A buyer confirms a cryptocurrency trade on an Egyptian peer-to-peer marketplace. The listing specifies bank transfer only, but the seller’s message contradicts this: “Please send 5,000 EGP via Vodafone Cash to this number.” This preference for mobile wallets isn’t arbitrary; it reflects a fundamental shift in how crypto settlement occurs in restricted markets.
A global pattern across ten markets
When regulators ban crypto or pressure banks to restrict transactions, users adapt. They don’t stop trading, they simply shift settlement to alternate methods like mobile wallets, which offer speed, accessibility and few restrictions. The result: crypto settlement has migrated to channels where regulators have far less visibility.
Crystal Intelligence documented this pattern across ten emerging markets between November 2025 and January 2026, analyzing peer-to-peer cryptocurrency advertisements to identify dominant settlement methods.
| Region | Country | MFS Share of P2P Ads | Dominant Providers |
| West Africa | Ivory Coast | 85% | MTN MoMo, Orange Money, Airtel Money, Wave, Moov Money |
| Ghana | 76% | MTN MoMo, Vodafone Cash, Airtel/Tigo, Telecash | |
| Nigeria | 45% | OPay, PalmPay, Chipper Cash, PAGA, Carbon, Kuda | |
| North Africa | Algeria | 67% | BaridiMob, CCP |
| Egypt | 65% | Vodafone Cash, Orange Cash, WePay, Telda | |
| South Asia | Bangladesh | 83% | bKash, Nagad, Rocket, Upay |
| India | 66% | UPI, IMPS, Paytm, PhonePe, Digital eRupee | |
| Pakistan | 58% | Easypaisa, JazzCash, NayaPay, SadaPay | |
| Philippines | 51% | GCash, PayMaya, GoTyme, Coins.Ph | |
| Latin America | Colombia | 48% | Nequi, Daviplata, Movii, Uala, BreB |
Massive scale, hidden activity
The range is notable: from near-total mobile wallet dependence in Bangladesh (83%) and the Ivory Coast (85%), to more balanced splits in Nigeria (45%) and Colombia (48%) where traditional banking remains accessible. But even at the lower end, nearly half of all peer-to-peer crypto settlement occurs through mobile money rails.
These aren’t niche services operating at financial system margins; they sit at the core of everyday payments for hundreds of millions of users. India’s Unified Payments Interface processed 21.6 billion transactions in December 2025, while PhonePe alone has over 600 million registered users and processes approximately 330 million daily transactions.
Across emerging markets, Vodafone Cash claimed 20 million users. bKash serves over 82 million users in Bangladesh, while Pakistan’s Easypaisa has more than 50 million accounts. GCash in the Philippines claims over 80 million active users worldwide. Ghana’s MTN Mobile Money surpassed 15-17 million monthly active users. Meanwhile, Egypt hosts 50 million mobile wallet accounts.
Globally, mobile money systems have surpassed two billion registered accounts and over 500 million monthly active accounts, processing trillions of dollars in value.
These platforms were designed and licensed for everyday payments like utility bills, sending money to family, and buying goods from local shops. Yet they’ve quietly become the dominant payment method in peer-to-peer cryptocurrency trading across markets representing hundreds of millions of potential users.
Mobile wallet operators conduct KYC and monitor for suspicious activity under AML obligations. But to their systems, a crypto settlement looks identical to any other person-to-person transfer – there’s nothing to flag it as crypto-related. Banks see mobile wallet float accounts. Neither can distinguish crypto settlement from legitimate P2P payments, and no regulatory framework currently requires crypto-specific monitoring for mobile money transfers.
Why regulators miss the connection
The compliance blindspot exists because mobile wallet-to-crypto transactions fall between regulatory authorities, none of whom have complete visibility.
What mobile wallet operators see: A customer sends 5,000 Egyptian Pounds via Vodafone Cash to another customer. Both accounts are KYC-verified. The transaction is domestic, peer-to-peer, and within normal limits. Nothing flags it as unusual – it looks identical to millions of routine transfers for rent, bills, or family support. Transaction approved. The operator has no visibility into what happens next: whether the recipient converts those pounds to USDT, or whether that USDT flows to sanctioned entities.
