Cryptocurrencies

• Criminals deposit illicit cryptocurrency into the custodial mixer's central wallet, pooling their funds with other users' deposits in a single operator-controlled address.
• The mixer subsequently disburses withdrawals from addresses unrelated to the original deposit, breaking the direct transaction trail and obscuring the source of funds.
• Commingling and redistributing funds in this manner hinders investigators' ability to trace or attribute suspicious activity, creating multiple transaction layers.
• Minimal or absent KYC measures allow large, rapid inflows and outflows, concealing ultimate beneficiaries and complicating financial institutions' due diligence efforts.

• In the 'Crypto ATM Mule' variant, mules convert physical cash into cryptocurrency (or vice versa), obscuring the transaction chain.
• Pseudonymous wallet setups and rapid crypto-to-fiat swaps further distance original launderers from law enforcement scrutiny.

Unlicensed MSB operators exchange illicit cash for cryptocurrencies without adhering to AML or KYC requirements. Criminals exploit this route to rapidly convert and transfer funds across borders, relying on pseudonymity and minimal transactional records to evade scrutiny.

Hot Transfer schemes can replicate informal value transfers by routing illicit funds through decentralized digital wallets. Criminals layer the funds across multiple wallet addresses and jurisdictions, making it difficult for investigators to trace the ultimate origin or beneficiary before converting them back into other assets or fiat currency.

• Criminals rapidly exchange illicit cash for cryptocurrencies (and vice versa) through informal exchange nodes operating outside regulatory scrutiny.
• These transactions often lack KYC requirements, enabling funds to move pseudonymously and obscuring their unlawful origin.
• Once converted, perpetrators can leverage cross-border transfers or layer transactions further, making it extremely difficult for authorities to trace or disrupt.

• By routing transactions through a VPN, illicit actors obscure their real network location, preventing exchanges or blockchain analytics from detecting suspicious or sanctioned jurisdictions.
• This obfuscation eases the layering process by allowing rapid transfers across multiple cryptocurrency addresses without raising location-based alerts.
• VPN-encrypted connections further complicate compliance tools designed to monitor aberrant transaction patterns tied to recognized high-risk areas.

• By routing exchange logins and transaction broadcasts through proxy servers, criminals mask their real geographic location.
• Rapid proxy switching impedes investigators' attempts to correlate multiple crypto transactions with a single origin, defeating location-based monitoring or blacklists.

• Criminals perform numerous small crypto transfers across multiple wallets or platforms, keeping each transaction below thresholds that might trigger enhanced scrutiny.
• Some exchanges have relaxed KYC for low-value transactions, allowing repeated sub-threshold deposits.
• Owing to the speed and borderless nature of crypto, illicit funds can be rapidly split, moved, and consolidated, overwhelming basic monitoring if each transaction is viewed in isolation.

• 'Cryptocurrency smurfing' involves splitting large digital currency amounts into multiple small transfers across different wallets or exchanges.
• Each low-value transaction remains below typical exchange alert triggers, concealing the overall volume of illicit assets being moved.

• After acquiring or trading in-game items or currencies, criminals transfer value into mainstream cryptocurrencies on centralized or decentralized exchanges.
• Minimal KYC or AML checks on some platforms allow them to layer funds by repeatedly converting among crypto assets and addresses.
• This cross-asset flow frustrates law enforcement attempts to trace transactions.

• Criminals leverage cryptocurrency donations to non-profits to disguise the origins of illicit funds, taking advantage of pseudonymity and global transferability.
• By routing funds through multiple wallets or mixing services before donating, they obscure the transaction trail, complicating AML efforts.
• Charities accustomed to minimal KYC for crypto donors may unknowingly integrate criminal proceeds alongside legitimate contributions.

• Remote mining produces freshly minted coins that appear unrelated to the original criminal funds.
• By using illicit proceeds to pay for mining capacity, the newly generated coins lack any direct on-chain trail connecting them to the initial illicit transactions, effectively breaking traceability.

• Adversaries submit altered or stolen identity details during exchange account registration, circumventing standard KYC procedures.
• Once verified, they convert fiat currency into cryptocurrencies, obscuring the source of illicit funds.
• By creating multiple exchange accounts under different synthetic profiles, they fragment the transaction trail and frustrate forensic tracing efforts.

