A blockchain gives investigators something unusual in finance: a public, timestamped and reproducible record of transfers. That advantage is real, but it can also create tunnel vision. It is easy to build a compelling transaction graph and treat the graph as the entire system. In practice, a crypto transfer may be only one leg of a wider settlement arrangement in which an obligation is closed through a bank account, trade invoice, cash payment, precious metal, merchandise or an offset between intermediaries.
A Financial Action Task Force report published on September 3, 2026 gives this framework new weight. The report examines professional money laundering, underground banking, hawala and similar service providers. Drawing on responses from 46 jurisdictions and expert input, it adds digitally based settlement to its analytical categories. Stablecoins and other virtual assets appear not as a sealed financial universe, but as cross-cutting enablers that can accelerate and connect existing settlement methods.
The implication for blockchain intelligence is substantial. The unit of analysis is no longer a transaction, an address or even a wallet cluster. It is a movement of value. Following that movement requires investigators to track transitions between rails, record the quality of evidence at each transition and recognise when the blockchain ceases to be the primary source of visibility. Ledger transparency does not disappear; it becomes an anchor inside a multi-system investigation.
The new report redraws the settlement map
FATF distinguishes five analytical settlement mechanisms: bilateral offsetting, triangular or network-based settlement, settlement through value such as trade or tangible assets, use of formal banking channels, and digitally based settlement. These categories are not mutually exclusive. The same network can receive a digital asset in one region, offset an obligation against imported goods in another and settle a remaining balance in cash somewhere else.
Crypto investigators should take this seriously. A stablecoin transfer may represent a final payment, an advance, collateral, debt offset or merely a coordination signal between parties. Funds sent to an exchange have not necessarily been “cashed out.” They may become an internal balance, move between accounts on a platform’s private ledger or support an arrangement completed off-chain. Without economic context, the technical observation remains accurate but incomplete.
The report also stresses that hawala and similar value-transfer systems are not inherently criminal. They may provide legitimate remittance services, particularly where access to formal banking is limited. Risk arises from misuse, from unlicensed operation where authorisation is required, and from professional services designed to obscure the source or destination of value. That distinction matters because intelligence must never substitute a cultural or geographic profile for evidence.
From a transaction graph to a value graph
A transaction graph connects addresses with transfer edges. A value graph adds other kinds of nodes: custodial accounts, legal entities, invoices, shipments, payment devices, conversion points, commodities, intermediary balances and offsetting events. It also permits relationships that are not direct transfers—for example, “the available evidence indicates that these two actions settled the same obligation.”
This broader model is not permission to connect everything to everything. The opposite is true. Every relationship needs a type, source, timestamp and confidence level. An on-chain transaction is a reproducible observation. Identifying an exchange deposit address may depend on public information, provider records or a commercial heuristic. A claim that a shipment balances a digital payment requires an entirely different class of evidence. If every edge is rendered with the same line and colour, the interface conceals the most important difference in the case.
A defensible data model separates at least four layers: what was observed, who or what is attributed to an account, what economic hypothesis is being tested, and what lawful action may be available. This prevents the leap from a suspicious transfer to a conclusion about a person. It also makes the case updateable. An attribution can change without erasing the underlying transactions, while a rejected hypothesis need not damage the integrity of the evidence log.
Five transition points where the investigation changes
The first transition is a virtual asset service provider. Once funds reach an exchange or hosted wallet, subsequent activity may disappear from the public chain. The next steps may require account records, deposit and withdrawal mappings, access times and customer data, subject to applicable law and authority. Investigators should mark the visibility boundary rather than present the absence of public transactions as the end of the trail.
The second transition is a stablecoin. Transfers remain visible, but there may also be an issuer, contract controls, freeze functions and multiple supported networks. Moving between versions of the same asset or using a bridge can change both the control point and the source of records. “USDT” or “USDC” is therefore not a complete description. The contract, network, issuer, custodian and precise time all matter.
The third transition is trade. Over- or under-invoicing, partial shipments, returned goods or circular commerce may be used to rebalance obligations. A blockchain may show only one payment within the arrangement. Customs data, shipping records, price comparisons, company ownership and bank flows become relevant. Chronological proximity is not enough; investigators must test whether quantity, price and counterparties form a plausible economic explanation.
The fourth transition is cash or local payment. A network may move a digital asset internationally while a different intermediary pays the customer in local currency. There is no cross-border bank transfer directly matching the crypto transaction, yet value has moved. The fifth transition is an asset with stored value—metals, stones, luxury goods or commercial inventory. Here too, the task is to understand how obligations were extinguished, not to force every settlement into a matching financial transaction.
No visible trail does not mean no value moved
One dangerous analytical error is to conclude that funds “stopped” because an address did not spend them. The economic value may already have been delivered through another rail, leaving the digital asset as inventory held by an intermediary. The reverse is also possible: fast on-chain movement does not prove that a real-world obligation was completed. A blockchain records the transfer of an asset, not necessarily the agreement that caused it.
