Share via:
- Updated on: May 14, 2026
Investigative reporters spent a year inside the back rooms and storefronts where cash becomes crypto. What they found should change how compliance teams think about AML risk.
A $1,200 transaction at a back-room counter in Kyiv ended up on the blockchain looking like a different business entirely. The cash desk that handled it – labeled as a currency exchange, accessed through a narrow deli, with a Telegram chat that moved itself onto a self-destructing channel before the swap – had moved millions of dollars through that single address, averaging more than $10,000 per transaction. The reporter doing the test transaction was the International Consortium of Investigative Journalists’ (ICIJ) Spencer Woodman, and his on-chain follow-up turned the visit into a much bigger story than the visit itself.
That contrast – unremarkable storefront, on-chain volume that looks nothing like retail remittance – sits at the center of the cash-desk problem. It is also the reason this category of business has moved from the margin of money-laundering conversations to the center of them in the last 12 months.
Key takeaways
- Cash desks move serious money out of unremarkable rooms. A Kyiv back-of-deli operation handled a $1,200 swap on a self-destructing Telegram chat. The same wallet showed millions moved at an average of over $10,000 per transaction. Crystal’s researchers found one Asian premises that had pushed roughly $380M through in nine months.
- The reporting is already shifting regulatory behavior. Eight London sites were raided, 47 Canadian licenses were revoked, and 4,000 crypto ATMs faced bans – all stemming from the ICIJ Coin Laundry and Toronto Star investigations.
- Legitimate need does not excuse shadow operation. Iranian diaspora customers have a real remittance problem, but the same wallets surfaced transactions experts flagged as allegedly being linked to Iran-backed terror groups. Registering a compliant cash desk in Canada is not onerous, so refusal to do it is itself a red flag.
- Investigative journalism is an unpaid extension of compliance. Exchanges that engage with reporters get a fairer story and a more mature industry. Those that don’t lose the chance to add context they later wish had been included.
The crypto cash desk reporting that pulled the curtain back
Crystal’s latest webinar, hosted by Chief Intelligence Officer, Nick Smart, brought together three of the journalists who put cash desks on the regulatory map: Spencer Woodman, staff reporter at the ICIJ, who led the Coin Laundry project, and the Toronto Star investigative reporters, Sheila Wang and Emma McIntosh, both of whose work has helped shape Canada’s current debate.
Audience polls were also conducted during the webinar, starting with finding out who had tuned in:
The panel’s findings are remarkably consistent across jurisdictions. In Ukraine, Poland, Dubai, and Toronto, the same pattern recurs: physical premises ranging from a back room in a deli to a three-storey mall lined with English and Persian signage; minimal or wrong-category registration; transaction sizes that bear no resemblance to ordinary remittance traffic; and a willingness to move clients onto encrypted channels before any money changes hands. Dubai, in Woodman’s account, far exceeded the Ukrainian numbers on per-transaction averages.
Public aggregator data points in the same direction. Nick’s quick scrape of BestChange – a popular cash-for-crypto directory – surfaced many such services in cities worldwide: 57 listings in London, 48 in New York, and Moscow being the densest with 98. Many operate either unlicensed or licensed under the wrong category – registered as a money service business, for instance, but not as a virtual asset service provider – putting them outside the AML control framework that should apply. Crystal’s own analysis of this shadow economy is collected in The billion-dollar blind spot in blockchain analytics.
The second poll asked the audience what their biggest concerns were regarding cash-to-crypto flows:
Why this category of crypto’s cash risks went uncovered for so long
The interesting question is not why this is happening, but why it took so long for anyone to write about it. The journalists’ answer is operational, not analytical. Investigating cash desks requires international travel, undercover test transactions with real money at risk, editors who tolerate that risk, and reporters willing to learn unhosted wallets and on-chain tracing from a near-zero base. Wang was explicit: she came in with “almost near zero knowledge about crypto.” The barrier was the cost of acquiring the skill, not the absence of the story.
For compliance teams, the same dynamic explains why these services have been able to operate at scale without drawing scrutiny. They look like nothing on the high street; they only look like something on-chain. Reading them requires the same combination of fieldwork, blockchain analytics, and patient editorial investment that the journalists had to build for themselves – the kind of capability Crystal builds for its customers via Crystal Expert and the wider compliance suite.
The final poll asked the audience members how confident in their organizations’ cash-to-crypto transaction detection capabilities they were:
The legitimate-use problem with crypto cash desk services
An important part of the discussion was about who uses these services. In Toronto’s Persian-speaking diaspora, cash desks are a remittance rail of last resort: Canadian banks have no correspondent relationship with Iranian institutions, and sanctions complexity has closed off most alternatives. There is, in McIntosh’s words, “a real legitimate need.”
The same wallets, however, surfaced transactions that experts flagged as alleged links to Iran-backed terror groups. The legitimate need does not insulate the operator from bad actors using the same payment rail.
