Cryptocurrency Money Laundering Indicators

Publication date 24-01-2022, 15:09

Virtual currencies are regularly linked to money laundering. Gatekeepers should be aware of the risks. But what behaviors provide clues to virtual currency money laundering?

The Europol Financial Intelligence Public Private Partnership (EFIPPP) was founded in 2017 and is the first international information sharing mechanism in the fight against money laundering, terrorist financing and financial crime. This partnership brings together, among other things, financial institutions with a footprint inside and outside the EU’s borders. In this type of consultation, representatives of financial institutions, financial intelligence units and investigative bodies exchange information on observed money laundering phenomena. In doing so, they support domestic public-private partnerships, build a common intelligence picture and better understand crime threats and risks.

Recently, the EFIPPP shared on the Europol Platform for Experts (EPE) a document with red flags on virtual currencies that may indicate money laundering.

We share this list of indicators with you below, they may be useful for use in systems and procedures to effectively detect financial crime.
The list is by no means exhaustive and we welcome new indicators to add to this list, you can read how to do so at the bottom of this article.

Above all, of course, it remains important to conduct a thorough customer due diligence (CDD) and identify customers of Cryptocurrency Service Providers and exclude business relationships related to virtual currencies when there is a significant risk of ML/TF policy violations or sanctions.

Know your customer (KYC) indicators of potential money laundering activities

  • Inconsistent statements about the source of funds used for transactions and purchases of cryptoassets;
  • A client is found on open source forums or other sites that directly or indirectly connect him/her to darknet markets.

Financial indicators of potential ML activity

Transaction Indicators

In the traditional payment process, it is only possible to establish a potential link between the transaction and the virtual assets by identifying a counterparty known to be a virtual asset service provider, or when the link is explicitly stated in the purpose of payment (such as “payment for Bitcoin” or “BTC”).

  • Payment and/or willingness to pay high commissions to convert (sell) virtual assets in exchange for fiat compared to the commissions normally charged by exchanges for virtual assets. It is not usually easy to determine whether the commission paid was high on the basis of transactions alone, but this can usually be determined in combination with price information on the exchange used;
  • Use of cryptocurrency exchanges that lack basic controls and anti-money laundering policies (such as Know-Your-Customer) – companies such as Chainalysis, which provide blockchain data and analytics, list such exchanges for their clients;
  • A 2020 report by CypherTrace indicates that more than half of all global exchanges (56%) have weak KYC identification protocols. Currency exchange services in Europe, the US and the UK are considered the worst offenders.
  • Send and receive large amounts to/from cryptocurrency platform. What can be understood by ‘large sums’ obviously depends on the financial institution and the customer profile;
  • Smurfing techniques to split and deposit funds into a large number of bank accounts with funds ultimately used to purchase cryptocurrency from private sellers in various countries;
  • Using Bitcoin/cryptocurrency ATMs to launder cryptocurrency fiat money through ATMs, especially if they are installed somewhere in a temporary facility, such as a pop-up shop or in connection with an event;
  • Transaction involving one or more crypto-assets (eg, Bitcoin) in combination with other suspicious account behavior and activities;
  • Too many third-party bank transfers quickly charged to companies (can’t also 1-pitters or unregistered companies) acting as a kind of ‘illegal’ dealer for the purpose of actually buying and selling cryptos;
  • Account credits are in rounded amounts where account activity indicates that the customer is an intermediary processing criminal proceeds for cryptocurrency to deliberately hide audit trails and attempt to make the money appear legitimate;
  • Funds deposited shortly after account registration and withdrawn shortly thereafter in the same cryptocurrency without using platform features (eg trading/margin financing) may indicate that a platform is being used as a mixer/tumbler;
  • Unusual third-party payments followed by the movement of funds into accounts, which are then quickly transferred to cryptocurrency exchange companies;
  • Payment in cryptocurrency to websites known to be associated with illegal activities;
  • Proceeds from the sale of cryptocurrency are immediately withdrawn in cash;
  • The account appears to be funded by unknown and unrelated third-party deposits for no apparent reason;
  • Transfers and deposits involving one or more cryptoassets in multiple jurisdictions;
  • The amount of cryptoassets purchased is not economically or financially explainable given the customer’s average usage;
  • Participation in Initial Coin Offerings (ICOs), which are the cryptocurrency industry’s equivalent of an Initial Public Offering (IPO). Due to their unregulated status and the anonymous nature of the transactions involved, ICOs are attractive for laundering money obtained through criminal means;
  • Multiple rapid transactions between multiple crypto exchange platforms with no clear related purpose, which could indicate attempts to break the chain of custody on the respective blockchains or further obfuscate the transaction;
  • Client who has known transaction activity with crypto exchanges makes an out of pattern transaction much higher than expected;
  • Client makes a large and unique transaction to a cryptocurrency exchange;
  • Money transfer to/from peer-to-peer (P2P) platforms, which are separate from major centralized exchanges. Users are often not required to provide personally identifiable information;
  • The customer purchases large amounts of cryptocurrency that do not match available capital or match his or her historical financial profile;
  • By using the money mule, which opens an account in a bank, deposits money into the money mule’s account from a criminal source, the money mule transfers the illegal funds to a third party account and can be converted into a cryptocurrency – see example of money laundering via money mule below ;
Source: FIU Lithuania

the dark web

Cryptocurrency is a popular means of transferring money to, from, and within darknet marketplaces. Blockchain analytics tools can help identify when money is sent and/or received directly or indirectly from a darknet wallet address.

  • A user often receives money from or sends money to darknet wallet addresses that accumulate to large values;
  • A significant percentage of a user’s contribution to an exchange comes from darknet marketplaces;
  • A significant percentage of a user’s withdrawals from an exchange result in transactions with darknet marketplaces.

Do these indicators provide information about suspicious transactions? These must of course be reported to FIU.

AMLC and Europol welcome all descriptions of phenomena, strategic information and anonymized feedback on all information coming from these EFIPPP indicators. Please contact Erik Reissenweber from AMLC,

Leave a Comment