A case timeline should therefore include non-financial events: account creation, publication of an address, invoice issuance, ownership changes, shipment departure, device movement, a documented communication or a withdrawal request. These events may strengthen or weaken a theory. Timing alone does not establish causation, but it helps teams formulate narrower requests and test alternative explanations.
Gaps should be preserved as data. If an exit to a service is expected but absent, document the absence. If an invoice falls outside the entity’s normal trading range, record the baseline used for comparison. A sound investigation does not fill missing information with a convenient narrative. It turns the gap into a question that can be tested.
Multiple sources demand evidence discipline
Hybrid investigations make provenance easy to lose. Block data can come from a public explorer, a node query or a commercial provider. A trade record may come from an authority, bank, company or open database. Each path has different limits of reliability, completeness and admissibility. An analytical report should let a reviewer determine what the team verified directly and what arrived from a third party.
Every item should receive a stable identifier, an original copy, a collection time and a record of transformation. Manually entered addresses require a second check. Currency conversions should retain the rate source and timestamp. Algorithmic wallet clusters should name the tool version and basis for the association. Reproducibility is not administrative overhead; it protects the case against false confidence.
The FATF report describes authorities using blockchain analytics as one component of broader financial intelligence, not as a substitute for it. That is the right model for the private sector as well. A system may find a junction or anomaly, but a decision to report, restrict or escalate should combine context, law, quality control and human review.
Do not turn risk management into profiling
Informal value-transfer systems sometimes exist because banking is costly, slow or unavailable. Broad de-risking can push legitimate users toward less transparent channels and reduce the quality of available intelligence. FATF itself emphasises the need to combine targeted enforcement with proportionate financial-inclusion measures.
A risk signal should describe behaviour rather than community identity. Amount structuring, multiple unrelated third parties, mismatches between stated trade and cash flow, repeated transitions across rails or sudden deviations from established behaviour can justify review. Origin, language, migration corridor or legitimate use of remittance services is not evidence of an offence. A rule that confuses the two creates both unfairness and operational noise.
Quality review should test alternative explanations. Could the pattern fit a seasonal small business, payment facilitator, exporter or household remittance? What did activity look like before the event? Are documents consistent with the declared purpose? The more severe the contemplated action, the stronger and more independent the corroboration should become.
An operating model for investigations across rails
Step one is event definition: identify the initial signal, what is known, what remains unknown and which decision the inquiry must support. Step two is preservation: retain transactions, pages, documents, logs and temporal context. Step three is on-chain mapping: verify the network, contract, addresses and paths without adding unsupported attribution.
Step four marks transition points—a custodian, bank, payment provider, company, commodity, shipment or physical asset. Step five builds settlement hypotheses and tries to falsify them. Only then does the action stage begin: a preservation request, lawful information process, compliance review, referral to a competent authority or a documented decision that the evidence is insufficient.
Every transition needs an owner, a clock and a source of authority. A blockchain team can identify a likely exchange, but legal specialists must decide whether and how records may be requested. Trade specialists can test price and shipment data, but should not guess who controls a wallet. Good operations do not blend disciplines into one; they coordinate them while keeping responsibilities explicit.
What blockchain intelligence products must become
The next generation of investigative tools has to manage more than addresses. It needs heterogeneous entity types, semantically meaningful relationships, confidence levels, a multi-source timeline and versioned attribution. It must show clearly when data comes from a ledger, when a provider supplied it and when it is an analytical inference.
Search should let analysts move from a transaction hash to an entity and from an entity to a document without stripping provenance. Access controls should be granular because some records are sensitive or legally protected. Exports for litigation or audit should carry citations, timestamps and model versions. A tool that produces a beautiful graph but cannot explain each edge is not a complete investigative product.
Metrics should change too. The number of addresses observed is not a quality measure. Better indicators include time to first verification, percentage of material assertions with independent support, time to identify a transition point, number of hypotheses tested, correction rate and the proportion of alerts that enabled a justified decision. The important question is not how much data the team collected, but which better decision the data made possible.
Transparency is a starting point, not the finish line
A blockchain remains one of the strongest sources of evidence available to a digital financial investigation. It allows teams to reproduce movement, test claims and return to a precise point in time. But when value moves through a private ledger, trade, offsetting or a physical asset, public transparency no longer covers the full cycle.
Dor Arad’s conclusion is that mature blockchain intelligence measures continuity of value, not continuity of addresses. It remains exact where evidence is visible and modest where more information is required. It connects systems without flattening source quality, and it distinguishes a signal, hypothesis, attribution and proof.
The September 2026 FATF report does not reduce the importance of on-chain analysis. It defines its place more accurately: an essential layer inside hybrid settlement. Organisations that build around that understanding will identify transition points more reliably, reduce false positives and produce work that can be explained, reviewed and defended. In a world where money can leave the chain without value stopping, that is not scope expansion. It is the correct definition of the mission.