19 August 2026
Basel Institute on Governance ¦ Financial Intelligence Units and Crypto-Enabled Crime in Africa
Crypto-assets are changing both finance and criminal enterprise
Crypto-assets have expanded access to payments, remittances and financial services across Africa. They have also given criminal networks faster and more flexible ways to move, conceal and convert illicit proceeds.
Virtual assets, stablecoins, privacy-focused cryptocurrencies, mixers, cross-chain bridges, decentralised finance platforms and non-fungible tokens can be used to transfer value across borders within seconds. The speed and complexity of these transactions create a central enforcement problem: tracing activity on a blockchain is not enough. Authorities must generate actionable intelligence quickly enough to preserve assets, identify the people behind wallets and disrupt the underlying criminal network.
This challenge is particularly significant in Africa. The region combines rapid crypto adoption, expanding mobile payments, a large informal economy and substantial reliance on cash. At the same time, weaknesses in border controls, uneven regulatory coverage and rising cybercrime create opportunities for criminals to exploit digital payment channels.
Reported crypto-enabled offences include investment fraud, ransomware, romance scams, business email compromise, corruption, money laundering, wildlife trafficking, human trafficking, terrorism financing and proliferation financing. Crypto-assets are not the predicate offence in these cases. They are frequently the means through which proceeds are transferred, layered, converted or made available to other participants.
A crypto investigation should not stop at the wallet or transaction. It must establish how the funds were generated, who controlled them, what criminal conduct produced them and where the proceeds can be recovered.
The predicate offence remains the starting point
Financial investigations involving crypto-assets are often presented as blockchain exercises. In practice, they begin with an offence and the financial activity that follows it.
A romance scam may generate payments from multiple victims. A ransomware attack may produce a demand for cryptocurrency and subsequent transfers through several platforms. Wildlife traffickers may convert proceeds into stablecoins before moving them abroad. A corruption scheme may rely on intermediaries, shell companies or digital-asset exchanges to disguise the source and ownership of funds.
Each scenario has a different predicate offence, but the laundering process may involve similar stages. Criminal proceeds enter the financial system, move through accounts or wallets, are divided among several addresses, exchanged for other assets, transferred across jurisdictions and eventually converted into fiat currency or used to purchase goods and services.
The investigation must therefore connect two questions. What happened to the money, and what crime produced it? A transaction trail can show the movement of value, but it does not by itself prove the criminal purpose, the identity of the controller or the relationship between participants.
Financial intelligence units (FIUs) are well placed to make these connections because they operate at the intersection of financial, corporate, law enforcement and administrative information.
Why financial intelligence units are central
Financial intelligence units receive suspicious transaction reports and other disclosures from banks, virtual asset service providers (VASPs) and designated non-financial businesses and professions. They may also access company records, beneficial ownership information, customs data, immigration records, tax information and law enforcement databases.
The value of this information lies in its combination. A wallet address may initially appear to be a meaningless string of characters. Once linked to a person, it can be compared with bank accounts, tax records, company directorships, vehicle registrations, travel patterns, communications data and known associates.
This process can reveal the structure behind an apparently isolated transaction. Analysts may identify common beneficiaries, repeated conversion patterns, shared devices or links between wallets and exchange accounts. They may also determine whether the suspected wallet holder is acting alone or as part of a wider network.
A financial intelligence unit does not merely follow funds from one address to another. It can build a financial profile, map relationships, identify behavioural patterns and develop typologies that connect transactions which initially seem unrelated.
The blockchain may show where the money went. Financial intelligence can help establish who moved it, why it moved and where it may be recovered.
From detection to prosecution and asset recovery
A crypto-enabled financial crime investigation typically begins when a reporting entity identifies unusual activity. A bank may detect a suspicious transfer to a crypto platform. A virtual asset service provider may observe rapid movement between newly created wallets, exposure to a known illicit address or conversion patterns inconsistent with a customer’s profile.
The reporting entity submits the relevant information to the financial intelligence unit, which analyses the transaction alongside other available data. If the information indicates possible money laundering, fraud, trafficking, corruption or another offence, the unit disseminates intelligence to law enforcement or a competent authority.
Speed is essential at this stage. Digital assets can be transferred across several jurisdictions before a conventional investigation has begun. Early action may allow authorities to identify the relevant wallet, request or impose a temporary hold where legally permitted, alert another jurisdiction or preserve information needed for later proceedings.
