Virtual Asset Service Provider (VASP) Data

Data from Virtual Asset Service Providers, including detailed logs of digital asset transactions such as amounts, timestamps, wallet addresses, sender and receiver information, and associated account details, as well as user activity within cryptocurrency exchanges (e.g., trading volumes, order details, and user behaviors).

[
Code
DS0038
]
[
Name
Virtual Asset Service Provider (VASP) Data
]
[
Version
1.0
]
[
Category
Transaction & Payment Data
]
[
Created
2025-04-02
]
[
Modified
2025-04-02
]

Related Techniques

Contains logs of digital asset and NFT transactions, including amounts, timestamps, wallet addresses, and trading parties. By analyzing patterns of repeated sales between related addresses at artificially high or low prices, investigators can detect wash trading or collusive price manipulation, which are common techniques used to distort digital asset valuations.

  • Provides internal-exchange logs (off-chain transfers, order IDs, user linkage) that complement blockchain traces and surface peel-chain bots operating on the exchange itself.

Contains records of user accounts, transactions, and compliance details from VASPs. For Burn and Mint Transfers, such data:

  • Reveals bridging or swapping of newly minted tokens shortly after burn events
  • Indicates minimal-KYC or decentralized platforms enabling cross-chain re-minting
  • Helps assess whether users are bypassing stricter compliance measures

By analyzing VASP data, investigators can trace layering or obfuscation attempts involving burn-and-mint schemes.

  • Contains logs of digital asset transactions, including wallet addresses, transaction timestamps, sender and receiver information, and amounts.
  • Facilitates the detection of cryptocurrency flows used to receive or launder funds tied to child exploitation, enabling enhanced tracing of illicit proceeds across blockchain networks.
  • Captures account creation details, KYC documentation, and transaction logs within VASP platforms, including cross-chain bridging transactions to and from user accounts.
  • Enables investigators to detect suspicious bridging activity, such as rapid or unexplained changes in bridging frequency, usage of minimal-KYC bridging services, and potential layering via multiple blockchains.
  • Verified identities and beneficial ownership details help attribute bridged funds and identify parties involved in cross-chain movements, supporting deeper AML investigations.

Data Provided:

  • Detailed logs of digital asset transactions, including amounts, timestamps, and wallet addresses processed by VASPs.
  • User account information, trading volumes, and history of interactions between custodial and decentralized platforms.

How It Supports Detection/Investigation:

  • Identifies the use of multiple VASPs with lax AML measures to conduct large-scale wrapped token transfers.
  • Detects suspicious bridging flows and cross-chain activities facilitated through VASP infrastructure.
  • Supports uncovering patterns of rapid token wrapping and unwrapping designed to obscure the origin of funds.
T0011.002
|
|
  • Consists of internal VASP records, including user profiles, wallet addresses, and transaction logs tied to crypto ATM usage.
  • Provides additional context (e.g., linked accounts, velocity checks) not visible on public blockchains.
  • Enables detection of multiple mules transacting through the same VASP-managed entity or wallet address, confirming organized layering activity.

Encompasses detailed logs from VASPs, including user account information, transaction histories, wallet addresses, and trading patterns, correlated with crypto ATM activity. This data enables more robust tracking of digital asset flows, linking on-chain movements to real-world identities and uncovering layering or structuring schemes across different service platforms.

  • Provides detailed logs of user accounts, deposit and withdrawal records, wallet addresses, and transaction volumes across both regulated and unregulated exchanges.
  • Facilitates the detection of repetitive or unexplained transfers among multiple wallets, the identification of newly opened accounts with minimal prior activity, and the recognition of high-risk crypto-exchange usage for this technique.
  • Contains detailed logs of user activity on cryptocurrency exchanges and other VASPs, including deposit and withdrawal events.
  • Helps identify the movement of newly minted coins into exchange wallets and subsequent conversions to fiat or other digital assets.
  • Facilitates tracing suspicious flows if criminals attempt to disguise illicit proceeds via multiple VASP accounts.

Contains detailed logs of digital asset transactions, including amounts, timestamps, and wallet addresses, along with related customer information. This data helps identify interactions with non-compliant mixers or addresses flagged for mixer involvement, monitor KYC gaps, and trace high-volume or repetitive transactions associated with layering via mixing platforms.

