FATF - Virtual Assets Red Flag Indicators

FATF REPORT

Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing September 2020The Financial Action Task Force (FATF) is an independent inter -governmental body that develops and promotes policies to protect the global financial system against money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti -money laundering (AML) and counter-terrorist financing (CFT) standard. For more information about the FATF, please visit www.fatf-gafi.org This document and/or any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area.

Citing reference: FATF (2020), Money Laundering and Terrorist Financing Red Flag Indicators Associated with Virtual Assets,

FATF, Paris, France, www.fatf-gafi.org/publications/fatfrecommendations/documents/Virtual-Assets-Red-Flag-Indicators.html © 2020 FATF/OECD. All rights reserved. No reproduction or translation of this publication may be made without prior written permission. Applications for such permission, for all or part of this publication, should be made to the FATF Secretariat, 2 rue André Pascal 75775 Paris Cedex 16, France (fax: +33 1 44 30 61 37 or e-mail: contact@fatf-gafi.org) Photocredits coverphoto ©GettyimagesTable of Contents Acronyms 2 Introduction 3 Methodology and sources used in drawing up the list of red flag indicators 4 Issues to note when reading this Report 4 Red Flag Indicators 5 5 7 9 12 15 Red Flag Indicators Related to Transactions Red Flag Indicators Related to Transaction Patterns Red Flag Indicators Related to Anonymity Red Flag Indicators about Senders or Recipients Red Flag Indicators in the Source of Funds or Wealth

5 7 9 12 15 Red Flag Indicators Related to Transactions Red Flag Indicators Related to Transaction Patterns Red Flag Indicators Related to Anonymity Red Flag Indicators about Senders or Recipients Red Flag Indicators in the Source of Funds or Wealth Red Flag Indicators Related to Geographical Risks 17 Conclusion 19

References 202  VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING

©FATF/OECD 2020

Acronyms AEC Anonymity enhanced cryptocurrency CDD Customer due diligence DNFBPs Designated non-financial businesses and professions DNS Domain name registrars FATF Financial Action Task Force FIs Financial Institutions FIUs Financial Intelligence Units ICO Initial Coin Offering KYC Know-your-customer LEAs Law enforcement authorities ML Money Laundering STRs Suspicious Transaction Reports TF Terrorist Financing VA/VAs Virtual Assets VASPs Virtual Asset Service ProvidersVIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING  3

©FATF/OECD 2020

Introduction

1. Virtual assets (VA) and related services have the potential to spur financial innovation and efficiency, but their distinct features also create new opportunities for money launderers, terrorist financiers, and other criminals to launder their proceeds or finance their illicit activities. The ability to transact across borders rapidly not only allows criminals to acquire, move, and store assets digitally often outside the regulated financial system, but also to obfuscate the origin or destination of the funds and make it harder for reporting entities to identify suspicious activity in a timely manner. These factors add hurdles to the detection and investigation of criminal activity by national authorities.

2. In October 2018, the Financial Action Task Force (FATF) updated its Standards to clarify the application of the FATF Standards to VA activities and Virtual Asset Service Providers (VASPs) in order to, among other things, assist jurisdictions in

activity by national authorities.

2. In October 2018, the Financial Action Task Force (FATF) updated its Standards to clarify the application of the FATF Standards to VA activities and Virtual Asset Service Providers (VASPs) in order to, among other things, assist jurisdictions in mitigating the money laundering (ML) and terrorist financing ( TF) risks associated with VA activities and in protecting the integrity of the global financial system. In June 2019, the FATF adopted an Interpretative Note to Recommendation 15 to further clarify the application of FATF requirements to VA activities or operations and VASPs, including with respect to suspicious transaction reporting.

3. The FATF has prepared this brief report on ML/TF red flag indicators associated with VAs to assist reporting entities, including financial institutions (FIs), designated non-financial businesses and professions (DNFBPs), and VASPs; however, they are categorised, in identifying and reporting potential ML and TF activity involving VAs. This report should also facilitate reporting entities’ application of a risk-based approach to their Customer Due Diligence (CDD) requirements, which require knowing who their clients and the beneficial owners are, understanding the nature and purpose of the business relationship, and understanding the source of funds.

