Financial Crime in 2027

Banking & Crypto Converge1 Virtual IBANs4 Hawala Goes Digital5 2 Stablecoins New Digital Ecosystems3 How Investigations Must Change6Financial Crime in 2027 Key T rends Shaping the Y ear Ahead

1 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change Introduction Financial crime is undergoing a profound transformation with the rapid adoption of digital assets, the growing use of stablecoins, the convergence of traditional and digital financial systems and increasingly sophisticated money laundering techniques. Criminals and bad actors are exploiting these changes to orchestrate financial crimes in new ways and to move and conceal illicit proceeds more effectively. Heading into 2027, these trends are making financial crime investigations more complex, spanning a growing mix of assets, platforms and jurisdictions. Investigators and analysts must keep pace with evolving tactics across fraud, money laundering, terror financing and other forms of financial crime. As illicit financial activity becomes increasingly intertwined with organized crime, trafficking, cybercrime and other offenses, financial intelligence is becoming a core component of nearly every major criminal investigation. Key trends which will shape financial crime investigations in 2027 include: The Line Between Banking and Crypto Blurs Virtual IBANs Increase Financial Complexity Stablecoins Become the Dominant Medium for Illicit Crypto Activity Informal Value T ransfer Merges with Digital New Digital Ecosystems Expand the Ways Value Can Move

Financial Crime in 2027 2 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change T rend 1 The Line Between Banking and Crypto Blurs As digital assets become more deeply integrated into mainstream financial services, the boundary between traditional banking and crypto is becoming less distinct. Banks are expanding digital-asset services. Payment providers are making it easier to move between fiat and crypto. Traditional financial products are increasingly being offered through blockchain-based systems. For criminals, this creates more opportunities to move funds between bank accounts, payment platforms, exchanges and wallets, adding layers between the origin and destination of illicit proceeds. 2A single case may move repeatedly between fiat and crypto, requiring investigators to follow the same flow of funds across systems that have traditionally been analyzed separately. For investigators, the boundary between an on-chain investigation and a traditional financial investigation is breaking down. In June 2025, the US Department of Justice charged the founder of US-based cryptocurrency payments company Evita. The defendant allegedly funneled more than $500 million of overseas payments through US banks and cryptocurrency exchanges, while hiding the source and purpose of the transactions. Foreign customers, many holding funds at sanctioned Russian banks, sent him cryptocurrency. Then Evita laundered the funds through crypto wallets and US bank accounts before converting them into dollars and making payments through bank accounts in New Y ork.1 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change

3 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 5 Hawala Goes Digital 6 How Investigations Must Change 1 Banking & Crypto Converge Source: Chainalysis 2026 Crypto Crime Report84% of illicit virtual asset transaction volume involved stablecoins Source: FATF 2025, T argeted Report on Stablecoins and Unhosted Wallets$154B received by illicit cryptocurrency addresses in 2025While Bitcoin once dominated the cryptocurrency landscape, stablecoins such as USDT and USDC now play a dominant role in illicit financial activity. Stablecoins are cryptocurrencies designed to hold a steady value by being pegged to a reference asset, most often the US dollar. That stability makes them useful for moving value quickly across borders without the price swings of Bitcoin or Ether, which is also what makes them attractive for moving illicit funds. Recent data illustrates the scale of this shift within the crypto ecosystem: illicit cryptocurrency addresses received at least $154 billion in 2025 , with stablecoins accounting for 84% of the illicit transaction volume. A VIOLENT WORLD 3T rend 2 Stablecoins Become the Dominant Medium for Illicit Crypto Activity

4 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 5 Hawala Goes Digital 6 How Investigations Must Change 1 Banking & Crypto Converge Unlike more volatile cryptocurrencies, stablecoins combine the speed and borderless nature of digital assets with relative price stability. This makes them increasingly useful for transferring, storing and laundering illicit funds across the global financial ecosystem. The growing use of stablecoins is also shifting attention toward the blockchain networks that facilitate their movement. TRON, for example, has emerged as a major infrastructure for USDT transfers, making it increasingly relevant to investigations involving scams, money laundering, terror financing sanction evasion and other forms of illicit financial crime. T raditional blockchain analytics tools enable authorities to detect and map crypto transactions and wallets associated with illicit activities. However, this is no longer enough. Authorities require advanced blockchain intelligence which enables them to link crypto wallets to the criminals behind them. In February 2026, the US Attorney's Office for North Carolina announced the seizure of more than $61 million in USDT linked to wallets used in a cryptocurrency investment fraud scheme. Homeland Security Investigations traced victim funds across multiple wallets used to launder the proceeds, with T ether assisting in transferring the assets.2 in USDT seized February 2026 • North Carolina Stablecoins offer several characteristics that make them attractive to criminal and terror networks including: Fast cross-border transfers High liquidity Lower transaction costs Reduced price volatilityBroad availability across exchanges and wallets

