Prevalent money laundering laws were built for a world of accountable intermediaries. A bank who knows its customer, sitting inside a single jurisdiction or a small number of them, which can be compelled by a domestic regulator to freeze an account or disclose a beneficial owner for compliance purposes. These features do not align with those of cryptocurrency which was pioneered by Satoshi Nakamoto in 2009. The misalignment is attributable to the fact that it runs parallely to the conceptual foundation of the international anti-money laundering framework. Where a transaction has the ability to be executed without any institution at all, the framework is left with nothing to attach itself to.
This article argues that the present architecture of international law, or to an extent even domestic law, built from the Palermo and Merida Conventions, the Financial Action Task Force Recommendations, and regional instruments such as the European Union Transfer of Funds Regulation, remains dependent on the existence of an identifiable regulated intermediary who plays a vital role in financial cross border transaction. Then the article further goes on to discuss how decentralised finance, self custodial wallets, and cross chain infrastructure can be seen to increasingly operate without one, thereby leaving a gaping hole which is being exploited by delinquents. The result of this article hypothesis is not merely a gap in enforcement mechanism but a lack in harmonisation between the unit of regulation that international law assumes to exist and the unit of activity that doesn’t need one.
Pseudonymity Is Not the Same as Anonymity
Public blockchains record every transaction permanently and make that said record available for anyone to see, but what they do not record is the real world identity behind the said wallet address. This is pseudonymity rather than anonymity, and the distinction has created a pathway for an enforcement mechanism to exist. Genuine anonymity, is a narrower and more recent problem. It arises from a limited number of mechanisms, principally mixers, which pools and redistribute funds in a manner that can, within seconds, obscure or effectively sever the laundering link connecting the proceeds of crime to their source and recipient, and cross-chain bridges, which move value between different blockchains. At no point throughout this journey does the money pass through a bank, or any other party who could have checked an ID, flagged the transaction, or frozen it on request of the enforcement agency. Meanwhile, self custodial wallets can be seen to compound a difficulty on another level because no institution intermediates the holding of the assets in question at all. The regulatory significance, therefore, lies in the growing disconnect present between a framework which is built around identifiable intermediaries and technologies that enable value to move beyond them.
An Architecture Built Around the Regulated Intermediary
The United Nations Convention against Transnational Organized Crime mandates the states parties to criminalise laundering of proceeds of crime while enabling confiscation of the same, but it defines its obligations of state party in terms of technology in neutral terms, leaving the operative details entirely to the domestic law. Whereas, the United Nations Convention against Corruption adds an asset recovery regime with detailed provisions on international cooperation, yet it too was negotiated before virtual assets existed consequently saying nothing about them directly. Neither of these conventions are deficient on its own terms, but at the same time neither can be read as addressing decentralised value transfer, because both assume that proceeds of crime move through channels which are capable of being frozen by an order.
The operative standard setting has therefore fallen on the Financial Action Task Force (FATF), a body which has been producing soft law rather than binding treaty obligations on its state members. FATF extended Recommendation 15 in 2019 so as to include within its ambit virtual assets by way of virtual asset service providers (VASP), while as simultaneously introducing what is known as the Travel Rule under Recommendation 16. These changes currently requires the VASPs to collect as well as transmit originator and beneficiary information to the authorities. This has brought about a significant conceptual move, because it directly imported the banking logic of the Wolfsberg era, where the regulatory financial institutions were expected to identify the parties involved in the transaction and the relevant details. This logic was applied directly into blockchain rail by defining a VASP as any entity capable of conducting exchange, transfer, safekeeping, or administration of virtual assets on behalf of others.
However, these definitions also work upon the assumption of an existence of identifiable intermediary, thereby, making it inadequate in a system where no such identifiable entity is present. FATF’s own monitoring data illustrates the resulting weakness. As of 2025, only one of 138 assessed jurisdictions was found fully compliant with Recommendation 15, with 21 per cent found non compliant outright, and FATF repeatedly flags unhosted wallets, decentralised finance, and stablecoins in areas where jurisdictions is incapable of identifying who, if anyone, should bear the licensing obligations.
