Research Report No. 16 · Compliance & Forensics

Compliance blind spots between crypto and fiat

Quality and plausibility review of the Crystal Report „Compliance Blindspots“ (2026), compared with official sources – and what the implications are for investigations and compliance in Germany.

83 %
Of the jurisdictions with a travel rule law – 55 out of 91 without supervisory measures (FATF)
92,4 %
Trading high-risk crypto cards is gambling (recalculation).
108.158
FIU reports from digital financial service providers 2025 (29 %)
≈ 40 %
Of the card volume of USD 1.18 billion, one provider accounts for the entire amount.

Whitepaper 2026

Management Summary

  • Context problem, not identity problem: Mobile money providers, banks, and card programs often know their customers – what they lack is an understanding of the purpose and subsequent events. Identity can often be obtained through information requests, but the connection must be established forensically.
  • Internal contradictions in the Crystal Report: In the Egypt case study, the tiles (USD 3.4 million high-risk, USD 534,000 sanctions-related) exceed the total inflow of approximately USD 452,000 many times over; the high-risk sums in the map section fluctuate between USD 161.7 and 167.6 million.
  • Headline vs. Substance: Of approximately USD 166 million in high-risk flows, USD 153.8 million is attributable to gambling; sanctions, scams, stolen funds, mixers, darknet and ransomware together account for approximately USD 13.8 million.
  • Focus instead of breadth: „Entity A“ represents approximately USD 479 million – about 40 % of the card volume of USD 1.18 billion.
  • Regulation targets entire conversion chains: FATF, EU (TFR, MiCAR, from 2027 AMLR) and German legislation (§ 15a GwG, GwGMeldV, KStTG) address precisely these transitions. The gap increasingly lies in enforcement.
  • Germany: Illegal crypto ATMs have been documented (BaFin(Raid 2024); Real-time transfers, payment apps, neobanks, and third-country BINs are forensically relevant, but not proven as crypto settlements. Official quantification is lacking.
  • For Appraise: Identify supplier figures, compare them, and cite them only with date, reference basis, and level of evidence.

The Crystal Intelligence report „Compliance Blindspots“ (July 2026) describes three transition zones where classic blockchain analysis only captures part of the risk picture: physical cash-to-crypto services, the handling of P2P crypto trading via mobile money and crypto-funded payment cards. The central thesis – that the biggest investigative and compliance problem often lies not in the blockchain itself, but at the interfaces between payment systems – is supported by the FATF, BIS, EBA, BaFin, and FIU. However, the review also shows: The theory is more convincing than its figures suggest. For expert opinions, the report is suitable as a typology and search hypothesis – not as a reliable quantity specification.

Key verdict

Crystal identifies the right problem, but supports it with figures that are sometimes inconsistent and formulates some statements too absolutely. On-chain data does not prove the physical cash transfer or the purpose of a mobile money payment. However, it can reveal risk relationships once wallets, services, BIN structures, or counterparties are reliably attributed. The most robust method remains cross-rail forensics, i.e., on-chain analysis., OSINT, provider attribution, payment data and legally obtained KYC/account data – and discloses the level of evidence for each statement.

Fiat's entry Cash, bank account,Mobile Money,Real-time transfer Conversion Cash desk, ATM,P2P traders, OTC On-Chain Self-custody wallet,VASP, Bridge,Stablecoin Off-Ramp Crypto card, OTC,P2P sales use Merchant, ATM,Bank account What the respective position typically sees Bank/PSP: Account holder,Amount, Contra account often none or onlyweak documentation TXID, address, amount,Time – public Provider: Funding Wallet,KYC weak to non-existent Acquirer: Card payment,not the wallet origin Dashed lines: System boundaries where data context can be lost.
Figure 1: The cross-rail chain. Each station only sees its own section; context is lost at system boundaries. Own illustration.

02 Subject of investigation and methodology

The subject is the 26-page report „Compliance Blindspots“ by Crystal Intelligence BV (Amsterdam, July 2026). He summarizes three studies: a physical survey of cash-to-crypto services, the analysis of 57,829 P2P ads in ten markets, and blockchain forensics on 45 VASPs and approximately 120 wallets from nearly 100 card issuers. Crystal itself acknowledges limitations: ads are not volumes, VASP tracing does not capture fiat values, and risk categories depend on continuously updated entity labels.

