contracts, and shipping documents. Suppose these show that stablecoin receipts correspond to specific invoices, contradicting the treasury explanation. Further checks establish that the actual buyer is controlled by a sanctioned person, despite a different intermediary appearing on the invoices.

That verified commercial relationship would materially change the assessment. The institution would escalate the matter and determine applicable payment restrictions and reporting obligations.

The distinction is crucial: technology identifies connections and inconsistencies. The investigator establishes who is involved, what the payment represents, and whether the evidence supports a sanctions concern.

Blockchain analytics is often presented as the answer to crypto transaction monitoring. What are its limits, and which other technologies or data sources play an important role?

Blockchain analytics helps reconstruct fund movements and identify exposure to attributed services. It does not, by itself, establish the purpose of a payment or the identity of everyone involved. Attribution and wallet clustering can carry uncertainty, and coverage varies across assets and networks.

Useful supporting sources include company and ownership registers, authorisation registers, sanctions screening, adverse media, exchange records, bank transactions and commercial documents. Travel Rule information, where applicable and available, can help identify parties to crypto transfers.

AI can help organise this material, but its role needs clear boundaries. Our client-facing use is still at an early stage, focused on onboarding risk assessment and readable summaries. Internally, we also use adaptive machine-learning models, pattern recognition, and decision-support processes.

An AI summary should help the analyst understand the evidence and outstanding questions. A fluent explanation is not proof. Its claims need to be traceable to sources, and important conclusions need verification.

Looking ahead to 2027, with the EU's new AML Regulation applying and AMLA ramping up supervision, which regulatory expectations and emerging threats should institutions start preparing for now?

The EU’s AML Regulation generally applies from 10 July 2027. AMLA’s timetable separates selection from supervision: it plans to select 40 entities in 2027, with direct supervision starting in 2028.

For institutions, preparation should start with their actual exposure. Identify customers that use crypto, the services they use, and where responsibility for reviewing that activity sits.

Then test the evidence behind decisions. Can an analyst explain why a customer was accepted, how the source of funds was assessed, and what prompted additional checks? Can another reviewer reconstruct the conclusion from the records?

For AI-assisted work, retain the supporting evidence, document limitations, and make responsibility for decisions clear. Model changes should also be controlled and evaluated.

The threats I would prioritise are fabricated source-of-funds evidence, deepfake-assisted onboarding, investment scams, and the use of stablecoins to obscure commercial counterparties. Institutions should prepare to challenge plausible stories with independently verified evidence.

About author

Elvis Galickis is CEO of Finchecker. He has more than ten years of experience in fintech development, with extensive involvement in payments projects. His work in compliance grew from a client development project into a standalone business. He focuses on how technology can help financial institutions assess customer risk and connect evidence across payments, company data, and crypto activity.About Finchecker

 

Finchecker compliance SaaS is provided for banks, electronic money institutions, payment service providers, and crypto businesses, primarily in Europe. Its products include sanctions screening, customer and business verification, transaction monitoring, card and wallet screening, and VASP due diligence. Its software supports compliance teams in gathering evidence, assessing risk, and documenting decisions.