Crypto Money Laundering Facilitators: The Decisions That Keep Illicit Money Moving

Crypto laundering facilitators use exchange and conversion services to cash out illicit funds and connect them to banking. The people making that possible may control customer verification, wallets or payment access without ever speaking to the victim. If you work at an exchange, payment business or bank, you may know why an account stayed usable after the warnings arrived. That decision can explain something a transaction trail alone cannot.

What an Exchange or Conversion Service Controls

An exchange can connect customer identity, a crypto balance and a payment in ordinary currency. A hosted-wallet provider can hold and move customer value, while its internal ledger records transfers that need not appear individually on the public blockchain. That makes the operator’s own records central to understanding who received the money.

The Financial Crimes Enforcement Network’s guidance on convertible virtual currency businesses follows what the business does. Accepting and transmitting value can make an exchange or hosted-wallet service a money transmitter even when both sides of the transaction use crypto. The account structure, control of the value and authority to approve transfers matter more than the service’s technology label.

Cash-out brings another participant into view. The Commodity Futures Trading Commission’s money-mule advisory describes recruits who receive and move assets at someone else’s direction, including conversions between dollars and crypto. The recruit supplies an account. The exchange supplies the conversion service. The bank supplies another part of the payment path. Those roles put different information in different hands.

An employee may see only the conversion or payment inside the laundering sequence. Customer records, account credits and the decision to allow access can connect that limited view to the business behind it.

Bitzlato and Repeated Criminal Proceeds Warnings

Bitzlato shows why repeated criminal proceeds warnings at a crypto conversion service matter. Its founder and majority owner pleaded guilty to operating a money transmitting business that transported and transmitted illicit funds. The Justice Department’s account of the guilty plea described an exchange whose weak identification practices sat beside repeated warnings to its operator.

In that criminal case, the Justice Department described Bitzlato as a Hong Kong-registered exchange operating globally. It said the company marketed minimal identification and repeatedly accepted identifying information belonging to straw registrants: a person supplied someone else’s identity, and the exchange allowed it. The gap was visible at the point where the business decided whom to admit.

Hydra Market was Bitzlato’s largest cryptocurrency counterparty. The Justice Department described Hydra as a marketplace for narcotics, stolen financial information, fraudulent identification documents and money laundering services. Its users exchanged more than $700 million worth of cryptocurrency with Bitzlato, directly or through intermediaries. The same criminal-case account said Bitzlato received ransomware proceeds and that its operator was repeatedly advised that funds passing through the exchange came from crime or were intended for illicit transactions.

An exchange that marketed minimal identification had a narcotics marketplace as its largest cryptocurrency counterparty. Its operator received repeated warnings about the money and kept the business open. For an insider, the connection worth explaining is between the customer file, the warning and the people who controlled the service. A warning’s wording matters. So does who received it and what the account could still do afterward.

What Is Correspondent Banking in AML?

Correspondent banking lets one financial institution provide deposits, payments or transaction processing for another. For anti-money laundering work, the question is whose money reaches the bank through that relationship. In a nested relationship, a foreign bank gives downstream institutions access through its own correspondent account. The U.S. bank’s direct customer can therefore be one institution while the payment serves another institution’s customer farther down the chain.

Huione and the Correspondent Access Restriction

Huione shows why an exchange money laundering enabler can become the subject of a correspondent access restriction. In its final rule concerning Huione Group, the Financial Crimes Enforcement Network said the Cambodia-based group had no direct U.S. dollar correspondent relationships with U.S. financial institutions. It accessed dollars through nested relationships outside the United States. The absence of a direct account had left an indirect path into dollar banking.

The rule prohibited covered U.S. institutions from opening or maintaining correspondent accounts for Huione and required measures against transactions involving Huione through foreign correspondents. It took effect on November 17, 2025. The action targeted the access path, including the downstream business using another institution’s account.

The agency assessed that Huione received at least $4 billion in illicit proceeds between August 2021 and January 2025. Its account connected the group’s services to cyber heists and investment scams. It also described a North Korean national with intelligence ties working with Huione Pay officials to transfer crypto and ordinary currency, and assessed that senior leadership knew of the person’s North Korean affiliation.

That knowledge was more specific than a blockchain address. The rule described personal relationships, meetings and assistance converting crypto into ordinary currency. A bank employee may see the correspondent relationship. Someone inside the payment service may know the customer and the officials who arranged the conversion. Together, those accounts can explain how a distant service reaches a payment system.