4. Operational agencies including Financial Intelligence Units (FIUs), law enforcement authorities (LEAs), and prosecutors may find this report a useful reference for analysing suspicious transaction reports (STRs) or improving detection, investigation, and confiscation of VAs involved in misuse.

5. Financial, DNFBP , and VASP regulators , on the other hand, may find these indicators useful when preparing STRs and monitoring for entities’ compliance with AML/CFT controls. Where a reporting entity has information indicating the existence of one or more indicators without logical business explanation, but fails to file an STR despite a customer’s inconsistent explanation or fails to seek clarification on the transaction, competent authorities may consider following up with the reporting

AML/CFT controls. Where a reporting entity has information indicating the existence of one or more indicators without logical business explanation, but fails to file an STR despite a customer’s inconsistent explanation or fails to seek clarification on the transaction, competent authorities may consider following up with the reporting entity taking into account the latter’s business profile.4  VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING

©FATF/OECD 2020

Methodology and sources used in drawing up the list of red flag indicators

6. The red flag indicators included in this report are based on more than one hundred case studies contributed by jurisdictions from 2017 -2020, the findings of the Confidential FATF Report on Financial Investigations Involving Virtual Assets (June 2019) and the published FATF Report Virtual Currencies Key Definitions and Potential AML/CFT Risks (June 2014), as well as information on the misuse of VAs available in the public domain.

Trends in use of VAs for ML/TF purposes The majority of VA-related offences focused on predicate or ML offences. Notwithstanding, criminals did make use of VAs to evade financial sanctions and to raise funds to support terrorism. The types of offences reported by jurisdictions include ML, the s ale of controlled substances and other illegal items (including firearms), fraud, tax evasion, computer crimes (e.g. cyberattacks resulting in thefts), child exploitation, human trafficking, sanctions evasion, and TF. Among these, the most common type of m isuse is illicit trafficking in controlled substances, either with sales transacted directly in VAs or the use of VAs as an ML layering technique. The second most common category of misuse is related to frauds, scams, ransomware, and extortion. More recently, professional ML n etworks have started exploiting VAs as one of their means to transfer, collect, or layer proceeds.

Source: Case studies contributed by jurisdictions from 2017-2020

Issues to note when reading this Report

7. These indicators are specific to the nature of VAs and their associated financial

recently, professional ML n etworks have started exploiting VAs as one of their means to transfer, collect, or layer proceeds.

Source: Case studies contributed by jurisdictions from 2017-2020

Issues to note when reading this Report

7. These indicators are specific to the nature of VAs and their associated financial activities, and are by no means exhaustive. Suspicious activities involving the use of VAs may also share similar traits with ML/TF activities involving the use of fiat currency, or other kinds of assets . Reporting entities should therefore consider the risks posed by their customers, products , and operations, as well as the presence of conventional risk indicators. Red flag indicators should always be considered in context.

8. Freestanding red flags such a s those listed below can be developed or combined with information from operational agencies , which can in turn be further developed through a public -private partnership, in a cyclical, evolutionary process that takes into account the unique risk and conte xt of a jurisdiction , customer type, or the reporting entity itself . The mere presence of a red flag indicator is not necessarily a basis for a suspicion of ML or TF, but could prompt further monitoring and examination. Ultimately, a client may be able to provide an explanation to justify the red flag indicator, business or economic purposes of a transaction.VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING  5