The panel’s framing – and it is the right one for compliance – is that legitimate use does not justify shadow operation. Registering a compliant cash-for-crypto business in Canada is not, as McIntosh and Wang demonstrated by walking through the registration steps themselves, particularly onerous. The choice to operate outside that framework is therefore a signal in its own right, not a regrettable consequence of red tape. Nick Smart recalled one premises that asked for ID on transactions below $5,000 and waived it above, what he quipped was “inverse compliance.”
What this means for compliance teams when dealing with crypto cash desk services
Several practical points fall out of the reporting:
Wrong-category licensing is the first signal. A money-service-business registration that does not extend to virtual assets is not a mitigating control; it is an indicator that the business has been told it needs to register and has registered as narrowly as possible. Treat the gap between the entity’s actual activity and the scope of its registration as a primary risk flag in counterparty due diligence.
Per-transaction averages, not headline volume, are the tell. A storefront moving large totals could plausibly be aggregating retail flow. A storefront where average transaction sizes sit above $10,000 – in a market where the typical user is a remittance customer – is not retail. Crystal’s own research surfaced one Asian premises that had pushed roughly $380M through in nine months operating from an entirely unremarkable room.
Open-source signals are richer than they look. BestChange-style aggregators, Telegram channels, mall directories, and Instagram pages routinely disclose the locations and registration statuses of these businesses. The Toronto Star team did most of their initial mapping from public sources before walking the streets. A compliance function that ingests this signal – through a typology library, periodic sweeps, or analyst review – can prioritize enhanced due diligence on counterparties associated with these premises before any chain activity hits.
Investigative reporting is worth treating as a negative feed. Treat the ICIJ, the Toronto Star, and similar investigations the way you treat the Panama Papers – as inputs that should trigger reviews of high-risk clients, not as PR events. The journalists were explicit that they see themselves as adjacent to compliance, not adversarial to it: the institutions that engaged them got better stories and, more usefully, kept their context in the published record. Read Crystal’s coverage of the ICIJ findings here.
Working with the press, not around it
For exchanges and VASPs that find themselves in the scope of this kind of reporting, Woodman’s wish was simple: talk to us. Silence can cost institutions the chance to add genuinely useful context – and they later regret not adding it. McIntosh’s complementary observation: reporters are not regulators. The Toronto Star team will not pass findings to law enforcement, will not act as tipsters, and will only share information with agencies to obtain comment or in the narrow case of imminent threats. Engagement does not create exposure to regulators that the reporting itself would not have created.
The regulatory tide is already turning
Since the Coin Laundry and Toronto Star reporting landed, the regulatory response has moved faster than is usual for this category, such as the eight London sites being raided, the 47 Canadian licenses revoked, and the country potentially facing a nationwide ban on crypto ATMs. None of these moves originated in journalism alone, but it is hard to find a regulator who acted on cash desks before the reporting forced the file open.
For compliance officers reading this: the category has moved from “emerging risk” to “supervised risk” in under a year. The premises being raided this quarter were on aggregator sites and within walking distance of regulator offices the quarter before. The signal was available; what changed was who was looking for it.
Watch the full conversation here:
Frequently asked questions
What is a crypto cash desk?
A crypto cash desk is a physical location where customers exchange cash for cryptocurrency, often operating from storefronts, back rooms, or informal premises. Many are unlicensed or registered under the wrong category, placing them outside the AML frameworks that should apply. The ICIJ and Toronto Star investigations revealed cash desks across Kyiv, Dubai, and Toronto moving millions through single wallets.
Why are crypto cash desks an AML risk?
Cash desks are an AML risk because they convert physical currency into digital assets with minimal or no identity verification. Transaction volumes at these premises often far exceed what retail remittance traffic would explain. Crystal’s research found one desk that pushed roughly $380M through in nine months from an unremarkable room.
What did the ICIJ Coin Laundry investigation find?
The ICIJ’s Coin Laundry project sent reporters undercover to cash-to-crypto desks across multiple countries. They found a consistent pattern: physical premises with minimal registration, transaction sizes that did not match retail use, and operators who moved clients onto encrypted channels before handling money. The reporting contributed to raids on eight London sites and the revocation of 47 Canadian licenses.
Are regulators taking action on cash-to-crypto desks?
Yes. Since the investigations were published, regulators have moved quickly. Eight London sites were raided, 47 Canadian licenses were revoked, and Canada is considering a nationwide ban on crypto ATMs. The category has shifted from emerging risk to supervised risk in under a year.
How can compliance teams detect cash desk exposure?
Compliance teams can detect cash desk exposure by monitoring for wrong-category licensing, unusually high per-transaction averages, and counterparty links to premises listed on public aggregator sites like BestChange. Treating investigative reporting as a negative-news feed and reviewing clients flagged in published investigations are also effective first steps.
