Hidden intermediaries, compliance gaps, and new approaches to blockchain forensics
Whitepaper 2026
Why the visible Crypto exchange is not necessarily the actual economic transaction service provider – and what consequences this has for investigations, sanctions controls, compliance and the assessment of payment flows.
Source: Original analysis by Crystal Intelligence (August 2026), FATF, EBA, EU law, BaFin and US Treasury Department. Our own services include: independent source verification, methodological review, risk assessment and forensic audit model.
Nested services are crypto service providers that serve their customers through accounts, wallets, or liquidity and payment infrastructure provided by other vendors. Therefore, an on-chain transaction often identifies the host exchange, but not the actual intermediary serving the customer or its end customer. This lack of clarity can affect both regular business models and high-risk activities. [1]
Crystal Intelligence's dataset for 2017 to 2025 identifies approximately USD 7.97 billion in gross transaction volume, 2,275,270 transactions, 2,052 attributed wallet addresses, and 39 host exchanges. According to the study, 87.4 % of the recorded volume is attributed to a single host. These figures represent the subset identified by Crystal – neither the entire market nor proven illicit money flows. [1]
Our own research shows that the issue is now explicitly addressed in international standards and European supervisory guidelines. The FATF addresses regulatory gaps in offshore VASPs and the indirect use of regulated platforms; the EBA guidelines and the EU travel rule require risk-appropriate due diligence and the handling of missing transfer information. [2–6]
Key findings
A nested service can act as a broker, OTC desk, swap service, payment processor, or informal exchange and may use the infrastructure of a larger virtual asset service provider for deposits or withdrawals.VASP) or Crypto-Asset Service Provider (CASP). For users, the smaller provider acts as the direct contractual partner, while the blockchain only shows an account or hot wallet of the host at a relevant point. [1]
| Model | mark | Main problem |
|---|---|---|
| Disclosed hosting | Formal business customer relationship between nested service and host | The host knows the business relationship, but not necessarily every end customer. |
| Undisclosed hosting | Infrastructure for third-party transactions, managed as a private or standard account | Customer volume and actual service provider role can be obscured. |
| Hybrid / multi-tiered hosting | Own wallets and external exchange accounts are combined. | Attribution and responsibilities across multiple levels are complicated |
The key distinction is between three levels of identity: the account holder at the host, the operational operator of the customer-oriented platform, and the economically acting end customer. None of these levels may be equated with another without evidence.
| Key figure | Crystal evaluation 2017–2025 | Classification |
|---|---|---|
| Gross volume | USD 7.97 billion | Cumulative inflows and outflows; no net loss |
| transactions | 2.275.270 | Data collected for analysis, not a full census |
| Wallet addresses | 2.052 | Attribution basis of the dataset |
| Host exchanges | 39 | Exchanges used as host according to Crystal |
| Host A concentration | 87.4 % (approximately $6.97 billion) | Strong concentration in the dataset; results largely influenced by one host |
| Historical SUEX case | USD 1.86 billion separately | Excluded from Crystal's total sum |
Figures and methodology: Crystal Intelligence, August 2026, pp. 9–16, 23, 30. [1]
The distribution over the years shows why, in addition to volume, the number of transactions must also be considered: Crystal reports a volume peak of USD 2.64 billion and 236,558 transactions for 2021; in contrast, 1,090,185 transactions with USD 941 million were recorded in 2025. The calculated average amount per transaction thus fell from around USD 11,200 to around USD 860. For monitoring systems, therefore, a sole focus on large amounts may be insufficient. [1]
Crystal allocates approximately 39.2 % of the volume to BTC, 25.9 % to USDT, and 17.3 % to ETH; the remaining 17.6 % are distributed among other assets. Token. This token distribution may indicate different business models and transfer costs, but says nothing about the legality of an individual transfer. [1]
The Crystal figures are based on a proprietary attribution database. Independent replication of the 2,052 addresses, the complete entity list, and all transfers is not possible without the underlying address and transaction data. Therefore, the research presented here confirms the consistency of key, publicly verifiable regulatory and sanction statements, not the completeness of the proprietary dataset.
The Crystal Report is identified as a third-party source, including its title, publication month, and page references. No original graphics or extensive passages are taken from it.
The FATF published a report on offshore VASPs on March 11, 2026, and its seventh Targeted Update on virtual assets on July 16, 2026. The offshore report specifically describes unlicensed offshore service providers that use accounts with licensed VASPs as purported retail customers; this corresponds to the pattern of undisclosed hosting. In the Targeted Update, 91 of the 109 jurisdictions surveyed (83 %) reported statutory implementation of the Travel Rule (paragraph 24). Of these, 55 of the 91 jurisdictions (60 %) had not yet reported any findings, orders, or other supervisory or enforcement actions specifically related to the Travel Rule (paragraph 25). This information does not represent the total VASP supervision. The FATF self-reports are not an independent impact assessment. [2, 3]
Since December 30, 2024, the licensing and supervisory requirements of Title V MiCAR (Regulation (EU) 2023/1114) have applied to CASPs. [7] This establishes a defined regulatory framework but does not automatically prevent undisclosed third-party transactions from running on external infrastructure. The EBA Risk Factors Guidelines require a risk-based approach to customers, products, distribution channels, and geography; they also address relationships between financial institutions and crypto service providers. [4]
The Transfer of Funds Regulation (EU) 2023/1113 and the EBA Travel Rule Guidelines, which have been in force since 30 December 2024, govern accompanying information on senders and recipients as well as the handling of missing and incomplete information. In the case of nested services, the additional question remains whether the formally submitted data set accurately reflects the actual intermediary role. [5, 6]
The maximum period under Article 143(3) MiCAR ended EU-wide on 1 July 2026, unless Member States provided for shorter transitional periods. For the companies specified in Section 50(1) of the German Banking Act (KMAG), the continued validity of their previous authorization under Section 50(2)(3) KMAG ended no later than 31 December 2025; it could also expire earlier under No. 1 or 2. Section 50 KMAG contains various scenarios, particularly for activities that were previously exempt from authorization. Therefore, this period cannot be applied across the board to every provider. The business model, the relevant authorization requirement, and the individual authorization situation remain decisive. [8, 11]
OFAC sanctioned SUEX OTC, SRO on September 21, 2021. The US Treasury Department stated that more than 40 % transactions in its known transaction history were associated with illegal actors and involved at least eight ransomware variants. This is an independently verified example of sanction risk for intermediary crypto service providers. The additional $1.86 billion nested volume reported by Crystal for SUEX, however, is Crystal's own analysis data. [1, 9, 10]
The following testing model was structured for practical case work. It distinguishes between technical probability, business identity, and reliable factual findings.
