Over-the-Counter Cryptocurrency Trading

Over-the-counter (OTC) cryptocurrency trading involves arranging large-volume trades through private brokerage channels rather than using public exchange order books. Criminals exploit this mechanism to bypass transparent price and volume reporting, thereby amplifying anonymity and defeating standard exchange-based tracking. In many documented cases, they physically deliver large amounts of cash to OTC desks that apply minimal customer due diligence, enabling rapid acquisition or liquidation of cryptocurrency with little paperwork. Some criminal networks systematically convert bulk cash into digital assets this way, further obfuscating audit trails. Repeated conversions through multiple OTC channels add complexity, masking both fund origin and ultimate beneficiaries. In regions such as Southeast Asia, extensive OTC and peer-to-peer markets are routinely misused by organized crime and sanctioned entities to circumvent formal financial controls. Research confirms a significant share of illicit Bitcoin transactions flow through OTC brokers providing limited or no KYC procedures, making such brokers key facilitators in laundering schemes. In some investigations, OTC trades also intersect with casino junket practices or underground banking networks, creating additional layers of anonymity and helping criminals evade detection.

[
Code
T0114
]
[
Name
Over-the-Counter Cryptocurrency Trading
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Channel Risk, Jurisdictional Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

OTC Cryptocurrency Trading

Tactics

ML.TA0007
|
|

Criminals use OTC desks to repeatedly convert and transfer illicit funds into various cryptocurrencies or accounts, explicitly aiming to mask the origin and beneficiaries. The private, minimally regulated nature of many OTC channels adds transactional complexity and frustrates investigators' ability to trace funds.

Risks

RS0003
|
Channel Risk
|

Criminals exploit OTC desks' private, off-exchange brokerage channels—often with minimal KYC—to rapidly place and layer illicit funds, bypassing the transparent monitoring of regulated cryptocurrency exchanges. The non-face-to-face or physically delivered cash arrangements undermine standard AML tracking, making channel exploitation the primary vulnerability.

RS0004
|
Jurisdictional Risk
|

Many OTC brokers operate in or cater to jurisdictions with limited AML/CFT oversight, enabling criminals to exploit weaker standards and cross-border anonymity. By situating trades where regulatory scrutiny is lax, illicit actors further undermine enforcement and obscure transaction trails.

Indicators

IND00790
|

Multiple high-value cryptocurrency-to-fiat trades executed exclusively through OTC desks that do not provide public order book data.

IND01741
|

OTC brokerage registered in a jurisdiction with limited AML/CFT regulations but handling frequent large cross-border trades for overseas clients.

IND01743
|

Customer repeatedly bypasses mainstream exchanges with robust KYC in favor of OTC channels known for weaker identity verification requirements.

IND01744
|

Significant cryptocurrency deposits from multiple external wallets aggregated into a single OTC trade without any clear business rationale.

IND01745
|

Multiple unrelated entities using the same OTC broker for large-volume trades despite having no apparent common ownership or economic links.

IND01747
|

Frequent physical deliveries or pickups of large volumes of cash at an OTC brokerage with minimal or no supporting documentation, inconsistent with the customer’s stated profile.

Data Sources

Contains risk ratings and regulatory information by country or region. Reviewing this data helps identify OTC brokers operating in high-risk or weakly regulated jurisdictions, aligning with known hotspots for unregulated cryptocurrency trading.

Official compilations of entities under economic or financial restrictions are essential tools. By screening OTC brokers and their customers against these lists, investigators can identify sanctioned or politically exposed individuals who may be exploiting OTC services to bypass regulated channels.

Provides comprehensive records of incoming and outgoing transactions across financial accounts, including timestamps, amounts, counterparties, and account identifiers. By isolating large or repeated OTC-related inflows and outflows, investigators can spot patterns indicative of cash-to-crypto conversions that avoid regulated exchanges.

Contains logs of digital asset transactions, including wallet addresses, timestamps, amounts, and user account details. By comparing these records with fiat transaction logs, investigators can identify large or repeated cryptocurrency trades conducted via OTC desks with minimal KYC. This helps detect unregulated laundering channels and trace the flow of funds.

