By transacting in utility tokens or decentralized application tokens with limited AML oversight, criminals obscure the true flow of illicit funds across multiple accounts or blockchains. High-speed transfers, easy cross-border access, and anonymity-friendly features make it challenging for investigators to link transactions back to underlying criminal proceeds. Although many tokens serve legitimate purposes (platform access, rewards, or governance), adversaries exploit the fragmented global regulatory landscape to shuffle funds, frustrating law enforcement efforts. In some jurisdictions, utility tokens are not classified as payment tokens and thus fall partially outside AML coverage, further increasing vulnerability to misuse. Criminals also exploit DeFi protocols powered by these tokens, repeatedly swapping or bridging them across chains to create additional transactional layers that hinder traceability and complicate investigations.
Utility Tokens
Tactics
Criminals exploit utility tokens by repeatedly swapping or bridging them across multiple blockchains. This creates additional transactional layers that obscure the origins of illicit funds and complicate investigative traceability.
Risks
Criminals exploit the inherent features and partial AML coverage of utility tokens—especially their anonymity-friendly design, cross-chain bridging capabilities, and minimal oversight in many decentralized ecosystems—to layer illicit funds. By repeatedly swapping or bridging these tokens, offenders obscure ownership and transactional records, taking advantage of the product’s lack of clear regulatory classification to hinder investigations.
Because certain jurisdictions do not classify utility tokens under full AML scrutiny, criminals engage in regulatory arbitrage by operating in or routing funds through regions with weaker or no oversight. This further conceals illicit asset origins and hinders law enforcement efforts.
Indicators
High frequency of utility token transactions on decentralized exchanges lacking strict KYC measures, indicating exploitation of anonymity.
Unusually high trading volumes of utility tokens across multiple trading platforms without an apparent economic purpose or commercial justification.
Frequent cross-chain transfers of utility tokens, moving tokens rapidly among different blockchain networks, indicating attempts to obscure fund origins or transaction trails.
Rapid and repetitive swapping of utility tokens on decentralized exchanges with minimal price variation, indicating possible wash trading or deliberate obfuscation.
Engagement in utility token transactions by clients with minimal or anonymous KYC information, lacking verifiable identity documentation.
Creation and use of multiple new wallet addresses for utility token transactions, particularly when these wallets lack historical activity or identifiable owners.
A circular pattern of token movements, such as round-trip transfers among multiple wallets, lacking any legitimate economic purpose, often associated with layering or integration of illicit funds.
High-volume utility token transfers with no use of the token’s platform features or functionality, suggesting purely transactional layering rather than legitimate utility usage.
Data Sources
- Provides comprehensive records of digital asset transactions and user activities, including wallet addresses, deposit and withdrawal logs, and any available KYC checks maintained by VASPs.
- Enables detection of suspicious utility token usage, such as high-frequency trades, multiple bridging transactions across chains, and rapid token movements with no clear legitimate purpose.
- Supports identification of accounts lacking robust identification or repeatedly transferring large volumes of tokens that may indicate layering or illicit fund flows.
- Contains verified customer identity information, beneficial ownership details, and account relationships.
- Helps detect minimal or anonymous KYC scenarios, flagging individuals or entities engaged in utility token transactions without verifiable identities.
- Facilitates correlation of on-chain or exchange data with real-world customer profiles, exposing potential use of multiple new wallets lacking proper KYC documentation.
- Provides on-chain transaction details (e.g., sender/receiver addresses, timestamps, transaction IDs, token types) across multiple blockchains.
- Enables tracing of frequent cross-chain transfers, bridging activities, and repetitive swapping of utility tokens, revealing potential layering or obfuscation methods.
- Identifies cyclical or high-volume token movements unconnected to the token’s intended platform use, suggesting questionable fund flows for AML investigations.
- Captures trade volumes, timestamps, counterparties, and order details associated with token transactions on regulated or semi-regulated exchanges.
- Enables detection of high-frequency or repetitive utility token trades lacking economic rationale or tied to cross-exchange arbitrage without valid commercial purpose.
- Helps identify potential wash trading or round-trip layering by analyzing trade patterns, price variations, and rapid buy-sell sequences.
Mitigations
Apply rigorous checks for clients engaged in significant utility token activity, including verifying the purpose of DeFi usage, identifying the ultimate wallet owners, and scrutinizing cross-chain bridging histories. By uncovering potential high-risk layering activity, institutions can more effectively mitigate attempts to conceal illicit proceeds in utility token ecosystems.