What regulators see: Egypt’s Central Bank prohibited banks from facilitating crypto in 2018. But they have no systematic visibility into unlicensed VASPs, blockchain transactions, or connections between mobile payments and crypto settlements.
Our investigation of Ebtoo – an Egyptian VASP in which 65% of ads specify mobile wallet settlement – found 2.9% in high-risk inflows and 6.9% in high-risk outflows, including sanctions and gambling exposure. This activity is invisible to Egyptian authorities.
What nobody connects: No single entity sees the complete chain: the mobile payment, the VASP conversion, and the blockchain destination. This blind spot is partly a consequence of regulatory design – by restricting crypto through banks, regulators pushed activity toward infrastructure they weren’t monitoring.
What blockchain analysis reveals
The peer-to-peer advertisement data shows where the crypto settles. Blockchain forensics show where it flows next. Crystal traced on-chain flows associated with 45 VASPs operating across the ten countries between January 2023 and December 2025. Combined, this local peer-to-peer ecosystem processed approximately $403.3M in total crypto flows – $186.7M received and $216.6M sent.
Behind seemingly ordinary mobile wallet transfers lies a dense, interconnected network of crypto flows linking local users to global centralized exchanges, offshore peer-to-peer platforms, illicit service providers, and sanctions-exposed wallets.
| VASP Type | Inbound | Outbound |
| Licensed exchanges | $78.7M | $75.7M |
| Unlicensed exchanges | $8.7M | $33.9M |
Above: VASP Flow Documented between January 2023 and December 2025. Source: Crystal Intelligence
Licensed exchanges dominate overall activity, accounting for $78.7M inbound and $75.7M outbound. However, significant exposure to high-risk entities exists. The imbalance in unlicensed exchange flows is notable: nearly four times more sent than received. This suggests these VASPs function primarily as on-ramps – converting local fiat to crypto, which then moves elsewhere.
Risk exposure
Local VASPs received $3.4 million in high-risk-tagged crypto (1.8% of inbound flows).
| Category | Amount | Share of High-Risk Inbound |
| Illegal services | $1.4M | 45% |
| Gambling | $1.2M | 38% |
| Sanctions-exposed entities | $534K | 17% |
Above: Inbound Risk Breakdown
On the outbound side, VASPs sent approximately $1.6 million to high-risk entities.
| Category | Amount | Share of High-Risk Outbound |
| Gambling | $814K | 54% |
| Sanctions-exposed entities | $396K | 26% |
| Illegal services | $307K | 20% |
Above: Outbound risk breakdown
The invisible risk
A clear pattern emerges: users convert local fiat into crypto through these brokers, after which a subset of funds is routed to higher-risk networks – a process that occurs entirely on-chain and outside the visibility of mobile wallet operators and domestic payment regulators.
The analysed VASPs aren’t primarily funded by high-risk sources. Instead, high-risk exposure appears more prominently in how crypto is distributed onward after fiat conversion, particularly to gambling platforms, illegal services, and sanctions-linked entities. This represents a fundamental blind spot in financial crime monitoring systems: the moment of highest compliance risk occurs at the fiat-to-crypto conversion, but the illicit activity only becomes visible afterward, on-chain, where local regulators aren’t looking.
On-chain case studies
The following case studies illustrate how informal, mobile-wallet-based crypto onramps connect directly to high-risk blockchain ecosystems that remain invisible to local payment operators and regulators.
West Africa: Ghana, Nigeria and Ivory Coast
West Africa presents some of the highest mobile wallet dependence in our dataset. Limited banking infrastructure, high mobile penetration, and young populations have made mobile money the default payment rail – and increasingly, the default crypto settlement method.