2.1 Testing procedure of this version

Three steps: recalculate all key figures against each other (text versus graph, summary versus detail page, totals versus individual values), check the methodology regarding sample, categories and reference bases, compare the key statements with external sources – with priority given to legal texts, supervisory authorities, FATF, BIS, Europol and official German statistics.

Certificate classMeaningTreatment in the whitepaper
A – Primary Law / SupervisionLaw, regulation, regulatory guideline, FATF, BIS, Europol, FIU, BundesbankRobust external reference frame
B – Industry / Market DataGSMA, Chainalysis, TRM LabsRegarding size and typology; consider methodology and interests.
C – Crystal's own surveyPhysical mapping, internal entity labels, provider/BIN samplingNot automatically independently verified; recalculated (Annex A)
D – Investigative research / Secondary sourcesICIJ, specialist media, law firm and consultant publicationsFor contextualization; the origin of the primary data is being checked.

03 What Crystal actually shows

3.1 The structural gap

Banks, card networks, mobile money providers, and cryptocurrency exchanges each primarily monitor their own segment of the market. When value is converted between these systems, the origin, economic purpose, or end user is lost: A P2P transfer is a domestic payment to the mobile wallet provider, a deposit from a self-custody address appears ordinary to the exchange, and a merchant payment doesn't reveal to the acquirer which wallet funded the card.

Value changes the payment world – the context remains. The blind spots that no individual monitoring can close are created at the interfaces between cash, bank account, wallet and card.

3.2 The three channels examined

channelCrystal findingsForensic significance
Cash-to-CryptoHundreds of services worldwide; Hong Kong > USD 2.5 billion cash turnover in 2024; 33 % related to unlicensed exchanges; 97 % flow to major international exchanges.The origin of the cash is determined before the on-chain data record; the attribution of cash desk wallets is crucial.
Mobile Wallet Settlement57,829 P2P ads in ten markets; mobile money share 48 % (Colombia) to 85 % (Ivory Coast); 45 VASPs with $403 million in on-chain flows.Fiat payment and crypto fulfillment exist in separate systems. Identity is usually present, purpose not.
Crypto-funded cardsNearly 100 providers; $1.18 billion in on-chain flows; 67.7% of % with no or weak identity verification; 32 out of 54 BINs (59 %) with no-KYC; +66% of % inflows in 2025.The funding wallet is the last point where the origin is visible on-chain.
Analytical core

The three channels differ technically, but follow the same pattern: when transitioning to a different system, the data context becomes less comprehensive. The crucial point is not to monitor every subsystem to the maximum extent, but to identify the conversion points and consolidate evidence across system boundaries.

04 Quality and plausibility check of the Crystal Report

A supplier report is cited in expert opinions, legal documents and compliance decisions – therefore, the key figures must be verifiable.

4.1 Internal consistency: What can be verified

A significant portion is consistent: The ten markets total exactly 57,829 ads, the card growth of 66 % results from 689.8 compared to 415.5 million USD, the shares 67.7 / 87.9 / 12.1 % correspond to 99 providers, 32 of 54 BINs result in 59 %.

4.2 Internal consistency: What doesn't fit together

FindingsSourceWeight
Egypt/Ebtoo – Order of magnitude: Tiles: $3.4 million high-risk (1.8 %), $1.4 million illegal services, $534,000 sanctions-related – the Sankey diagram on the same page shows only $452,393 total inflow. Implicit base approximately $189 million, not specified anywhere.p. 10high
Egypt/Ebtoo – Percentages: Running text 2.9 %, tile 1.8 %.p. 10medium
Cards – High-Risk Total: 166 million (Summary), 161.7 million (Detail), table total approximately 167.6 million, percentage basis approximately 166.4 million USD.pp. 2, 13, 14medium
Cards – entrance and exit mixed: „"USD 3.8 million related to sanctions" as an inflow; according to the table, only USD 2.55 million inflow, USD 1.27 million outflow.p. 13medium
BIN jurisdictions: Text HK 47 % / USA 16 %, Graphic HK 48 % / USA 19 %.p. 15small amount
BIN count: 32 No-KYC-BINs vs. „22 unique BINs“ – ratio not explained.p. 14, 19medium
Image captions swapped or repeated.p. 12, 15low (editorial)

