blog_landing

contact_us

## KYC as Infrastructure for White-Label FinTech Platforms
### The context
White-label FinTech platforms have reshaped how financial products are launched, allowing businesses to enter regulated markets faster than ever. Payments, wallets, neobanking, and other digital services can now be deployed using shared infrastructure and turnkey solutions.
However, regulatory responsibility does not transfer with the platform. White-label FinTech businesses remain fully accountable for KYC, AML, and customer due diligence requirements, often across multiple jurisdictions and regulatory regimes.
### The basics
For white-label FinTech platforms, KYC is a mandatory component of user onboarding and ongoing operations. A compliant setup typically includes:
- Collection and verification of identity data
- Document and biometric checks
- AML, PEP, and sanctions screening
- Enhanced due diligence for higher-risk customers
- Ongoing monitoring and periodic re-verification
These processes must be reliable, consistent, and adaptable to different regulatory environments.
### The challenges
White-label FinTech businesses face several compliance-related challenges:
- Limited control over core infrastructure, restricting customization
- Multiple end-clients or brands, each with distinct risk profiles
- Jurisdictional complexity, requiring flexible compliance logic
- Rapid scaling, where compliance must grow alongside user volume
Without a modular approach, compliance can quickly become a bottleneck.
### Understanding the white-label ecosystem
The white-label FinTech space involves multiple layers: platform providers, payment processors, compliance vendors, and regulatory frameworks.
Resources like [WhiteLabels.io](https://whitelabels.io/) help businesses map this ecosystem and understand how different components connect - useful context when building or evaluating a compliance stack.
- When evaluating KYC vendors, white-label platforms should assess:
- API flexibility and integration ease
- Multi-jurisdiction support
- Scalability under load
- Vendor stability and regulatory track record
### How DataSpike addresses this
DataSpike provides customer verification and risk intelligence tools that support document and biometric verification, AML and sanctions screening, and ongoing monitoring. Flexible deployment models allow compliance workflows to be adapted to different brands, jurisdictions, and risk profiles without reworking the underlying platform.
The platform integrates seamlessly via REST API and offers customizable verification flows that can be tailored to each white-label client's specific requirements.
### Why it matters
In white-label FinTech, compliance is not an optional add-on. It is foundational infrastructure that determines a platform's ability to scale, enter new markets, and maintain regulatory trust. Platforms that invest early in flexible, compliant KYC and AML systems reduce operational risk and create a stronger base for long-term growth.
### Next steps
Whether you operate in iGaming, white-label FinTech, or another regulated sector, DataSpike's verification platform provides the compliance infrastructure you need:
- Automated identity and document verification
- Biometric and liveness checks
- AML/PEP/sanctions screening
- Ongoing monitoring and risk intelligence
[Contact us](/contact-us) to learn more about integrating compliance infrastructure into your platform.

