Virtual Asset Service Provider

An entity or business that offers services for exchanging, transferring, safekeeping, managing, or issuing digital assets. This category includes centralized and peer-to-peer trading platforms, decentralized finance protocols, wallet providers, and other digital asset platforms.

[
Code
AT0093
]
[
Name
Virtual Asset Service Provider
]
[
Version
1.0
]
[
Category
Financial Institutions & Service Providers
]
[
Created
2025-02-03
]
[
Modified
2025-04-02
]

Related Techniques

They facilitate rapid, cross-border virtual asset transfers with limited transparency. Criminals exploit these platforms to obscure the origin and beneficiary of funds, circumventing traditional AML safeguards applied by financial institutions.

Virtual asset service providers are exploited by criminals using burn-and-mint transfers when:

  • Offering cross-chain bridging or token swap services with limited or no KYC measures.
  • Facilitating rapid exchanges of newly minted tokens, obscuring transaction histories and making chain analytics more challenging.

These services unwittingly enable criminals to layer funds across multiple networks, creating anonymity gaps for financial institutions.

T0005
|
|

Virtual asset service providers facilitate chain hopping by:

  • Providing bridging or swapping functionalities across multiple blockchains, often with minimal or no KYC requirements.
  • Allowing criminals to create new addresses, deposit funds, and perform rapid cross-chain transfers that frustrate investigators.

Financial institutions struggle to monitor these cross-chain activities when dealing with partial or inconsistent AML controls across different platforms.

T0091
|
|

Virtual asset service providers are involved when criminals channel disputed refunds into digital asset exchanges by:

  • Converting newly refunded funds into cryptocurrencies, thereby creating additional layers of anonymity.
  • Utilizing decentralized or peer-to-peer platforms to obscure transaction trails, which complicates traditional financial tracking.

Cross-chain bridging services often function as or resemble decentralized VASPs, facilitating token transfers without strong KYC measures or oversight.

Criminals take advantage of these non-custodial bridging protocols to obscure the origin of funds, hinder chain analytics, and complicate financial institutions' due diligence.

Repeated bridging across multiple networks creates complex layering paths, making it more difficult for financial institutions to identify the original source of funds or the ultimate beneficiary.

Virtual asset service providers, including exchanges or custodial wallet platforms, are exploited in cryptocurrency mixing by:

  • Allowing criminals to deposit, withdraw, or transfer funds that have passed through mixers, obscuring the transaction trail.
  • Operating with potentially limited KYC or AML checks, enabling illicit actors to layer funds through multiple wallets or accounts.
T0142
|
|

Virtual asset service providers are exploited to move drug funds by:

  • Enabling borderless transfers that bypass conventional banking scrutiny.
  • Allowing criminals to set up digital wallets or accounts with incomplete or opaque identity records.
  • Operating in or routing transactions through less-regulated jurisdictions to conceal criminal proceeds.

Criminals leverage VASPs, often unwittingly, to facilitate governance token obfuscation by:

  • Taking advantage of minimal or no-KYC onboarding and decentralized trading venues to transact governance tokens without easily traceable identities.
  • Quickly converting governance tokens into other digital assets or mainstream cryptocurrencies, reducing transparency on the original source of funds.

These providers can inadvertently enable layered transactions, making it challenging for financial institutions to identify illicit patterns and enforce effective AML controls.

Criminals exploit virtual asset service providers, including both centralized and peer-to-peer cryptocurrency exchanges, to convert funds across various fiat and digital currencies. They:

  • Break larger sums into smaller transactions on less-regulated VASPs, making it harder to detect suspicious activity.
  • Rapidly switch between different crypto assets and fiat currencies, obscuring transaction flows.
  • Weaken financial institutions’ ability to trace beneficial ownership or flag illicit origins.
T0015.005
|
|

Virtual asset service providers are exploited when criminals route their connections through Onion over VPN to:

  • Conceal user location and IP data, bypassing risk-based or geolocation-based transaction monitoring.
  • Open or operate accounts without revealing accurate network identifiers, hindering robust KYC and investigative processes.

This exploitation significantly impedes the provider’s ability to flag unusual activity and collaborate with financial institutions on suspicious transaction investigations.

Criminals exploit VASPs, both centralized and peer-to-peer, by:

  • Converting in-game currencies or items directly into cryptocurrencies or fiat with little to no KYC.
  • Layering funds across multiple wallets or exchanges to further obscure the source of illicit proceeds.

These rapid, multi-asset conversions hamper financial institutions' transaction tracing and hinder law enforcement investigations.

OTC desks operating as virtual asset service providers enable criminals and sanctioned entities to rapidly convert bulk cash into cryptocurrency by:

  • Accepting large volumes of cash with minimal or no due diligence, bypassing standard exchange-based KYC.
  • Facilitating large off-exchange trades that evade transparent order book reporting, undermining financial institutions' monitoring.
  • Creating multiple layers of transfers across various OTC brokers, obscuring the origin of funds and ultimate beneficiaries.
T0070.002
|
|

Criminals exploit virtual asset service providers by:

  • Depositing peeled funds in repeated small increments that appear unrelated, making it harder to connect them to illicit origins.
  • Converting fragmented cryptocurrency into fiat or other digital assets, further distancing the funds from the initial illicit source.

These processes complicate detection for financial institutions, as each transaction often falls below typical alert thresholds, masking the laundering operation.

T0144.009
|
|

Criminals exploit unwitting or under-regulated VASPs by:

  • Directing pig butchering victims to send funds or cryptocurrency to specific addresses hosted on these platforms.
  • Rapidly transferring or layering stolen capital across multiple wallets, complicating the tracing of illicit proceeds.
  • Leveraging the global, borderless nature of virtual assets to hamper detection and AML efforts.

Virtual asset service providers, including both centralized and peer-to-peer platforms, are exploited by criminals seeking to:

  • Trade mainstream cryptocurrencies for privacy coins while avoiding robust KYC checks.
  • Break traceability links by layering transactions across multiple providers.
  • Operate under poor or non-existent regulatory oversight, further complicating compliance and investigative efforts for financial institutions.

Criminals exploit virtual asset service providers in tokenized fundraisings by:

  • Launching fraudulent ICOs or IDOs on platforms with limited KYC measures, thereby raising or layering illicit funds.
  • Rapidly converting newly issued tokens into other cryptocurrencies or fiat through in-house exchange functions.
  • Leveraging multi-jurisdictional or decentralized setups that hinder investigators' ability to trace and freeze suspect transactions.

This exploitation poses challenges for financial institutions, which must identify suspicious token sales and monitor complex wallet movements for signs of laundering activity.

T0067.005
|
|

They provide various platforms—centralized exchanges, peer-to-peer trading, cross-chain bridging, decentralized finance protocols, and instant swap services—that criminals exploit to layer funds. Inconsistent or limited KYC measures allow:

  • Rapid deposits, withdrawals, and token conversions without clear customer identification.
  • Complex multi-chain transactions that obscure beneficial ownership and bypass conventional monitoring.

These features hinder financial institutions' ability to track and freeze illicit funds effectively.

Criminals exploit these service providers by:

  • Initiating pseudonymous token swaps and conversions under insufficient KYC procedures.
  • Rapidly bridging stablecoins across different blockchain networks to evade potential freezes or scrutiny.
  • Creating intertwined token transactions that hinder traceback, complicating investigations by financial institutions.