4.3 Headline versus Substance

The report places approximately USD 166 million in high-risk categories on an equal footing with sanctions, the darknet, ransomware, and terrorist financing. In reality, this figure does not include… $153.8 million (92.4 %) on gambling Depending on the legal system, these transactions may require a permit, be prohibited, or be legal, and as an indicator of money laundering, they are significantly weaker than those linked to sanctions or scams. The categories with investigative weight total approximately USD 13.8 million, just over one percent of the USD 1.18 billion in card transactions; the terrorist financing indicator amounts to approximately USD 6,200, of which USD 261 is incoming.

composition Non-gambling categories in detail 04080120150 153,8 13,8 gambling all the restCategories Million USD (total inflows and outflows) 01234 Million USD SanctionsStolen fundsScamsmixerIllegal servicesDarknet marketsRansomwareTerror financing 3,803,502,501,701,500,590,240,006
Figure 2: Composition of the high-risk flows reported by Crystal for crypto card wallets (total of inflows and outflows). Data source: Crystal Intelligence 2026, p. 13; author's own illustration.

Furthermore, there is a strong concentration: „Entity A,“ an unlicensed provider based in Georgia, recorded inflows of approximately USD 478.8 million on TRON – roughly 40 % of all tracked card flows. The report leaves open the question of whether this growth of 66 % is broadly based.

4.4 Methodological limitations

  • Mobile Financial Services category: For India, Crystal includes UPI and IMPS – bank-based systems, not comparable to e-money wallets like bKash. India accounts for 18,147 reports (just over 31 of the sample are %).
  • „Prohibition markets“ as a framework: This is suitable for Egypt, Algeria, and Bangladesh – but not for Nigeria, India, the Philippines, or Colombia. The FATF overview from July 2026 confirms this.
  • Identity present, context missing: Crystal describes its mobile money payments as "KYC-verified" – the account holder can generally be contacted via information.
  • Advertisers are not sales: Ads, dealers, and volume are three different sizes.
  • Hong Kong number: The figure of 2.5 billion USD lacks a rationale; the ICIJ also relies on Crystal.
  • Selection bias: Openly advertising card providers are overrepresented.
  • Internal tension: Cash origin „not identifiable“, card gap „directly“ closeable – both are only true in a narrower sense.
  • Interests: The report also serves as product communication – a reason for independent verification.

4.5 Clarification of the pointed statements

Important distinction

„The statement "Blockchain analysis cannot retrospectively identify the origin of cash" is only partially true: The blockchain does not document the physical transfer. However, once wallets of a cash-to-crypto service have been reliably identified, on-chain analysis can show that a subsequent deposit originates directly or indirectly from this infrastructure. What is missing is proof of the specific off-chain transaction – not necessarily every risk factor.

Conversely, blockchain analysis alone does not "close" the card gap: it reveals the origin of the funding wallet, but not who uses the card at the terminal. For that, card, issuer, and acquirer data are needed.

4.6 Overall assessment of coherence

StatementDocument qualityVerdict
Compliance gaps arise at the interfaces between payment systems.Externally supported by FATF, BIS, EBA, BaFin, FIUcoherent
Cash desks feed large stock exchanges with "unobtrusive" deposits (97 %)Crystal only; origin not disclosed.plausible, but not verified
Bans shift P2P settlement to mobile moneyPlausible for individual markets; selection and categories inconsistent.partially conclusive
Crypto cards are a relevant off-ramp option with weak KYC.Sample of 99 providers, test registrationscoherent as a typology
$166 million in high-risk flows via crypto cardsRegarding 92 % gambling; sums inconsistentmisleading without classification
Egypt case study (Ebtoo)The tiles and the diagram differ by orders of magnitude.Clarify before use

05 External sources: How far can Crystal be confirmed?

5.1 FATF 2026: Three reports, one finding

March 2026: The Targeted Report on stablecoins and unhosted wallets warns against P2P transactions without a regulated intermediary; stablecoins have grown to over 250. Token and a market capitalization of more than USD 300 billion, with a share of 84 % of the illegal volume in 2025 (according to Chainalysis). July 2026: 83 % (91 out of 109) of the jurisdictions have travel rule laws – but 55 of them (60 %) still lack a supervisory or enforcement measure (para. 25; the Executive Summary speaks of „almost half“). September 3, 2026: The report on underground banking and „digital hawala“, prepared under German co-leadership, describes cases involving over €500 million – an independent confirmation of the cross-rail problem.

