jakiro
Author: Zhang Feng
As the anonymity, global circulation and decentralization of cryptocurrency are widely recognized, it has become the “new favorite” of money laundering crimes.From the early “Silk Road” darknet market to today’s use of decentralized financial protocols for complex on-chain transfers, money laundering methods are constantly being renovated, posing a severe challenge to global financial security.
Against this background, regulatory agencies in various countries are using unprecedented intensity to require cryptocurrency trading platforms, custodians and other virtual asset service providers to fulfill strict anti-money laundering obligations.
1. Legal framework and regulatory requirements
Globally, the FATF Recommendations issued by the Financial Action Task Force on Anti-Money Laundering are the authoritative international standards for anti-money laundering and counter-terrorist financing.It clearly includes virtual asset service providers under supervision and requires them to implement the “travel rule”, that is, for the transfer of virtual assets exceeding a certain amount (usually 1,000 US dollars/euro), the information of the originator and the recipient needs to be collected and transmitted.
In China, laws are tough on money laundering using cryptocurrencies.Article 191 of the Criminal Law stipulates the crime of money laundering, and clearly defines “transferring funds through transfer or other payment and settlement methods” and “cross-border transfer of assets” as money laundering methods, fully covering cryptocurrency-related operations.Although the operation of cryptocurrency trading platforms has been banned in China, law enforcement agencies still exercise long-arm jurisdiction and severely crack down on platforms that operate overseas but serve Chinese users, as well as “underground banks” that provide services for outbound funds, in accordance with relevant laws.
The European Union’s “Crypto-Asset Market Regulation” (MiCA) and the United States’ “Bank Secrecy Act” have set forth clear registration, licensing and anti-money laundering obligations for VASPs.Therefore, no matter where the platform is located, fulfilling anti-money laundering obligations is no longer a multiple-choice question, but a must-answer question for survival and development.
2. Analysis of top ten typical cases at home and abroad and reflection on platform obligations
Case 1: PlusToken pyramid scheme money laundering case
Brief introduction to the case:This is a typical case of combining “capital disk” and money laundering.PlusToken uses high returns as bait, with a development level of more than 2 million, involving a total digital currency value of more than 40 billion yuan.After the incident, the criminal gang converted huge amounts of assets between different addresses and currencies through intensive on-chain transactions, and finally cashed out through domestic and foreign exchanges.
Money laundering techniques:“Broken into parts”, “On-chain confusion”, “Cross-exchange withdrawals”.They dispersed huge amounts of funds to thousands of addresses, took advantage of the anonymity of Bitcoin, Ethereum, etc. to conduct multiple transfers, and finally sold them in batches on exchanges with looser supervision and converted them into legal tender.
Reflections and suggestions on platform obligations: First, strengthen the identification and monitoring of high-risk businesses;The platform must establish an effective transaction monitoring system to automatically alert for frequent, small-amount currency deposits and withdrawals (in line with the characteristics of “structured transactions”) within a short period of time from the same source or associated addresses; the second isStrictly enforce the “travel rules”,Although this case mainly occurred before the FATG Recommendations were widely implemented, it highlights the importance of information traceability.The platform must collect and verify identity information such as user names and addresses for transactions that exceed the threshold to ensure that the flow of funds can be traced.
Case 2: Using “Benchmark Platform” and USDT Money Laundering Case
Brief introduction to the case:Criminal gangs such as telecommunications fraud and online gambling recruit a large number of “code merchants”, let them use their own bank accounts or Alipay to collect payments, and then instruct the “code merchants” to purchase an equal amount of USDT on the cryptocurrency platform, and then transfer it to the wallet address designated by the criminal gang.In this way, criminal funds are “seamlessly” transferred from the traditional banking system to the cryptocurrency system.