©FATF/OECD 2020

9. When evaluating potential suspicious activity, competent authorities, FIs, DNFBPs, and VASPs should be mindful that some red flag indicators might be more readily observable during general transactional monitoring, while others may be more readily observable during transaction-specific reviews. The observation of one or more of the indicators is dependent on the business lines, products, or services that an institution or VASP offers and how it interacts with its customers. When one or more red flag indicators are present and with little or no indication of a legitimate economic or business purpose, the reporting entity may be more likely to develop a suspicion that ML or TF is occurring. 1 These indicators should not be the sole

or more red flag indicators are present and with little or no indication of a legitimate economic or business purpose, the reporting entity may be more likely to develop a suspicion that ML or TF is occurring. 1 These indicators should not be the sole determinant of whether or not an STR should be filed. Reporting entities should consider filing of an STR if they know, suspect, or have reasonable grounds that ML/TF has been committed. Red Flag Indicators

10. The following sections contain a collection of red flag indicators of suspicious VA activities or possible attempts to evade law enforcement detection, as identified through more than one hundred case studies collec ted since 2017 from across the FATF Global Network, literature reviews, and open source research. As previously mentioned, the existence of a single indicator does not necessarily indicate criminal activity. Often, it is the presence of multiple indicators in a transaction with no logical business explanation that raises suspicion of potential criminal activity. The presence of indicators should encourage further monitoring, examination, and reporting where appropriate.

Red Flag Indicators Related to Transactions

11. While VAs are still not widely used by the public, their use has caught on among criminals. The use of VAs for ML purposes first emerged over a decade ago, but VAs are becoming increasingly mainstream for criminal activity more broadly .

This set of indicators demonstrates how red flags traditionally associated with transactions involving more conventional means of payment remain relevant to detecting potential illicit activity related to VAs. Size and frequency of transactions  Structuring VA transactions (e.g. exchange or transfer) in small amounts, or in amounts under record-keeping or reporting thresholds, similar to structuring cash transactions.  Making multiple high-value transactions – o in short succession, such as within a 24-hour period; o in a staggered and regular pattern, with no further transactions recorded during a long period afterwards, which is particularly common in ransomware-related cases; or

1 While a number of red flag indicators could apply to both instances of ML and TF, e.g. fundraising activities, financing of foreign

o in a staggered and regular pattern, with no further transactions recorded during a long period afterwards, which is particularly common in ransomware-related cases; or

1 While a number of red flag indicators could apply to both instances of ML and TF, e.g. fundraising activities, financing of foreign terrorist fighters (FTFs), and purchase of weapons (e.g. on the darknet) using VAs, readers are encouraged to read in connection with the Confidential FATF Report on Detecting Terrorist Financing: Relevant Risk Indicators ( June 2016) (restricted access to FATF Members).6  VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING

©FATF/OECD 2020 o to a newly created or to a previously inactive account.  Transferring VAs immediately to multiple VASPs, especially to VASPs registered or operated in another jurisdiction where – o there is no relation to where the customer lives or conducts business; or o there is non-existent or weak AML/CFT regulation.  Depositing VAs at an exchange and then often immediately – o withdrawing the VAs without ad ditional exchange activity to other VAs, which is an unnecessary step and incurs transaction fees; o converting the VAs to multiple types of VA s, again incurring additional transaction fees , but without logical business explanation (e.g. portfolio diversification); or o withdrawing the VAs from a VASP immediately to a private wallet. This effectively turns the exchange/VASP into an ML mixer.  Accepting funds suspected as stolen or fraudulento depositing funds from VA addresses that have been identified as holding stolen funds, or VA addresses linked to the holders of stolen funds.

Case Study 1. Multiple immediate transfers of large amount of VAs to overseas VASPs A local VASP submitted STRs following suspicions concerning the purchase of large amounts of VAs by various individuals and their subsequent immediate transfers to VASPs in a foreign jurisdiction. In