Regulatory frameworks range from nascent (Ivory Coast) to recently formalized (Ghana’s December 2025 VASP Bill) to still evolving (Nigeria’s 2023 reversal of its crypto banking ban, followed by the 2025 Investment and Securities Act, which defined digital assets as securities).
| Country | Population | MFS Share | P2P Ads Analyzed | VASP Traced | Headline Risk Finding |
| Ivory Coast | 33.5M | 85% | 1301 | NKAB Exchange | Fraud, gambling, sanctions exposure |
| Ghana | 35.7M | 76% | 1863 | Big Flex | 9.9% gambling inflows, stolen funds |
| Nigeria | 242M | 45% | 10771 | Cardify Africa | Sanctions-linked, scam-related flows |
Population source data: Worldometer
Ghana
Crystal’s investigation of Big Flex revealed over $4.5M in outgoing flows and $3M in incoming flows. Gambling platforms dominated high-risk exposure (9.7% received, 1.5% sent), with additional exposure to illegal services and stolen funds
Above: Chart shows Big Flex’s incoming flow of $3,050,136, with about 9.74% high-risk, mainly gambling (9.7%) and illegal services (0.042%). Outgoing flows of $4,570,300 had 1.72% high-risk, mainly gambling (1.5%), stolen coins (0.17%), and illegal services (0.052%). Source: Crystal Expert.
Beyond the overall risk percentages, on-chain analysis identified transactional exposure to multiple high-risk entities. These include the gambling platforms Stake and Shuffle, and addresses linked to the ongoing Nepal Gold Smuggling case. Additional interactions were observed with wallets flagged under “Banned by Contract” from Tether, as well as addresses associated with Victim Reports.
These interactions involve both inbound and outbound flows, with several counterparties connected within a limited number of blockchain hops. The relatively short path distances indicate that the exposure is not merely indirect or incidental but reflects closer transactional proximity to flagged entities.
Ivory Coast and Nigeria
The Ivory Coast exhibits the highest mobile wallet dependence in our study: 85% of 1,301 peer-to-peer advertisements settle via MFS, including MTN MoMo, Orange Money, Airtel Money, Wave, and Moov Money. The regulatory environment remains a grey area, with only perfunctory guidance from the regional Central Bank of West African States (BCEAO) on electronic money handling.
Crystal’s investigation of NKAB Exchange revealed high-risk incoming exposure to fraudulent exchange services (0.25%), gambling platforms (0.056%), and sanctioned entities (0.017%). While these percentages are lower than Ghana and Nigeria, the near-total reliance on mobile money (85%) means even modest risk exposure flows through infrastructure with no crypto-specific monitoring.
In Nigeria, only 45% of 10,771 peer-to-peer ads specify mobile wallets – reflecting greater banking access than its neighbors. However, the fintech wallet ecosystem (OPay, PalmPay, Kuda) is growing rapidly. Crystal’s investigation of Cardify Africa showed 0.5% high-risk inflows from sanctions only and 4.81% high-risk outflows, the bulk of which was due to sanctions.
Above: The chart shows $417,098 incoming flows for Cardify Africa, with 0.5% high-risk from sanctions. Outgoing flows of $871,137.71 had 4.8% high-risk, including sanctions (4.8%) and scams (<0.01%). Source: Crystal Expert.
On-chain analysis identified transactional interactions with several sanctioned entities, including Nobitex, Garantex, Bit24, and addresses designated by the National Bureau for Counter Terror Financing of Israel(NBCTF), specifically via administrative seizure orders (ASOs) such as ASO – 29/23.
These interactions indicate exposure to exchanges and entities that are subject to sanctions designations or associated with sanctioned jurisdictions. The presence of multiple touchpoints across various sanctioned platforms suggests that this exposure is not isolated.
Engagement with such entities significantly elevates compliance and regulatory risk, particularly because these flows originate from mobile-payment–funded peer-to-peer activity.
North Africa: Algeria and Egypt
Algeria and Egypt represent the most restrictive regulatory environments in our study – both have banned or heavily restricted crypto trading. Yet the data shows prohibition doesn’t eliminate activity; it pushes settlement underground. These two markets also show some of the highest sanctions exposure among the VASPs we analyzed.
| Country | Population | MFS Share | P2P Ads Analyzed | VASP/s Traced | HeadlineRisk Finding |
| Algeria | 48M | 67% | 815 | Changer2u | 7.2% sanctions exposure |
| Egypt | 120M | 65% | 3,471 | Ebtoo | Total gambling exposure of 6.53% |
Population source data: Worldometer
Egypt
Despite crypto trading being technically illegal, Egypt hosts 50 million mobile wallet accounts – and 65% of the 3,471 peer-to-peer ads analyzed settle via mobile money, dominated by Vodafone Cash, InstaPay, and Etisalat Cash.
