《Chainalysis：2024洗錢及加密貨幣報告：檢測和調查的趨勢及新技術（英文版）（31頁）.pdf》由會員分享，可在線閱讀，更多相關《Chainalysis：2024洗錢及加密貨幣報告：檢測和調查的趨勢及新技術（英文版）（31頁）.pdf（33頁珍藏版）》請在三個皮匠報告上搜索。

1、JULY 2024Money Laundering andCryptocurrencyTrends and new techniques for detection and investigationTable of ContentsMoney Laundering and Cryptocurrency2Crypto-native money laundering4Layering in cryptocurrency:Intermediary wallets4Crypto obfuscation services:Mixers,bridges,and privacy coins8Destina

2、tion of illicit funds13The crypto nexus in non-crypto native money laundering18Typologies of suspicious on-chain activity and examples of heuristicsthat can help identify them18Anti-money laundering(AML):Policy and prevention strategies26Leading regulatory frameworks27Strategies for crypto native an

3、d non-crypto native scenarios30The role of technology in money laundering prevention31Money Laundering and CryptocurrencyWhile public blockchains are inherently transparent and traceable,illicit actors turn to cryptocurrencies tolaunder ill-gotten gains for the same reasons people use them for legit

4、imate purposes:they arecross-border,virtually instant,and generally inexpensive to transact.Money laundering in the cryptocontext is typically associated with cybercriminals attempting to conceal the flow of funds related toon-chain crimes,such as darknet market and ransomware operations.However,cry

5、ptocurrency isincreasingly being used to launder funds from a broader range of illicit activities beyond the conventionalunderstanding of crypto crime.The growing ubiquity of crypto has made it a tool for laundering proceedsfrom various off-chain crimes,such as narcotics trafficking and fraud.In 202

6、4,money laundering in cryptoencompasses all crime not just that which is inherently tied to the crypto ecosystem.This shift carries significant implications for investigators.First,expertise in cryptocurrency must extendbeyond specialized cybercrime units to include law enforcement agencies of all k

7、inds.Cryptocurrency isnow one of the payment methods used by illicit actors worldwide,and therefore this expertise mustencompass both blockchain transaction tracing and a comprehensive understanding of traditional moneylaundering tactics.Second,there is a silver lining:with the right data and tools,

8、investigators in the publicand private sectors can leverage the transparency of blockchain to uncover illicit activity that mayotherwise go undetected.Blockchain analysis can generate both intelligence signals for proactive leadgeneration and more concrete evidence of illicit flows in existing inves

9、tigations,helping a broad range ofanalysts and investigators unravel increasingly sophisticated money laundering networks.What is money laundering?Money laundering is the process of concealing the origins of money obtained from illegal activities so thatthe funds can be used without drawing attentio

10、n to their illicit source.This typically involves making largesums of money generated by criminal activities,such as drug trafficking or terrorist financing,appearlegitimate.The process of money laundering generally consists of three stages:placement,layering,and integration.Placement is the initial

11、 stage in which illicit money is introduced into the financial system.Layering involvesmoving the money through a series of financial transactions to obscure its origin.Finally,integration is theprocess of re-entering the money into the legitimate economy,making it appear as though it has comefrom a

12、 legitimate source.Chainalysis has published money laundering analyses in our annual Crypto Crime Reports for severalyears,dissecting the flow of funds from known illicit wallets during the placement stage,to conversionservices which represent the layering stage of laundering.Known illicit wallets h

13、old funds connected toconfirmed crypto-native criminal activity like exchange heists,crypto scams,and darknet market proceeds.Conversion services swap cryptocurrencies for fiat,other types of crypto,or provide some other service.Examples of conversion services include centralized exchanges,DeFi serv

14、ices,gambling sites,mixers,andbridges.Because this activity occurs entirely on-chain,we refer to it as crypto-native money laundering.This type of money laundering can be traced and analyzed with a higher degree of accuracy and speedcompared to traditional financial systems thanks to the inherent tr

15、ansparency of blockchain.Money Laundering and Cryptocurrency2As shown below,since 2019,nearly$100 billion in funds have been sent from known illicit wallets toconversion services.The highest amount recorded was in 2022,with$30 billion identified,largelyattributable to transactions involving sanction

16、ed services such as the Russian exchange Garantex.Total value leaving illicit wallets and arriving at conversion services including off-ramps2019-2024(YTD)These amounts represent the dollar value of the assets at the time they leave wallets associated with illicitactors.These estimates only include

17、the totals moved from illicit sources to crypto services,and do notinclude the value sent and received among intermediaries a process described below which can includetens or hundreds of individual transactions.This estimate also does not include transactions wherecryptocurrency is used to launder f

18、unds,but the source of the illicit activity is unidentified or off-chain.Forexample,consider a drug cartel selling narcotics and paying a distributor using cryptocurrency.If thistransaction flows directly between two known exchanges,it would be indistinguishable on-chain fromlegitimate service-to-se

