Senior Associate James Broomhall discusses how cryptocurrency is replacing cash as the path of least resistance for modern financial crime, in Global Relay.

James’ article was published in GRIP, 7 July 2026.

There is a familiar rhythm to how financial crime evolves. Money has always sought the path of least resistance – away from scrutiny, away from borders, and away from institutions that ask difficult questions.

For decades, cash was that path. Untraceable, portable, and peer-to-peer, physical currency allowed value to move without leaving a reliable audit trail. Regulators and prosecutors eventually built frameworks to address it: currency reporting thresholds, suspicious activity reports, anti-money laundering obligations, and the long arm of correspondent banking.

Cryptocurrency is doing what cash always did. The difference is speed, scale, and the near-total absence of the friction that made cash manageable.

Three moments that tell the story

Three recent developments, taken together, illustrate where we are today.

Recently at the Central Criminal Court, two men were convicted of conspiracy to commit arson at properties linked to the Prime Minister. The ringleader, an anonymous Russian-speaking individual operating as “El Money”, recruited his operatives via Telegram and offered £3,000 in cryptocurrency as the bounty, payable on proof the fires made the news. The payment mechanism was not incidental. It allowed a handler whose identity remains unknown to direct a cross-border attack on the head of a democratic government with no bank account, no wire transfer, and no financial footprint to follow.

Meanwhile, in Brussels, the EU’s 21st sanctions package targets eleven crypto platforms explicitly identified as helping Russia evade Western restrictions, alongside close to 90 Russian banks in the largest single sweep of the sanctions era. A mechanism for full third-country bans on crypto asset services is being introduced. Kyrgyzstan has already been targeted under the EU’s anti-circumvention tool because of its role in Russian crypto transactions. And in a detail that says something about how rattled the Kremlin has become, Russia placed a seventeen-year-old British schoolboy on its sanctions list this month – Alexander Browder, son of anti-corruption campaigner Bill Browder, apparently for researching how Russian interests use cryptocurrency to circumvent Western restrictions. A nuclear power with a permanent UN Security Council seat, reaching for its designations list because of a teenager with a laptop. A backhanded confirmation, if one were needed, that the investigations are landing.

Back in London, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made by Parliament in February, bring cryptoassets formally within the FCA’s regulatory remit for the first time. The new regime commences on 25 October 2027, with an authorisation window opening September 2026. Firms providing cryptoasset services in or to the UK will require FCA authorisation under FSMA. AML obligations, the Senior Managers and Certification Regime, prudential requirements, and Consumer Duty will all apply.

Three examples, with one thread running through all of them: the infrastructure of modern finance has developed a parallel track, and the law is running to catch up.

The structural problem

The traditional AML and KYC frameworks were built for a world where value moved through identifiable choke points – banks, money service businesses, brokers, enrolled as de facto arms of the state, obligated to verify identity, monitor transactions, and report anomalies. The model worked because there was no meaningful alternative route.

Crypto disrupts that structurally. Decentralised finance protocols do not have compliance officers. Peer-to-peer transactions do not generate suspicious activity reports. Self-custodied wallets do not require identity verification. Layering, once demanding accounts across multiple jurisdictions, compliant intermediaries, and significant operational overhead, can now be conducted by a single actor with a laptop and a working knowledge of decentralised exchanges. The obligation frameworks governments spent thirty years building were designed for intermediaries. Crypto’s entire value proposition, in its purest form, is their elimination.

Sanctions enforcement exposes the gap most acutely. Sanctions have historically operated through the banking system: freeze accounts, restrict correspondent relationships, deny access to dollar clearing. When value moves through cryptocurrency infrastructure, that dependency falls away entirely. A sanctioned entity blocked the moment it attempts a dollar wire can convert to a stablecoin, pass funds through wallets across multiple chains, swap on a decentralised exchange, and emerge in a clean jurisdiction within hours, without touching a regulated institution. Russia’s major banks were cut from SWIFT in 2022. Russian companies have since built alternative payment rails, including crypto infrastructure, to continue trading.

What effective enforcement actually requires

The FCA’s incoming regime is the right instinct, but authorising the visible layer is not the same as controlling the underlying infrastructure.

Effective enforcement requires three things. First, genuine technical capacity, not merely reading blockchain explorers, but understanding how cross-chain bridges, privacy protocols, and decentralised liquidity pools operate. Enforcement that cannot understand the mechanism it pursues will always be outpaced by those deploying it.

Second, territorial instincts must be substantially relaxed. Crypto does not respect jurisdiction. An investigation that stops at a national border will not reach its target. Mutual legal assistance treaties, joint investigation teams, and information-sharing protocols need modernising to match the speed at which assets move. The FCA’s regime applies to firms providing services in or to the UK, a broader hook than traditional financial regulation, but the gap between a UK authorisation requirement and conduct routed through unregulated infrastructure elsewhere remains wide.

Third, the framework must extend to the actual points of friction: the on-ramps and off-ramps where digital assets meet traditional currency, and the infrastructure providers -validators, node operators, protocol developers, who exercise genuine influence over how value moves.

A system under pressure

For those of us in the white collar crime and investigations sphere, this presents a genuine professional challenge. Clients navigating allegations touching on digital assets are operating in a legal environment still being constructed in real time. The law is inconsistent across jurisdictions. The technical evidence is complex. The line between legitimate crypto activity and criminal liability is, in many cases, far less clear than regulators care to admit.

With the FCA’s authorisation window opening in September 2026 and the full regime commencing in October 2027, there is a transitional period in which expectations are shifting but obligations have not yet crystallised. Conduct in that window, before the new rules bite but after regulatory intent is clear, will attract intense scrutiny. A significant number of enforcement actions will arise from exactly this period.

The enforcement landscape is shifting fast. States thinking about financial pressure through a twentieth-century lens – correspondent banking, account freezes – will find themselves increasingly irrelevant to a financial ecosystem that has already moved on.

The money, as it always has, will find a way. The question is whether the law can keep up.