large_complience_infrastructure.png

medium_complience_infrastructure.png

small_complience_infrastructure.png

thumbnail_complience_infrastructure.png

complience_infrastructure.png

COMPLIANCE INFRASTRUCTURE

## Why KYC Became a Core Compliance Layer for iGaming Operators
### The context
Over the past decade, the iGaming industry has become one of the most tightly regulated digital sectors. Licensed operators are required to verify player identities, prevent underage gambling, detect fraud, and comply with AML regulations - often across multiple jurisdictions at once.
At the same time, user expectations have changed. Players expect instant access to platforms, fast withdrawals, and minimal onboarding friction. This puts iGaming operators in a difficult position: compliance must be strict, but invisible.
### The basics
Know Your Customer (KYC) in iGaming goes far beyond simple identity checks. A compliant onboarding flow typically includes:
- Collection and verification of identity documents
- Biometric and liveness checks
- AML, PEP, and sanctions screening
- Enhanced due diligence for higher-risk players
- Ongoing monitoring of user behavior and transactions
Each of these steps is essential to meet regulatory requirements and protect platforms from fraud, abuse, and reputational damage.
### The challenges
iGaming operators face several industry-specific risks:
- High-volume onboarding, where delays directly impact conversion
- Fraud patterns unique to gaming, including multi-accounting and bonus abuse
- Regulatory fragmentation, with different rules across markets
- Long-term risk exposure, as player behavior may change after onboarding
Basic or fragmented KYC solutions are often insufficient to address these challenges at scale.
### Industry context and resources
Effective KYC in iGaming is not a one-time process. It spans the entire player lifecycle, from initial verification to continuous monitoring and risk reassessment.
The iGaming compliance landscape continues to evolve rapidly. Platforms like [Gamblizard](https://gamblizard.com/blog/kyc-solutions/) provide operators with regulatory updates, compliance guides, and market analysis across different gaming jurisdictions - helping teams understand what regulators expect and how requirements differ by market. This type of industry knowledge, combined with technical KYC infrastructure, enables operators to build more robust compliance programs.
### How DataSpike addresses this
DataSpike is a customer verification and risk intelligence platform that supports iGaming-specific compliance requirements, including document and biometric verification, liveness checks, AML and sanctions screening, and ongoing monitoring.
The platform is fully automated, API-first, and can be deployed via SDKs or web-based flows, allowing operators to integrate KYC into onboarding and other user journeys with minimal disruption.
### Why it matters
In iGaming, KYC is not just a regulatory obligation - it is a safeguard for platform integrity and player trust. Operators that treat compliance as core infrastructure rather than a checkbox are better positioned to scale sustainably in a highly regulated environment.
While gaming platforms face unique compliance challenges, similar patterns emerge in other regulated sectors - particularly in white-label financial services where compliance responsibility remains with the platform operator regardless of the underlying infrastructure.


large_kyc-in-igaming.png

medium_kyc-in-igaming.png

small_kyc-in-igaming.png

thumbnail_kyc-in-igaming.png

kyc-in-igaming.png

KYC IN IGAMING

This July, millions of British users launched their favorite social websites and games to be greeted with a new requirement to verify their age in accordance with the Online Safety Act (OSA). This legal novel passed in 2023, and its key provisions came into power on July 25, 2025, with the remaining parts coming into full force in early 2026. The Act created a new duty of care for online platforms, games, etc, to protect younger users from a wide range of content deemed illegal, potentially harmful, or just age-inappropriate.

## The basics

The Act implies that any website that hosts content with themes potentially inappropriate to minors is subject to regulation. It’s not limited to pornography, as information about reproductive health or LGBTQ+ rights can be potentially considered “too adult”. Platforms with content catered to different audiences, such as Facebook or Reddit, must establish robust automated content classification rules. The Wikimedia Foundation tried to challenge the OSA in court, arguing that the regulation threatens its anonymous users rather than protects them.

OSA applies to most of the web, especially to the websites and apps with user-generated content and interactions, if they have a considerable audience in the UK. Some extra transparency and risk assessment requirements are implied for Category 1 platforms that exceed 45 million monthly UK visitors, which include gaming, streaming, sharing, etc.

The Act permits different methods of age verification: age assessment based on facial recognition, via providing one’s banking information, credit card age check, email-based estimation (based on cross-checking other resources where email was used), mobile network operator check (confirming whether a phone number has age filters applied to it), digital ID wallet connection, and ID document photo upload. 

## The solution

For most companies subject to OSA, compliance can be reached through a connection with a third-party age verification provider, such as [Dataspike](https://dataspike.io/age-verification?lang=en). Our platform evolved from a KYC/KYC provider to a full-featured customer verification and onboarding platform that has a solution for the two most common age verification approaches: through face recognition and liveness checks, and based on a state-issued ID. Dataspike’s verification pipeline is fully automated, easily integrated via APK or SDK, and supports requirements for numerous regions, such as the UK, US, and EU, simplifying compliance for global companies.

## The concerns

Numerous privacy advocates and tech representatives voiced strong concerns that the Online Safety Act’s focus on age verification can create more harm than it averts.

#### Data breaches

No company is immune to data breaches—including both content platforms and customer verification providers. There have been numerous cases when leaks have dramatically affected personal well-being. For instance, the Ashley Madison dating platform hack half a decade ago led to attacks on unfaithful partners. A breach of Tea (women-only dating app) exposed 13,000 selfies and ID photos used for verification and 59,000 images from posts, comments, and personal messages.

Many risks related to data breaches can be mitigated through adherence to international data protection standards (such as GDPR) and well-thought-out data management policies. Dataspike doesn’t store sensitive data provided by users and deletes it immediately after the check, ensuring that no sensitive information can be leaked. We isolate each partner and customer from others to make sure no data can end up in the wrong hands.