5.2 EU, EBA and BaFin

The EBA Risk Factor Guidelines explicitly mention blockchain analytics as a risk mitigation tool; TFR (EU) 2023/1113 and the Travel Rule Guidelines require originator and beneficiary data. MiCAR generally requires authorization (with a narrow exception: reverse solicitation, Art. 61); the transition period ended EU-wide on July 1, 2026, and in Germany on December 31, 2025. BaFin specifies the enhanced due diligence requirements for self-hosted addresses (§ 15a GwG).

5.3 Mobile Money: Order of magnitude confirmed, crypto usage not.

The GSMA reports approximately 2.3 billion registered and 593 million monthly active mobile money accounts for 2025, with more than USD 2 trillion in transactions – but does not confirm Crystal's country-specific P2P crypto shares. UPI and Pix are not classified as mobile money by the GSMA. High mobile money usage is not an indicator of money laundering; this only becomes relevant when linked to specific crypto transactions.

5.4 BIS: Regulatory arbitrage between payment instruments

BIS Paper 166 (March 2026) assesses AML/CFT regimes over cash, bank money, crypto assets and CBDC It moves beyond this and addresses arbitrage between the instruments – almost identically to the Crystal thesis. BIS Bulletin 111 (2025) proposed using on-chain transparency specifically at the points of contact with the banking system.

5.5 Illicit Volume Data: Record Values, but Other Drivers

TRM Labs TRM estimates the illegal cryptocurrency volume at USD 158 billion in 2025, while Chainalysis estimates at least USD 154 billion – largely driven by sanctions evasion, particularly the ruble-backed stablecoin A7A5 (Chainalysis estimates USD 93.3 billion, TRM over USD 72 billion). The stablecoin share of 84 % cannot therefore be directly attributed to investment fraud; such figures should be identified as provider estimates.

5.6 Europol: Division of labor infrastructure, also in Germany

In 2025, Europol dismantled an investment fraud network with over 5,000 victims and around €460 million, as well as a network with over €700 million in laundered funds – with raids also in Germany and including the affiliate marketing infrastructure of the fraudulent advertising.

06 Source matrix: confirmed, plausible, or unclear?

Crystal statementExternal evidenceClassification
Compliance gap at fiat/crypto transitionsFATF 2026a–d; BIS 2025/2026; EBA 2024; BaFinStrongly confirmed
Unhosted wallets / P2P increase visibility risksFATF 2026a/b; EU TFR; § 15a GwGStrongly confirmed, but risk-based; self-custody is not illegitimate per se
Mobile wallets as a crypto settlementGSMA confirms scale; FATF „digital hawala“Structurally plausible; Country values not verified
Mobile money payments „invisible“Crystal describes its own KYC-verified transfers.To be corrected: Identity present, purpose lacking
Hong Kong cash desks > $2.5 billion 2024ICIJ relies on Crystal; Hong Kong prepares licensing regimePlausible, essentially Crystal-based
67.7 %, the card provider without genuine KYCNo equivalent independent sampleNot independently confirmed; internally consistent
$166 million in high-risk cryptocurrency cardsCrystal table itself: 92.4 % gamblingNeeds classification; Totals inconsistent
Map BINs as a focal pointCard/issuer structure is comprehensible.Mechanism plausible, numbers proprietary
Stablecoins dominate illegal on-chain flowsFATF 2026a; Chainalysis 2026; TRM 2026Confirmed, heavily influenced by A7A5

07 Germany: Market, regulation and investigative reality

Crystal investigates emerging and Asian markets. The Crystal figures do not apply to German cases – what matters is which of the three channels correspond to German cases and which of these are substantiated, and which are only forensically plausible.

7.1 Documented and possible correspondences of the three channels

Crystal ChannelGerman equivalentEvidence
Cash-to-CryptoProven: illegally operated crypto ATMs (e.g., at kiosks). Possible: Cash OTC trading and cash handovers in crypto transactionsBaFin raid August 2024: 13 ATMs at 35 locations, almost €250,000 in cash; no official volume statistics.
Mobile Wallet SettlementPossible settlement rails: real-time transfers, payment apps (PayPal, Wero), neobank accounts; money mulesNot documented as a crypto settlement; documented are the prevalence (Bundesbank) and increase in FIU reports of digital financial service providers.
Crypto-funded cardsCards from non-EU programs (HK or US BINs) at German terminalsNo official figure; Crystal cites Western Europe as his area of operation.

