The question at hand
Your vendor management team is asking whether it's necessary to check if your logistics partner, accounting firm, or marketing agency has exposure to cryptocurrency transactions.
Regulations suggest that it is. Jurisdictions are expanding regulations over cryptocurrency exchanges, and the UK has introduced a Failure to Prevent Fraud criminal offense, making companies liable for third-party conduct. But with 3,000 active vendors, limited resources, and no clear definition of "crypto exposure" in due diligence, your risk team faces a challenge.
This situation presents a familiar dilemma for third-party risk managers. One side argues for comprehensive screening, treating cryptocurrency activity as a red flag. The other side believes you can't screen for every potential risk without slowing down vendor onboarding.
Both perspectives have merit.
The case for universal crypto screening
Advocates for broad screening argue that you can't manage what you don't measure. Without asking about cryptocurrency exposure during vendor intake, you might miss hidden financial crime risks.
The regulatory angle is clear. Cryptocurrencies can be used for opaque financing, and regulators are integrating digital asset platforms into traditional anti-money laundering frameworks. If a third party processes payments through an unregulated exchange or accepts cryptocurrency from unknown customers, it creates a compliance blind spot you need to address.
The liability is also significant. Under the UK's Failure to Prevent Fraud offense, your company could face prosecution if an associated person commits fraud to benefit your organization. "Associated person" includes vendors, consultants, and agents. If a third party uses cryptocurrency to hide fraudulent transactions on your behalf, not asking about their payment methods won't be a valid defense.
Adding cryptocurrency exposure to your due diligence questionnaire aligns with reality. You already inquire about anti-corruption controls, sanctions screening, and beneficial ownership. Asking about cryptocurrency transactions and their regulatory framework fits into this category.
Operationally, it's easier to screen everyone upfront than to retrofit your program later. Waiting until regulators mandate crypto screening could create a backlog of vendors needing re-screening and delay onboarding for new vendors.
The case for targeted, risk-based screening
The opposing view focuses on resource constraints. Third-party risk teams are already stretched thin. Adding another screening dimension to every vendor assessment means either hiring more people or cutting corners elsewhere.
Universal screening conflates theoretical risk with actual risk. Your office supplies vendor probably isn't laundering money through Bitcoin. Your facilities management company isn't running a sanctions evasion scheme via stablecoins. Treating every third party as a potential cryptocurrency risk wastes resources needed for more significant relationships.
Risk-based screening proponents suggest a tiered approach. High-risk categories, such as payment processors, cross-border service providers, and financial intermediaries, should receive enhanced scrutiny, including cryptocurrency exposure questions. Low-risk categories should focus on more probable risk vectors.
This camp also questions the utility of the information. If a marketing agency accepts cryptocurrency payments, what's your next step? Do you terminate the relationship or require additional controls? Without a clear plan, you're collecting data you can't act on.
Cryptocurrency risk intersects with sanctions, corruption, fraud, and money laundering risks. A vendor questionnaire asking, "Do you handle cryptocurrency?" without connecting it to your broader risk assessment framework just creates noise.
Regulatory requirements around cryptocurrency are evolving. Geopolitical changes shift how criminal networks operate, creating new routes for illicit money. Building a rigid screening protocol around today's crypto landscape might leave you screening for outdated threats.
Where practitioners actually land
Most third-party risk managers use a hybrid approach. They're not screening every vendor for cryptocurrency exposure, but they're not ignoring it either.
The common pattern: integrate cryptocurrency questions into your risk assessment for specific vendor categories. Payment processors, yes. Marketing agencies, probably not. The trigger is whether the vendor relationship involves financial transactions, cross-border payments, or intermediary roles that could obscure the source or destination of funds.
For high-risk vendors, questions go beyond "Do you handle crypto?" to "What controls do you have around cryptocurrency transactions?" and "Are you registered with financial regulators in jurisdictions where you operate?" You're looking for evidence that the vendor treats cryptocurrency activity as a compliance matter, not just a payment option.
Some programs add cryptocurrency exposure as a factor in periodic re-screening protocols rather than initial onboarding. This allows you to phase in the requirement without creating an immediate backlog and acknowledges that a vendor's risk profile can change over time.
Our take
Universal screening sounds thorough, but it's not the right answer. Compliance programs fail when they treat every risk as equally urgent.
Start with your existing risk tiers. If you've categorized vendors as high, medium, or low risk based on factors like transaction volume, geographic footprint, and access to sensitive data, use those tiers to determine who gets cryptocurrency screening. Don't create a parallel assessment track that ignores what you already know about the relationship.
For high-risk vendors, cryptocurrency exposure belongs in your enhanced due diligence protocol alongside beneficial ownership verification and sanctions screening. For medium-risk vendors, it's a question worth asking but not necessarily a deal-breaker. For low-risk vendors, focus on more probable risks.
The goal isn't to document every theoretical exposure. It's to identify relationships where cryptocurrency activity could enable financial crime, then apply controls proportionate to that risk. Ask specific questions, not generic ones, and have a plan for what you'll do with the answers before you ask them.