5 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change T rend 3 New Digital Ecosystems Expand the Ways Value Can Move The digital economy continues to create new ways to transfer value outside traditional financial channels. Payment apps, online gaming platforms, virtual goods marketplaces and digital gifts allow value to move between users in ways that do not resemble conventional financial transactions. While these platforms serve legitimate purposes, they can also be exploited to layer transactions, obscure ownership or move funds across jurisdictions. Financial activity increasingly moves between traditional accounts, digital assets and online platforms. This creates additional gaps in the money trail. Investigators and analysts require advanced solutions that enable them to follow the money across this diverse ecosystem and connect it back to individuals, accounts, wallets and wider criminal networks. In March 2026, Spanish authorities working with Ukrainian police and supported by Europol arrested 12 suspects in a money laundering network. They exploited vulnerable Ukrainian women to open bank accounts, which were then used in gambling and gaming platforms to transfer illicit profits. Investigators identified 55 victims and estimate the network profited by 4.75 million euros.3 Gaming PlatformsVirtual Goods & MarketplacesDigital Gifts & RewardsCreator Payments & Virtual GiftsPayment Platforms & Apps In-game currency, items and accounts can be traded or sold.Digital goods and services bought, sold and resold across platforms.Gift cards, rewards and loyalty points can be converted and transferred.Tips, virtual gifts and fan payments can be shared or monetized by creators.E-wallets and payment apps enable fast, cross-border value movement. Examples: G2A DMarketSkinport Fortnite League of LegendsExamples: PUBG Mobile Alipay PayPalExamples: WeChat Pay Examples: TikT ok LIVE T witchY ouTube Examples: Amazon Gift Cards Google Play Gift CardsApple Gift Cards

6 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change Financial Crime in 2027 6 Financial Crime in 2027 T rend 4 Virtual IBANs Increase Financial Complexity Virtual IBANs enable unique account identifiers to route payments through underlying centralized accounts, improving payment efficiency, but potentially adding layers to the financial trail. The European Banking Authority (EBA) has identified money laundering (ML) and terrorist financing (TF) risks associated with virtual IBANs, alongside regulatory inconsistencies that can complicate oversight. These concerns reflect a broader challenge across the rapidly evolving fintech sector. In 2025, 70% of competent authorities reported high or rising ML/TF risks, citing weak AML/CFT controls and poor governance among key concerns. In light of these concerns, investigators and analysts require advanced solutions to help map complex payment structures and go beyond individual account identifiers. This would help them trace underlying accounts, entities and beneficiaries, particularly in cross-border investigations. In July 2026, BaFin published a Supervisory Notice, drawing on joint findings with Germany's Financial Intelligence Unit, setting out how virtual IBANs in complex cross-border structures can conceal the people actually involved in transactions and the economic background of payments. BaFin pointed to high-volume flows through international companies with intermediary payment service providers in Hong Kong and China, warning that a virtual IBAN can act as a T rojan horse within digital underground banking networks.4 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change

7 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs5 Hawala Goes Digital 6 How Investigations Must Change 1 Banking & Crypto Converge T rend 5 Informal Value Transfer Merges with Digital Informal value transfer systems such as hawala and fei ch’ien (a Chinese underground financial system with no paper trail) are increasingly intersecting with conventional financial channels and digital assets rather than operating as entirely separate systems. T raditionally based on networks of trusted intermediaries, these systems can now be used alongside: Recent investigations illustrate this convergence. In a 2025 European case, suspects allegedly used an existing hawala network to transfer funds between Turkey and Germany. This occurred while also establishing a blockchain company and purchasing cryptocurrency to launder criminal proceeds. In another operation, Europol dismantled a parallel-banking network that combined hawala, cash collection, cash couriers and cryptocurrency-to-cash exchange within the same criminal service. For investigators, this means a single financial trail may move between informal networks, bank accounts, cash and blockchain-based assets. Reconstructing that trail increasingly requires connecting financial intelligence, blockchain analytics, communications data and other digital evidence to reveal the individuals, intermediaries and wider networks behind the movement of funds. Digital walletsCrypto- currenciesEncrypted communications Bank accounts Payment providers 7 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs5 Hawala Goes Digital 6 How Investigations Must Change 1 Banking & Crypto Converge

8 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital6 How Investigations Must Change How Financial Crime Investigations Must Change For years, financial crime investigations focused primarily on suspicious transactions flagged by traditional banking systems and financial institutions. Rules-based monitoring and transaction alerts were often sufficient to detect unusual activity. That model is no longer enough. Criminal and terror organizations now orchestrate complex financial operations which are increasingly decentralized, cross-border and technology-driven. As financial crime evolves, investigative methodologies must evolve with it. Traditional financial investigations T raditional banking & financial institutions Linear & limited Rules-based alerts Siloed investigationsFinancial investigations in 2027 Fast, cross-border, multi-jurisdiction Intelligence-led risk scoring Network-centric investigationsECOSYSTEMCrypto Gaming Payments Digital Banks MOVEMENT APPROACH INVESTIGATION