7.2 Key figures at a glance

Key figure / ruleGermany 2024–2026Forensic classification
FIU: Crypto reference 20248,711 messages; 3.3 % out of 265,708Measure reports, not crimes.
FIU: Crypto reference 2025No longer shown separatelyTime series breaks off
FIU: Digital Financial Service Providers 2025108,158 messages; 29 %Central observation point
Bundesbank: Cash 202545 % of everyday payments; 71 % between private individualsHybrid payment area
Bundesbank: Crypto usage by 20254 % purchased/paid for; 10 % plannedPrimarily investment
BaFin: Crypto ATMs 202413 vending machines, 35 locations, ~250,000 EURCash-to-crypto also exists here.
GwGMeldV since March 1, 2026Blockchain transaction ID (mandatory field)Messages can be linked with on-chain data.
MiCAR / KMAGTransitional period: Germany until 31.12.2025; EU until 1.7.2026Approval status as an OSINT checkpoint
Suspicious activity reports from digital financial service providers (share of total reporting volume) 040.00080.000120.000 43.19052.28934.357108.158 (13 %)(16 %)(13 %)(29 %) Total: 337,186Total: 322,590Total: 265,708Total: 374,693 2022202320242025
Figure 3: Suspicious activity reports from digital financial service providers 2022–2025, showing their share of total reports. Source: FIU Annual Report 2025, Table 1. Author's own illustration.

7.3 FIU 2024 and 2025: More reports, fewer published crypto metrics

In 2024, the FIU reported 8,711 crypto-related notifications (3.3 %). The 2025 annual report records 374,693 notifications (+41 %); digital financial service providers increased their share to 29 %, with fraud and embezzlement being the most frequent reason for reporting. The FIU seized approximately €751.8 million through 106 immediate actions. The 2025 report no longer publishes a total number of crypto-related notifications – internal quarterly special analyses are not quantified.

7.4 Money Laundering Reporting Ordinance: The TXID becomes mandatory

Since March 1, 2026, the blockchain transaction ID has replaced the transaction number in crypto transactions; this includes the cryptocurrency value, exchange rate, and provider. According to the FIU, incomplete mandatory fields lead to the technical rejection of the report. This improves interoperability between Suspicious activity report and on-chain analysis significantly.

7.5 MiCAR and KMAG: Approval as a test point

According to Section 50 of the German Banking Act (KMAG), the continuing authorization for existing providers expired no later than December 31, 2025; the transitional arrangement ended EU-wide on July 1, 2026. Since then, the authorization or passporting status (BaFin database, ESMA register) has been a particularly reliable OSINT checkpoint – a lack of proof is not evidence of a crime, but a relevant indicator.

7.6 Self-Custody: Section 15a GwG

For transfers to or from self-hosted addresses, providers must identify money laundering, terrorist financing, and sanctions risks and take appropriate measures; according to Section 10 of the German Money Laundering Act (GwG), general due diligence obligations apply outside of a business relationship for transfers exceeding €1,000. Self-custody is neither prohibited nor automatically suspicious.

7.7 Payment behavior: Germany remains hybrid

According to a Bundesbank study from 2025, for the first time more everyday payments were processed electronically than in cash; cash remains the most frequently used individual payment method at 45%, and 71% between private individuals. Since October 9, 2025, credit institutions have also been required to be able to send real-time transfers. 4% have purchased or paid with crypto tokens; 92% of those with crypto experience (n=139) primarily use them for investment. The relevant transition is frequently bank account → exchange/wallet → investment or conversion back.

7.8 German law enforcement: No/Low KYC infrastructure is real

Operation „Final Exchange“ (September 2024): The German Federal Criminal Police Office (BKA) and the Central Office for Information Security (ZIT) shut down 47 exchange services hosted in Germany. At the end of April 2025, the infrastructure of the swapping service eXch was seized – including approximately €34 million in crypto assets and over eight terabytes of data. Interface investigations are standard practice.

7.9 BaFin warnings: Platform clones and identity theft

BaFin warnings from 2025 document serially constructed investment websites (two platform series with 28 websites) and identity theft to the detriment of the Stuttgart Stock Exchange. Domain history, legal notices, trademark infringement, advertising materials, and license information support off-chain attribution.

