Financial crime risk across insurance and cryptoassets

Why sector context matters

A control that makes sense for a deposit-taking bank may not fit an insurer or a virtual asset service provider. Product design, payment flows, customer relationships and the information available to investigators all affect how risks should be understood. International standards provide a shared reference point, but countries implement them through their own legal and supervisory frameworks. The applicable entities, activities and jurisdictions therefore need to be established before drawing conclusions.

Insurance and cryptoasset businesses face different customer, product and transaction patterns. Insurance analysis can follow premiums, policies and claims; cryptoasset analysis connects on-chain activity with customers, counterparties and fiat services. The applicable risks and controls depend on each business and jurisdiction.

Insurance: products, claims and distribution

Insurance exposure varies across life, retail and wholesale business. Premiums, policy changes, surrender or cancellation, beneficiary changes, refunds, claims and intermediary relationships may create different financial crime signals. Useful context can include policy and payment records, claims data, distribution channels, customer and beneficiary information, third-party roles, and how data moves between underwriting, servicing and claims systems.

The FCA’s June 2026 multi-firm review considered governance, risk assessment, client due diligence, sanctions, AML transaction monitoring, fraud and other control areas across UK retail, wholesale and life insurers. Its observations distinguish between business models and regulated status, reinforcing why a proportionate approach should be based on the firm’s own activities and evidence.

Cryptoassets: customer, wallet and transfer context

For cryptoasset businesses, relevant questions may include which virtual asset activities are performed, who the customer and counterparties are, how transfers enter and leave the service, what blockchain and off-chain records are available, and how exceptions are investigated and escalated. A useful discussion connects customer due diligence and transaction monitoring to the firm’s products, operating model and data limitations; it does not assume that an analytics tool alone establishes the source or purpose of funds.

FATF guidance recommends that countries assess the money laundering and terrorist financing risks associated with virtual assets and apply proportionate measures to virtual asset service providers. The 2019 guidance notes that later standards revisions are not reflected, so applicable national requirements should be checked for the activity and jurisdiction.

Frame an international enquiry

A first conversation identifies the organisation, products, customer and activity locations, the regulatory perimeter it understands to apply, and the decision it needs to make. Available records, policies and system descriptions help establish whether the question concerns risk assessment, control design, monitoring or another advisory area. Trevor Barritt's experience in UK financial services can inform international work, while local legal interpretation remains jurisdiction-specific.