Actually, we believe that digital privacy and data protection are a priority.  In the case the user doesn’t trust the data management policies of the platform or its provider, we’d rather recommend not to provide personal data. There are no legal consequences for end users circumventing OSA (aside from sanctions for Terms of Service violations on a particular platform or service: the Act focuses on larger corporate entities, not individual users.

#### Identity theft

One serious concern is a potential spread of fake age assurance websites and phishing pop-ups aimed at stealing users’ information. We believe that the developers of content blockers (standalone apps, browser extensions, or built-in tools) will do their best to protect users from such fraud attempts.

#### Users threshold

The Online Safety Act aims to protect underage Brits from adult content. However, there’s a whole internet out there that doesn’t care about the British regulations. Hence, the widespread age verification in the UK will most probably push people towards unregulated websites that don't require users to provide a state-issued ID to watch pornography.

#### Technological flaws

Following the launch of widespread age verification for UK users, tech media reported that age verification on Discord and Reddit could be tricked by a video game’s photo mode. The users could use the face of Death Stranding’s protagonist, Sam Porter Bridges, performed by Norman Reedus, and apply a variety of facial expressions to pass the Liveness test easily. The providers claimed that they blocked nearly 100% of such attempts, but it’s pretty impossible to confirm or deny.

#### VPN

The simplest way to circumvent the current implementation of age verification is a VPN that allows users to appear as a person from a different location (a foreigner, when it comes to a UK-based website or app). The downloads of popular VPN apps spiked by over a thousand percent in late July 2025.

## What about non-compliance?

Unlike end users, companies can’t ignore OSA requirements. Platforms can be fined up to GBP 18 million or 10 percent of their qualified worldwide revenue (whichever is greater). We recommend that companies take a three-step approach to Online Safety Act compliance.
* First, consult with your lawyers about noncompliance-related risks. For instance, a company without UK-based users can generally ignore OSA requirements for now.
* Second, use Dataspike’s API integration to introduce reliable age verification for a website or an app in a matter of hours. The user will be able to verify on an external web page, in an external app, with a chatbot, etc. 
* Third, use SDK to seamlessly build Dataspike’s customer verification into the user onboarding and other stages of the customer journey (if needed). Dataspike has a fair and transparent pay-as-you-go plan that fits companies of any size or industry.

## Trend for age verification

The developments of the UK internet regulations ain’t unique. For instance, 24 US states have issued their own age verification laws, and the nationwide Kids Online Safety Act (KOSA) has been discussed in Congress since 2022. In the EU, the age verification pilot project was introduced within the context of the European Digital Services Act (DSA) in Italy, France, Spain, Greece, and Denmark.

Dataspike is a global customer verification provider with solutions tailored for different national legislations, document formats, and trained to recognize people of different skin colors with varying facial features. Dataspike is a privacy-focused company that is serious about data safety, so we follow the best practices in the industry to protect our customers and their customers.




smartphone-interface-with-user-profile-chat-icons.png

large_smartphone-interface-with-user-profile-chat-icons.png

medium_smartphone-interface-with-user-profile-chat-icons.png

small_smartphone-interface-with-user-profile-chat-icons.png

thumbnail_smartphone-interface-with-user-profile-chat-icons.png

AGE VERIFICATION

FATF was established in 1989 as a one-year fact-finding body to research money laundering trends and develop recommendations and policies to combat illicit activities. However, it outlived its original purpose to become a 40-member global organization with a mandate to set international standards of anti-money laundering (AML) legislation, which are translated into domestic policies, monitor the effectiveness of law enforcement, and assess countries’ compliance.

Since the 2000s, FATF has maintained two lists of countries with strategic deficiencies in policies against money laundering, terrorism financing, and proliferation: a black list of high-risk jurisdictions and a grey list of jurisdictions under increased monitoring. 

### The blacklist is plain and simple

The FATF blacklist includes countries that refuse to cooperate with FATF on improving their AML and CTF (counter-terrorism financing) legislation and measures or systematically fail to do so. By 2024, the list included three countries: isolationist North Korea; Iran, which is a natural state-sponsor of terrorism; and Myanmar, which was previously blacklisted from 2001 to 2006, and from 2011 to 2016, and was included in the grey list from 2020 to 2022. 

