Unlicensed exchanges and nested services

As of September 2026: Sanctions lists, seizures and indictments in this area change often. The Garantex indictment was unsealed in March 2025; no conviction of the defendants was found in this review. Successor services and their status may have changed since the OFAC action of August 14, 2025.

Also called: no-KYC exchanges · rogue exchanges · nested exchanges · high-risk VASPs.

What are unlicensed exchanges and nested services?

Most crypto exchanges that serve people in the United States or Europe are regulated. They register, verify customers, screen transactions, and report suspicious activity. That makes them the choke point where crypto meets bank accounts and cash. An unlicensed exchange is one that operates without that registration or licensing, and usually without real identity checks. Its customers get a place to swap and cash out where nobody asks who they are or where the money came from.

A nested exchange or nested service is a different animal. It is a business built on top of a larger exchange. Chainalysis describes such services as ones that use a big exchange’s deposit addresses to reach its liquidity and trading pairs. Most nested services are legitimate: over-the-counter brokers are the common example. The problem is the ones that are not. The host exchange sees deposits into one account. The people and businesses behind that account, and where the funds came from, are invisible to it.

Both belong to layering and, at the end of the chain, integration, because they turn crypto into something spendable. The other crypto techniques on this site, like chain-hopping and mixers, move value around. These are the doors that let it leave.

How do unlicensed exchanges and nested services work?

1. Light or no onboarding. A rogue exchange advertises quick sign-up. FinCEN’s list of red flags for kiosk businesses includes advertising that customers can transact with no ID, or with only a phone number or email address. The same pattern applies to online platforms. Where verification exists on paper, it may not be enforced.
2. Hidden or borrowed infrastructure. A rogue exchange may run from a jurisdiction with weak supervision. A nested service instead borrows a legitimate exchange’s infrastructure by using its deposit addresses, which means the host’s compliance team cannot easily tell who is who.
3. Volume. Criminals send proceeds from ransomware, darknet markets, scams, or sanctioned sources in bulk. Treasury said Suex’s history included at least eight ransomware variants and that more than 40 percent of its transactions involved illicit actors.
4. Cash-out. The platform converts coins to another asset or to fiat, often through a partner gateway, a payment processor, or an over-the-counter desk. The related pages on stablecoins and OTC brokers cover that leg in more detail.
5. Re-emerge. If the platform is sanctioned or seized, the same people may relaunch under another name. Treasury said this is what happened between Garantex and Grinex.

Why do unlicensed exchanges and nested services work?

Regulation applies where the entity is, not where the customer is. An exchange incorporated in a country that does not enforce anti-money-laundering rules can serve customers anywhere. The international standard setter, the FATF, has pushed countries to license and supervise crypto businesses, and its July 2026 update on virtual assets reportedly flags offshore unlicensed platforms as a continuing risk. But gaps remain, and those gaps are the market.

Demand is concentrated. Criminals need to convert large sums fast and safely. The right nested service or rogue exchange gives them scale. Chainalysis found that in 2022 four exchange deposit addresses alone received just over $1 billion in illicit funds, and that a small group of nested services facilitate the majority of crypto money laundering. That concentration is a weakness for criminals too, because it gives investigators a short list to watch.

The host cannot see through the account. A large exchange applies its controls to its own customer. If the customer is a nested service, the exchange may know only the service, not the service’s users. That gap is what makes a nested service useful to a criminal and hard for the host to police.

Weak controls can be disguised. FinCEN warns that non-compliant operators may tell banks and exchanges they are registered while failing to run the required controls. In the Garantex indictment, prosecutors said that when Russian authorities asked for records on an account tied to a co-defendant, Garantex gave incomplete information and falsely said the account was not verified.

Real cases: Suex, Garantex and Grinex

Suex. On September 21, 2021, the Treasury’s Office of Foreign Assets Control designated Suex OTC, S.R.O., calling it the first sanctions designation of a virtual currency exchange. It acted under an executive order aimed at supporting ransomware actors. Treasury said at least eight ransomware variants had transacted through Suex and that more than 40 percent of its known transaction history was linked to illicit actors. Everything Suex owned that touched the US was blocked, and Americans were barred from dealing with it.

Garantex. OFAC sanctioned Garantex on April 5, 2022 under an order about Russia’s financial services sector. It kept operating. In March 2025 the US Secret Service, working with German and Finnish authorities, seized the exchange’s web domains, froze more than $26 million, and obtained copies of servers holding customer and accounting databases. It said Garantex had processed at least $96 billion in crypto since April 2019. An indictment unsealed in the Eastern District of Virginia charged Aleksej Besciokov, whom it called the exchange’s primary technical administrator, and Aleksandr Mira Serda with conspiracy to commit money laundering. Besciokov was also charged with conspiracy to violate sanctions law and to operate an unlicensed money transmitting business. Those are allegations.

Grinex. Treasury said Grinex was created after the March 2025 disruption to continue Garantex’s business and take over customer deposits. Customers who lost access to funds were given the A7A5 token, a ruble-backed digital asset issued by a Kyrgyz firm named Old Vector. On August 14, 2025 OFAC sanctioned Grinex, the co-founder Sergey Mendeleev, Mira Serda, another Garantex co-owner named Pavel Karavatsky, and companies including Old Vector and InDeFi Bank. Treasury said Garantex had processed over $100 million in transactions linked to illicit activity since 2019, including millions from ransomware groups.

Beyond exchanges. The same logic reaches the big platforms. See the case pages on Binance and on the Huione and Prince Group networks for how regulators treated an exchange that did not register as a money services business and a payments group that FinCEN said laundered at least $4 billion.

How does it get caught?

Sanctions and designation. OFAC’s actions make every dealing with a named exchange a possible violation, and blockchain analytics firms then label its addresses so banks and other exchanges can block them. Grinex shows the limits: designation of a successor comes months after the original problem.

Law enforcement takedowns. Seizing domains and copying servers, as in the Garantex operation, turns a “no logs” promise into an evidence trove. It also gives investigators the customer and accounting databases they could not get from anyone else.

Analytics that see nested accounts. Because a small group of nested services handle much of the laundering, analytics firms such as Chainalysis label their deposit addresses. That lets an exchange spot a customer that is really a service, and lets investigators tell one business’s flows from another’s.

Bank and exchange due diligence. FinCEN’s guidance says financial institutions should check whether a customer is registered as a money services business and holds required state licenses, and should look at whether the customer collects identification. These are the same detection habits that catch other unregistered money transmitters.

Travel Rule and standards. The Travel Rule requires virtual asset providers to pass sender and receiver details along with transfers. Unlicensed services sit outside that system, so transfers from regulated venues to unlicensed ones draw attention.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026