Case Study 1. Multiple immediate transfers of large amount of VAs to overseas VASPs A local VASP submitted STRs following suspicions concerning the purchase of large amounts of VAs by various individuals and their subsequent immediate transfers to VASPs in a foreign jurisdiction. In various instances, the individuals shared the same resid ential address; and most of the VA addresses were accessed from the same IP address – indicating the potential use of money mules by professional money launderers to launder the illicit proceeds. In addition, multiple layering of the fiat funds was arranged prior to the VA purchase by mules. To disguise the fund s’ origin, cash w as first deposited into various accounts at different FIs across the jurisdiction. Those funds were then further transferred to various accounts held in the name of entities registered in the jurisdiction. Electronic payments were made into the accounts in smaller amounts. After that, funds were transferred to another group of accounts before reaching the mules’ accounts held with local VASPs. VAs were immediately purchased and transferred to foreign VASPs. More than 150 individuals were involved in this case, responsible for transf erring a total of about USD 108 352 900 (or BTC 11,960) to multiple VA accounts held by two overseas VASPs.

Source: South AfricaVIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING  7

©FATF/OECD 2020

Case Study 2. Multiple VAs and multiple transfers to foreign VASPs A local VA exchange reported that app roximately KRW 400 million (EUR 301 170) was stolen from phishing victims and was ultimately exchanged for VAs as a layering technique. What triggered the reporting was the multiple high -value transactions transferred to a foreign VASP into one single wallet. The stolen funds in fiat currency were first exchanged to three different types of VAs and then deposited to the suspect’s VA wallet held with a local VASP. The suspect then attempted

was the multiple high -value transactions transferred to a foreign VASP into one single wallet. The stolen funds in fiat currency were first exchanged to three different types of VAs and then deposited to the suspect’s VA wallet held with a local VASP. The suspect then attempted to obfuscate the source of funds by transferring funds an additional 55 times through 48 separate accounts held in different lo cal VASPs, and then to a different VA wallet located abroad.

Source: South Korea

Red Flag Indicators Related To Transaction Patterns

12. Similar to the above section, the red flags below illustrate how the misuse of VAs for ML/TF purposes could be identified through irregular, unusual, or uncommon patterns of transactions.

Transactions concerning new users  Conducting a large initial deposit to open a new relationship with a VASP, while the amount funded is inconsistent with the customer profile.  Conducting a large initial deposit to open a new relationship with a VASP and funding the entire deposit the first day it is opened , and that the customer starts to trade the total amount or a large portion of the amount on that same day or the day after, o r if the customer withdraws the whole amount the day after. As most VAs have a transactional limit for deposits, laundering in large amounts could also be done through over-the-counter-trading.2  A new user attempts to trade the entire balance of VAs, or withdraws the VAs and attempts to send the entire balance off the platform. Case Study 3. Initial deposit inconsistent with customer profile The presence of the following s uspicious indicators prompted an FI (bank) to file an STR with authorities, leading to an ML investigation:  transactions inconsistent with the profile of the account holder – in the first two days after a personal account had been created for a young individual, the account received deposits of a commercial nature from different legal persons in large amounts;  transaction patterns – the deposited funds were immediately transferred to accounts of several VASPs (in one day) for VA purchase (Bitcoin);

for a young individual, the account received deposits of a commercial nature from different legal persons in large amounts;  transaction patterns – the deposited funds were immediately transferred to accounts of several VASPs (in one day) for VA purchase (Bitcoin);

2 Over-the-counter trading refers to securities that are traded for companies that are not listed on a formal exchange, and via a broker-dealer network.8  VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING

©FATF/OECD 2020  customer profile – one of the ordering parties was known to the bank as a subject in a fraud case. The bank also provided IP addresses used for internet banking services to the authorities. Based on an investigation, the personal account holder appeared to be a money mule recruited by criminals on a social media platform to help receive claimed payments for goods sold online. However, such funds appeared to have been deposited by other victim companies and were not payments for goods. The deposited funds were immediately transferred out from the persona l bank account via several divided payments to another account held by a joint -stock company in Czech Republic, and were exchanged to VA (Bitcoin) held in several local VASPs. These VASPs were then immediately withdrawn from the account. In addition to fil ing an STR , the bank also suspended the suspicious transfers, which made subsequent seizure of funds possible. The local VASP also noticed irregularities in the funds received and provided useful information to aid the investigation. The information included: circumstances where the VAs were purchased; transaction and other CDD information such as wallet address, copy of misused identification document for the purchase, and name of the alleged buyer. These allow ed authorities to request additional informati on from the banks (e.g. bank statements).