Countries on the blacklist are essentially economically pariah jurisdictions cut off from the global finance. Private and state-owned enterprises de-risk and avoid dealing with them, while international financial institutions, such as the International Financial Corporation (IFC), and the World Bank (WB), hesitate to provide loans to countries that fail to ensure the funds won’t be laundered and spent on illicit activities.

### The grey list is a different story

The grey list includes countries with strategic deficiencies in AML and CTF policies that cooperate with FATF and make time-bound political commitments to address these deficiencies and follow an approved action plan. Once the issues are identified during the mutual assessment (the countries independently assess each others’ compliance with AML and CTF standards using FATF methodology), the country is provided one year to address them. If no significant progress is achieved, the country can be included in the grey list.

FATF considers greylisting a motivation for improvement rather than a punitive measure or signaling of external risks. The organization doesn’t oblige members to take any action, and its recommendations on the matter are non-binding. However, other financial actors see greylisting as a potential prelude to further sanctions, causing them to reconsider their risk profile, reduce investments, and strengthen compliance. Even though FATF doesn’t call for enhanced due diligence anymore, countries implement such measures as a part of national regulation. 

### Prepare for the foreseen consequences

Greylisting has severe effects on the national economy that form a negative cycle, further worsening the economic conditions in the targeted country. According to the International Monetary Fund (IMF) working paper published in 2021, the capital inflows (foreign investments and bank transfers) declined by 7.6% of GDP on average, following the counties’ introduction to the grey list.

While there’s no single scenario, the development of negative effects of greylisting may take the following order.
- Both the greylisted country and the other countries increase regulatory pressure, sometimes making regulatory risks unmanageable or inadequate for business.
- The companies based in the greylisted countries or maintaining business relations with them have to amend internal policies and operating practices in response to greylisting. Increased compliance costs lead to increased supplier costs.
- The other countries implement enhanced due diligence audits if their supply chains pass through greylisted countries. In some EU member states, the firms even have to identify and eliminate risks to human rights and environmental damage along their supply chains—which skyrockets compliance costs.
- Enhanced due diligence measures lead to problems with correspondent banking. Foreign banks must introduce more checks and investigate every suspicious transaction within their risk calculation models. Legit transactions are often rejected, or more paperwork is needed.
- The aforementioned costs and risks lead to reduced profits, which causes companies to reduce the range of goods and services provided or exit the market. Lowered supply and profitability reduce tax payments and limit debt capacity.
- Investments decline following the decline of profits and uncertainty of investors, leading to the reduction of capitalization of local markets.
- Increased national budgetary pressure meets the decreased ability to attract funds from donors, such as IMF, IFC, or development banks. The country's credit rating declines.
- International bond and loan markets react, putting pressure on both government borrowing levels and corporate spreads, further reducing access to the capital

The combination of such factors launches a negative spiral, which causes more harm to the national economy with each interaction, as the damaging factors take cumulative effect. The whole process is triggered by overreaction and over-compliance, with stakeholders becoming less responsive to positive news emanating from the greylisted countries. Additionally, greylisting may attract individuals and groups interested in exploiting identified regulatory loopholes.

### Not all countries are equal

In the worst possible scenario, a country with a small or weak economy will struggle to overcome the consequences of greylisting. It may cause long-term adverse effects, such as poverty, inequality, negative impacts on education and healthcare, brain drain, and political instability.

The effects are considerably smaller or barely noticeable for strong economies. For instance, the UAE was greylisted from 2022 to 2024 but enjoyed stable economic growth fueled by the high energy prices. Despite the inconveniences in correspondent banking, the country continued to attract foreign investors, and its credit rating (AA- stable, according to Moody’s) wasn’t affected.

### What can be done to stop all this?

To get off the grey list, the country has to follow the FATF-approved action plan to strengthen its AML and CTF legal framework. The steps may include: improving laws and regulations, bolstering international cooperation in fighting money laundering, addressing risks related to shell companies, ensuring effective implementation of targeted financial sanctions, and empowering the Financial Intelligence Unit (FIU) in investigating and persecuting crime.