Contains verified identities, ownership details, and risk profiles of clients. Reviewing these records for parties transacting through OTC desks reveals whether minimal or no due diligence was performed, highlighting potential laundering risks.

Details gambling-related transactions, including deposit, withdrawal, and betting activity. When cross-analyzed with OTC trading data, these records help uncover overlapping cash-based or chip redemption behaviors that intersect with OTC conversions, adding additional layers of anonymity.

Encompasses on-chain transaction details, including wallet addresses, transaction IDs, timestamps, and amounts. Comparing these data with institution-held fiat transaction logs uncovers OTC trades that consolidate large sums of cryptocurrency without passing through regulated exchange order books.

Captures cross-border payments, including settlement details, involved institutions, and participating jurisdictions. This data assists in detecting significant inbound or outbound transfers routed through OTC brokers, potentially indicating unregulated international flows.

Provides official company registration and shareholder records to identify the true owners and controllers of OTC brokerages. This data helps confirm whether such entities are legally registered or if they exploit opaque structures to evade AML controls.

Mitigations

For customers or counterparties engaging in large or repeated OTC cryptocurrency trades, require in-depth verification of the source of funds, the purpose of transactions, and all beneficial owners. Obtain additional supporting documentation, such as detailed business or personal references and financial statements, explaining why OTC channels are used over regulated exchanges. Confirm the legitimacy of introduced cash through reliable third-party records and maintain ongoing reviews to detect any changes in risk profile. This addresses the anonymity gap exploited by OTC brokers with minimal KYC procedures.

Implement specific transaction surveillance rules for OTC activity, flagging unusual trading volumes or patterns that deviate from standard or declared customer profiles (e.g., recurrent or structured high-value purchases, rapid in-and-out conversions). Trigger investigative alerts for accelerated review when multiple OTC desks or brokers are used consecutively without clear economic justification. This directly mitigates layering attempts that exploit OTC anonymity.

Conduct periodic in-depth assessments of the AML controls and licensing status of any OTC brokers that handle your institution’s transactions. If brokers fail to meet minimum AML/CFT standards, such as lacking mandatory identity checks or operating in lax regulatory environments, restrict or sever ties. This measure targets the risk of unregulated OTC channels enabling anonymity and minimal oversight.

Systematically record and report large physical cash movements connected to OTC trades, following applicable threshold-based or suspicious transaction filing requirements. Include details of the counterparties, any structuring attempts, and the nature of the OTC transaction. This addresses the vulnerability of bulk cash deliveries going unreported when bypassing regulated exchange systems.

Use blockchain analytics to trace and analyze cryptocurrency flows originating from or passing through OTC trades. Specifically, examine addresses or transaction patterns known to be associated with mixers or dark web marketplaces. Identify rapid layering between multiple wallets or cross-border hops that suggest an attempt to mask origins, ensuring suspicious OTC-related transactions are escalated for investigation.

Provide focused training for financial institution employees who interact with OTC desks or review OTC-related transaction flows. Emphasize red flags such as inconsistent customer disclosures, unexplained preference for cash transactions over regulated exchanges, repetitive high-value deals with no valid business rationale, and the use of multiple brokers to complicate audit trails. This approach helps staff identify and escalate suspicious OTC activities.

Instruments

  • OTC brokers exchange illicit cash for cryptocurrencies like Bitcoin off-exchange, preventing the public recording of trade volume or customer data.
  • Repeated use of multiple OTC channels compounds layering, making blockchain analysis more challenging and further obscuring the origins and beneficiaries of funds.
IN0051
|
|
  • Criminals physically deliver large volumes of cash to OTC brokers who provide minimal or no KYC, allowing direct placement of illicit funds.
  • By bypassing traditional banking channels and their accompanying documentation, these large cash transactions occur with reduced scrutiny, concealing the original source of the funds.