| signal | Possible explanation | Required cross-check |
|---|---|---|
| Automated Sweep | Host-based deposit accounts or regular treasury | Time series, multiple independent deposit transactions, cluster assignment |
| Many payers, one target cluster | Broker/payment pool account or customer aggregation | Transaction purpose, deposit instructions, off-chain receipts |
| Hot wallet withdrawal | Custody by the stock exchange | Bank statements or stock market information relating to the initiating party |
| Internal ID / UID / Pay-ID | Use of intra-exchange transfers | Authenticity of the payment instruction and platform assignment |
| Several host exchanges | Redundancy, liquidity or concealment | Separate records for each business relationship |
| Missing license information | Information deficit or actual permit gap | Register query with timestamp and legal entity comparison |
For Bitcoin, common-input heuristics are only reliable when CoinJoin and UTXO exceptions are taken into account. On account-based chains, sweep behavior and gas funding can provide clues, but smart contracts and exchange-internal entries complicate ownership attributions. Cluster labels from external analytics providers are hypotheses whose reliability depends on the source and recency.
If a purported investment portal uses a deposit address belonging to a well-known stock exchange, this does not necessarily mean that the fraudulent platform is identical to that exchange. It is conceivable that the operators have a customer account with the host or that an intermediary service provider is involved. Relevant for investigation are the period during which the deposit address was clearly linked to an account, the account/sub-account assignment, and the subsequent transfer of funds. Without information from the host, the beneficial owner often remains unknown.
Cash-based or P2P-based exchanges can concentrate many payments through a few host accounts. What's striking is not so much the existence of an exchange connection, but rather the combination of unclear end-customer KYC, unusual volumes, a lack of corporate identity, and inconsistent proof of origin.
Current list and country checks, control relationships, and specific legal jurisdiction are crucial. A technical host match triggers a more in-depth review but does not replace a legal assessment under sanctions law.
| risk | Test question | Control measure |
|---|---|---|
| Attribution | Is the visible host actually the customer provider? | Entity-level mapping and label origin |
| KYC/KYB | Who knows and verifies the end customer? | Contractual disclosure of third-party business activities |
| Sanctions | Who initiates and controls the order? | List matching, geography and ownership/control analysis |
| regulation | Is the activity in the target market covered by a permit? | CASP/VASP register, period, legal form |
| documentation | Is the finding reproducible? | Evidence chain, hashes, version archive |
| Level | minimum basis | Permissible wording |
|---|---|---|
| A – occupied | Original receipt and independent confirmation | „"It has been proven..."“ |
| B – strongly supported | Several consistent on/off-chain indicators | „"With a high probability..."“ |
| C – plausible hypothesis | Individual suitable behavioral patterns | „There are indications…“ |
| D – unconfirmed | Platform claim only, screenshot or single label | „"Not verified..."“ |
This matrix is a proposed internal audit standard, not a legal classification. Technical proof of a host connection, criminal liability, and beneficial ownership must be distinguished from one another.
Nested services are not a fringe phenomenon in blockchain forensics, but rather a structural limitation of purely address-based interpretation. The critical risk arises where a regulated infrastructure is interpreted as a trust signal, even though the actual customer contact is handled by a less transparent intermediary. Consistently separating the host, intermediary, and end customer can significantly improve the quality of investigations, compliance decisions, and sanctions checks.
The white paper does not name any additional, independently identified perpetrators, hosts, or transactions. Its unique research contribution lies in the primary source comparison, the critical interpretation of a proprietary data basis, and the development of a practically verifiable investigative framework.
Research date: October 15, 2026. The original study was analyzed for content; publicly available primary sources from regulators and authorities were checked separately. All figures from the proprietary analysis are explicitly attributed to Crystal Intelligence. Recommendations made by us are to be understood as expert conclusions. No independent on-chain sample was recalculated, and no access to Crystal raw data is claimed.
Publication notice
This publication is for informational purposes only. It does not replace a case-specific blockchain analysis or legal, regulatory, or sanctions-related advice. All statements regarding specific market participants are subject to the stated cut-off date and the respective sources.
David Lüdtke
Managing Director · OSINT Analyst & Crypto Forensic Expert · Finanz Forensik GmbH
Court-admissible crypto transaction analysis, OSINT-based asset investigation, and expert reports for defense attorneys, insolvency administrators, and companies. Certified Crystal Expert (CECF, CEEI, CEUI). Finanz Forensik Supports law firms, companies, investigative bodies and insolvency administrators — focus areas: Blockchain forensics, wallet analysis, court-admissible documentation, OSINT.
Contact: postfach@finanz-forensik.de · +49 6057 9189145 · finanz-forensik.de
We separate host, intermediary and end customer: with documented attribution, confidence level per statement and secured evidence for law firms, compliance and investigative bodies.