Money laundering techniques:“Legal currency-stable currency” conversion uses the stable price characteristics of USDT as a value medium to “launder” the stolen money.
platformobligationReflections and suggestions: First, deepen the legal currency channelCustomer due diligence,When platforms provide fiat currency exchange and cryptocurrency services, they cannot just be satisfied with online KYC.Users who frequently make currency purchases of “small amounts, multiple transactions, and with many counterparties” should be regarded as high-risk customers and should undergo enhanced due diligence to verify the legality of their fund sources; secondly,Establish abnormal behavior models,The system should be able to identify transaction patterns that are clearly inconsistent with the user’s declared occupation and income level. For example, an ordinary office worker conducts dozens of legal currency transactions with different people every day.
Case 3: An underground bank’s use of Bitcoin to cross-border blackmail
Brief introduction to the case:Domestic customers transfer RMB to the underground bank’s domestic account, and the underground bank instructs its overseas partners to pay the equivalent value of foreign currency (or cryptocurrency) to the overseas account designated by the customer.In this process, Bitcoin serves as the unit of account for balancing domestic and foreign capital pools. There is no physical cross-border capital flow, but the actual cross-border transfer of funds is completed.
Money laundering techniques:“Counter-knock” uses cryptocurrency as a value measure and settlement tool to circumvent foreign exchange controls.
Reflections and suggestions on platform obligations: First, strengthen regional risk monitoring,Platforms should identify and monitor transactions involving countries on the jurisdiction’s embargo list and high-risk areas.Accounts that frequently engage in “buying all and selling all” between two specific jurisdictions and where the user’s IP address does not match the transaction behavior should be focused on review; secondly,Risk assessment from a global perspective,Single-platform trading cannot be viewed in isolation.Platforms should actively participate in industry information sharing (within the scope permitted by law) and identify knock-on trading patterns from a global perspective.
Case 4: Using cross-border e-commerce for cryptocurrency money laundering
Brief introduction to the case:Criminal gangs set up fake cross-border e-commerce companies, forged import and export trade contracts, purchased bitcoins through domestic cryptocurrency OTC merchants and transferred them to overseas affiliated companies.After overseas companies sell Bitcoins, they pay foreign exchange to domestic companies in the name of “export payment”, thereby covering the illegal funds with the appearance of legal foreign trade.
Money laundering techniques:Trade laundering, fictitious real transactions, and fake capital flows using the cross-border convenience of cryptocurrency.
platformobligationReflections and suggestions: First, conduct a penetrating review of corporate users;For corporate users who claim to be engaged in international trade, the platform should not only verify their industrial and commercial registration information, but also review their actual trade background, such as logistics documents, customs records, etc., and be alert to situations where the transaction scale is seriously inconsistent with the size of the company; secondly,Pay attention to the risks of the OTC market,OTC merchants are the key node connecting legal currency and cryptocurrency.The platform must conduct strict access review and continuous monitoring of settled OTC merchants, and regard them as the key targets of anti-money laundering work.
Case 5: Online gambling “salary” USDT conversion case
Brief introduction to the case:The online gambling platform will switch all gamblers’ deposits, withdrawals, and “wages” and “commissions” paid to agents and employees to USDT.Gamblers recharge legal currency to buy USDT and then recharge it to the gambling platform. After winning money or getting commissions, the platform returns the USDT to the user’s wallet, and the user sells it himself.
Money laundering techniques:Encryption of the entire process isolates the entire illegal business system from the traditional financial system, greatly increasing the difficulty of investigation.
platformobligationReflections and suggestions: First, identify addresses associated with illegal businesses;Platforms should use on-chain analysis tools to mark known gambling platforms, darknet markets and other related deposit addresses.Any users associated with these addresses should be immediately marked and restricted; secondly,Behavior analysis and association mapping,Establish user behavior portraits. For a large number of users who regularly remit USDT to a centralized address and receive USDT from this address on a regular basis, the “salary” pattern should be automatically identified and alarmed.
Case 6: Bitfinex 2016 hacker attack and money laundering case (United States)
Brief introduction to the case:Hackers stole nearly 120,000 Bitcoins from Bitfinex exchange.In the following years, they laundered the money through coin mixers, decentralized exchanges, exchanging for other tokens, and creating thousands of new wallet addresses.It was not until 2022 that the U.S. Department of Justice arrested two suspects and recovered some assets.