• By rotating among multiple passports during account creation on exchanges, criminals minimize effective KYC checks.
• They funnel illicit funds into different exchange accounts under distinct national identities, reducing the risk of flagged consolidated activity.
• Rapid conversions between fiat and crypto across these separately verified accounts hide transactional origins and beneficiaries.

Launderers invoke bots to shuttle value through multiple wallets and exchanges, exploit 24/7 settlement to layer funds in minutes, and pivot across coins or chains to break the fiat audit trail before reconverting to clean currency.

• Offenders integrate cryptocurrency payment options into e-commerce storefronts or peer-to-peer marketplaces, enabling cross-border transactions that are more difficult to track.
• They convert illicit funds into or out of cryptocurrency through fabricated sales and refunds, leveraging decentralized networks and pseudonymous wallets to mask their illicit origins.

• Bad actors send minimal crypto amounts to or from exchanges to determine the threshold at which the platform flags a transfer.
• After identifying these triggers, they adjust future transactions to fall just below the alert criteria, exploiting the platform’s monitoring rules.

• Some campaigns and lobbying groups accept cryptocurrency donations, allowing criminals to transfer funds from anonymous or pseudonymous wallets.
• Mixing or tumbling services can further obscure the origin of digital assets before they reach political recipients, weakening any transactional audit trail.
• Rapid crypto-to-fiat conversions or direct crypto acceptance by campaigns can evade tighter AML oversight exercised by traditional banking channels.

• Traffickers convert cash or funnel-account deposits into cryptocurrencies, exploiting pseudo-anonymity and rapid cross-border transfers.
• By moving funds through multiple wallets and exchanges—often in different jurisdictions—they obscure payment trails.
• Online subscription platforms or P2P crypto networks further facilitate layering, reducing the likelihood of detection.

• Offenders convert proceeds into mainstream cryptocurrencies on regulated or unregulated exchanges, using fraudulent IDs or straw accounts.
• Funds are then shuffled among multiple wallets, making it challenging for authorities to distinguish legitimate from illicit flows tied to child exploitation.

• Crypto ATMs enable quick exchanges between fiat and digital assets, often with limited or lax KYC compliance.
• After illicit funds are converted into cryptocurrencies, criminals can perform multiple wallet transfers or repeatedly use various ATMs to layer and obscure the origins.
• The pseudonymous nature of blockchain transactions makes it challenging to identify the real parties behind suspicious flows, thereby hindering investigative efforts.

When gaming platforms or third-party brokers allow blockchain-based asset transfers, criminals exchange in-game assets or account proceeds for cryptocurrencies.

• These cryptocurrencies can be routed through multiple digital wallets, traded for other tokens, or moved across decentralized exchanges to mask the trail.
• Cross-platform interoperability tools enable shifting between game tokens and general-purpose cryptocurrencies, complicating AML efforts and making it harder to link funds back to their origin.

• Criminals deposit illicit cryptocurrency into minimally regulated gaming exchanges or in-game marketplaces that accept crypto.
• These deposits are presented as routine gaming-related funding, bypassing stricter identity controls.
• Eventually, criminals convert the in-game balance back into cryptocurrencies, further masking the audit trail through layered transfers between crypto and gaming wallets.

• Criminals register accounts on virtual asset platforms using stolen or synthetic identities, undermining AML/KYC controls.
• They trade or convert digital currencies while posing as legitimate account holders, obscuring the real ownership and origin of funds.
• Investigators encounter difficulty linking the transactions to the true perpetrators because the exchange accounts appear validly registered.

Offenders create exchange or custodial wallet accounts remotely by uploading forged ID documents or synthetic data. Automated KYC systems can be repeatedly manipulated by making slight alterations to identity details while using the same hardware or IP address. Once onboarded under false profiles, they trade or transfer illicit funds in and out of cryptocurrencies, complicating efforts to trace beneficial owners and maintain accurate transaction records.