Delisting has a massive positive impact, significantly increasing the confidence of foreign investors, firms, credit rating agencies, and international financial institutions. Supported by the positive expectations, the economy recovers and returns to growth.

One should remember that even if the formal requirements for delisting are met, the poor implementation of new regulations may undermine the country’s efforts to manage money laundering risks. For instance, Kenya, which was previously greylisted from 2010 to 2014, failed to combat suspicious financial activity, regulate shell companies, and implement other measures. It remained a major money laundering hub and was eventually readded to the grey list in 2024.

Explore actionable insights and tools to stay ahead of compliance challenges with  [Dataspike](https://dataspike.io/), your trusted partner in AML and KYC solutions.


large_FATF Grey List impact on economies.jpg

medium_FATF Grey List impact on economies.jpg

small_FATF Grey List impact on economies.jpg

thumbnail_FATF Grey List impact on economies.jpg

FATF Grey List impact on economies.jpg

What Is the FATF Grey List? Understanding Its Role in Global AML Policies

### Binance: USD 4.3 billion for non-compliance

One year ago, US regulators blasted the world’s largest cryptocurrency exchange, Binance, with a record-setting penalty of USD 4.3 billion for outrageous compliance failures. In November 2023, the company and its founder Changpeng Zhao pleaded guilty to non-compliance, poorly executed anti-money laundering instruments, and deliberate disregard for illegal funds being routed through the platform. We covered this story in our December newsletter in 2023.

The [charges](https://www.reuters.com/technology/highlights-us-charges-against-crypto-exchange-binance-2023-11-21/) against the platforms included but weren’t limited to facilitating transactions worth billions of dollars without proper KYC checks, inadequate compliance measures, proceeding transactions that were clearly the proceeds from darknet market operations (which included transactions to Hydra, a notorious Russian marketplace used by criminals for nearly everything for drug sales to [contract murders](https://www.bbc.com/russian/features-50167318)), enabling sanctions evasion, and financing of terrorist organizations, such as Hamas or Hezbollah. These “shortcomings” in compliance were hardly a secret for the management and the employees, but no steps were made to prevent Binance from being used for illegal operations.

Other changes were related to “[Tai Chi](https://www.forbes.com/sites/michaeldelcastillo/2020/10/29/leaked-tai-chi-document-reveals-binances-elaborate-scheme-to-evade-bitcoin-regulators/),” the scheme Binance used to deceive US regulators by setting up a separate compliant US entity yet providing crypto services to US citizens on its main platform. Forbes originally revealed this scheme in 2020. In June 2023, the US Securities and Exchange Commission sued Binance and Zhao for illegal operations in the US and defrauding crypto investors.

Both the platform and its founder pleaded guilty. The court obliged both to pay massive non-compliance fines. Zhao was also sentenced to several months in prison. That verdict dramatically differed from other cases, when cryptocurrency platform operators faced decades of imprisonment for facilitating money laundering, which was widely considered a result of Binance’s full cooperation with the US authorities.

### TD Bank: guilty plead for money laundering

In November 2024, for the first time in US history, TD Bank pleaded guilty to money laundering charges. The Toronto-headquartered bank (its name stands for Toronto Dominion) is the second largest in Canada and the sixth largest in North America. Following two decades of successful expansion in the US market, the bank now faces a USD 3 billion fine and a little-used asset cap for compliance failures.

TD Bank’s history of regulatory failings in Canada and the US is continuous enough to be separated into several paragraphs.

The bank often failed to report suspicious activity and take the necessary actions. In 2008 and 2009, TD Bank did not file suspicious activity reports regarding the notorious [Scott Rothstein Ponzi scheme](https://www.forbes.com/sites/jordanmaglich/2014/10/31/on-fifth-anniversary-of-rothsteins-1-2-billion-ponzi-scheme-questions-remain/) while its regional vice-president was [found](https://www.sec.gov/newsroom/press-releases/2013-192) involved in fraud and misleading investors. TD Bank’s P2P payments app Zelle, launched in 2017, raised numerous red flags for the lack of transaction monitoring with investigations identifying alleged money laundering and payments for illicit activities, such as human trafficking. From 2018 to 2021, the bank failed to terminate hundreds of accounts marked for closure by its compliance team, allowing a total of USD 5 billion to be transferred to suspicious accounts.