The next phase involves tracing the funds on the blockchain and attributing wallet addresses to individuals or organisations. Attribution is rarely achieved through blockchain analysis alone. It depends on exchange records, customer due diligence information, device data, IP addresses, bank records, communications and other intelligence.
Investigators then seek to freeze and seize assets, establish the evidential chain and bring charges. The final objective is not simply conviction. It is also the recovery of criminal proceeds and the removal of the financial incentive that sustains the crime.
Network analysis exposes the organisers
Traditional investigations often focus on the immediate recipient or the person who physically carries out the offence. That approach can leave the organisers, financiers and beneficiaries untouched.
Financial intelligence units can help identify these higher-level actors by mapping the network around a transaction. A drug courier may be visible to investigators, while the person financing the operation remains concealed. A fraudster may receive the funds, but another individual may control the wallets, provide accounts or direct the conversion process.
Network analysis can reveal common financial infrastructure, repeated counterparties, shared contact details, linked businesses and connections between domestic and foreign actors. It can also show how a criminal group separates operational roles to distance the beneficiary from the predicate offence.
This is especially important in money laundering cases. The person who receives or converts the proceeds may not be the person who committed the underlying fraud, trafficking offence or corruption scheme. Establishing the links between those actors can support charges for laundering, conspiracy, participation in an organised criminal group or related offences, depending on the applicable law.
Case patterns illustrate the investigative value
Romance scams demonstrate why the combination of blockchain and conventional intelligence is necessary. Victims may be persuaded to purchase bitcoin or another cryptocurrency and transfer it to addresses controlled by the perpetrators. The proceeds can then be divided across exchanges, converted into local currency and withdrawn through bank accounts.
Blockchain analysis can identify the movement of funds. Financial intelligence can add bank account details, customer identification records, depositors, beneficiaries, telephone data, geographic information and links to other assets. Communication patterns may reveal relationships between people who do not transact directly but are part of the same criminal network.
The former Hydra darknet market illustrates the cross-border dimension. Funds associated with illicit activity moved through bitcoin, exchanges and laundering networks. Cooperation between financial intelligence units helped identify institutions and actors in different jurisdictions, supporting wider enforcement action.
Wildlife trafficking presents another pattern. Proceeds from illegal activity may be converted into USDT, transferred abroad and withdrawn locally. Linking virtual asset service provider records with bank accounts, customs information and travel data can expose the participants and the movement of value across the network.
These examples share a common feature: the crypto-asset transaction is only one component of a broader criminal process. The predicate offence, the laundering mechanism and the beneficiaries must be analysed together.
International cooperation must match the speed of crypto-assets
Criminal networks operate across borders, while formal legal assistance procedures can take months or longer. That delay can undermine an investigation because digital assets can be moved or converted almost immediately.
The Egmont Group provides financial intelligence units with a framework for secure international cooperation. Its Secure Web enables units to submit requests, exchange information and support cross-border financial tracing through protected channels.
Faster intelligence exchange can help authorities identify wallet holders, confirm financial profiles, locate linked assets and coordinate action before proceeds disappear. It can also help connect investigations in jurisdictions that might otherwise treat each transaction as a separate incident.
International cooperation is not limited to formal membership structures. Bilateral and regional arrangements, memoranda of understanding, joint typology work and coordinated investigations can all improve results. Regional cooperation is particularly important where the same exchanges, payment channels, facilitators and cash-out networks operate across several countries.
Public-private cooperation improves the first report
Financial intelligence units cannot address crypto-enabled crime without effective cooperation from the private sector. Banks and virtual asset service providers are often the first organisations to see suspicious activity.
The quality and timing of suspicious transaction reports directly affect the ability of authorities to act. Reports that contain only generic explanations or defensive language are of limited operational value. Useful reporting should provide the customer profile, transaction history, wallet addresses, counterparties, relevant dates, exchange activity, source-of-funds information and the reasons the activity appears inconsistent or suspicious.
Virtual asset service providers also have a role in identifying exposure to known illicit services, rapid movement between wallets, unusual use of mixers, transactions involving high-risk jurisdictions and patterns associated with scams or ransomware.
Effective public-private partnerships should include feedback. Financial intelligence units can share typologies, reporting indicators and examples of information that support investigations, while private-sector firms can explain technical developments and operational constraints. This feedback loop can improve both detection and the quality of future reports.
Technology supports analysis but does not replace judgment
Financial intelligence units face large volumes of data. In Nigeria, for example, the financial intelligence unit receives information from thousands of reporting entities. Manual review alone cannot identify every meaningful relationship across millions of transactions.
