Not every risk is a "stop". After sanctions, mixers and crime, we move into the realm of shades of grey: exchanges without KYC, nested exchanges, gambling and P2P transfers. Here there is rarely black and white — more often moderate scores of 30–50 that call not for automatic refusal but for measured interpretation. Learning to work with this zone is the mark of a mature AML specialist, because this is where most real checks take place.
KYC (Know Your Customer) is the procedure for identifying a client. An exchange with full KYC knows who is behind every withdrawal and will not let obvious crime through. An exchange without KYC accepts and issues funds anonymously — and thus becomes a convenient "laundering point" where criminal flows mix with legitimate ones.
Why this matters. The key difference from sanctions: perfectly legitimate users who simply do not want an identification barrier also pass through an exchange without KYC. So the "trail" of such an exchange raises risk but does not nullify the funds. This is a
probabilistic signal, not a binary one: it says "the baseline probability of crime here is higher", not "these particular coins are criminal".
Nested exchanges: an exchange within an exchange
A nested exchange is a service that operates on top of an account at a large legitimate exchange, without its own infrastructure and often without its own KYC. In essence it is an intermediary "hiding" behind the addresses of a big exchange.
- How it works. The operator opens an account at a large exchange and services their own clients through it, issuing them internal addresses.To an outside observer the funds look like they are "coming from exchange X", although in reality they are controlled by an opaque intermediary.
- The risk. The absence of their own compliance makes nested services a channel for laundering. Large exchanges fight them by freezing accounts.An example from the industry — services like Suex/Chatex, which fell under sanctions precisely as nested infrastructure.
- Interpretation. An identified nested exchange is above-average risk; if it is sanctioned — that is already a stop.The boundary between a "grey" nested exchange and a "black" sanctioned one is fluid and depends on the specific service.
Casinos and gambling
Crypto casinos and bookmakers are a legal industry in a number of jurisdictions, but from an AML standpoint this is a classic "grey zone". Gambling has historically been used for laundering: bring in "dirty" funds, pretend you gambled, withdraw them as "winnings".
- Mixing of flowsThe deposits of thousands of players — legitimate and not — converge on casino addresses. Withdrawing "winnings" makes it hard to establish the true source.
- Varying levels of complianceA licensed casino with KYC is a moderate risk; an anonymous one is markedly higher.
- InterpretationThe mere fact of gambling is not a crime. So a gambling trail usually gives a moderate score, not a stop — provided there are no aggravating links (mixers, sanctions, darknet).
Low
0–29
→
Moderate / grey
30–50
→
High / stop
70+
Gambling, P2P and exchanges without KYC most often give the middle range of 30–50 — a zone for judgement, not automatic refusal.
Why P2P addresses are often "grey"
P2P (peer-to-peer) is direct trading between people, often through built-in exchange platforms (for example, Binance's P2P section) or separate services. It is a perfectly legal and widespread way to buy/sell crypto, especially where banking access is limited. But from a tracing standpoint a P2P address is almost always "grey", and here is why:
Why this matters. An active P2P trader makes dozens of deals a day with dozens of unknown counterparties. They physically cannot verify the cleanliness of each one's funds. It only takes one counterparty being linked to darknet or a scam — and the "paint" of that risk falls on the trader's address, and through it on everyone who traded with them. A P2P address accumulates the
averaged risk of the crowd: not criminal, but not sterile either. Hence the typical score of 30–50 — "there is contact with something dubious, but the share is small and diluted by a mass of clean deals".
- Many counterpartiesHigh graph connectivity: the address touches hundreds of others, among which "bad" ones are statistically inevitable.
- No control over the sourceThe trader does not run AML on every buyer — the risk is irreducible by the nature of the activity.
- Transit characterFunds pass "straight through" quickly, which outwardly resembles layering, although it is often ordinary trading.
How to interpret moderate risks (score 30–50)
The main professional competence of this lesson is not to confuse "grey" with "black" and vice versa. A moderate score requires context, not reflex.
- Assess the share and proximity. 40% of funds one hop from a high-risk exchange is more serious than 3% five hops away. Look not only at the fact of a link, but at its weight and distance.This is exactly why the taint analysis from the next section matters, not just "is there a label or not".
- Look for aggravating combinations. Gambling by itself is a moderate risk. Gambling + a mixer trail + a fresh address is already a laundering picture. Risks reinforce one another.A combination of grey factors can add up to a high verdict.
- Take the client's profile into account. For an active P2P trader a score of 40 is normal for their activity. For a "dormant" investment wallet the same 40 is an anomaly requiring explanation.The behavioural context changes the interpretation of the very same number.
- Decide by risk appetite. A moderate score is a decision point: request additional documents (source of funds), limit the amount, allow with monitoring, or refuse. The choice depends on the platform's policy, not on a "magic threshold".Mature compliance differentiates its response rather than treating everything with one brush.
Caution. Do not fall into either of two extremes. The first — "if there's any risk at all, I refuse everyone" — this way you cut off a mass of honest P2P users and lose business. The second — "it's not sanctions, so it can be ignored" — this way you miss laundering disguised as gambling or P2P. The grey zone exists precisely so that
measured decisions can be made, not automatic ones.
Section takeaway. Sources of risk form a hierarchy. Sanctions (Lesson 3.1) — a binary stop. Mixers and crime (3.2–3.3) — almost always high risk. Scams and phishing (3.4) — from clutter to outright theft. And finally, the grey zone (3.5) — moderate scores, where judgement, share and context decide. The ability to distinguish these levels and not confuse "grey" with "black" is the essence of the AML analyst's profession.
Lesson and section summary
- Grey zone ≠ crimeExchanges without KYC, nested, casinos, P2P raise risk probabilistically, they do not nullify funds.
- P2P accumulates the crowd's riskMany counterparties → inevitable contact with something dubious → an averaged score of 30–50.
- Look at share, proximity, combinationsThe weight of a link and the combination of factors matter more than the mere fact of a label.
- A moderate score = a decision pointExtra documents, limits, monitoring or refusal — by risk appetite, not by reflex.
This concludes the "Sources of risk" section. Next the course turns to how these risks are measured quantitatively — through taint analysis, exposure shares and building transaction chains.
This material is for educational purposes only and does not constitute legal advice.