Money laundering via cryptocurrency – the red flags

Cryptocurrencies are regularly used to launder money. As a financial institution, you have a gatekeeper function and should be alert to integrity risks. Above all, it remains important to conduct thorough customer due diligence. But what behaviours should you look out for? In this article, we provide an overview of indicators that may indicate money laundering via virtual currency, and how you can deal with them in practice. 

Red flags 

The Europol Financial Intelligence Public Private Partnership (EFIPPP) is the first international information-sharing mechanism for combating money laundering, terrorist financing and economic crime. Within this partnership, financial institutions and investigative bodies, among others, exchange information on observed money laundering phenomena. 

At the Europol Platform for Experts (EPE), EFIPPP has published a document with red flags. In other words, indicators in the field of virtual currency that may indicate money laundering. The EPE is a platform for specialists in different areas of law enforcement. Some indicators will be explained in more detail below. The EFIPPP stresses that the list of indicators is not exhaustive. 

The following two KYC indicators of potential money laundering activities are distinguished by EFIPPP: 

• Inconsistent statements about the source of funds used for transactions and purchase of crypto assets. 
• A customer is affected on e.g. open source forums or other sites that link the customer to darknet markets. 

In the remainder of this article, we will discuss these indicators and how to recognise it in practice. 

Paying high commissions 

A key transaction indicator is paying and/or willingness to pay high commissions for converting (selling) virtual assets in exchange for fiat money. Based on transactions alone, it cannot be determined whether the commission paid was too high. 

In practice 

Combine price information on the exchange used with the value of the commission paid. In this way, it can be determined whether the commission paid was high and thus whether there is an indicator of money laundering. 

Sending or receiving large sums of money to or from a cryptocurrency platform 

Sending and receiving large sums of money to or from a cryptocurrency platform can also be a red flag. What can be understood by large amounts depends on several factors. 

In practice 

For instance, the interpretation of this indicator can vary greatly from one financial institution to another. For instance, the type of products and services offered by the institution plays a role, as well as the customer segments the institution deals with. Important here is that the financial institution has and complete and up-to-date customer profile on the basis of which it can be determined whether a ‘large amount’ is involved. 

Smurfing techniques to split and deposit funds 

A similarly common indicator is called smurfing. This involves a technique to split and deposit funds into a large number of bank accounts with funds that are eventually used to purchase cryptocurrency from private sellers located in different countries. 

Smurfing is quite difficult to detect in practice. It is a technique to ensure that transactions remain below the reporting limit of the financial institution. Together, these transactions make up a high, reportable amount, but in part they remain below that limit. This is why many different accounts are used. In the names of different individuals (‘smurfs’) and at different banks. In the case of professional money launderers, also in different countries. This usually takes place in the first phase of the money laundering process (placement). 

In practice 

In practice, smurfing is notable for a relatively high volume of transactions for relatively low amounts to the same beneficiary. It will also stand out if the customer has several accounts where the same pattern can be recognised. For example, multiple accounts may still occasionally be opened at an institution in the name of the same person, or a number of related persons (family members), which are used for money laundering purposes. Due to poor customer due diligence, the necessary links are not made and the transaction patterns are not linked, so the practices go undetected. Today, with a partnership like TMNL, it has become easier for the major Dutch banks to gain insight into such practices. 

Multiple quick transactions between multiple crypto exchange platforms 

Another indicator is when multiple transactions are carried out in quick succession between different crypto exchange platforms, with no clear link between the transactions. Such transactions may indicate attempts to break the chain of custody around the respective blockchains. Or on continuing the transaction further in disguise. The chain of custody is the term that refers to the chronological paper trail that documents how and by whom individual items of physical or electronic evidence were collected and analysed. 

In practice 

A key indicator is the use of a relatively large number of different crypto exchange platforms. Not all platforms offer all types of crypto. Often, however, a few major platforms, such as Binance, KuCoin and Coinbase, will suffice, together covering the vast majority of crypto-currencies. Still, if it appears that a customer is depositing and receiving funds to and from 10 to 15 different platforms, this could indicate money laundering. 

Unexplained crypto assets 

Finally, the last indicator. Here, the amount of crypto assets purchased is not economically or financially explicable, given the average usage by the customer. The customer has unexpectedly made a larger transaction than was previously the case. 

In practice 

You can approach this indicator from two angles. On the one hand, if the customer suddenly starts buying crypto for a large amount, it is noticeable even though this does not quite fit the profile the institution has of this customer (assets etc.). 

Reasoning in the other direction, funds (often relatively high amounts or a high volume of small amounts) may be deposited into an account from a crypto platform. The money launderer could then argue that these are returns obtained from previous investments in cryptos. As crypto has a high volatility (strong fluctuation), it can happen that an investment in crypto can generate a lot of money in a short period of time. However, proof of this should always be requested as part of an investigation into the origin of funds. This can very easily be printed out on the crypto platform. A crypto account can easily be supplemented with transfers of crypto funds from other platforms. It is therefore important to request such a statement. This shows what has been contributed and how the assets have grown. 

Darknet

To transfer money to and from darknet marketplaces, cryptocurrency is often used. The following ways can provide insight and help identify when funds are directly or indirectly sent and/or received from a darknet wallet address. 

• A user often receives funds from, or sends funds to, darknet wallet addresses that accumulate to large values; 
• A significant percentage of a user’s deposits on an exchange originate from darknet marketplaces; 
• A significant percentage of a user’s withdrawals from an exchange result in transactions with darknet marketplaces. 

Want to know more? 

Do you recognise the red flags that may indicate money laundering, terrorist financing, fraud or corruption? Our new Financial Economic Crime (FEC) Awareness e-learning helps you recognise suspicious signals or transactions in practice and teaches you what to do with them. Or do you want to speak to one of our consultants? Feel free to contact us without obligation