Above: Chart showing the Egyptian preference for local MMS, with just three, Vodafone Cash (24.2%), InstaPay (23%), and Etisalat Cash (7.7%) making up 54.9% of ads. Source: Crystal Intelligence.
Ebtoo showed 2.9% high-risk inflows and 6.9% high-risk outflows:
- Sanctioned entities: 1.9% and 0.35%
- Gambling: 0.13% and 6.4%
- Illegal services: 0.87% inflows and 0.087% outflows.
Above: Chart showing that incoming flows of $452,393 included approximately 2.9% high-risk exposure, primarily driven by sanctions (1.9%) and illegal services (0.87%), with smaller contributions from gambling (0.13%) and negligible scam exposure (<0.01%). High-risk transactions in the outgoing flows of $453,507 accounted for approximately 7.1% of the total, largely composed of gambling (6.6%), followed by sanctions (0.35%), illegal services (0.087%), and stolen coins (0.066%). Source: Crystal Expert.
These suggest that Egypt’s ban status may concentrate activity among higher-risk operators willing to serve users that compliant exchanges won’t touch.
Algeria
Algeria banned crypto in 2018, yet there are considerable settlement flows through state-owned infrastructure: 67% of 815 peer-to-peer ads use Algerian Post-owned MFS.
Crystal’s investigation of the now-defunct Changer2u revealed 7.44% high-risk inflows during the January 2023 to December 2025 window, predominantly from sanctioned entities (7.2%). This indicates significant sanctions exposure flowing through a state-owned payment rail – an irony not lost on compliance observers.
Asia-Pacific: Bangladesh, India, Pakistan, and the Philippines
South Asia represents the largest markets in our study by both population and transaction volume. The region spans the full regulatory spectrum – from India’s cautious engagement (including plans for a state-backed cryptocurrency) to Pakistan where crypto remains technically illegal. What unites these markets is massive mobile payment infrastructure: India’s UPI alone processed 21.6 billion transactions in December 2025.
| Country | Population | MFS Share | P2P Ads Analyzed | VASP Traced | Headline Risk Finding |
| Bangladesh | 178M | 83% | 5,021 | Pay2 Change | 2.07% high-risk inflows, sanctions and scams |
| India | 1.5B | 66% | 18,147 | ZebPay | 2.9% high-risk received, gambling-dominated |
| Pakistan | 259M | 58% | 9,059 | NafaChange | 2.6% high-risk, gambling and sanctions |
| Philippines | 118M | 51% | 5,603 | Maya.Ph | 5% high-risk received, gambling-dominated |
Population source data: Worldometer
Bangladesh
Bangladesh has the highest mobile wallet dependence outside Africa: 83% of 5,021 peer-to-peer ads settle via MFS, with bKash (82 million users) leading, followed by Nagad, Rocket, and Upay. The Central Bank declared crypto illegal in 2017, though the government’s 2020 National Blockchain Strategy signaled a potential shift.
Above: Chart showing the predominance of the Bangladeshi preference for MMSs, with bKash (34%) and Nagad (27%) alone accounting for 61% of ads. Source: Crystal Intelligence.
Crystal’s investigation of Pay2 Change revealed 2.07% high-risk inflows and 1.9% high-risk outflows, with exposure spanning gambling, sanctions, scams, and illegal services.
Pay2 Change
Above: Chart showing incoming flows at Pay2Changes of $766,260, of which 2.277% were high-risk, comprising gambling (2%), sanctioned entities (0.044%) ,and illegal services (0.033%). High-risk transactions in the outgoing flows of $803,688 accounted for 2.2% of the total and were composed of gambling (1.4%), sanctions (0.6%), stolen coins (0.13%), and other illegal services (0.061%).Source: Crystal Expert.
India, Pakistan and Philippines
India dominates by volume – Crystal analyzed 18,147 peer-to-peer ads, the largest dataset in our study. UPI and mobile wallets account for 66% of settlements. ZebPay, an AUSTRAC-registered exchange, showed 2.9% high-risk inflows (gambling at 2.6%) and 2.4% outflows – demonstrating that even licensed, regulated exchanges carry measurable risk exposure.
