Basel Institute on Governance ¦ The Future of Financial Crime Investigations involving Cryptoassets

A moving target that demands new responses

Financial crime in the crypto ecosystem continues to evolve rapidly. At a recent global conference bringing together law enforcement, regulators, private-sector innovators, asset managers and educators, practitioners stressed that the problem is not a single technology or typology but a moving target of techniques, jurisdictions and professional enablers. Criminals exploit privacy coins, bridges, decentralized finance and jurisdictional gaps, while using both digital and traditional means to launder proceeds. The panelists concurred that responding effectively requires continuous innovation in investigative tools, sustained capacity building, reorganization to enable collaboration, multisector partnerships and attention to the full lifecycle from prevention to asset management and forfeiture.

Institutional awareness and capacity-building remain highest priorities

One striking theme from the discussion was that technical challenges (mixers, cross-chain swaps, privacy-preserving protocols) are significant but not the only — or even the greatest — barrier to effective investigations. Many jurisdictions and agencies still lack basic institutional awareness, trained personnel and retention strategies for cryptocurrency specialists. That gap shows up across law enforcement, tax authorities and financial intelligence units: some teams are highly capable, while others have virtually no crypto capability or tooling. T he consequence is fragmented responses, missed leads and reliance on external providers.

Panelists argued that training must cover fundamentals as well as advanced techniques. Investigators need to understand what a blockchain record actually represents, how a transaction flows, what metadata and open-source evidence can be produced and, crucially, how to defend that evidence in court. Practical exercises — such as creating and using wallets, making transactions, and reproducing tracing results with open-source methods — were emphasized as essential to turn abstract knowledge into court-ready, admissible evidence. Bespoke, role-specific training (for negotiators, covert operators, financial investigators and prosecutors) was recommended so that those working particular crime types receive tools and methods tailored to their needs.

Bring open-source intelligence and OSINT into every investigation

Private-sector speakers urged a broader intelligence posture that extends beyond on-chain analytics. Valuable leads and identities are often discoverable in the clear web, deep web and dark web long before an exchange KYC response arrives — social posts, forum threads, airdrop announcements, reused usernames and even early transaction hashes can connect a wallet to a person. Building OSINT capability and integrating it with chain analytics reduces dependence on slow subpoenas and can produce actionable leads that stand up in court when corroborated with verifiable artefacts. In short, on-chain and off-chain signals must be fused.

Public–private partnerships and data-driven hotspot identification

Analytics firms and law enforcement highlighted the role of public–private collaboration in identifying criminal typologies and jurisdictional hotspots. Large-scale, data-driven analysis shows where illicit flows concentrate — Southeast Asia was cited repeatedly as a region into which substantial illicit flows move, often because of regulatory and enforcement gaps. But data alone is not enough: meaningful impact requires a coordinated five-pronged approach: capacity building, regulatory reform, enabling legislation, operational best practices for seizure and custody, and intelligence collection. Only by addressing all these dimensions together can jurisdictions be “hardened” against becoming laundering magnets.

Bastian Schwind-Wagner_Follow "The rapid evolution of crypto-enabled financial crime demands coordinated public–private action: build specialist capacity, integrate open-source and on‑chain intelligence, and treat seizure and asset management as operational priorities. Only by combining explainable AI, targeted training, and harmonized legal frameworks can investigators stay ahead of adaptive criminal typologies."

Seizure and asset management are a specialization, not an afterthought

Seizing cryptoassets is not as simple as “grab a ledger and lock it in a safe”. Panelists stressed that seizure, custody and management of cryptoassets have become specialist disciplines. Effective programs require policies, procedures, approval frameworks, continuity plans, trained custodial teams and legal structures that allow appropriate actions after seizure (for example conversion rules to mitigate volatility or to preserve value pending forfeiture). Mistakes in custody create evidentiary, operational and organizational risks; for example, loss of access when personnel change jobs, or legal barriers to converting volatile tokens. The seizure lifecycle must be planned up front and embedded into investigator training and institutional design.

