For years, the anti-money laundering conversation has centered on banks, payment firms, and crypto exchanges, the businesses that actually move money. A recent legal analysis from Bird & Bird is a useful reminder of how quickly that picture has changed, and it should give infrastructure providers pause, too.
How fintech rewrote the rules of layering
The article lays out how fintech has scrambled the traditional three-stage model of laundering, placement, layering, and integration, by making transactions faster, more automated, and increasingly cross-border. Crypto-assets, the authors note, can strip out the placement stage entirely, since funds enter the system already cloaked in a degree of anonymity, which removes one of the moments regulators have traditionally relied on to catch illicit money early. Layering has become correspondingly harder to trace, as funds pass through digital wallets, NFT marketplaces, and challenger banks whose rapid, automated onboarding was built for growth rather than scrutiny.
When the story stops being a banking problem
That last point is where the story stops being purely a banking problem. The Bird & Bird piece points to the FCA’s £28.9 million fine against Starling Bank in 2024, which highlighted failures in transaction monitoring, customer due diligence, and enhanced due diligence for high-risk accounts, as a case that underscores growing regulatory concern over challenger banks specifically. Challenger banks, digital wallets, and crypto platforms do not run themselves. They run on cloud infrastructure, hosted domains, identity verification tooling, and payment rails that are, in most cases, supplied by third parties. When a regulator asks how a network of mule accounts was onboarded in minutes or how a shell entity spun up a functioning payment service in a weekend, the answer increasingly runs through infrastructure providers who never touched the money but enabled the speed that made the scheme possible.
Why this matters for hosting, domains, and cloud compute
This matters for CloudFest’s community specifically, because the sectors most exposed here, hosting, domains, cloud compute, and identity services, sit upstream of the fintech products regulators are now scrutinizing. A hosting provider that offers instant provisioning to a newly registered entity, a domain registrar that allows bulk registration with minimal verification, or a cloud platform that lets a customer stand up a payment-facing application without meaningful know-your-customer checks, is not committing an offense in the way a bank might be. But it is, in the language the article uses to describe professional enablers in legal and accounting sectors, part of a chain that can unwittingly, or in rarer cases deliberately, facilitate the layering stage of a laundering scheme, especially as fintech compliance regulations continue to expand beyond traditional financial institutions.
Where regulatory pressure for Fintech is heading next
The FCA’s own enforcement priorities, as summarized in the piece, offer a hint at where this is heading. Regulators are pushing firms toward AI-driven monitoring, tighter onboarding controls, and stronger governance, not because the technology is inherently suspicious, but because speed and scale, the very qualities that make cloud infrastructure valuable, are the same qualities that make it attractive to criminals. Infrastructure providers who want to stay ahead of this shift would do well to treat customer verification and abuse monitoring not as a compliance afterthought bolted onto sales, but as a genuine product feature, one that protects the platform’s reputation as much as it protects the financial system.
The takeaway for infrastructure providers
None of this means every hosting company needs to become a quasi-regulated entity overnight. But the direction of travel is clear enough. As enforcement widens from the obvious targets to the ecosystem around them, the providers who thought of themselves as neutral pipes are going to find that regulators, and increasingly their own enterprise customers, expect otherwise, particularly where regulatory compliance for fintech platforms depends on the infrastructure layer beneath them.