Source: Czech Republic Transactions concerning all users  Transactions involving the use of multiple VAs, or multiple accounts , with no logical business explanation.  Making frequent transfers in a certain period of time (e.g. a day, a week, a

banks (e.g. bank statements).

Source: Czech Republic Transactions concerning all users  Transactions involving the use of multiple VAs, or multiple accounts , with no logical business explanation.  Making frequent transfers in a certain period of time (e.g. a day, a week, a month, etc.) to the same VA account – o by more than one person; o from the same IP address by one or more persons; or o concerning large amounts.  Incoming transactions from many unrelated wallets in relatively small amounts (accumulation of funds) with subsequent transfer to another wallet or full exchange for fiat currency. Such transactions by a number of related accumulating accounts may initially use VAs instead of fiat currency.  Conducting VA-fiat currency exchange at a potential loss (e.g. when the value of VA is fluctuating, or regardless of abnormally high commission fees as compared to industry standards, and especially when the transactions have no logical business explanation).  Converting a large amount of fiat currency into VAs, or a large amount of one type of VA into other types of VAs, with no logical business explanation.VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING  9

©FATF/OECD 2020

Case Study 4. Transfers conducted in a recurrent time A local FI (securities firm) filed an STR regarding unauthorised payments between the VA accounts of their broker and a foreign national. The securities firm reported the activity after it determined that the foreign national intended to make transfers totalling USD 4.8 million (two separate transactions that occurred six minutes apart on the same day), and filed an application to the broker for a trading account the next business day. The wallet was not hosted in the Cayman Islands. The STR reporting led to a successful information exchange with foreign FIUs and the successful return of most of the funds to the victim, as the online platform in a foreign jurisdiction had been able to freeze the suspect’s account before the offence had been

Cayman Islands. The STR reporting led to a successful information exchange with foreign FIUs and the successful return of most of the funds to the victim, as the online platform in a foreign jurisdiction had been able to freeze the suspect’s account before the offence had been completed.

Source: Cayman Islands

Red Flag Indicators Related to Anonymity

13. This set of indicators draws from the inherent characteristics and vulnerabilities associated with the underlying technology of VAs. The various technological features below increase anonymity and add hurdles to the detection of criminal activity by LEAs. These factors make VAs attractive to criminals looking to disguise or store their funds. Nevertheless, the mere presence of these features in an activity does not automatically suggest an illicit transaction. For example, the use of a hardware or paper wallet may be legitimate as a way to secure VAs against thefts.

Again, the presence of these indicators should be considered in the context of other characteristics about the customer and relationship, or a logical business explanation.  Transactions by a customer involving more than one type of VA , despite additional transaction fees, and especially those VAs that provide high er anonymity, such as anonymity -enhanced cryptoc urrency (AEC) or privacy coins.  Moving a VA that operates on a public, transparent blockchain, such as Bitcoin, to a centralised exchange and then immediately trading it for an AEC or privacy coin.  Customers that operate as an unregistered/unlicensed VASP on peer-to-peer (P2P) exchange websites, particularly when there are concerns that th e customers handle huge amount of VA transfers on its customer’s behalf, and charge higher fees to its customer than transmission services offered by other exchanges. Use of bank accounts to facilitate these P2P transactions.  Abnormal transactional activity (level and volume) of VA s cashed out at exchanges from P2P platform -associated wallets with no logical business explanation.  VAs transferred to or from wallets th at show previous patterns of activity

 Abnormal transactional activity (level and volume) of VA s cashed out at exchanges from P2P platform -associated wallets with no logical business explanation.  VAs transferred to or from wallets th at show previous patterns of activity associated with the use of VASPs that operate mixing or tumbling services or P2P platforms.10  VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING

©FATF/OECD 2020  Transactions making use of mixing and tumbling services, suggesting an intent to obscure the flow of illicit funds between kn own wallet addresses and darknet marketplaces.  Funds deposited or withdrawn from a VA address or wallet with direct and indirect exposure links to known suspicious sources, including darknet marketplaces, mixing/tumbling services, questionable gambling sit es, illegal activities (e.g. ransomware) and/or theft reports.  The use of decentralised /unhosted, hardware or paper wallets to transport VAs across borders.  Users entering the VASP platform having registered their Internet domain names through proxies or using domain name registrars (DNS) that suppress or redact the owners of the domain names.  Users entering the VASP platform using an IP address associated with a darknet or other similar software that allows anonymous communication, including encrypted ema ils and VPNs. Transactions between partners using various anonymous encrypted communication means (e.g. forums, chats, mobile applications, online games, etc.) instead of a VASP.  A large number of seemingly unrelated VA wallets controlled from the same IP-address (or MAC -address), which may involve the use of shell wallets registered to different users to conceal their relation to each other.  Use of VAs whose d esign is not adequately documented, or that are linked to possible fraud or other tools aimed at implementing fraudulent schemes, such as Ponzi schemes.  Receiving funds from or sending funds to VASPs whose CDD or know-your-

 Use of VAs whose d esign is not adequately documented, or that are linked to possible fraud or other tools aimed at implementing fraudulent schemes, such as Ponzi schemes.  Receiving funds from or sending funds to VASPs whose CDD or know-yourcustomer (KYC) processes are demonstrably weak or non-existent.  Using VA ATMs/kiosks – o despite the higher transaction fees and including those commonly used by mules or scam victims; or o in high-risk locations where increased criminal activities occur. A single use of an ATM/kiosk is not enough in and of itself to constitute a red flag, but would if it was coupled with the machine being in a high-risk area, or was used for repeated small transactions (or other additional factors).VIRTUAL ASSETS RED FLAG INDICATORS OF MONEY LAUNDERING AND TERRORIST FINANCING  11

©FATF/OECD 2020

Case Study 5. Use of IP address associated with Darknet Marketplace – Alpha Bay AlphaBay, the largest criminal darknet market dismantled by authorities in 2017, was used by hundreds of thousands of people to buy and sell illegal drugs, stolen and fraudulent identification documents and access devices, counterfeit goods, malware and other computer hacking to ols, firearms, and toxic chemicals over a two-year span. The site operated as a hidden service on the TOR network to conceal the locations of its underlying servers as well as the identities of its administrators, moderators, and users. AlphaBay vendors us ed a number of different types of VAs, and had approximately 200 000 users, 40 000 vendors, 250 000 listings and facilitate d more than USD 1 billion in VA transactions between 2015 and 2017. In July 2017, the U.S. Government, with assistance from foreign counterparts, took down the servers hosting the AlphaBay marketplace, arrested the administrator, and pursuant to a seizure warrant issued in the Eastern District of California, seized the physical and virtual assets

In July 2017, the U.S. Government, with assistance from foreign counterparts, took down the servers hosting the AlphaBay marketplace, arrested the administrator, and pursuant to a seizure warrant issued in the Eastern District of California, seized the physical and virtual assets from the marketplace itself, and those that represented the unlawful proceeds from the AlphaBay criminal enterprise. Federal agents obtained the warrants after tracing VAs transactions originating from AlphaBay to other VA accounts and identifying bank accounts and other tangible assets controlled by the alleged administrator.

Source: United States

Case Study 6. Use of mixing and tumbling – Helix A darknet-based VASP, Helix, provided a mixing or tumbling service that helped customers conceal the source or owners of VAs fo r a fee over a three-year period. Helix allegedly transferred over 350,000 Bitcoin, with a value at the time of transmission of over USD 300 million. The operator specifically advertised the service as a way to conceal transactions on the darknet from law enforcement. In February