7.10 Tax transparency: KStTG

The Crypto Asset Tax Transparency Act (DAC8) has been in force since December 24, 2025; obligations apply from calendar year 2026, first report to the Federal Central Tax Office (BZSt) by July 31, 2027. It does not cover private P2P transfers outside of reportable providers.

7.11 Operation Chargeback: Payment infrastructure as part of the crime

Over 4.3 million affected cardholders in 193 countries, over €300 million in damages, around 14 million analyzed transactions: not a crypto case, but the same weakness – fraud, settlement, shell companies and money laundering are distributed in such a way that no one involved sees the big picture.

What cannot be reliably quantified for Germany

No official German source quantifies the volume of physical cash-to-crypto transactions, the share of P2P crypto trading via real-time transfers or payment apps, or the prevalence of no-KYC crypto cards in Germany. The BaFin raid confirms the existence of illegal ATMs, not their revenue. Therefore, the Crystal meth figures should not be extrapolated to the entire German population; they can be used for typology and search hypotheses, not as evidence of prevalence.

08 A forensic model for practical application: Cross-rail evidence

It is not the blockchain alone, but the connection of the evidence spaces that is decisive. A robust case is documented in five levels:

levelTypical dataQuestion of proof
1 · On-ChainTXID, address, token, amount, time, chain, smart contract and bridge interactionWhat has been technically proven to have happened?
2 · Service AttributionExchange/VASP label, card issuer, BIN, merchant, bridge, swap serviceWhat infrastructure has taken over the river?
3 · Off-Chain / OSINTWebsites, domains, messenger channels, commercial register, license status, warning messagesWho is behind the service or infrastructure?
4. Payment and identity dataBank account, real-time transfer, mobile wallet, card details, KYC, login/IP data, recipient verificationWho performed the off-chain move?
5 · Legal safeguardsFreeze request, information request, protective order, legal assistance, issuer freezeHow does analysis become a usable measure?

8.1 Levels of evidence and formulations

degreebasisExample of wording in the expert opinion
E1 · On-Chain observedReproducible transaction data„"Address X transferred Y USDT to address Z on … (TXID …)."“
E2 · Information from authorities or providersInformation, KYC data, decision„"According to information from the provider dated ..., the account holder is ..."“
E3 · OSINT-corroboratedSeveral independent open sources„Several independent sources attribute the domain … to the operator ….“
E4 · Tool AttributionLabel of an analytics provider, with date and version„"The analysis tool ... assigns the address (as of ...) to the service ...."“
E5 · Analytical HypothesisPattern, time correlation, plausibility„"The temporal and quantitative agreement suggests that ... Alternative explanations: ..."“

8.2 Time correlation as a bridge between systems

Identical or corresponding amounts, short intervals, recurring frequencies, and identical counterparty patterns can support a hypothesis, but do not replace establishing identity. Good reports provide alternative explanations and the information that would verify the connection; since October 2025, the result of the recipient verification can also serve as a starting point.

8.3 Test scheme for supplier studies in expert reports

  • Version and date: Which version, which data and label status?
  • Reference basis: Incoming, outgoing, or total; providers, wallets, or transactions?
  • Text-graphics matching: Do the body text, tiles, tables, and diagrams match?
  • Sample: Selection, size, obvious distortions?
  • Composition: Which category drives the headline value?
  • Concentration: How much is attributable to individual players?
  • Independent confirmation: Is there a source based on a different data set?
  • Interests: Is the study also product communication?

09 Red flags and indicators – used correctly

The strength of the indicators lies in their combination. TRON usage, self-custody, mobile money, or round amounts are not, in themselves, proof of illegal activity. The last three lines supplement German scenarios.