Service & Products

  • Facilitate private, large-volume trades outside of exchange order books, enabling criminals to bypass transparent reporting and standard AML monitoring.
  • Allow physical delivery of bulk cash to OTC desks that perform minimal KYC, rapidly converting cash into cryptocurrency and obscuring the origin of funds.
  • Repeated use of multiple OTC channels creates complex layering structures, complicating investigations and concealing beneficiaries.
  • Enable direct user-to-user crypto trades without a centralized intermediary, often providing minimal identity verification or transaction monitoring.
  • Criminals exploit these platforms to rapidly transact large volumes of cryptocurrency across multiple accounts, further obscuring audit trails.
  • Commonly utilized in regions with limited AML enforcement, facilitating cross-border operations and complicating investigations.

Actors

Organized crime groups exploit OTC and peer-to-peer cryptocurrency trading to:

  • Convert bulk illicit proceeds into digital currencies without attracting attention from regulated exchanges.
  • Conduct repeated layering steps through multiple OTC brokers, hindering investigators’ ability to trace funds.
  • Leverage cash deliveries to facilitate rapid transactions and maintain anonymity, challenging financial institutions’ detection efforts.

Sanctioned entities or individuals utilize OTC and peer-to-peer trading to:

  • Circumvent formal financial controls that would normally flag or block their transactions.
  • Shift funds across borders surreptitiously, defying sanctions screening by regulated institutions.
  • Disguise the provenance of assets through repeated conversions, exploiting limited KYC or weak oversight in certain OTC markets.

Peer-to-peer exchange operators enable direct user-to-user cryptocurrency transactions by:

  • Offering markets with minimal identity verification, allowing criminals to move funds quickly across multiple accounts.
  • Operating informally or across decentralized platforms, making it difficult for financial institutions to trace and monitor transaction flows.
  • Providing an alternative to regulated exchanges, further obscuring beneficial ownership and audit trails.

Informal value transfer system operators (underground banking networks) collaborate with OTC desks to:

  • Transfer funds outside regulated banking channels, reducing traceability for financial institutions.
  • Add another layer of anonymity in the money flow, integrating ill-gotten gains into legitimate financial systems.
  • Support cross-border laundering by moving cash or cryptocurrency without triggering conventional transaction alerts.

OTC desks operating as virtual asset service providers enable criminals and sanctioned entities to rapidly convert bulk cash into cryptocurrency by:

  • Accepting large volumes of cash with minimal or no due diligence, bypassing standard exchange-based KYC.
  • Facilitating large off-exchange trades that evade transparent order book reporting, undermining financial institutions' monitoring.
  • Creating multiple layers of transfers across various OTC brokers, obscuring the origin of funds and ultimate beneficiaries.

Junket operators intersect with OTC trades by:

  • Coordinating high-value clientele who move cash between casinos and crypto brokers, adding layers of transactional secrecy.
  • Combining casino-based funds with cryptocurrency conversions, obscuring the original ownership or source.
  • Further complicating due diligence for financial institutions investigating large and rapid money flows.

References

  1. Asia/Pacific Group on Money Laundering. (2022, July). APG Yearly Typologies Report 2022. APG Secretariat. https://apgml.org/methods-and-trends/documents/

  2. Joint Financial Intelligence Unit. (2023). Joint Financial Intelligence Unit Annual Report 2023. Joint Financial Intelligence Unit. https://www.jfiu.gov.hk/en/jfiu_publications.html

  3. Carlisle, D., Izenman, K. (2019, April). Closing the crypto gap: Guidance for countering North Korean cryptocurrency activity in Southeast Asia. Royal United Services Institute for Defence and Security Studies. https://www.rusi.org/explore-our-research/publications/occasional-papers/closing-crypto-gap-guidance-countering-north-korean-cryptocurrency-activity-southeast-asia

  4. Teichmann, F. M. J., Falker, M.C. (2020). Cryptocurrencies and financial crime: Solutions from Liechtenstein. Journal of Money Laundering Control, Vol. 24 No. 4, pp. 775-788. https://doi.org/10.1108/JMLC-05-2020-0060

  5. Owen, A., Seshadri, C. (2024). North Korean activity in the casino and gaming sector: How do jurisdictions respond?. Royal United Services Institute for Defence and Security Studies. https://www.rusi.org/explore-our-research/publications/emerging-insights/north-korean-activity-casino-and-gaming-sector-how-do-jurisdictions-respond