Congress Is About to Regulate Crypto. Criminals Are Ready.

But here’s a problem: Congress is racing to set up a regulatory framework for crypto markets while leaving unresolved clear loopholes that criminals already exploit to move and hide dirty money. If Congress doesn’t close those gaps now, it won’t just be setting rules for a fast-moving market, it will be writing the next chapter in how dirty money moves around the world.

I work at Transparency International U.S., a nonprofit that’s part of the world’s oldest and largest anti-corruption network. We spend a lot of time tracking how corrupt officials steal from their citizens, then move and hide that money globally. In many real-world cases, crypto is already part of that playbook.

Take Venezuela. As U.S. sanctions restricted access to oil revenue and the traditional financial system, regime insiders and their partners increasingly turned to digital versions of dollars to move money across borders and pay for goods when banks were blocked from processing those transactions. These digital dollars can be moved quickly and globally, often without a bank or other gatekeeper in the middle, and can be difficult to stop in real time, even when the activity is clearly tied to people the United States has sanctioned.

And it’s not just Venezuela. Iran, Russia, and North Korea have all used crypto in different ways to move funds, evade sanctions, or finance state activity under pressure from the traditional financial system.

This isn’t about whether crypto is good or bad. It’s about whether Congress is about to pass laws that criminals can game on day one. There are four ways that can happen if lawmakers aren’t careful.

First, some crypto companies already handle people’s money in ways existing rules were written for, but without following those rules. They hold customer funds. They move money. They facilitate buying and selling. And they take a cut. Yet some of the proposals Congress is considering would let companies dodge basic safeguards simply by claiming that “no one is really in charge” because the system is “decentralized.” That’s like letting online auto or home lenders skip consumer protections by claiming it’s “just an app.” If you handle people’s money, basic rules to prevent fraud and dirty money should apply. Rules should follow function, not labels.

Second, sanctions are one of the strongest tools the U.S. has to cut criminals off from money, whether that’s corrupt governments, drug cartels, or terrorists. But some crypto tools are designed so that once they’re activated, and even when dirty money is clearly flowing through them, there’s no one to call and nothing to shut off. That can’t be an excuse. A rule that applies when a person moves money, but disappears when software does the same thing, isn’t a rule at all; it’s a loophole. Congress needs to be explicit: Sanctions still apply when crypto tools are used to move money.

Third, Congress has already taken initial steps to regulate digital dollars, focusing largely on the companies that issue them. That was a start. But those rules mostly look at the moment these digital dollars are created, not what happens once they’re circulating. As these instruments move from person to person, across borders and through multiple hands, many of the safeguards that apply to traditional money fall away. If something functions like money, basic protections should follow it wherever it goes. Right now, they don’t. And whenever money can move freely without oversight, criminals are the first to take advantage.

Finally, Congress shouldn’t let companies dodge the rules simply by saying they’re based somewhere else. Some proposals risk allowing crypto businesses to serve Americans while claiming they don’t have to follow U.S. law because their offices or infrastructure are located overseas. That’s exactly the kind of gap criminals look for. When rules stop at the border, but money doesn’t, the people trying to hide dirty money gain an advantage. The fix is simple: If you do business with U.S. customers or otherwise operate in U.S. commerce, you follow U.S. rules.

These are basic principles that have worked for decades across our financial system. Crypto rules are coming either way. The real question is whether those rules will make crime harder or easier. Rushing out laws with exploitable gaps all but guarantees years of cleanup after the damage is already done. If those gaps aren’t fixed now, their consequences may surface sooner—and more clearly—than Congress expects.