Red flags
The Europol Financial Intelligence Public Private Partnership (EFIPPP) is the first international information sharing mechanism in the fight against money laundering, terrorist financing and economic crime. Within this partnership, financial institutions and investigative agencies, among others, exchange information on observed money laundering phenomena.
On the Europol Platform for Experts (EPE), the EFIPPP published a document with red flags. In other words: indicators in the field of virtual currency that may indicate money laundering. The EPE is a platform for specialists in different areas of law enforcement. Some of the indicators will be explained in more detail below. The EFIPPP emphasizes that the list of indicators is not exhaustive.
The following two KYC indicators of potential money laundering activities are distinguished by EFIPPP:
- Inconsistent statements about the source of funds used for transactions and purchase of crypto assets.
- A client is affected on e.g. open source forums or other sites that link the client to darknet markets.
In the remainder of this article, we will discuss these indicators and how to recognize them in practice.
Paying high commissions
A key transaction indicator is the payment of and/or willingness to pay high commissions for converting (selling) virtual assets in exchange for fiat money. Based on transactions alone, it is impossible to determine whether the commission paid was too high.
In practice
Combine the price information regarding the used currency exchange with the value of the commission paid. In this way, you can determine whether the commission was high and therefore whether there is an indicator of money laundering.
Sending or receiving large amounts of money to or from a cryptocurrency platform
Sending and receiving large amounts of money to or from a cryptocurrency platform can also be a red flag. What exactly ‘large amounts’ are, depends on several factors.
In practice
The interpretation of this indicator can vary greatly from one financial institution to another. For example, the type of products and services offered and the customer segments the institution focuses on play a role. It is important that the financial institution has a complete and up-to-date customer profile that can be used to determine whether a transaction is ‘large’ or not.
Smurfing techniques to split and deposit funds
An equally common indicator is called ‘smurfing’. This involves a technique of splitting and depositing funds into a large number of bank accounts with funds that are eventually used to purchase cryptocurrency from private sellers located in different countries.
Smurfing is quite difficult to detect in practice. The technique ensures that the transactions remain below the reporting limit of the financial institution. Together, these transactions make up a high, reportable amount. Partially, however, they remain below the limit. Therefore, smurfing requires the use of many different accounts. In the name of different people (‘smurfs’) and at different banks. And, in the case of professional money launderers, also in different countries. This usually takes place in the first phase of the money laundering process (placement).
In practice
In practice, you can detect smurfing by identifying a relatively high volume of transactions for relatively low amounts to the same beneficiary. Another red flag is when a client has multiple accounts where the same pattern can be recognized. For example, there may be several accounts in the name of one person, or a number of related persons (family members), that are used for money laundering purposes. Due to inadequate customer due diligence, the necessary links are not identified and the transaction patterns are not detected, thus allowing the laundering to go unnoticed. Today, with a partnership such as TMNL, it has become easier for large Dutch banks to gain insight into these types of practices.
Multiple quick transactions between several crypto exchange platforms
Another indicator is when multiple transactions are performed in quick succession between different crypto exchange platforms, without a clear link between them. Such transactions may indicate attempts to break the ‘chain of custody’ around the respective blockchains. The chain of custody refers to the chronological paper trail that documents how and by whom individual items of physical or electronic evidence were collected and analyzed.
In practice
A key indicator is the use of a relatively large number of different crypto exchange platforms. Not all platforms offer all types of crypto. However, most of the time, using a few large platforms such as Binance, KuCoin and Coinbase will be sufficient. Together they cover the vast majority of cryptocurrencies. If it does turn out that a customer is depositing and receiving funds to and from 10 to 15 different platforms, this could indicate money laundering.
Unexplainable crypto assets
Finally, the last indicator. Here, the amount of crypto assets purchased is not economically or financially explainable, given the average use by the client. The client has unexpectedly made a larger transaction than was previously the case.
In practice
You can approach this indicator from two angles. On the one hand, it is striking if the client suddenly starts buying large amounts of crypto while this does not quite fit the profile that the institution has of this client (assets, etc.).
On the other hand, funds (often relatively high amounts or a high volume of small amounts) can be deposited into an account from a crypto platform. The client could then argue that these are returns, obtained from previous investments in cryptos. Because cryptocurrencies are highly volatile, an investment in cryptocurrencies may yield a lot of money in a short period of time. However, proof of this should always be requested as part of the investigation into the origin of the funds. This can be done very easily on the crypto platform. A crypto account can easily be supplemented with transfers of cryptos from other platforms. It is therefore important to request such an overview. This shows what has been contributed and how the assets have grown.
Darknet
To transfer funds to and from darknet marketplaces, cryptocurrency is often used. The following indicators can provide insight and help identify when funds are sent and/or received directly or indirectly from a darknet wallet address:
- A user often receives funds from, or sends funds to, darknet wallets that accumulate to large values;
- A significant percentage of a user’s deposits to an exchange come from darknet marketplaces;
- A significant percentage of a user’s withdrawals from an exchange result in transactions with darknet marketplaces.
Want to know more?
Charco & Dique supports financial institutions in the battle against financial-economic crime. We help you to comply with the Wwft, for example by setting up an effective client onboarding or transaction monitoring process, or by performing an integrity risk analysis.
We also offer various training courses in this area through our training institute, The Ministry of Compliance. From a Wwft Awareness e-learning to in-depth trainings in the field of transaction monitoring and customer investigation. Want to know more about the possibilities? Please do not hesitate to get in touch.
Get in touch