Artificial intelligence, machine learning, blockchain analytics, entity resolution, risk scoring, knowledge graphs, rules-based models and automated anomaly detection can help analysts prioritise cases and identify hidden links.
These tools must be used carefully. An automated alert is not a finding of criminality, and a risk score is not proof of money laundering. Human analysts must assess context, test alternative explanations, verify identities and ensure that intelligence is accurate and legally usable.
Technology should increase speed and coverage while preserving accountability. It cannot replace professional judgment, evidential standards or the need to understand the predicate offence.
Five foundations for stronger African financial intelligence units
Effective capability depends on more than purchasing blockchain-analysis software. Financial intelligence units need a clear legal mandate, operational independence and strong institutional oversight. They need access to relevant databases, including beneficial ownership, tax, customs, immigration and financial records.
They also need trained personnel who understand crypto-assets, financial investigations, cybercrime, asset recovery and the evidential requirements of criminal proceedings. Legal powers must support the timely production of records, the preservation and freezing of assets, intelligence dissemination and international information exchange.
Cooperation is equally important. Membership of international and regional networks, effective information sharing agreements and direct contact between analysts can reduce delays and prevent jurisdictional gaps.
Finally, institutions need sustainable funding. Many African financial intelligence units cannot afford expensive proprietary tools. Open-source solutions, shared regional platforms, technical assistance and joint procurement can help address the resource gap without compromising investigative capability.
The principal obstacles are practical and structural
Limited crypto expertise remains a serious weakness. Analysts and investigators may lack the knowledge required to understand wallets, decentralised platforms, stablecoins, mixers, bridges and exchange infrastructure.
Reporting quality is another problem. Weak or incomplete suspicious transaction reports (STRs) make it harder to identify the predicate offence and distinguish criminal activity from legitimate crypto use. Low registration levels among virtual asset service providers and inconsistent regulation further reduce visibility.
Access to beneficial ownership information is often limited, as is access to real-time data. Investigators may also face shortages of blockchain-analysis tools, trained personnel and experience in digital-asset seizure and recovery.
International legal assistance can be too slow for the risk presented by rapidly transferable assets. By the time a formal request has been processed, funds may have passed through multiple wallets, converted into another asset or moved beyond effective recovery.
These weaknesses are substantial, but they can be addressed through targeted training, better reporting standards, stronger regulation, improved data access and practical cooperation between agencies.
A forward-looking enforcement strategy
Short-term priorities include training analysts, improving suspicious transaction reporting, expanding access to affordable analytical tools and developing common indicators for crypto-enabled money laundering and predicate offences.
At the regional level, financial intelligence units can conduct joint typology studies, exchange case intelligence and support coordinated investigations. A case involving several countries should not be divided into disconnected national files if the same network, wallet infrastructure or cash-out mechanism is involved.
Over the longer term, authorities can work towards real-time monitoring, predictive intelligence and more advanced analytical systems. These developments should be introduced alongside safeguards for data protection, due process, accuracy and institutional accountability.
The strategic objective is not to collect the largest possible volume of blockchain data. It is to convert financial, digital and human intelligence into timely action that identifies offenders, preserves assets, supports prosecution and recovers the proceeds of crime.
Turning crypto-related vulnerabilities into enforcement strength
Crypto-enabled crime exposes weaknesses in financial intelligence, regulation and cross-border cooperation, but it also creates opportunities for better investigative practice. Blockchains provide permanent records of transactions. When those records are combined with identity data, financial information, corporate records, communications and international intelligence, they can help authorities reconstruct complex criminal networks.
The strongest response will come from financial intelligence units that operate as analytical hubs rather than passive recipients of reports. Their role is to connect the predicate offence to the laundering method, the wallet to the person, the person to the network and the proceeds to the recovery process.
Crypto investigations do not begin with blockchain data. They begin with intelligence about crime. The jurisdictions most capable of disrupting crypto-enabled money laundering will be those that act quickly, cooperate across borders and give analysts the tools, authority and training required to transform digital traces into usable financial intelligence.
EU Sanctions Helpdesk
The EU Sanctions Helpdesk platform supports European operators in complying with European Union restrictive measures (also known as sanctions) imposed worldwide.
Aimed primarily at Small and Medium-sized Enterprises (SMEs), the Helpdesk offers resources and personalised help to companies performing sanctions due diligence checks.