Regional law has moved further than the global standard in this regard, though limited only within its own borders. The European Union’s remodel of Transfer of Funds Regulation (TFR) is the most concrete binding instrument which requires the crypto asset service providers to attach originator and beneficiary information across all cryptocurrency transfers from 30 December 2024 onwards, with additional verification obligations being placed for transfers to self hosted addresses above a defined threshold. In addition to TFR the Markets in Crypto Assets Regulation supplies the licensing regime for crypto asset service providers making the Union’s set of guidelines in regards to virtual assets the most complete regional answer present till date. It remains, however, a regional answer. A transaction routed through a service provider established outside the Union, or through no service provider at all, sits far beyond its reach, and the Union’s own supervisors have acknowledged that the treatment of transfers to non custodial addresses outside the bloc remains unresolved.
Enforcement Against a Network With No Fixed Address
The shortcomings prevailing within an intermediary-based framework is most apparent at the point of enforcement, where the law is bound to identify something or rather someone against whom its powers is capable of being operated. This difficulty is illustrated by Van Loon v. Department of the Treasury. There, the Fifth Circuit considered OFAC’s designation of the Tornado Cash mixing protocol under the International Emergency Economic Powers Act (IEEPA). The court held that the immutable smart contracts which is present beneath the protocol can not be constituted as “property” capable of being blocked under IEEPA because, once made immutable, they can not be owned, controlled, altered, or removed by anyone. More importantly, the court recognised an even deeper limitation: where technology is specifically designed to operate beyond the control of any identifiable person or entity, it falls outside the reach of the existing sanctioning framework.
The significance of Van Loon can be seen to extend beyond this particular statutory question presented before the court, as the case demonstrates the precise limitation which has been identified in this article. The practical response however in other cases has been to move from protocol to the individuals who are associated with it. The founders of the Samourai Wallet mixing service pleaded guilty in 2025 to conspiracy of operating an unlicensed money transmitting business, while the developer of Tornado Cash faced a separate federal prosecution. These proceedings tells us about the resulting shift: where the protocol itself presents no obvious regulatory point of attachment, enforcement is instead redirected towards the persons who create, operate, or maintain it.
Toward a Different Regulatory Model
None of this suggests that international law should attempt a comprehensive new treaty on virtual asset laundering. A negotiated instrument of that kind would take at least a decade to conclude, would settle on the lowest common denominator which would be acceptable to the widest membership, and would likely be obsolete before ratification, given the pace of protocol innovation. The more viable path is targeted and functional rather than comprehensive and institutional.
Therefore in lieu of the discussion above, FATF’s Recommendation 15 should be revised to adopt a functional test for regulatory control by placing liability on whoever can be seen to exercise effective control over a protocol’s parameters, fee structure, or front end interface, rather than confining the VASP status to entities that somehow seems to resemble a conventional intermediary in the transaction. This factor follows directly from the reasoning which has been given in Van Loon of no one being able to own or control immutable code itself, the only actor left in these scenario are those who retains discretion over how the protocol is presented and monetised. Anchoring liability towards the said actor provides the Travel Rule with an addressee even where the underlying protocol has none. Moreover, Cross chain bridges, which serves as the principal laundering choke point, should be brought expressly within the Travel Rule’s scope as a distinct category in itself and as a way to close the gap being exploited. Furthermore, the present mutual legal assistance is structurally too slow for on-chain asset flows, which takes place in mere minutes, this can be solved via formation of dedicated fast track cooperation protocol analogous to that of Council of Europe’s confiscation cooperation machinery.
International law has not failed to notice cryptocurrency based laundering. It has responded by extending an intermediary centred model to a technology partly designed to operate without intermediaries, and the extension works only where the technology in some way still resembles the model closely enough. The honest assessment is that the current framework is legally coherent for custodial activity but can be seen to be largely absent for everything else, and that absence will not be filled by writing a new convention so much, as can be done by rebuilding the operative standard around function and control rather than institutional form.
Vaidehi Yadav is a fourth-year B.A. LL.B. (Hons.) student at the University School of Law and Legal Studies, Guru Gobind Singh Indraprastha University. She has a keen interest in economic law and white collar crime, and I aspires to build her career in these areas through research and practice.
PC: Adobe Stock