indicatorWhy relevantDon't overinterpret.
New self-custody wallet → faster CEX depositMay indicate cash desk or intermediary useLegitimate users also pay in promptly.
Many small tributaries → few large outflowsTypical of aggregation, collection structuresThis can be legitimate payment aggregation.
Regular round amountsCan reflect off-chain pricing or cash thresholdsAlone weak
P2P / Mobile Money + VASP referenceConnects fiat rail with crypto fulfillmentMobile money is legitimate on a massive scale.
TRON/BSC + StablecoinsLow fees encourage high-frequency transfers.Chain choice is not a debt indicator
No/Low KYC card providersWeak identity bonding at the off-rampVerify current status and KYC practices
Bridge, mixer, chain hopping after crime influxCan enhance layeringEven legitimate standard functions
DE: Real-time transfers to private individuals with timely cryptocurrency purchasesExamples from P2P traders and money mulesPrivate payments are also possible.
DE: Paper wallet or deposit after ATM purchaseNotice regarding unauthorized vending machinesApproved vending machines exist.
DE: Card payment with third-country BIN from crypto fundingOff-ramp outside EU supervisionBIN origin alone is not a suspicion

10 Recommendations for action

10.1 For law enforcement agencies and forensic analysts

  • Do not stop at the Exchange label. – Check the Fiat, Card, Mobile Money, Real-Time or OTC channel behind each On/Off ramp.
  • Version service attribution: Screenshots, tool version, date, alternative labels.
  • Formulate off-chain evidence requirements early (KYC, IP, Card, BIN, Account Holder, Merchant).
  • Map cross-chain flows in a timeline.
  • Consider security options – the closer to the regulated provider or freeze-able issuer, the higher the chance; time is crucial.
  • Check supplier numbers before citing (Test scheme 8.3).

10.2 For stock exchanges, CASPs, banks and payment service providers

  • Include offshore, no-KYC and cash-to-crypto infrastructure as context in the risk assessment.
  • Do not block self-hosted transfers across the board, but differentiate them (§ 15a GwG).
  • Combining BIN, issuer, and card program risks with on-chain attribution.
  • Combine travel rule data, blockchain analytics, and payment fraud signals into a single case view.
  • Suspicious activity reports must be fully completed in accordance with the German Money Laundering Reporting Ordinance (GwGMeldV) (TXID, cryptocurrency, price, provider).

10.3 For representatives of injured parties and law firms

  • In addition to wallet address and TXID, always also Fiat receipts Secure: IBANs, real-time transfer receipts including recipient verification, card statements, payment app receipts, chats, timestamps.
  • The report should specify where the transition to a regulated system lies and what information can be requested there.
  • Prepare the chain of evidence up to legally addressable counterparties, not just up to the last wallet hop.
  • „Use "perpetrator wallet" only if there is a verifiable personal connection; otherwise, refer neutrally to receiving address, intermediate wallet, cluster or service wallet.

10.4 For supervision and legislation

  • Cryptocurrency transactions should again be reported separately in the FIU statistics – based on the TXIDs recorded since March 2026.
  • Treat the settlement layer (real-time transfers, payment apps, neobanks) as a separate typology field.
  • Prioritize the enforcement of the Travel Rule and MiCAR licensing requirements for offshore providers.

11 Outlook 2026/2027

AppointmentDevelopmentSignificance for the blind spots
since December 24, 2025KStTG (DAC8) in force; first notification by 31.7.2027More tax data; no P2P coverage
since March 1, 2026GwGMeldV: TXID as mandatory informationSuspicious activity report ↔ Blockchain linkable
since July 1, 2026EU-wide end of the MiCAR transition periodGenerally subject to authorization (exception: Reverse Solicitation, Art. 61)
2026Hong Kong: Draft law for VA dealers (OTC) and custodiansCould formalize the cash desk market
10.7.2027AMLR applicable; Art. 79 prohibition of anonymous (crypto) accounts, Art. 80 cash payment limit of EUR 10,000Pressure is shifting to unregulated P2P and offshore channels.
2027/2028AMLA (Frankfurt): direct supervision of up to 40 high-risk financial companies from 2028The majority of providers remain under national supervision.
openCrystal announces on-chain analytics for cash desksVerification of the 97-% statement will be possible.

With stricter regulation, the risk of a shift to unregulated P2P structures, offshore services, and digital hawala networks increases – an assessment (level of evidence E5) supported by the FATF findings. For forensic investigators, this means more, rather than less, interface work.

12 Conclusion

Crystal hits a key point in modern financial forensics: the most challenging moments are when value changes hands between cash, bank or mobile money systems, unhosted wallets, VASPs, and card infrastructure – the data available in 2026 significantly reinforces this diagnosis. However, as a data source, the report only partially withstands close scrutiny; in any case, the figures are not applicable to Germany. The consequence is not an abandonment of blockchain forensics, but rather its expansion: on-chain reproducibility, off-chain attribution, payment data, OSINT, regulatory status, and a legally admissible, documented chain of evidence – all linked by clearly defined levels of evidence.