For the person who works on correspondent due diligence or payment screening, the relevant question is which downstream service the relationship actually serves.

Garantex’s Alleged Wallet Changes After Sanctions

The Garantex indictment alleged that administrators changed the exchange’s operational wallets daily to make it harder for U.S. exchanges to identify and block its transactions. According to the Justice Department’s announcement of the criminal charges, that redesign followed the exchange’s sanctions designation and its administrators’ knowledge of the sanctions.

The indictment alleged that the administrators knew criminal proceeds were moving through Garantex and took steps to conceal the activity. The Justice Department described a technical administrator responsible for critical infrastructure and for reviewing and approving transactions. That role connects the machinery of the exchange to decisions about the money it processed.

The criminal-case account also described an alleged mismatch between the exchange’s customer records and what it told investigators. Garantex allegedly claimed that an account belonging to its co-founder was unverified when the business had associated it with his identifying documents. The account file allegedly held information the response withheld.

For an employee, those are recognizable decisions: who approved the infrastructure change, which customer an internal record identified and what the company said outside the business. The alleged wallet changes explain why screening addresses and understanding the operator behind them are connected tasks. The indictment’s account turns on a known service continuing to transact through changing addresses.

SUEX and the Exchange’s Known Transaction History

SUEX illustrates a sanctions action based on the exchange’s connections to illicit actors. In its September 21, 2021 designation, Treasury attributed transactions involving proceeds from at least eight ransomware variants to SUEX. It associated over 40% of SUEX’s known transaction history with illicit actors.

Treasury’s account ties proceeds from different ransomware operations to the same exchange. The connection between those operations was a business moving their money.

What Proof Do You Need as a Whistleblower?

The useful evidence connects the money, the customer and a decision inside the institution. An exchange ledger can show which customer received credit. Wallet-control records can show who could move the value. Bank messages can show the payment path. Screening decisions and escalation histories can show what staff knew when they allowed activity to continue.

These records answer questions the public chain leaves open. A transaction hash records a transfer. The internal account may identify the customer behind it. A wallet’s appearance can change while the service controlling it remains the same. A correspondent payment can pass through an account held by one institution for activity originating farther downstream. The insider’s contribution is the connection between the visible movement and the decision that enabled it.

Compliance officers, onboarding staff, payment operations teams, engineers and auditors may each see part of that history. Their knowledge can explain how the written control worked in practice: what information reached it, who could override it and what happened to the account afterward. That is a case worth discussing with people who understand both the exchange and the bank.

More Reports Do Not Answer the Control Question

The decisions behind a suspicious activity report matter: the customer information available, the activity detected and the response inside the institution.

Anti-Money Laundering: Opportunities for Improvement, published by the Wharton Initiative on Financial Policy and Regulation in 2024, examines the gap between rules and their practical effect. Discussing FinCEN’s early guidance on convertible virtual currencies, the paper says:

The paper also finds that rising suspicious activity report volumes are difficult to interpret: the available data cannot readily separate better detection from excessive, defensive reporting. An insider who can explain a specific warning and the decision that followed supplies a different kind of information. The account gives the activity a customer, a decision-maker and a history.

Who Investigates Money Laundering in the USA?

Federal agencies including the Federal Bureau of Investigation, IRS Criminal Investigation, Homeland Security Investigations and the U.S. Secret Service investigate money laundering. The FBI and Secret Service investigated Garantex, while the Justice Department prosecutes criminal cases. The Financial Crimes Enforcement Network handles financial intelligence and civil enforcement, and Treasury’s Office of Foreign Assets Control administers sanctions.

Our whistleblower experts assess the conduct you know and bring in whistleblower lawyers who understand money laundering, sanctions and digital-asset businesses. FinCEN’s anti-money laundering and sanctions whistleblower program provides for qualifying whistleblowers to share 10% to 30% of eligible monetary sanctions collected. We work out with you which program fits what you know.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program from the one for money laundering and sanctions information.

Who Kept the Account Usable?

If you know who accepted the identity exception, received the warning or kept the conversion route open, tell our whistleblower experts what happened inside the business. We build the case around that knowledge and bring in money laundering whistleblower lawyers who understand exchange operations and banking access. We stay beside you as that inside account becomes a case against the people and institutions responsible.