A client transfers the fee in USDT. A customer settles the invoice in Bitcoin because it's faster and cheaper for them. At first glance, a normal payment. But if these coins have passed through a mixer, a sanctioned exchange, or a darknet address, you're accepting money of unknown origin. And this is precisely where anti-money laundering laws impose obligations, the violation of which can be costly.
Accepting a cryptocurrency payment presents a different challenge than accepting a traditional bank transfer. With a bank, an institution verifies the origin of the payment in the background. With cryptocurrency, the verification lies with you, and the crucial information isn't on your bank statement, but on the blockchain.
Finanz Forensik GmbH traces the origin of crypto assets. We examine wallets, correlate transactions, and prepare legally admissible reports for law firms and companies. Proof of origin of fundse. This article shows which anti-money laundering obligations apply and how a clean wallet screening process works.
The most important information at a glance
- Personal responsibility instead of bank filters: Those who accept crypto directly bear the responsibility for verifying its origin themselves and cannot rely on an intermediary bank.
- The Money Laundering Act also applies to companies: Due diligence obligations, identification of the beneficial owner and Suspicious activity report You can meet these requirements as soon as you start accepting crypto assets for business purposes.
- The blockchain is your proof: Every transaction is permanently visible. Wallet screening makes sanctions-related issues, mixer exposure, and proximity to the darknet measurable.
- Tainted funds are a real risk: Coins with a problematic history can lead to a ban or investigation even years later.
- Documentation is key: It is not good intentions that provide protection, but verifiable, auditable proof that you have checked the origin.
- The pressure will increase in 2026: Stricter fine rules, the Travel Rule and new reporting channels significantly increase the requirements for crypto compliance.
Why accepting a crypto payment is a money laundering risk
Cryptocurrencies are pseudonymous, not anonymous. Every payment leaves a permanent trace in an open ledger. This is both a blessing and a curse. On the one hand, the path of the money can be fully traced. On the other hand, with every incoming payment, you inherit the entire history of the coins, whether you know it or not.
With a bank transfer, a regulated institution acts as an intermediary between the sender and recipient, conducting its own anti-money laundering checks. Direct cryptocurrency payments lack this filter. The money moves directly from the recipient's wallet to yours. If it originates from a compromised source, this transaction will subsequently appear in your own transaction history.
For law firms, this is doubly serious. A fee derived from fraudulent proceeds can raise suspicions of money laundering and lead to professional disciplinary action. For companies, it means fines, frozen funds for the next stock market payout, and, in the worst-case scenario, a criminal investigation. Our work on [topic missing in original text] demonstrates how such a case is forensically investigated. Crypto forensics.
Money laundering obligations under the German Money Laundering Act (GwG)
The Money Laundering Act no longer applies solely to banks. Goods traders, service providers, and, in many situations, law firms also fall under its purview as soon as they handle assets for business purposes. Anyone accepting crypto assets should be aware of three core obligations.
General due diligence obligations and origin verification
You must identify your contractual partner and understand the purpose of the business relationship. In cases of increased risk, the law requires enhanced due diligence. This includes plausibly verifying the origin of the assets used. Specifically, in the case of cryptocurrencies, this means checking where the coins came from and which addresses they have passed through.
A mere assurance from the payer is insufficient. If someone claims that their Bitcoin came from an early investment, that's just an assertion. Only an analysis of the transaction chain reveals whether this claim holds water. This is precisely where professional proof of origin verification for cryptocurrencies comes in.
Beneficial owner
The German Money Laundering Act (GwG) requires the identification of the beneficial owner, i.e., the natural person who ultimately owns or controls the assets. This is challenging with cryptocurrencies because a wallet address initially reveals nothing about its owner. Is your contractual partner actually behind the payment address, or is it a third party, such as an exchange or a trustee?
ClusterAnalyses and mappings to known services help answer this question. They show whether an address belongs to a regulated exchange, an anonymizing service, or a private wallet. This is the basis for being able to identify the beneficial owner in the first place.