Set targeted rule sets for utility token transactions, generating real-time alerts for suspicious patterns such as rapid token swaps, cross-border bridging without a clear purpose, or repeated small transactions designed to circumvent thresholds. By analyzing transaction velocity, volumes, and correlation with known adversarial addresses, institutions can detect layering attempts unique to utility tokens.
Implement specialized analytics tools to trace cross-chain bridging, repeated token swaps, and high-velocity utility token movements across multiple blockchains. Investigate wallet addresses frequently involved in short-interval transfers or connected to known illicit activities. By leveraging on-chain data from multiple networks, institutions can detect layering attempts aimed at obscuring fund origins.
Leverage public block explorers, watchlists, and specialized negative media checks to uncover suspicious wallet addresses, known layering patterns, or illicit projects harnessing utility tokens. Verify claims of legitimate token usage by consulting external data sources and identifying unregistered or fraudulent platforms used to disguise illicit flows.
Deny or limit access to high-risk DeFi protocols or unregulated cross-chain bridging platforms that lack robust AML/KYC controls. For utility tokens primarily traded for anonymous layering, impose transaction limits, require additional approvals, or enforce usage bans to obstruct illicit fund movements.
Continuously reassess customer utility token activity to identify sudden increases in volume, cross-chain transfers, or repetitive short-interval trades that are inconsistent with stated usage. By regularly updating risk profiles and investigating anomalies, institutions can promptly detect and escalate emerging layering risks specific to utility tokens.
Instruments
- Criminals exploit the inconsistent AML coverage of utility tokens to place illicit proceeds on-chain with minimal scrutiny.
- They obscure fund origins by repeatedly swapping or bridging these tokens across multiple blockchains, creating layered transactions that complicate tracing.
- DeFi protocols powered by utility tokens allow near-instant conversions and cross-border movements, hindering investigators' ability to track beneficial ownership.
- In certain jurisdictions, utility tokens are not regulated as payment tokens, reducing required customer due diligence and enabling criminals to circumvent reporting obligations for illicit transfers.
Service & Products
- Criminals exploit automated lending, staking, and swapping protocols powered by utility tokens, layering illicit proceeds repeatedly without centralized oversight.
- Liquidity pools and smart contracts allow rapid, algorithmic transactions that obscure beneficial ownership and complicate regulatory reporting.
- Criminals exploit minimal KYC requirements to trade utility tokens directly between unknown parties, often using escrow features that enable near-anonymous transfers.
- Through frequent P2P trades, they fragment the transaction chain, making it difficult for investigators to follow the flow of illicit funds.
- Rapid token conversions and one-off swap transactions enable criminals to repeatedly shift utility tokens into different cryptocurrencies, complicating chain analysis.
- Near-instant settlement across different blockchains significantly reduces the time investigators have to track or freeze suspicious funds.
- Criminals deposit or withdraw utility tokens under partial or inconsistent KYC measures, making it difficult to trace the original fund source.
- They convert illicit proceeds into a variety of tokens or fiat currencies, creating multiple transaction layers that obscure the money trail across jurisdictions.
- Criminals use bridging services to transfer utility tokens and related assets across multiple blockchain networks, complicating transaction monitoring.
- By rapidly moving tokens among several chains, they generate overlapping transaction records, creating further layers and hindering forensic tracing.
Actors
They use utility tokens to:
- Move and layer illicit proceeds across multiple blockchain networks.
- Exploit partial or inconsistent KYC requirements, obscuring the source and ownership of funds.
Through frequent swaps or cross-chain transfers, they reduce traceability and frustrate financial institutions’ efforts to identify criminal proceeds.
They provide various platforms—centralized exchanges, peer-to-peer trading, cross-chain bridging, decentralized finance protocols, and instant swap services—that criminals exploit to layer funds. Inconsistent or limited KYC measures allow:
- Rapid deposits, withdrawals, and token conversions without clear customer identification.
- Complex multi-chain transactions that obscure beneficial ownership and bypass conventional monitoring.
These features hinder financial institutions' ability to track and freeze illicit funds effectively.
References
Akartuna, E. A., Johnson, S.D.,Thornton, A.E. (2022, September). The money laundering and terrorist financing risks of new and disruptive technologies: a futures-oriented scoping review. Springer Nature. https://link.springer.com/article/10.1057/s41284-022-00356-z
CGMF (Interdepartmental coordinating group on combating money laundering and the financing of terrorism) Switzerland. (2024). National Risk Assessment (NRA): Risk of money laundering and the financing of terrorism through crypto assets. CGMF. Switzerland. https://www.newsd.admin.ch/newsd/message/attachments/86329.pdf