Over the years, TD Bank’s compliance department lacked personnel and underperformed. According to reports, the bank systematically failed to detect and report alerts and respond to subpoenas. The bank’s management was aware of the issues but took no measures. The loopholes in the bank’s systems allowed corrupt bank employees to bypass compliance controls and execute transactions on behalf of customers potentially related to criminal groups in Colombia.

On another note, TD Bank failed to implement Regtech software effectively and had deficient Know Your Customer (KYC) procedures, which permitted high-risk clients to open accounts and perform transactions. In 2017, the internal assessment of the interbank transaction monitoring system found naturally no active system to monitor domestic transactions. In 2023, it became public that due to coverage gaps, transactions worth several trillion dollars weren’t screened by the bank’s software. The bank had spent several years changing its Regtech services provider but only made things worse. The new system seemingly failed to identify questionable operations, leading to a 123% increase in transactions that passed the AML checks. Still, the bank didn’t notify regulators or apply any mitigation control.

Under the penalty agreement, The Office of the Comptroller of the Currency (OCC), a US bank regulator, also implemented a USD 434 billion asset cap: a limit on TD Bank’s business functions and consolidated assets. Alongside the fines, such restrictions are meant to ensure that the bank focuses on implementing proper controls and risk management. The asset cap will remain indefinitely unless the OCC removes it. It will likely take years to satisfy the regulators: for instance, Wells Fargo still deals with its USD 1,95 trillion asset cap enforced in 2019.

### It’s time for a change: AML regulation in Canada

TD Bank’s problems in the US had an unusual outcome: the Canadian Bankers Association requested the House of Commons to reform the national AML procedures. The regulatory burden in Canada is terrible: banks and other businesses (such as brokers, agents, real estate firms, sales representatives, money services, casinos, etc)  have to submit 12,5 times more reports than those in the US and 96 times more reports than those in the UK. However, the performance of the Financial Transactions and Reporting Analysis Centre of Canada (FINTRAC), the national supervisory and financial intelligence organization, is subject to debate.

At the same time, Canada is considered a money laundering haven due to legislation that shields the real owners of companies, effectively allowing criminals or sanctions evaders to establish shell companies in Canada, make transactions, and purchase assets. Many forms of business organizations only require the key managers to be publicly disclosed, and some exempt people from filing taxes in Canada if they are living elsewhere. The practices of tax evasion, sanction evasion, and money laundering using Canadian firms are sometimes referred to as “snow washing”. TD Bank’s woes resulted from a combination of many factors. However, one can’t write off the regulatory requirements and enforcement practices that shaped the bank’s business strategy. 

### Our simple advice to the banks: invest in Regtech

We are not strictly neutral on the matter. Dataspike.io is an advanced regulatory technology platform that automates KYC and legal screening operations for banks, money services, and other firms in regulated markets. TD Bank’s problems resulted from poor managerial decisions, vastly underperforming Regtech software and a short-staffed compliance department.

[Dataspike.io](http://dataspike.io) focuses on a particular component of AML compliance, but we get your back no matter your Regtech stack. Our [platform](https://dataspike.io/pricing) scales well and works for both newborn startups and established banks. It integrates well with other compliance technology as a component of a robust compliance system that minimizes the chance for mistakes and noncompliance penalties. 





large_AML_KYC compliance workflow.jpg

medium_AML_KYC compliance workflow.jpg

small_AML_KYC compliance workflow.jpg

thumbnail_AML_KYC compliance workflow.jpg

AML_KYC compliance workflow.jpg

Binance and TD Bank: Compliance Failures and the Rising Importance of Regtech

### Introduction

In recent decades, sanctions have become a standard instrument in international politics and a headache for compliance teams. Sanctions take different forms, from restrictions to additional rules on specific services and trade deals (such as price caps), and can be applied to individuals, entities, or jurisdictions.

Sanctions compliance is easily the most risky regulatory environment. Sanction evaders create complex schemes to access financial instruments and employ new technologies to launder and transfer money. 

Compliance officers should understand how such actors operate to abide by national and international sanctions without over-compliance, establish an effective Regtech stack to analyze transaction patterns and cooperate with national financial intelligence units to secure themselves from potential noncompliance fines.

