NECC ranks cryptoassets third among nine UK economic crime priorities

What happened

The National Economic Crime Centre (NECC), part of the National Crime Agency (NCA), published its annual report on 8 September 2026. The report says criminals are making what it calls “innovative use of crypto asset products” to evade detection and move illicit value at scale. Decrypt first reported the findings on 8 September 2026, citing the NECC document directly.

Cryptoassets rank third among the NECC’s nine economic crime priorities. That places crypto above criminal cash and above money mules. The NECC agreed this priority list with the Financial Conduct Authority (FCA), the UK’s financial regulator, the Home Office, and the Treasury in July 2025. The NECC is now building a proactive, intelligence-led capability dedicated to cryptoassets.

Two operations already show what that capability looks like in practice. Operation Atlantic, run with the US Secret Service alongside the exchanges Coinbase, Binance, and Kraken plus the stablecoin issuer Tether, identified 20,000 approval-phishing victims and froze $12 million. Operation Destabilise targets Russian-speaking networks that convert street cash into cryptocurrency. Since 2022, it has produced 129 arrests and more than £25 million in cash and cryptoasset seizures across the UK.

Why it matters

Analysis: the ranking signals a shift in enforcement resourcing, not only rhetoric. Cash smuggling and money mule networks have dominated UK economic crime enforcement for years, and crypto now sits ahead of both. That ordering suggests the NECC expects crypto-enabled laundering to account for more illicit value than mule networks move, though the report does not publish a monetary comparison between priorities.

The two cited operations point in a specific direction. Operation Atlantic shows exchanges and a stablecoin issuer cooperating directly with law enforcement across borders, which narrows the space for approval-phishing schemes to operate undetected. Operation Destabilise shows the same intensity applied to a well established laundering method, converting street cash into crypto through Russian-speaking networks, rather than a new typology. For regulated firms, this points to sustained supervisory interest in how well transaction monitoring systems catch crypto on-ramps and off-ramps, not a one off report.

Practitioner angle

• Review whether current transaction monitoring rules flag crypto on-ramp and off-ramp activity, including exchange transfers and stablecoin movement, at the same sensitivity as cash based typologies.
• Check whether fraud and financial crime teams currently monitor for approval-phishing schemes, the exact scheme type behind Operation Atlantic’s 20,000 identified victims and $12 million in frozen funds.
• Confirm training materials name crypto laundering as a specific typology, not a generic emerging-risk line, so frontline staff know what to escalate.
• Where firms serve money service businesses or cash-intensive customers, revisit due diligence on corridors linked to the cash-to-crypto conversion pattern described in Operation Destabilise, without treating this as evidence against any individual or community.

The single most important action: benchmark existing crypto typologies against the NECC’s nine priorities before the next internal risk assessment, since supervisors are now positioned to ask why crypto was not already ranked this high.