• Criminals divert funds from compromised accounts into cryptocurrency exchanges or wallets.
• Rapidly converting fiat to digital assets and moving them across multiple wallet addresses hinders tracing and frustrates investigators.
• The remote-access nature of many exchanges permits these transfers to occur quickly with minimal direct oversight.

• Once chargeback refunds are approved, criminals direct these funds through decentralized exchanges, converting them into digital assets.
• This transfer obfuscates the audit trail, as cryptocurrency transactions intermix chargeback proceeds with legitimate crypto flows.
• Decentralized platforms reduce transparency around ownership, making it more difficult to trace the laundered funds back to the original fraudulent disputes.

• Criminals feed counterfeit bills into cryptocurrency ATMs that lack robust banknote authentication.
• They rapidly convert fake notes into digital currency, making it harder to trace original transactions once funds enter a blockchain environment.
• Minimal KYC or AML checks at some crypto ATMs enable criminals to exploit this route for laundering forged money.

• Criminals use multiple exchange accounts or pseudonymous wallets they control to execute coordinated buy/sell orders on the same cryptocurrency.
• This repeated self-dealing artificially boosts market volume and can manipulate asset prices, allowing illicit funds to be disguised as legitimate trading profits when withdrawn.
• The pseudonymous nature of crypto transactions and inconsistent KYC requirements facilitate rapid wash trading cycles that obscure the original illicit flow of funds.

• Infiltrated banks can facilitate high-volume crypto-to-fiat transactions while suppressing or falsifying AML checks.
• Corrupted insiders override controls, allowing illicit crypto earnings to be quietly integrated into the bank’s customer accounts.
• This creates a seamless blending of illegal proceeds with legitimate funds, making it harder for external regulators to detect suspicious activity.

• Criminals quickly convert fiat funds into cryptocurrencies through online exchanges or peer-to-peer platforms, then move between various crypto assets to disguise the trail.
• These cross-currency conversions are presented as routine crypto trades or speculative activity, allowing criminals to ‘layer’ funds across multiple blockchains.
• Less regulated exchanges or smaller transaction sizes further complicate AML controls, making it harder to link back to the original illicit source.

• Criminals exploit the pseudo-anonymous nature and global reach of cryptocurrencies to move funds rapidly across borders without relying on conventional financial institutions.
• They convert illicit fiat currency into crypto on lightly regulated exchanges, then transfer it to multiple wallets to further camouflage the money trail.
• Minimal transparency in transactions, especially on platforms with weak KYC, undermines standard AML efforts and enables the swift layering of tainted funds.

• By providing counterfeit or altered identity documents to cryptocurrency exchanges' remote KYC processes, criminals obtain accounts without accurate identifying information.
• This grants them the ability to deposit, trade, and withdraw virtual assets with reduced risk of detection, masking beneficial ownership and the source of funds.
• Repeated submissions of slightly modified credentials enable ongoing circumvention of automated verification systems.

• Illicit actors exploit the decentralization of common cryptocurrencies (e.g., Bitcoin, Ethereum) to move funds across borders without relying on traditional banks.
• By transacting through unregulated exchanges, criminals circumvent the rigorous screening that might flag sanctioned wallets or addresses.
• This decentralized framework reduces the visibility of underlying participants, enabling sanctioned entities to transfer or convert funds covertly.

• Criminals convert drug proceeds into popular cryptocurrencies (e.g., Bitcoin, Ethereum) through over-the-counter brokers or exchanges with lax KYC.
• The pseudo-anonymous nature of blockchain addresses enables layering, as funds can be rapidly transferred among multiple wallets or converted back into fiat in different jurisdictions.
• This cross-border fluidity and partial anonymity make blockchain transactions attractive for obscuring the origins of drug money.

• Criminals convert revenue from counterfeit pharmaceutical sales into cryptocurrencies using peer-to-peer exchanges with minimal KYC requirements.
• Funds can be moved quickly across different wallets or swapped into various tokens, creating a complex transaction trail that frustrates investigators seeking to trace the original illicit proceeds.

• Pirates convert ransom proceeds into cryptocurrencies to leverage pseudonymous wallet structures.
• These digital assets can then be moved rapidly across borders or through decentralized exchanges, reducing transparency and complicating law enforcement efforts to track final beneficiaries.