9 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital6 How Investigations Must Change Financial Investigations Become Multi-Intelligence Investigations Following the money remains essential, but financial data alone rarely tells the complete story. Investigators increasingly need to combine financial intelligence with other forms of digital intelligence, including: Connecting these diverse intelligence sources can help investigators move beyond tracing where funds traveled to understanding who controls them, how individuals and entities are connected and how the wider criminal network operates. Connecting Accounts, Wallets and Networks with Graph Analytics Financial crime rarely involves a single transaction, account or individual. Illicit funds can move across multiple entities, accounts, wallets, intermediaries and jurisdictions, using techniques such as smurfing, wallet hopping, cross-chain transfers and money mule networks to obscure ownership and movement. For investigators, the challenge is understanding how these seemingly separate pieces fit together. An individual transaction, account or wallet may be only one node in a much larger financial network. Messaging applications Social media Open-source intelligence (OSINT) Blockchain activity and wallet attributionCommunications data This changes the investigative question from "Is this transaction suspicious?” to "Which transaction is connected to a network?"

10 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital6 How Investigations Must Change Modern investigations require graph analytics capabilities to reveal relationships that may be difficult to identify when examining transactions individually. By connecting people, organizations, accounts, wallets, transactions and other entities, graph analytics can help investigators: This enables investigators to move beyond analyzing isolated transactions and reconstruct the broader networks responsible for moving and concealing illicit funds. Uncover hidden relationships between entities T race the movement of funds across multiple hops and financial systems Expand an investigation from a single lead to the wider criminal network Identify central actors, intermediaries and money mules Detect patterns and clusters of related activity AI as an Investigative Partner The volume and complexity of financial data continue to outpace manual investigative methods. AI and graph analytics are already helping investigators prioritize leads, detect hidden relationships, reveal criminal networks and accelerate analysis. However, these capabilities have largely focused on helping investigators analyze information and answer questions they already know to ask. The next shift is toward AI. AI can support the investigation by connecting evidence, identifying gaps, recommending next steps and adapting as new information emerges. Agentic workflows take this further by applying domain-specific investigative methodologies across multi-step processes, while keeping investigators in control of critical decisions. Financial Crime in 2027 10 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital6 How Investigations Must Change

11 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change 11The New Investigative Model with Decision Intelligence NEXYTE is Cognyte's AI-powered decision intelligence platform. It fuses financial records, blockchain activity, open-source intelligence, corporate and beneficial ownership data and other authorized sources into a single investigative workspace. NEXYTE then applies entity resolution, graph analytics and agentic AI to turn fragmented data into a clear picture of the entities behind the transfer of funds and how the network operates. Conclusion Financial crime in 2027 will span more platforms, assets and methods of moving value than ever before. Stablecoins, digital payment platforms, virtual IBANs and informal value-transfer networks are creating new routes for illicit funds, while sophisticated laundering networks make the suspects and organizations involved harder to uncover. Staying ahead will depend on solutions that unite financial, blockchain and open-source intelligence in a single investigative picture, with AI helping investigators move from a single suspicious transaction to the network behind it.NEXYTE provides agencies with critical capabilities to: ✓ Follow funds across banking, crypto, and digital ecosystems ✓Connect financial activity with blockchain and digital intelligence ✓ Surface potential links among transactions, entities, wallets and investigative leads ✓Uncover potential relationships and network patterns ✓ Apply investigative expertise and guide next steps 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change

12 Financial Crime in 2027 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change Cognyte, a global leader in investigative analytics solutions, helps government agencies and other organizations navigate complex threat environments with Actionable Intelligence for a Safer World®. Cognyte’s solutions empower law enforcement, national security and military intelligence agencies, as well as other organizations, in navigating an increasingly complex threat landscape.* *Cognyte helps customers make sense of complex, multi-source data to help identify, assess, and mitigate risks across dynamic environments, supporting informed, mission-critical investigations and operations. Hundreds of customers worldwide rely on Cognyte’s intelligence platform to uncover insights and reveal what matters, across fragmented data and organizational silos, enabling confident decision-making in high-stakes environments. Learn more at www.cognyte.com.1. Founder of Cryptocurrency Payment Company Charged with Evading Sanctions and Export Controls 2. U.S. Attorney’s Office EDNC Announces Seizure of $61 Million Dollars’ Worth of Cryptocurrency 3. 12 members of money laundering scheme exploiting Ukrainian women 4. Virtual IBANs under BaFin scrutiny 5. Italian prosecutors target alleged Chinese underground banking network About Cognyte Resources Learn More Financial Crime Investigation SolutionHow a Tier-1 Military Agency Leverages Cognyte to Disrupt T error FinancingSolution Brief Case Study 2 Stablecoins 3 New Digital Ecosystems 4 Virtual IBANs 1 Banking & Crypto Converge 5 Hawala Goes Digital 6 How Investigations Must Change