Indicators for money laundering via cryptocurrency
Virtual currency is regularly linked to money laundering. Gatekeepers need to remain alert of the risks. But which amount offers an indication of money laundering with virtual currency?
The Europol Financial Intelligence Public Private Partnership (EFIPPP) set up in 2017 is the first international mechanism for sharing information in the area of combating money laundering, terrorist financing and economic crime. This collaboration allows financial institutions and others with a footprint within and outside the borders of the European Union to come together. Within this collaboration, representatives of Financial Institutions, Financial Intelligence Units and investigation agencies all share information with each other from relevant money laundering phenomena that have been observed. This provides support for national public-private collaborations, they can put together a joint picture of the information and they can understand the threats and risks of crime better.
The EFIPPP recently shared a document on the Europol Platform for Experts (EPE) with red flags in the area of virtual currency which could point to money laundering.
We are sharing this list of indicators with you below: they may well be useful for application in systems and procedures for efficiently detecting financial crime.
The list is in no way complete and we welcome any new indicators to add to this list. Instructions for such additions are given at the end of this article.
More than anything, it remains important always to carry out thorough customer due diligence (CDD) and to identify clients of Cryptocurrency Service Providers, as well as to exclude business contacts associated with virtual currencies when a substantial risk exists of a breach of the ML/TF policy or Sanctions.
Know your client (KYC) indicators of potential money laundering activities
- Inconsistent statements about the source of funds used for transactions and the purchase of crypto assets;
- A client is found on open source fora or other sites which provide a direct or indirect link between him/her with darknet markets.
Financial indicators of potential ML activity
Within the traditional payment process, it is only possible to establish a potential link between the transaction and the virtual assets through the identification of a counterparty, of which it is known that the latter is a service provider in the area of virtual assets, or when the link is specifically indicated in the purpose of the payment (such as "payment for Bitcoin" or "BTC").
- The payment of and/or the willingness to pay large commissions for exchanging (selling) virtual assets for authorisation, in comparison with the commissions which are normally charged by stock exchanges for virtual assets. On the basis of transactions alone, it is not a simple matter to establish whether the commission paid was large. However, in combination with price information concerning the exchange used, this can be established;
- Use of cryptocurrency exchanges, which do without basic anti-money laundering checks and policy (such as Know-Your-Customer) - a company such as Chainalysis, which provides blockchain data and analysis, draws up a list of such exchanges for its clients;
- A report dating from 2020 produced by CypherTrace indicates that more than half of the exchanges worldwide (56%) have weak KYC identification protocols. Exchange services in Europe, the US and the UK are considered to be the worst offenders.
- Sending and receiving large amounts to/from a cryptocurrency platform. What may be considered to be ‘large amounts’ necessarily depends on the financial institution and the client profile;
- SMURF techniques for splitting funds and depositing those in a large number of bank accounts with funds, which are finally used for buying cryptocurrency from private sellers who reside in different countries;
- Use of Bitcoin/cryptocurrency ATMs to launder the authorisation money in cryptocurrencies through ATMs, mainly where those have been installed temporarily, such as in a pop-up store or in combination with an event;
- Transaction with one or more crypto assets (e.g. Bitcoin) in combination with other suspicious account behaviour and activities;
- Excessive number of transfers by third parties which are then quickly transferred to companies (also the self-employed or unregistered businesses), that work as a sort of ‘illegal’ trader for the benefit of the actual purchase and sale of cryptos;
- Credit entries on the account are in rounded off amounts, with account activities which indicate that the client is an intermediary who processes criminal revenue in cryptocurrency in order to intentionally disguise audit trails and to attempt to make the funds appear legitimate;
- Funds which are deposited shortly after the account registration and then shortly afterwards are withdrawn again in the same cryptocurrency without making use of platform functions (e.g. trade/margin financing) may indicate that a platform is being used as a mixer/tumbler;
- Unusual payments by third parties followed by transfer of funds to accounts, which are then quickly transferred to cryptocurrency exchange companies;
- Payment in cryptocurrency to websites of which it is known that they are linked to illegal activities;
- Revenue from the sale of cryptocurrency is withdrawn immediately in cash;
- Account appears to be financed by an unknown person and unrelated deposits by third parties which clearly have no reason;
- Transfers and deposits whereby one or more crypto assets are involved in multiple jurisdictions;
- The quantity of crypto assets purchased cannot be explained economically or financially in view of the average use by the client;
- Participation in an Initial Coin Offering (ICO), which is the equivalent in the cryptocurrency industry of an Initial Public Offering (IPO). Due to their unregulated status and the anonymous nature of the transactions involved, ICOs are attractive for the laundering of money acquired in a criminal manner;
- Multiple quick transactions between multiple crypto exchange platforms without a clearly related purpose, which may indicate attempts to break through the chain of custody on the respective blockchains or to further disguise the transaction;
- Client who has known transaction activities with crypto exchanges makes a transaction which is atypical and which is much higher than would be expected;
- Client who makes a large and unique transaction to a cryptocurrency exchange;
- Transfer of funds to/from peer-to-peer (P2P) platforms, which are independent of the large centralised exchanges. Users are often not obliged to provide personal identity data;
- Client purchases large quantities of cryptocurrency which do not balance the available assets, nor in accordance with his or her historical financial profile;
- Use of a money mule, who opens an account with a bank, deposits funds into the account of the money mule from a criminal source, the money mule then transfers the illegal funds to an account of a third party and can be converted into a cryptocurrency – see the example given below of money laundering through a money mule;
Cryptocurrency is a popular means for transferring money to, from and within darknet marketplaces. Blockchain analysis instruments can help in identifying when funds are directly or indirectly sent to and/or received from a darknet wallet address.
- A user often receives funds from, or deposits funds into, darknet wallet addresses which accumulate large values;
- A significant percentage of the deposits made by a user on an exchange originate from darknet market places;
- A significant percentage of the withdrawals of a user of an exchange result in transactions with darknet market places.
Do these indicators provide information about suspicious transactions? Then they must be reported to the FIU.
The AMLC and Europol welcome all descriptions of phenomena, strategic information and anonymised feedback concerning all information arising from these EFIPPP indicators. For such purposes, please contact Erik Reissenweber of the AMLC, email@example.com.