Here, we review several cases elaborating on old-school and novel sanctions evasion approaches and provide advice on how to react to them.

### Case one: Tracking Cryptocurrencies 

The generous promise of anonymity and privacy made cryptocurrencies widespread among illegal actors. Still, it took stablecoins (pegged to traditional currencies) to make them genuinely convenient for money laundering, illegal trade, and sanctions evasion.

Just like bank accounts, cryptocurrency wallets can store significant wealth. A non-custodial wallet not operated by a platform like Binance or Coindesk requires no KYC checks to create and manage and can’t usually be traced back to its beneficial owner. A single person can control a virtually unlimited number of wallets, which means assets belonging to a single person can be distributed across numerous accounts, making them hard to trace.

However, blockchain is transparent by design, meaning that a high-net-worth sanction evader won’t be able to quietly transfer all his wealth through crypto. The lack of liquidity in the cryptocurrency market means that crypto isn’t reliable as a replacement for traditional financial instruments on a large scale. However, crypto is suitable for smaller-scale transactions, such as payments for smuggled goods between private entities working on procurement for sanctioned organizations. There are many crypto exchanges with lax or lacking AML controls that are specifically suited for such clientele.

### Case Two: Informal Connections

One crucial challenge in sanctions compliance is identifying ties between designated entities and proxies that facilitate sanctions evasion. One year ago, we emphasized this problem in the context of PEP screening in jurisdictions with widespread government corruption. Sanctioned individuals may conceal ownership of assets and actual beneficiaries of transfers behind distant relatives, close associates, and other trusted individuals, such as lawyers or consultants.

### Case Three: Revealing Schemes

Large-scale sanctions evasion, such as international trade with a sanctioned country or corporation, often requires complex schemes, including numerous legal entities in different jurisdictions (including off-shore and mid-shore financial centers), multiple international bank transactions to conceal the beneficiaries, and shady practices related to movement of the goods. 

Compliance-wise, such activities pose a significant risk to financial intermediaries. 
On the one hand, they can’t see the whole picture and may be convinced that the transactions between parties are legit. Even though sometimes the people behind sanction evasion schemes are well-known wealthy individuals with a lobbying potential, often the global sanction evasion and money laundering networks are orchestrated in secrecy and managed by seemingly quiet people living simple lives, which can’t usually be connected to high-risk activities.

On the other hand, once an illegal scheme is revealed, the regulators may consider that a financial intermediary (such as a bank) failed to take sufficient measures to prevent money laundering and sanction evasion, resulting in noncompliance fines. The well-known cases include Standards Chartered, Deutsche Bank, HSBC, Danske Bank, Societe Generale, Commerzbank, Credit Suisse, and BNP Paribas, with cumulative fines totaling 20 billion dollars in the last two decades.

### Conclusions

In 2024, compliance teams should go far beyond standard anti-money laundering frameworks to ensure full enforcement of international sanctions. There are several key recommendations:

* Fintech companies that enable the convenient use of traditional money and cryptocurrencies for everyday payments should employ on-chain analysis and risk assessment for crypto assets to prevent illicit transactions and ensure compliance. Such an approach is essential to avoid over-compliance and enable legitimate money transfers over the blockchain.
* Advanced Regtech solutions automate complex compliance tasks, such as adverse media searches, which allow the identification of informal ties between designated individuals and legal entities and facilitators of sanctions evasion. 
* Financial intermediaries lack instruments to identify complex sanctions evasion schemes, so related noncompliance risks can’t be mitigated. That’s why it’s crucial to cooperate with the national financial intelligence units and independent financial crimes investigators (such as [OCCRP](https://www.occrp.org/en)) and be proactive in reporting potential sanction evasion cases.

Dataspike platform leverages compliance teams’ ability to identify high-risk individuals and entities and prevent sanctions evasion, money laundering, and other illicit activities. It aggregates information from various sources, assesses risks, and helps compliance officers make informed, evidence-based decisions.


AGE VERIFICATION

Try DataSpike Now

COMPLIANCE INFRASTRUCTURE

KYC IN IGAMING

AGE VERIFICATION

What Is the FATF Grey List? Understanding Its Role in Global AML Policies

Binance and TD Bank: Compliance Failures and the Rising Importance of Regtech

Lessons on sanctions evasion