Money laundering and terrorist financing indicators – Virtual currency transactions

Money Launderinggracechurchfcp

This guidance on suspicious transactions is applicable to all reporting entities (REs) that are subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated Regulations. It is recommended that this guidance be read in conjunction with other suspicious transaction report (STR) guidance, including:

  • What is a suspicious transaction?
  • Reporting suspicious transactions to FINTRAC

Money laundering (ML) and terrorist financing (TF) indicators are potential red flags that could initiate suspicion or indicate that something may be unusual in the absence of a reasonable explanation. Red flags typically stem from one or more factual characteristics, behaviours, patterns or other contextual factors that identify irregularities related to financial transactions. These often present inconsistencies with what is expected of your client based on what you know about them.

The ML/TF indicators in this guidance were developed by FINTRAC through a review of ML/TF cases, a review of high quality STRs, published literature by industry and international organizations such as the Financial Action Task Force (FATF) and the Egmont Group, and consultation with select RE sectors. These ML/TF indicators do not cover every possible situation but were developed to provide you with a general understanding of what is or could be unusual or suspicious. On its own, a single ML/TF indicator may not appear suspicious. However, observing an ML/TF indicator(s) could lead you to conduct an assessment of the transaction(s) to determine whether there are further facts, contextual elements or additional ML/TF indicators that require the submission of an STR.

Criminal organizations often combine various methods in different ways in order to avoid the detection of ML/TF. If you detect unusual or suspicious behaviour or a transaction that prompts the need for an assessment, ML/TF indicators combined with facts and context can help you determine if there are reasonable grounds to suspect that the transaction is related to the commission or attempted commission of an ML/TF offence. These ML/TF indicators may also be used to explain or articulate the rationale for your reasonable grounds to suspect in the narrative portion of an STR, as they provide valuable information from a financial intelligence perspective.

Important considerations
One piece of the puzzle
The ML/TF indicators in this guidance are not an exhaustive list of ML/TF indicators to support all suspicious scenarios. These ML/TF indicators should be considered as examples to guide the development of your own process to determine when you have reasonable grounds to suspect that the transaction is related to the commission or attempted commission of an ML/TF offence. These ML/TF indicators are one piece of the puzzle and are designed to complement your own STR program and can be used in conjunction with other publicly-available ML/TF indicators.

During an assessment, FINTRAC will review your policies and procedures to see how you use ML/TF indicators within your STR program. Part of the assessment will include evaluating how the actual policies follow your documented approach and determining its effectiveness with respect to the use of ML/TF indicators. This can include a review of transactions to determine how your STR program identifies potential STRs and assesses them using facts, context and ML/TF indicators. For example, you can receive questions if you have not reported an STR for a client you have assessed as high-risk and that client activity also matches against multiple ML/TF indicators.

Combination of facts, context and ML/TF indicators
If the context surrounding a transaction is suspicious, it could lead you to assess a client’s financial transactions. Facts, context and ML/TF indicators need to be assessed to determine whether there are reasonable grounds to suspect that the transaction is related to the commission or attempted commission of an ML/TF offence. On its own, a single financial transaction or ML/TF indicator may not appear suspicious. However, this does not mean you should stop your assessment. Additional facts or context about the associated individual or their actions may help you reach the reasonable grounds to suspect threshold.

Alert or triggering system
FINTRAC acknowledges that an RE may have developed a system that relies on specific alerts or triggering events to signal when to assess a transaction to determine if an STR should be submitted to FINTRAC. If you rely on such a system, FINTRAC expects that you review the alerts in a timely manner in order to determine if an STR should be submitted. Regardless of how you choose to operationalize these ML/TF indicators, FINTRAC expects that you will be able to demonstrate that you have an effective process to identify, assess and submit STRs to FINTRAC.

Virtual Currency ML/TF indicators
The ML/TF indicators in the following section are applicable to both suspected ML and/or TF. The ability to detect, prevent and deter ML and/or TF begins with properly identifying the person or entity in order to review and report suspicious financial activity.

You may observe these ML/TF indicators over the course of your business activities with a client. It is important to note that depending on your business activities, some of these ML/TF indicators may not apply.

  • Client portfolio only consists of privacy coins or has a high value in privacy coins (For example, Monero, Dash, Zcash).
  • Client transfers Bitcoin in large volumes in exchange for privacy coins (For example Monero, Dash, Zcash, etc).
  • Client is unwilling or unable to provide information about the source of privacy coins they once held or currently have.
  • Virtual currency addresses match addresses on recognized watch lists such as the list of the Office of Foreign Assets Control (OFAC) or law enforcement information.
  • Many individuals register with the exchange within a short period using a shared address, mobile device, phone number, IP addresses and other common identity indicators.
  • The client’s virtual currency wallet or address is linked to fraudulent activity in media reports and/or cyber security bulletins.
  • A platform receives unusual or persistent requests from other exchanges/vendors/service providers in respect of a client’s deposited funds.
  • A broker charges abnormally high commission fees compared to the industry standard.
  • The white paper is of poor quality, incomplete, misleading, and has limited information.Footnote1
  • Publicity is created around the initial coin offering (ICO) (advertisements, celebrity endorsements, social media ads), also known as pump and dump ICOs.
  • The developers are anonymous or information provided about the ICO cannot be verified.
  • There is no access to the smart contract, to the code or to technical information about the token’s creation.
  • There is no possibility to sell the investment or to exit the project to recover the invested funds.
  • A series of complicated transfers of funds to multiple addresses or wallets that seems to be an attempt to hide the source and intended use of the funds.
  • Transactions take place at the same time of day. Transfers from fiat to virtual currency and virtual currency to fiat.
  • High volume and frequency of transfers between different types of virtual currencies.
  • Client provides an anonymous email address obtained through an encrypted email service.
  • Funds are deposited or withdrawn from a virtual currency address or wallet with direct and indirect exposure links to known suspicious sources, including darknet marketplaces, mixing/tumbling services, questionable gambling sites, illegal activities (for example, ransomware) and/or theft reports.
  • Funds flow through a large number of intermediate addresses in a very short period of time prior to being deposited in a client’s wallet, or just after being withdrawn.
  • Virtual currency passes through mixers/tumblers and is transferred to multiple wallets, where the funds are cashed out.
  • The virtual currency’s funds originated from an over the counter trade broker that advertises its services as privacy-oriented/anonymous.
  • Virtual currency address has links or hops from a wallet address that has appeared on online platforms indicating support for violent extremism or radicalization (including social media, ads on fundraising sites, sites on Tor or messaging sites).
  • The source of funds used for the purchase of large amounts of virtual currencies is unknown.
  • The email address used in the transaction is linked to advertisements for the sale of virtual currencies on peer to peer exchange platforms. These advertisements may suggest that the client is buying and selling virtual currency on a commercial scale through a business as a non-registered money services business.
  • The client frequently receives funds from multiple payment processors.
  • The client makes frequent payments or transfers to companies, post office mailing services or uses money orders from agents of the Crown for the purchase of computer software or hardware.

Article credit: https://www.fintrac-canafe.gc.ca/guidance-directives/transaction-operation/indicators-indicateurs/vc_mltf-eng