  • Includes exchange-level transaction logs, user account information, wallet addresses, and trading volumes.
  • Helps trace suspicious conversions of newly mined cryptocurrency into fiat or other digital assets, supporting the detection of cryptojacking proceeds and related laundering activity.
T0003.001
|
|
  • Captures detailed logs from cryptocurrency exchanges and other VASPs, including wallet addresses, transaction histories, and user activity.
  • Enables reviewing user interactions with known custodial mixer addresses or identifying patterns indicative of layering and rapid turnover via mixer services.
  • Includes user account data, transaction logs, and trade activity on centralized or decentralized exchanges, covering amounts, counterparties, timestamps, and bridging or swap protocols.
  • Identifies patterns of rapid transfers between different digital assets or blockchains without legitimate business purposes.
  • Reveals layering attempts through decentralized exchange activities and cross-chain bridging specifically tied to Darknet marketplace proceeds.

Contains aggregator or exchange transaction logs, user account details, and usage patterns, allowing investigators to correlate wallet addresses, detect chain-hopping events, and link suspicious DeFi activity to identifiable user accounts where possible.

  • Provides detailed logs of user and transaction data from regulated or semi-regulated exchanges.
  • Enables tracing of funds as they move between decentralized mixers and VASP accounts, bridging on-chain activity with identifiable account holders.
  • Assists investigators in linking suspicious on-chain mixer transactions to real-world user profiles maintained by VASPs.

Includes detailed logs from centralized or semi-decentralized exchanges and bridging platforms, capturing user account data, transaction details, and flows of governance tokens. This data helps investigators trace conversions, link user identities, and detect suspicious patterns when governance tokens are moved or swapped, complementing on-chain analysis.

  • Includes exchange and wallet activity records, user identities, and transaction details from cryptocurrency platforms.
  • Helps trace conversions of in-game currency to digital assets and vice versa, especially when assessing suspicious deposits or withdrawals tied to gaming accounts.

Includes transaction logs, user activity metrics, wallet addresses, and device or IP data from non-custodial or minimal-KYC crypto service providers. This data:

  • Details rapid conversions across different digital assets, revealing layering patterns.
  • Captures user behaviors and potential multi-account usage to identify suspicious high-velocity transactions.

By leveraging VASP data, investigators can trace crypto swaps across multiple platforms, a common tactic in instant exchange-based laundering.

T0144.017
|
|

Contains transaction logs, user records, and trading activity related to cryptocurrency exchanges and other digital asset service providers. This data helps trace funds involved in fraudulent crypto investment offerings and identify patterns of rapid layering or sudden fund withdrawals.

  • Contains logs of digital asset transactions, including wallet addresses, timestamps, volumes, and counterparty information across cryptocurrency exchanges.
  • Supports identifying micro-structuring through repeated low-value crypto transfers, which collectively mask larger laundering schemes.
  • Captures detailed trading and user account information from NFT marketplaces and cryptocurrency exchanges, including order histories, volumes, and price points.
  • Enables detection of artificially inflated NFT sale prices, unusual trading spikes, and suspiciously coordinated transactions among multiple wallets or accounts.
  • Contains logs of digital asset transactions, including amounts, timestamps, wallet addresses, and user details, on centralized or decentralized platforms.

  • Supports tracing the conversion of game currencies to cryptocurrency or fiat, where minimal KYC requirements may be exploited for laundering.

Contains logs of digital asset transactions, including wallet addresses, timestamps, amounts, and user account details. By comparing these records with fiat transaction logs, investigators can identify large or repeated cryptocurrency trades conducted via OTC desks with minimal KYC. This helps detect unregulated laundering channels and trace the flow of funds.

T0067.001
|
|

Captures detailed transaction logs, wallet addresses, user identification records, and trading patterns from VASPs. This enables the detection of repeated small transactions, unusual address changes, and cross-exchange token flows indicative of potential layering or structuring.

T0070.002
|
|

Includes VASP-held transaction logs, user account details, wallet address assignments, and deposit/withdrawal records, allowing the linkage of on-chain peel chain hops to specific exchange user accounts or identities. This data is critical for detecting suspicious patterns, such as multiple micro-deposits or rapid withdrawals, and correlating them with on-chain evidence of layering and fragmentation in a peel chain scheme.