Pakistan presents a contradiction: crypto is technically illegal, yet 58% of 9,059 peer-to-peer ads settle via Easypaisa, JazzCash, and other mobile wallets. Crystal’s investigation of NafaChange revealed 2.6% high-risk exposure, split between gambling and sanctioned entities – notable given that online gambling is also illegal in Pakistan.
The Philippines shows the most balanced split in the region: 51% mobile wallets versus 49% bank transfers across 5,603 ads. GCash and PayMaya dominate the MFS side. Maya.Ph, a BSP-licensed exchange, showed 5% high-risk inflows (gambling at 4.4%) but less than 1% high-risk outflows – suggesting risk is entering the Philippine crypto ecosystem but being converted to cleaner channels before exiting.
Latin America: Colombia
Colombia is the sole Latin American market in our study, included as a comparator to test whether the mobile wallet-crypto pattern holds outside Africa and Asia. It does – though with a more balanced split reflecting greater banking access.
| Country | Population | MFS Share | P2P Ads Analyzed | VASP Traced | Headline Risk Finding |
| Colombia | 54M | 48% | 1,778 | Wallib | 0.6% high-risk, illegal services-dominated |
Population source data: Worldometer
Colombia: Fintech-crypto convergence
Crypto is not recognized as legal tender in Colombia but is not prohibited. The Financial Superintendency (SFC) provides oversight andDraft Bill 510 (2025) could bring regulatory clarity if passed.
Forty eight per cent of 1,778 peer-to-peer ads analyzed settle via mobile wallets – primarily Nequi and Daviplata – versus 52% through traditional banking. This near-even split reflects Colombia’s more developed banking infrastructure compared to African and South Asian markets.
Above: Chart showing that Nequi (30.1%) is the most prolifically used local MFS, while Bancolombia (29.4%) is the most used traditional bank. Source: Crystal Intelligence.
Crystal’s investigation of Wallib showed the lowest risk exposure in our study at 0.6%, dominated by illegal services. This comparatively clean profile may reflect Colombia’s clearer regulatory environment and the presence of established fintech players operating closer to traditional compliance standards.
Wallib Exchange
Above: Chart showing that on Wallib exchange, a total incoming high-risk profile of 0.63%, dominated by illegal services (0.57%). The latter represents the entire outgoing high-risk profile, also at 0.35%. Source: Crystal Expert.
High-risk exposure represents a relatively small proportion of total transaction volume on Wallib. The on-chain analysis shows sustained transaction activity and significant volumes, indicating that informal VASPs accepting mobile payments are becoming increasingly popular and widely used. As overall activity scales, even limited percentages of illicit exposure translate into meaningful absolute value flows.
Conclusion
Across all countries analyzed, the pattern is consistent: regulatory restrictions applied to banks and exchanges do not eliminate crypto activity. Instead, they redirect settlement into mobile payment channels that were not designed, supervised, or resourced to detect crypto-related risks.
For regulators, the implication is not necessarily to regulate mobile wallets as crypto intermediaries, but to acknowledge and address the convergence between payment systems and virtual asset activity. Without coordination among payment supervisors, financial intelligence units, and crypto regulators, significant volumes of crypto-related value transfers will continue to flow through channels outside existing regulatory toolkits.
Three approaches that could close these gaps:
1. Mandate crypto-specific transaction monitoring for mobile wallet operators
Current payment fraud systems focus on account takeovers and unauthorized transactions. Detecting crypto settlement requires different indicators, capabilities that specialized blockchain intelligence providers such as Crystal can deliver:
- high-frequency round-number transfers between unrelated parties
- users receiving funds from dozens of accounts (broker patterns)
- velocity is inconsistent with consumer behavior.
Several jurisdictions have successfully implemented such requirements. In the EU, payment service providers under the Payment Services Directive (PSD2)are required to screen for emerging financial crime typologies. Similar frameworks can be adapted for crypto settlement detection in mobile money systems.
2. Develop blockchain monitoring capability
Prohibiting crypto trading without detection capability creates an unenforceable policy. Most financial authorities in these jurisdictions lack blockchain monitoring infrastructure- unlike counterparts in the US, Singapore, and the EU, who have deployed on-chain surveillance.