Suspicious activity report
If there are indications that assets originate from a crime or are related to terrorist financing, a reporting obligation to the Central Office for Financial Transaction Investigations may exist. Since 2026, such suspicious activity reports have been processed via the goAML system.portal in a structured format. Anyone who is required to report and fails to do so risks severe penalties.
A reliable suspicious activity report needs substance. A wallet screening provides the facts you can rely on, instead of a vague gut feeling. This protects you in both directions: it substantiates the report when necessary, and it documents your review when there is no suspicion.
Why the origin verification process works differently for cryptocurrencies
With cash or bank transfers, verification of origin relies on documents: bank statements, purchase contracts, pay slips. With crypto, verification is technical in nature. The truth lies in the blockchain, and it cannot be falsified retroactively. Anyone who can read the chain can see what really happened.
The crucial difference lies in the traceability across numerous intermediaries. Coins often change addresses dozens of times before reaching you. Some of these jumps are harmless, such as transfers between your own wallets. Others are warning signs, such as passing through a crypto mixer, which is intentionally designed to obscure the trail.
Furthermore, there's the interconnectedness across various networks. Value migrates from Bitcoin to Ethereum, is moved via bridges to networks like Polygon or Arbitrum, and exchanged for stablecoins. Looking only at the most recent transaction overlooks the history. A forensic analysis traces the path across network boundaries and reconstructs the true origin.
This is how a wallet screening works.
Wallet screening is not a single click, but a structured review process. It transforms a confusing transaction history into a clear risk assessment that you can document and present if necessary.
Sanction and Risk Score
The process begins with comparing the address against known sanctions and risk lists. The system checks for direct or indirect links to addresses listed by OFAC, the EU, the UN, or other authorities. This generates a risk score that categorizes the wallet. Indirect links are particularly important: even an address located just a few steps away from a sanctioned address can carry an increased risk.
Cluster assignment
Individual addresses alone don't tell us much. The analysis becomes meaningful when addresses are grouped into clusters—that is, groups of addresses that demonstrably belong together. This allows us to identify whether a wallet belongs to an exchange, a payment service, a fraudulent scheme, or a sanctioned entity. This association forms the basis for reliably assessing the origin and beneficial ownership. We describe how these methods work in detail in our [section/document/etc.]. Forensic methods.
Exposure to Mixers and the Darknet
The next step involves measuring the extent to which a wallet has had contact with clearly problematic sources. These include mixers and tumblers that obscure traces, as well as darknet marketplaces, ransomware addresses, and fraudulent platforms. This exposure is not simply assessed with a yes or no, but quantified: What percentage of the incoming funds can be traced back to such sources? The higher the percentage, the greater the risk you would be assuming by accepting the transaction.
Handling tainted funds
"Tainted funds" refers to coins with a problematic history, meaning assets that have demonstrably been involved in criminal activities. The insidious thing about them is that the taint doesn't disappear over time or through numerous intermediate transactions. It remains visible on the blockchain and can become relevant years later, for example, when you want to withdraw the funds from a regulated exchange and the exchange verifies their origin.
The practical risks range from account suspension by the stock exchange to the initiation of an investigation. If a withdrawal is linked to illicit funds, the provider often freezes the balance and demands proof of the funds' origin. Without proper documentation, you then bear the burden of proof for something you never verified.
The right approach is prevention. Check before accepting, not after. If a screening reveals an error, you can refuse payment, request an alternative payment method, or document the values separately and report them if necessary. If payment has already been received, a forensic reconstruction can help prove your good faith and the actual origin of the payment. We support companies in this process as part of our services. Financial forensics for companies.
Clear documentation as proof
In money laundering law, what matters is not what you thought, but what you can prove. An audit that isn't documented anywhere is, in effect, nonexistent for the authorities. Therefore, documentation isn't a bothersome addendum, but rather the actual shield.
An auditable record details which addresses were investigated, using which methods, at what time, and with what result. It traces the origin of the funds and documents why a payment was accepted or rejected. If a stock exchange, auditor, or authority later makes inquiries, the answer is already available.
