Tracing Crypto Exposure Through Payment Structures

Crypto exposure can sit inside an appar­ently conven­tional payment chain even when the merchant never prices goods in cryptocur­rency. A customer may pay by card, an acquirer may settle in fiat, and a later treasury transfer may convert proceeds into a stablecoin. Inves­ti­gators therefore need to trace the full flow of value, not merely search the merchant’s website for a crypto-payment button.

Map the payment chain before analysing wallets

Start with the commercial trans­action and identify every role: merchant, payment gateway, payment facil­i­tator, acquirer, bank or electronic-money insti­tution, exchange or other virtual-asset service provider, custodian, wallet controller and final benefi­ciary. Record the contracting entity, regulated entity, account name and juris­diction for each step. Similar trading names can hide different legal entities.

Draw separate paths for customer payment, merchant settlement, refunds, charge­backs, reserves and intra-group transfers. This approach builds on the same disci­pline used when tracing cash through payment facil­i­tators. It also reveals where a fiat trans­action becomes a virtual-asset transfer—or where claimed crypto exposure never occurs at all.

Distinguish direct and indirect exposure

Direct exposure includes holding cryptoassets, controlling a wallet, accepting a token from a customer or receiving settlement in a token. Indirect exposure can arise when a processor or treasury provider converts funds, a counter­party relies on crypto liquidity, or a group company handles the virtual-asset leg.

Do not equate crypto accep­tance with price risk. A processor may convert the customer’s asset immedi­ately and pay the merchant a fixed fiat amount. Conversely, an ordinary card-acquiring arrangement can create crypto exposure if merchant proceeds are later settled in stable­coins. Malta Media’s report on PAYSTRAX adding optional stablecoin settlement is a useful illus­tration of the distinction between the payment method and the settlement asset. Provider claims should still be checked against contracts, regulator records and trans­action evidence.

Collect evidence from both sides of the bridge

For the fiat side, examine bank state­ments, processor state­ments, merchant descriptors, settlement reports, invoices, reserve movements and foreign-exchange entries. For the crypto side, preserve wallet addresses, trans­action hashes, chain, token contract, timestamp, amount and trans­action fees. Confirm that the token is genuine; ticker symbols and copied logos are not reliable identi­fiers.

A blockchain record can show transfers between addresses, but it does not automat­i­cally identify the person controlling an address. Custodial platforms often use omnibus wallets and keep decisive ownership infor­mation off-chain. Bridges, mixers, decen­tralised exchanges, internal exchange ledgers and address rotation can further interrupt a simple trail. Attri­bution from an analytics provider should be recorded with its source, date and confi­dence level rather than presented as certain fact.

Link the two sides using several corrob­o­rators: matching amounts after fees, narrow timestamps, repeated deposit addresses, exchange reference numbers, counter­party names, withdrawal confir­ma­tions and Travel Rule infor­mation where available through lawful channels. A flow-of-funds diagram should mark verified links differ­ently from inferred ones.

Check the service providers and controls

Verify each provider in the relevant regulator’s register and check whether the legal entity is autho­rised for the service and territory in question. A group company’s licence does not automat­i­cally cover its affil­iates. The FCA’s current cryptoasset regis­tration expec­ta­tions specif­i­cally call for monitoring of both fiat, off-chain activity and cryptoasset, on-chain activity, supported by a detailed flow-of-funds diagram.

Review onboarding, source-of-funds records, sanctions screening, counter­party due diligence, wallet screening, alert dispo­sition and escalation logs. Examine whether the business can identify origi­nators and benefi­ciaries rather than merely gener­ating risk scores. When shell entities appear in the chain, apply the ownership checks described in our guide to tracing the owners of a crypto brokerage.

Treat red flags as prompts for verification

The FATF virtual-asset red-flag report highlights unusual trans­action patterns, anonymity-enhancing features, geographical risk and activity without a logical business expla­nation. None proves wrong­doing on its own. High-frequency transfers may reflect legit­imate treasury opera­tions; a bridge may be used for cost or liquidity reasons; and one exchange deposit address may represent many customers.

Stronger findings usually combine indicators: unexplained conver­sions shortly after card settlement, funds routed through an unrelated group company, repeated exposure to sanctioned or illicitly attributed services, incon­sistent invoices, or a provider operating outside its permis­sions. Compare those facts with how payment insti­tu­tions allocate struc­tural risk before assigning respon­si­bility.

Report the result with clear limits

State the period reviewed, chains covered, data sources and missing records. Separate confirmed transfers, provider attri­bution, analytical inference and unresolved gaps. Calculate exposure using a consistent valuation time and distin­guish gross flows from balances actually held.

A defen­sible inves­ti­gation may conclude that the merchant had direct exposure, indirect counter­party exposure, settlement-only exposure or no demon­strated crypto exposure. That calibrated answer is more valuable than claiming the blockchain makes every payment trans­parent.