  • Includes detailed logs of digital asset transactions, such as wallet addresses, transaction timestamps, and cryptocurrency-to-fiat conversions.
  • Reveals rapid liquidation of crypto proceeds to fund precursor chemical purchases.
  • Facilitates identification of abnormal or high-volume transactions lacking legitimate supporting documentation.
  • Includes records on VASP licensing status, transaction logs, and KYC procedures for cryptocurrency exchanges and platforms.
  • Aids in detecting reliance on unlicensed or poorly regulated platforms offering privacy coin trading with minimal or non-existent KYC checks, highlighting elevated risks of laundering activity.
T0034.001
|
|
  • Includes detailed records of customers’ digital asset transactions, wallet addresses, deposit and withdrawal logs, and associated account details maintained by VASPs.
  • Helps investigators identify the use of privacy wallets, trace rapid or suspicious transfers, and correlate user activity with KYC information to detect layering and anonymity-enhancing behaviors.

Provides logs of digital asset transactions and user activity within cryptocurrency exchanges and other virtual asset service providers. This includes wallet addresses, user identities, trading volumes, deposit and withdrawal records, and associated account details. Such explicit data is crucial for tracing ransomware proceeds, detecting suspicious cross-exchange transfers, and potentially linking illicit wallets to real-world entities.

T0020.001
|
|
  • Records digital asset and related fiat deposits, withdrawals, and transaction details, including timestamps, amounts, and counterparties.
  • Supports the detection of suspicious or high-volume transfers connected to remote mining, including payments for mining contracts and subsequent flows of newly generated cryptocurrency.
T0144.003
|
|

Captures exchange-level logs from virtual asset platforms, including detailed transaction records, user account details, order books, and compliance checks. This data enables investigators to trace how rug pull proceeds are converted or moved within various trading environments, linking wallet addresses to identifiable user accounts and uncovering laundering patterns.

  • Contains user account information, wallet addresses, transaction details, and trading activities within cryptocurrency exchanges.
  • Highlights suspicious transfers to unregulated exchanges or mixers linked to sanctioned addresses, aiding in sanctions evasion investigations.
  • Captures all customer wallets on file with regulated platforms, including whether they meet KYC standards.
  • Helps confirm that certain external wallets remain outside custodial compliance, aligning with the 1591 indicator.
  • Captures cryptocurrency transaction logs, wallet addresses, account details, and user activities on digital asset platforms.
  • Enables tracing of crypto flows used to launder proceeds from sexual exploitation, identifying high-risk wallets and layering tactics.
  • Stores detailed logs of user registration, wallet addresses, and transaction histories within exchange or token launch platforms.
  • Provides visibility into large purchases, suspicious deposit or withdrawal patterns, and user-level behaviors for potential money laundering or fraudulent fundraising activities.
  • Provides user account information, transaction logs, and bridging activities across digital asset platforms.
  • Helps link multiple wallets or accounts under the same user engaging in cross-asset transfers.
  • Supports detection of unusual transaction volumes and rapid bridging frequently involved in transaction chaining.
T0067.005
|
|
  • Provides comprehensive records of digital asset transactions and user activities, including wallet addresses, deposit and withdrawal logs, and any available KYC checks maintained by VASPs.
  • Enables detection of suspicious utility token usage, such as high-frequency trades, multiple bridging transactions across chains, and rapid token movements with no clear legitimate purpose.
  • Supports identification of accounts lacking robust identification or repeatedly transferring large volumes of tokens that may indicate layering or illicit fund flows.

Provides detailed logs from centralized or semi-regulated cryptocurrency exchanges and other VASPs, including user account information, deposit and withdrawal records, trading histories, and KYC data. This helps link on-chain addresses to real customers when available, detect suspiciously frequent token conversions or bridging activities, and identify layering attempts across both decentralized and regulated platforms.

  • Includes user account details, wallet addresses, KYC records, trading activities, and deposit/withdrawal logs from crypto exchanges.
  • Links in-game or NFT transactions to external off-ramps, helping trace final conversion into fiat or mainstream cryptocurrencies for AML investigations.