Our reports are structured to withstand scrutiny in court. They are admissible in court, methodologically transparent, and GDPR-compliant. This provides you not just with an internal memo, but with verifiable evidence that you can present to third parties. We offer a more in-depth look at this topic in our article on documenting the origin of funds for cryptocurrencies.
What law firms and companies should do specifically
Define the minimum amount and the specific circumstances under which you will conduct wallet screening. Small, plausible payments from known business partners require less screening than large amounts from unknown addresses. A risk-based approach is also what the German Money Laundering Act (GwG) expects.
Verify the paying address before accepting a payment, not just when problems arise. Document the result in writing and keep it for your records. If any irregularities are detected, obtain a forensic assessment before using the funds further. And train employees who accept payments so they can recognize warning signs.
The effort required for a single screening is manageable, considering the risk that a fraudulent payment can trigger. An overview of our Services and you can find the appropriate testing depths on our services page.
Securely verify crypto payments
Want to accept a cryptocurrency payment and be sure of its origin? We verify the paying wallet, trace the transactions, and create legally admissible proof of funds origin. Nationwide, discreet, and typically with initial feedback within one business day.
Call us at +49 6057 772 994 86 or write to postfach@finanz-forensik.de. Alternatively, you can contact us directly via our contact form. We will tell you openly whether a screening is necessary in your case and how we will proceed.
Note: This article is for general information purposes only and does not replace legal advice in individual cases. Finanz Forensik GmbH is a forensic service provider and not a law firm.
FAQ: Accepting crypto payments and money laundering
This depends on your business activities and the amounts involved. Many goods traders and service providers fall under the Money Laundering Act (GwG) as soon as they handle assets in their business. Even those who are not explicitly obligated can be prosecuted if they knowingly accept proceeds from criminal activity. If in doubt, you should have your obligations reviewed before accepting cryptocurrency payments.
Wallet screening is the systematic examination of a crypto address for risks. This includes checking for links to sanctions lists, association with known services or fraud schemes, and contact with problematic sources such as mixers or darknet addresses. The result is a documented risk assessment upon which you can base your decision.
A verbal or written statement is merely an assertion. It says nothing about whether the coins actually originate from the stated source. Only an analysis of the transaction chain in the blockchain reveals the true path of the money. Therefore, a thorough verification of origin requires more than just the payer's word.
The beneficial owner is the natural person who ultimately owns or controls the assets. With cryptocurrencies, this isn't always obvious because an address doesn't reveal its owner. Cluster analysis and matching transactions to exchanges or services can help determine who is actually behind a payment.
Tainted funds are coins with a tainted history that have demonstrably been involved in criminal activity. The taint remains permanently visible on the blockchain and does not disappear over time or through intermediate transactions. It can later lead to a ban on an exchange or to an investigation, even if you yourself were unaware of the taint.
No, quite the opposite. Regulated stock exchanges conduct their own origin checks for withdrawals. If a connection to tainted funds is detected, the exchange often freezes the balance and demands proof of the funds' origin. Without proper documentation, you then become responsible for providing that proof.
Before accepting a payment, you can refuse it or request an alternative payment method. If the payment has already been received, you should not use the funds until its origin has been clarified. In many cases, there is a legal obligation to report the transaction. A forensic analysis can help clarify the situation and demonstrate your good faith.
Yes, provided it is methodically sound and transparent. Our reports document the checked addresses, the methods used, the date, and the result in a traceable manner. They are structured to be legally valid in court and before authorities, and are prepared in compliance with the GDPR.
An initial screening of individual addresses is often possible at short notice. We typically contact you within one business day to discuss the necessary level of investigation. Complex cases with many intermediaries and multiple networks require more time, as the entire transaction chain needs to be reconstructed.
Whenever you accept significant amounts of cryptocurrency, the contractual partner or address is unknown, a provider has blocked your funds, or there are questions about the origin of the funds, a thorough due diligence review is advisable. It is also recommended in cases of anti-money laundering obligations and ongoing legal proceedings. We support you nationwide, discreetly, and with court-admissible reports. Call us at +49 6057 772 994 86 or email us at postfach@finanz-forensik.de.