Money laundering techniques:Use currency mixers and DeFi protocols to perform on-chain confusion and cut off the flow of funds.
Reflections and suggestions on platform obligations: First, block addresses related to coin mixers.The platform should blacklist the deposit addresses of known currency mixing services (such as ChipMixer, Wasabi Wallet, etc.), prohibit users from depositing coins from these addresses, and review the behavior of withdrawing coins to these addresses.The second isIntegrate on-chain analysis tools,The platform must purchase or build its own on-chain tracking capabilities, and use tools such as Chainalysis and Elliptic to score the “purity” of recharged funds. Funds from high-risk addresses or related to illegal activities should refuse to provide services or freeze them pending investigation.
Case 7: OneCoin Ponzi Scheme Case (Global)
Brief introduction to the case:OneCoin is known as the “Bitcoin killer”, but in fact it is a pyramid scheme without a blockchain and centralized accounting, and has made more than 4 billion euros in wealth worldwide.It moves money through a complex global network of bank accounts and cash shipments, but is also layered in part with cryptocurrencies.
Money laundering techniques:Combining traditional and new methods, using cryptocurrency as one of the multi-layered tools.
platformobligationReflections and suggestions: First, be wary of “pseudo-cryptocurrency” projects:Before listing any token, the platform should conduct sufficient due diligence to ensure its technical authenticity, team transparency and business logic rationality.We should resolutely resist “pyramid schemes” that are centralized and promise high returns; secondly,Strengthen the construction of internal compliance culture,Prevent internal employees from being bribed or colluding with criminal gangs.Conduct regular anti-money laundering training for employees and establish independent compliance reporting channels.
Case 8: Africrypt investment platform ran away with money (South Africa)
Brief introduction to the case:The founder of the cryptocurrency investment platform Africrypt lost contact after claiming to have been “hacked” and took away about 69,000 Bitcoins.They quickly converted Bitcoin into other tokens via mixers and cross-chain bridges, and used unregulated exchanges to cash out.
Money laundering techniques:Keep watch and steal, using cross-chain technology to transfer assets.
platformobligationReflections and suggestions.The first is to fulfill the monitoring obligations of DeFi and cross-chain protocols,With the popularity of cross-chain bridges, money laundering paths have become more complex.The platform needs to update monitoring rules to be able to track the transfer paths of assets between different blockchains; secondly,Establish a rapid response mechanism with law enforcement agencies,When receiving a suspicious activity report or a request for law enforcement assistance, the platform should have a standardized internal process to ensure that assets can be frozen quickly and data provided to avoid missing opportunities due to lengthy internal processes.
Case 9: Russian drug cartel used BTC to launder money
Brief introduction to the case:A Russian drug cartel sells drugs through the dark web, collects bitcoins, and hires a professional money laundering team.The team laundered the funds through exchanges such as BTC-e, which had weak anti-money laundering at the time, and eventually put the funds into the legitimate economy.
Money laundering techniques:Darknet-exchange-real economy, three typical stages of money laundering.
platformobligationReflections and suggestions.First, dark web-related addresses are listed as the highest risk.Any inflow of funds from known darknet market addresses should be considered extremely high risk.The platform should automatically trigger investigations and consider freezing relevant accounts directly; secondly,implement a risk-based approach,Based on the user’s nationality, transaction behavior, source of funds, occupation and other multi-dimensional information, users are divided into risk levels (low, medium, high), and stricter continuous monitoring and transaction limits are adopted for high-risk users.
Case 10: North Korean hacker organization Lazarus Group money laundering case (global)
Brief introduction to the case:The organization stole huge amounts of cryptocurrency through phishing, malware, etc. (for example, US$625 million was stolen from the Ronin Network cross-chain bridge), and then used a complex strategy of “on-chain jumping” to exchange, pledge and transfer through multiple DeFi protocols, and finally tried to complete money laundering through a currency mixer.