Regulators have several options:
- partner with specialized blockchain intelligence firms
- coordinate with international counterparts who have established capabilities,
- or build internal capacity through staff training and technology procurement.
The key is matching the enforcement authority with technical capability.
3. Prioritize enforcement against visible unlicensed operators
In jurisdictions where crypto trading is prohibited, or VASP licensing is required, many unlicensed exchanges operate openly-advertising on Telegram channels with thousands of subscribers, listing services on international peer-to-peer platforms, and maintaining public websites. These targets don’t require sophisticated cyber investigation since they’re visible and identifiable.
Intelligence on these operations already exists. The constraint appears to be resource allocation rather than target identification. Even selective enforcement against prominent operators could establish deterrent effects across the market.
The enforcement window may be closing. The next major scandal, whether it be terrorism financing, large-scale fraud, or sanctions evasion, that traces through mobile wallet infrastructure will force reactive policy responses. Authorities that act proactively can implement control methods methodically and demonstrate foresight rather than react to external pressure.
Why Crystal sees what others miss
Most blockchain analytics providers begin with on-chain data derived from transactions already recorded on public ledgers. They can identify that funds moved from Address A to Address B, cluster wallets, and label known exchanges.
But this misses the critical first step: how fiat currency becomes cryptocurrency. These intelligence gaps matter, because the moment of highest compliance risk- cash converting to crypto through unlicensed intermediaries- occurs before blockchain transactions are recorded.
Crystal Intelligence combines three intelligence layers:
Physical Intelligence: Our research team identifies and documents unlicensed VASPs operating in local markets. We locate their physical operations, document their advertising, and map their service offerings.
Market Intelligence: We systematically monitor peer-to-peer crypto platforms to analyze payment method preferences, merchant behavior, and settlement patterns.
Blockchain Analysis: We trace crypto flows from identified VASPs to downstream destinations, quantifying exposure to sanctioned entities and high-risk counterparties.
This integrated approach reveals compliance risks that purely digital analysis cannot detect. When we report that Cardify Africa in Nigeria shows 4.8% outbound sanctions exposure – including interactions with Garantex and NBCTF-designated addresses – that conclusion rests on ground-truth intelligence collection.
The competitive advantage is not better blockchain analysis. It’s knowing which addresses to trace, what real-world services they represent, and how fiat currency reaches them through payment infrastructure that appears completely legitimate in isolation.
Appendix
Methodology
This report draws on two complementary research streams conducted by Crystal Intelligence between November 2023 and December 2025.
Peer-to-peer market analysis
Crystal systematically collected and analyzed 57,829 peer-to-peer cryptocurrency advertisements across ten countries: Ivory Coast, Ghana, Nigeria, Algeria, Egypt, Bangladesh, India, Pakistan, the Philippines, and Colombia. Data was gathered from major peer-to-peer platforms between November 2025 and January 2026, capturing buy/sell offers and their specified payment methods. For each market, we categorised payment methods into mobile financial services (MFS), traditional bank transfers, and other methods, then calculated the percentage share of each category.
Blockchain forensic analysis
Crystal conducted targeted on-chain tracing of 45 Virtual Asset Service Providers operating in these markets. VASPs were identified through local market intelligence, including advertising on Telegram, listings on peer-to-peer platforms, and public-facing websites. For each VASP, we traced inbound and outbound flows between January 2023 and December 2025, categorizing counterparties by risk level using Crystal’s entity database. High-risk categories include sanctioned entities, illegal services, gambling platforms (where unlicensed), stolen funds, and scam-related addresses.
Country selection criteria
Markets were selected based on three factors: emerging-economy status with high mobile wallet adoption, crypto regulatory regimes that are or were recently restrictive, and sufficient peer-to-peer market activity to enable meaningful analysis. This combination creates conditions where mobile wallet-crypto convergence is most pronounced and compliance gaps most acute.
Limitations
Peer-to-peer advertisement data reflects listed payment preferences, not confirmed transaction volumes. VASP tracing captures on-chain flows but not fiat-side transaction values. Risk categorization relies on Crystal’s entity labelling, which is continuously updated but may not capture all illicit activity.
