The State of Financial Crime Risk in Asia-Pacific

Crypto and scam flows are the twin frontlines

When we asked compliance leaders which financial crime typology is hardest to manage right now, the responses were unambiguous, and they point to a regional risk environment that is evolving faster than many compliance programs are built to handle.

Crypto and virtual assets emerged as the clear top concern, cited by 29% of respondents. What makes this significant is not the percentage alone, it is what it represents. Digital assets have created new corridors for illicit finance that move faster, across more borders, and with less transparency than traditional payment channels. Compliance teams are not just dealing with a new asset class. They are dealing with a fundamentally different risk topology.

Mule and scam flows came in at a virtual tie at 28%, and for good reason. Scam-driven fraud has become one of the most operationally intense challenges in financial crime compliance. The proceeds move quickly through layered accounts, exploit legitimate payment infrastructure, and are increasingly difficult to intercept without real-time intelligence and behavioral detection capabilities.

Together, these two typologies account for 57% of all responses, a signal that the compliance agenda across Asia-Pacific is being shaped, above all else, by the speed and sophistication of digitally-enabled financial crime.

Further down the ranking: beneficial ownership opacity was cited by 17% of respondents, sanctions evasion by 16%, and trade-based typologies by 9%. 

The Philippines is driving the regional picture on crypto and scam risk

The country-level breakdown adds important context to what the regional numbers alone cannot fully convey. The Philippines stands out not just statistically, but as a case study in what rapid digital financial inclusion looks like when risk controls have not scaled at the same pace. 

Philippine respondents accounted for a substantial share of overall responses, with crypto and virtual assets as the clear top concern at 38%. The country contributed 57% of all crypto responses (30 of 53) and 52% of all mule/scam responses (27 of 52) across the entire survey, a concentration that reflects the reality on the ground. The Philippines has one of the region’s most active crypto markets, significant cross-border remittance flows, and a fast-growing digital payments ecosystem that has created new exposure points for fraud and illicit finance. 

India told a parallel story on mule and scam flows, 37% of Indian respondents identified this as their top concern, driven by the intersection of UPI’s scale and the fraud typologies that have grown alongside it. Singapore and Australia presented a different risk profile, with beneficial ownership opacity and sanctions evasion ranking highest, reflecting those markets’ greater exposure to complex corporate structures and international enforcement activity. Hong Kong SAR followed a pattern closer to the Philippines, with crypto as the top concern at 43% of local respondents.

The strategic gap: you cannot fight what you cannot see

The second survey question asked respondents to identify the biggest gap in their current financial crime risk strategy. Disconnected systems and data silos and lack of visibility across trade and counterparties tied at the top, each cited by 25% of respondents, accounting for 50% of all Question 2 responses combined. 

The remaining responses pointed to limited ability to detect indirect sanctions exposure (20%), challenges in meeting evolving regulatory expectations (18%), and slow or reactive risk detection (13%). These five responses describe variations of the same underlying problem: organizations know risk exists somewhere in their counterparty networks or transaction flows, but their systems are not configured to surface it reliably or in a form that supports defensible decisions. 

The threat-gap disconnect reveals deeper structural issues

One of the most analytically interesting findings is the gap between what respondents identified as their top threat and their top strategic weakness. India provides the clearest example. Indian respondents overwhelmingly identified mule and scam flows as their hardest typology in Question 1. But their top Question 2 gap was indirect sanctions detection, cited by 32% of Indian respondents. The threat they are most exposed to is not the same as the gap they are most concerned about closing. 

Singapore presents a related dynamic. Beneficial ownership opacity was the top concern in Question 1 - reflecting Singapore’s position as a hub for complex corporate structures. In Question 2, 46% of Singapore respondents pointed to data silos as their biggest gap. They know where the risk is,but cannot always see through the ownership layers clearly enough to act with confidence. 

Australia surfaces a similar tension. Sanctions evasion ranked as the top threat, but 50% of Australian respondents identified data silos as their top Question 2 gap. The infrastructure for detecting the risk is not keeping pace with the risk itself. 

Indirect sanctions exposure: the risk that is hardest to see

The 20% of respondents who flagged indirect sanctions detection as their biggest gap are pointing to one of the most technically demanding challenges in financial crime compliance. Direct sanctions screening, checking a customer or counterparty against a designated list, is now a baseline capability for most institutions. The harder problem is second and third-order exposure: the counterparty of a counterparty connected to a sanctioned entity; the vessel carrying cargo on behalf of a sanctioned beneficial owner; the shell company one layer removed from a designated individual.

These exposures are not visible through standard list-matching alone. They require network analysis, ownership mapping, and the ability to connect signals across multiple data sources in real time. And critically, many organizations simply do not have data at the right granularity to detect them. Counterparty records are incomplete. Ownership structures are opaque. Vessel and trade data sits in separate systems. Without that granular, connected data layer, indirect sanctions exposure remains structurally invisible, which is precisely why it is so often undetected until enforcement action makes it visible.

For India, where 32% of Question 2 respondents identified this as their top gap, the concern is particularly acute given the complexity of India’s expanding trade relationships and counterparty networks.

Four things the data is telling us

• The region’s two biggest threats are interconnected. Crypto and mule/scam flows ranked first and second , and they are not separate problems. Scam proceeds increasingly move into digital assets. Institutions that address these typologies in isolation will find their controls incomplete. 
• Visibility is the defining challenge for 2026. When 50% of respondents point to data silos and counterparty visibility as their top strategic gaps, they are identifying something structural. Risk distributed across disconnected systems cannot be reliably detected, reported, or evidenced. 
• Indirect exposure is underestimated as a systemic risk. The 20% who flagged indirect sanctions detection likely represent a larger share of actual organisational exposure, precisely because indirect risk is the hardest to see, and most organisations lack the data granularity to surface it confidently.
• Regional profiles require regional responses. The Philippines is managing a crypto and mule problem. India is navigating mule flows and indirect sanctions exposure simultaneously. Singapore is wrestling with beneficial ownership and data infrastructure. Australia is dealing with sanctions detection in the context of fragmented systems. A compliance approach calibrated to one market will not be effective across all of them. 

The path forward: from reactive detection to connected intelligence

The threats are not new. Crypto fraud, mule networks, sanctions evasion, and beneficial ownership opacity have been on compliance agendas for years. What has changed is the scale, speed, and interconnection of these threats, and the gap between that reality and the operational capabilities many institutions have in place to respond.

Financial crime compliance in Asia-Pacific is moving from reactive, transaction-level detection toward proactive, intelligence-led risk management. That shift requires connected data, integrated workflows, and the ability to understand how risk signals interact across counterparties, transactions, geographies, and time. Organisations that close the visibility gap will be better positioned to detect indirect exposure, respond to emerging typologies, and meet regulatory expectations as they continue to evolve. Those that do not will find that the most significant risks in their portfolios remain the ones they cannot yet see.

Watch the webinar. Full recording of the Fintelekt Asia-Pacific Financial Crime Risk webinar, including practitioner Q&A.

LexisNexis® Risk Solutions provides global risk intelligence, connected data infrastructure and advanced analytics to help financial institutions across Asia-Pacific detect fast-moving threats, strengthen sanctions screening, improve counterparty due diligence, and meet evolving regulatory expectations, at scale, across every market. Learn More.

LexisNexis and the Knowledge Burst logo are registered trademarks of RELX Inc. © 2026 LexisNexis Risk Solutions.