Money laundering techniques:National-level, highly complex on-chain money laundering combines hacking, DeFi, coin mixers and other means.
Reflections and suggestions on platform obligations: first, comply with sanctions regulations;The platform must incorporate international sanctions lists such as OFAC into the system and automatically intercept transactions with IP addresses, email addresses and wallet addresses related to sanctioned countries such as North Korea and Iran; secondly,Improve defense against advanced persistent threats,The platform itself can also become a target for hackers.We must invest heavily to strengthen network security to prevent it from becoming the source of money laundering crimes.At the same time, we share threat intelligence with our peers and law enforcement agencies to jointly respond to threats from national hacker groups.
3. Systematic construction of platforms to fulfill anti-money laundering obligations
Based on the above cases, for an encryption business platform to effectively fulfill its anti-money laundering obligations, it must build a multi-layered, full-process defense system.
First,Customer due diligenceIt’s the cornerstone.AuthenticationIt is not limited to names and ID cards, but should be combined with biometric technologies such as facial recognition and liveness detection to ensure “real people, real names, and real identities.”risk classification,Establish a dynamic risk assessment model to adjust the risk level in real time based on user behavior, region, transaction mode, etc.Strengthen and continue due diligence,For high-risk users, you should understand their source of funds, wealth status, and transaction purposes, and continue to pay attention to whether their trading behavior is consistent with the initial statement.
Secondly, transaction monitoring is core.Intelligent rules engine,Establish monitoring rules based on case experience, such as “structured transactions”, “quick asset transfer”, “interaction with blacklist addresses”, etc.behavioral analysis model,Introduce machine learning to analyze each user’s “normal” behavioral baseline, and immediately alert the police if there is a significant deviation (such as sudden large-amount transactions, changes in transaction objects).On-chain tracking capabilities,It must be equipped with professional on-chain analysis tools and have the ability to trace the source of funds and identify currency mixing behaviors.
Again, recording and reporting are key.Keep complete records,All KYC information, transaction records, and internal communication records must be kept for at least five years in accordance with the law.Submit suspicious transaction reports promptly,Establish an independent anti-money laundering compliance officer who should not hesitate to report any suspicious transactions to the Financial Intelligence Center.
In addition, organizations and systems are guarantees.clear anti-money laundering policy,Develop a clear and enforceable internal anti-money laundering policy and ensure that all employees are aware of and comply with it.independent compliance function,The anti-money laundering compliance department should have a high degree of independence and authority, reporting directly to the board of directors or top management.Ongoing staff training,Let front-line employees, especially customer service and operations staff, be familiar with the latest money laundering techniques and platform response strategies.
Also, technological investment and innovation are the future.Embrace regulatory technology,Actively explore the application of privacy protection technologies such as zero-knowledge proofs in the field of compliance to achieve compliance verification while protecting user privacy.Industry collaboration,Promote the establishment of an industry-wide risk address sharing library (within the legal and privacy framework) to form a joint prevention and control force.
For encryption business platforms, anti-money laundering is no longer an external regulatory pressure, but an internal requirement for its own long-term and healthy development. It is a “passport” to build market trust and win legitimate users.From PlusToken to Lazarus Group, every case is a painful lesson and a clear mirror that reflects the loopholes in the platform’s anti-money laundering defense.Only by integrating anti-money laundering obligations into the blood of corporate culture, using technology as a shield and systems as swords to build a solid, intelligent, and dynamic defense system can we steadily move forward on the balance beam of innovation and compliance and truly become a responsible and trustworthy participant in the future financial ecosystem.The road is as high as the devil, and the fight against money laundering crimes is always on the road.
4. Anti-money laundering risk management of licensed exchanges
As a licensed exchange, we faceLegal compliance, anti-money laundering regulatory requirements, technology and security, market and operations, assets and management, strategy, public relations processingand other risks.As discussed in this articleAnti-money launderingKey to this type of risk management is continued compliance with changing global and local regulatory requirements.