Guiding principle

The blockchain shows the flow of money. Identity is created at the interfaces. Forensic quality arises where both are cleanly combined, every number is recalculated, and the level of evidence for each statement is disclosed.

A Appendix: Recalculation of Crystal's key figures

CheckpointInformation in the reportRecalculationResult
Total P2P ads57,829 (p. 7, 23)Total of the ten country values = 57,829coherent
Weighted mobile sharenot specified≈ 61 %; excluding India ≈ 59 %additionally
India's share18,147 ads (p. 8)31.4 % of all; ≈ 34 % of mobileConsider weighting
Map growth 2025+66 % (p. 12)689,8 / 415,5 = 1,660coherent
Total card volumeUSD 1.18 billion2024 + 2025 = 1,105.3 million; remainder ≈ 75 million by Jan. 2026plausible, but not directly proven
KYC shares67.7 / 87.9 / 12.1 % (p. 13)= 67 / 87 / 12 out of 99coherent
No-KYC BIN share32 of 54 = 59 % (p. 14)59,3 %coherent
Total high-risk cards166 million (p. 2); 161.7 million (p. 13)Table ≈ 167.6; Input ≈ 162.9; Base ≈ 166.4 million.inconsistent
Gambling element92.4 % (p. 14)153,8 / 166,4 = 92,4 %consistent at base 166.4
Non-gamblingnot specified≈ 13.8 million USDadditionally
Entity A478.8 million USD (p. 16)≈ 40.6 % out of 1.18 million.concentration
Ebtoo Total Inflow452,393 USD (p. 10)Sanctions share 1.9 % ≈ 8,600 USD–
Ebtoo tiles3.4 million (1.8 %); USD 534,000Implicit base ≈ USD 189 millionContradiction
BIN jurisdictionText: HK 47 %, US 16 %Graphics: HK 48 %, US 19 %different

13 Sources and further reading

Analytics providers like Crystal, Chainalysis, and TRM Labs use proprietary entity databases; their volume data is used for typological and order-of-magnitude classification, not as official statistics. A complete list of sources with links is available in the PDF.

Crystal Intelligence (2026): Compliance Blindspots · FATF (2026a–d): Stablecoins and Unhosted Wallets; Seventh Targeted Update VA/VASPs; offshore VASPs; Underground Banking and HOSSPs · BIS Papers No 166 (2026) · BIS Bulletin 111 (2025) · EBA (2024): ML/TF risk factor guidelines CASPs; Travel Rule Guidelines · Europol (2025a/b) · Regulation (EU) 2023/1113 (TFR), 2023/1114 (MiCAR), 2024/1624 (AMLR), 2024/886 (Real-time Credit Transfers) · FIU Annual Reports 2024 and 2025 · Deutsche Bundesbank: Payment Behavior in Germany 2025 · BaFin (2024, 2025a–d), MiCAR Approval · BKA/ZIT (2024, 2025) · GwG, GwGMeldV, KMAG, KStTG · GSMA (2026) · Chainalysis (2026a/b) · TRM Labs (2026) · ICIJ (2025) · Hong Kong FSTB/SFC · UNODC (2024).

Version 2.1 · Research date: September 24, 2026 · not legal advice in individual cases.

Professional headshot of an older man in a dark blazer and light shirt, looking at the camera.

David Lüdtke

Managing Director · OSINT Analyst & Crypto Forensic Expert · Finanz Forensik GmbH

Court-admissible crypto transaction analysis, OSINT-based asset investigation, and expert reports for defense attorneys, insolvency administrators, and companies. Certified Crystal Expert (CECF, CEEI, CEUI). Finanz Forensik Supports law firms, companies, investigative bodies and insolvency administrators — focus areas: Blockchain forensics, wallet analysis, court-admissible documentation, OSINT.

Contact: postfach@finanz-forensik.de · +49 6057 9189145 · finanz-forensik.de

The trail doesn't end at the Exchange label.

We combine on-chain analysis, OSINT, provider attribution and payment data into a cross-rail chain of evidence – with an openly declared level of evidence, prepared for law firms and investigating authorities.