Operational use of seized assets: covert operations and intelligence gains

Beyond preservation, well-governed management of assets can enable proactive operations. Assigning use-cases for seized assets — such as supporting covert operations or funding intelligence activities — requires strict governance but can create opportunities to infiltrate criminal marketplaces, run sting operations and produce intelligence that yields further seizures. Doing this effectively depends on cross-disciplinary coordination across investigators, prosecutors and asset managers, plus clear legal authority in the jurisdiction.

Specialized tooling and the right tool for the right job

The crypto ecosystem has diversified: Bitcoin-era tracing techniques no longer suffice for privacy coins, DeFi protocols, mixer designs and cross-chain bridges. Investigators need a mix of general analytics, specialized tooling and reproducible open-source methods. The panel recommended a pragmatic approach: equip teams with bespoke training and tools aligned to the crime types they investigate (e.g., financial investigators, cyber specialists, negotiators). Private-sector analytics can fill capacity gaps, but reliance on proprietary black-box outputs must always be balanced by open-source corroboration that can be explained in court.

From reactive tracing to proactive pattern recognition

Advances in pattern recognition — across chains and across typologies — enable a shift from largely reactive, case-by-case tracing to proactive detection of criminal networks. Machine-driven scanning for behavioral patterns rather than just transactional links helps identify typologies that don’t form a single graph cluster but share operational fingerprints. This shift supports prioritization: focusing scarce enforcement resources on actors and flows with the highest impact.

AI: a force multiplier with explainability and evidentiary limits

Artificial intelligence holds the potential to dramatically compress investigative timelines — tasks that once took months can now be accelerated. AI can link disparate OSINT traces, surface behavioral patterns at scale and assist attribution. But the panel repeatedly warned about explainability, reproducibility and courtroom admissibility. Models whose inner workings cannot be faithfully explained or replicated risk producing outputs that are unusable in prosecution. The consensus: use AI as an augmentation and triage tool, but ensure that investigative conclusions rely on verifiable, explainable evidence that can be demonstrated in open-source terms where necessary. The arms-race dynamic was also noted — criminals will adopt AI too — so defenders must combine technological advances with basic operational hygiene and diversified investigative techniques.

The persistence of “back-to-basics” laundering

As crypto solutions and tracing tools improve, criminal actors adapt — and sometimes revert to low-tech, cash-based methods. Large cash deposits, physical networks of money mules, and classic placement techniques remain part of the laundering toolkit. Effective strategies must therefore span digital and traditional financial investigations; improving crypto capabilities must not mean neglecting fiat investigative skills.

Prevention, victim reporting and coordinated action

Prevention and victim support remain essential. Public reporting tools can help warn potential victims and, when curated and validated, provide analytic value. But victim-reported data is noisy and must be handled carefully to avoid false leads. The panel urged investment in prevention, public education and victim-reporting channels that feed into coordinated analytic pipelines. Joint public–private prevention efforts are valuable, but enforcement — arrests, seizures and prosecutions — must also remain a central pillar.

Conclusion: integrate innovation, capacity, collaboration and the full lifecycle

The path forward requires a holistic response: accelerate innovation in tools (including AI, but with a focus on explainability), build and retain specialist capacity, reorganize investigative and seizure capabilities where needed, and deepen multisector collaboration that links prevention, detection, seizure, forfeiture and victim redress. No single actor can tackle crypto-enabled financial crime alone. Combining open-source methods with proprietary analytics, standardizing best practices for seizure and custody, investing in targeted training programs and synchronizing regulatory and operational levers across jurisdictions are practical steps that, when coordinated, create durable gains. The opportunity is to turn the same speed and innovation that criminals exploit into a more agile, transparent and effective collective response.

Acknowledgement

This summary draws on the Basel Institute on Governance panel discussion featuring the panelists.