This study examines the theoretical, structural, and empirical applications of Artificial Intelligence (AI) and Machine Learning (ML) architectures within the domain of regulatory compliance (RegTech) and supervisory technology (SupTech) for cross-border digital transactions. The exponential expansion of cross-border financial flows, real-time payment systems, and decentralized financial instruments has amplified regulatory fragmentation, multi-jurisdictional compliance friction, and sophisticated financial crime typologies. Utilizing institutional economics, information asymmetry theory, and computational compliance modeling, this paper analyzes how advanced algorithmic architectures—specifically Graph Neural Networks (GNNs), Natural Language Processing (NLP), and Federated Learning—optimize anti-money laundering (AML), counter-terrorist financing (CFT), and real-time sanctions screening. The findings demonstrate that shifting from legacy rule-based heuristics to adaptive, privacy-preserving AI frameworks significantly compresses false-positive rates, bridges cross-jurisdictional regulatory disparities, and establishes a dynamic, mathematically rigorous paradigm for global financial integrity.
Abstract The boundary between traditional organized crime and cybercrime is eroding. Long-established criminal groups increasingly rely on encrypted communications, darknet markets, and cryptocurrency-based money laundering, while profit-driven cybercriminal groups adopt the durable structures, division of labor, and governance mechanisms long associated with organized crime. This article examines this convergence, understood as the organizational, operational, financial, and technological integration of traditional criminal groups and cybercriminal networks. The study combines a qualitative analysis of documents published between 2020 and 2026, including law enforcement reports, court records, and assessments by international organizations, with a case study of the Hive ransomware group and its disruption in 2023, complemented by supporting cases such as Conti, Hydra Market, EncroChat, and the online fraud compounds of Southeast Asia. Three vectors of convergence are identified: ransomware-as-a-service models and inter-group alliances; darknet marketplaces and the wider crime-as-a-service economy; and direct alliances between hackers and conventional criminal groups, including trafficking-based forced criminality. The article develops an integrative framework that links each vector to the organizational features it produces, to established criminological theories, and to corresponding enforcement levers. It concludes that convergence is a profit- and opportunity-driven adaptation to a weakly guarded digital environment and that effective responses require synchronized pressure on offenders, finances, infrastructure, and criminal service providers.
Cybercrimes that exploit virtual assets—including laundering, concealment, and illicit financing through the dark web—are increasing rapidly, while existing tracking tools remain limited when offenders leverage multi-layer blockchain architectures and off-chain mechanisms to obscure fund flows. This paper proposes a practical full-node-based blockchain forensic framework for the automated detection and tracking of illicit virtual asset transactions across Layer-1 and Layer-2 environments. The framework operates a full-node network to construct a continuously updated database of all on-chain transactions, from which exchange-controlled internal addresses are identified using six formalized heuristics (H1–H6) expressed as a weighted-sum scoring model. A unified multi-layer transaction graph incorporates Layer-2 events—payment channel closures, rollup batch submissions, and bridge deposits and withdrawals—as contextual edge attributes correlated with Layer-1 settlement. Protocol-specific cross-layer correlation procedures, covering Arbitrum retryable tickets, Optimism cross-domain messages, zkSync Era batch commitments, and third-party bridge relays, were validated on live main-net transactions. Applying the framework to 7511 suspect wallet addresses, 821 (10.93%) were attributed to four Korean exchanges, and real laundering cases involving mixing and swapping—together with integrated real-time alerting and transaction-freeze request functions—demonstrate its direct applicability to law enforcement investigations. In addition, attribution reliability is quantified through the 98.80% labeling consistency observed across repeated independent collections of the same addresses, the standard forensic metrics are formally defined together with publicly released evaluation tooling, and the end-to-end detection latency is bounded analytically by the confirmation properties of the underlying protocols, substantiating the real-time capability of the framework.
Type of the article: Research ArticleAbstractThe blockchain financial system allows users to send money fast without any border restrictions. However, the same structure of the blockchain may be used as a means of laundering money. This paper assesses the relationship between the complexity of transaction networks and the likelihood of their illicit nature within the public Elliptic Bitcoin benchmark and examines whether anomaly detection using machine learning helps to interpret risks from an AML/CFT perspective. This empirical analysis assumes that Elliptic provides an anonymized transaction network in which nodes correspond to Bitcoin transactions, edges reflect directed transactions, and anonymized features facilitate licit/illicit classification of transactions. Furthermore, the dataset is not considered evidence of sender wallet addresses, receiver wallet addresses, transaction amount, timestamp, ownership of exchanges, user geography, and national AML/CFT effectiveness. Based on the labelled analytical dataset presented in the uploaded workbook (46,564 observations, including 42,019 licit transactions and 4,545 illicit transactions), a logit model found a significant positive correlation between illicit transactions and degree centrality (beta = 1.870, p < 0.001), clustering coefficient (beta = 0.940, p < 0.001), and flow entropy (beta = 0.680, p < 0.001). Isolation Forest and Autoencoder reached AUCs of 0.866 and 0.841, respectively. In turn, the coefficient measuring a country’s regulatory capacity and its interaction term are not included in the estimation because there is no country-window marginal effect. Therefore, this paper does not test for the impact of regulatory capacity of the USA, Singapore, and UAE on transaction classification.