19、rvice transfers without specific lead information.However,investigators can stillfollow these funds using a combination of off-chain intelligence and on-chain analysis,and complianceteams can flag unusual transactions outside of their customers business profiles.In this report,we aim to broaden our

20、analysis of money laundering to encompass not only crypto-nativemoney laundering,but also suspicious transaction patterns that may indicate money laundering activitiestied to off-chain crime that would require deeper investigation to confirm.First,we will examine trends and behaviors within the cryp

21、to-native money laundering space,identifyingkey patterns and methods used by a range of threat actors.We will then explore how traditionallyMoney Laundering and Cryptocurrency3fiat-powered criminal activities are leveraging cryptocurrency for money laundering,and how blockchainanalysis can provide i

22、ntelligence to investigators in government and compliance.Crypto-native money launderingEvery month,billions of dollars flow through the crypto ecosystem from illicit wallets to conversion services.Crypto-native money laundering can be particularly sophisticated,as these cybercriminals often leverag

23、emixers,cross-chain bridges,and hops between intermediary wallets1to obscure the origin and movementof their funds.An advanced understanding of these mechanisms can help crypto-native actors attempt toevade detection more effectively,posing a persistent challenge for crypto services and law enforcem

24、entagencies.We can see this complexity at play in the Atomic Wallet exploit by the North Korea-affiliated hackinggroup TraderTraitor in June 2023,as detailed in our 2024 Crypto Crime Report.This incident exemplifiesthe intricate layering involved in sophisticated crypto-native laundering,demonstrati

25、ng the advancedtactics some actors use to obscure illicitly obtained funds.On-chain laundering:A potential workflowAdvanced blockchain analysis technology can provide opportunities for detection and disruption throughout this processLayering in cryptocurrency:Intermediary walletsThe layering stages

26、of money laundering can take many forms.In traditional fiat laundering,this mightinvolve sending funds through multiple bank accounts and shell companies.In crypto,one popular methodof layering involves sending funds through numerous intermediary personal wallets known as“hops.”This tactic is design

27、ed to obscure the connection between the illicit funds in the initial placement stage andtheir eventual integration.1From a data standpoint,we define intermediaries as distinct unidentified wallets between two known endpoints.In thismoney laundering analysis,intermediaries are between an illicit wal

28、let and a conversion service.Transactions betweenintermediary wallets may or may not represent a change of custody.In other words,the transaction could involve a hand offfrom a cybercriminal to a professional money launderer,or it could be one individual sending crypto through many individualprivate

29、 wallets they control.In the analysis for this report,we suspect these intermediary wallets are primarily personal wallets,although they may also include unidentified services.Throughout this report,we use data science techniques to demonstratetrends in money laundering,but further investigation is

30、required to confirm individual cases of potential money laundering.Money Laundering and Cryptocurrency4In the on-chain laundering process,these intermediary wallets play a significant role,often accounting forover 80%of the share of the total value flowing through these laundering channels,as shown

31、in the chartbelow.2Illicit flows through wallets2019-2024Additionally,growth in the number of intermediary wallets is the sort of thing we would expect if illicitactors were adding hops to their laundering process in order to increase the complexity of their operationson-chain.2“Service flows”as sho

32、wn here is defined as the movement of assets from service to service,while“intermediary flows”encompasses transactions between intermediary wallets,which includes wallet-to-wallet transactions or flows from illicitwallets to intermediary wallets.Money Laundering and Cryptocurrency5Total number of in

33、termediary wallets moving known illicit funds2019-2023Since each hop increases the fees paid by illicit actors,these additional steps may be motivated,at least inpart,by a desire to avoid detection by law enforcement and compliance teams at crypto services.At the same time,the number of intermediary

34、 wallets between illicit wallets and conversion servicestypically correlates with the total amount of illicit activity we observe at a given time.For instance,the useof intermediary wallets involving illicit flows peaked in late 2022,a year we observed the most totalcryptocurrency value received by

35、illicit addresses.An increasing portion of illicit funds passing through intermediary wallets are represented by stablecoins,consistent with our finding that stablecoins now account for the majority of all illicit transaction volume.Money Laundering and Cryptocurrency6Number of intermediary wallets

36、moving illicit funds by asset type2019-2023This rise in the use of stablecoins likely reflects the overall increase in stablecoin adoption over the last fewyears after all,both good and bad actors often prefer to hold funds in an asset with a value that will notchange based on swings in the market.B

37、ut using stablecoins also adds an element of risk for launderers:stablecoin issuers have the ability to freeze funds,which we address later.Data analysis can help identify intermediary wallets holding a large concentration of funds linked tocrypto-native criminal activity.These wallets often act as

38、consolidation points,holding cryptocurrencydeposited from multiple other intermediary wallets.Money Laundering and Cryptocurrency7Share of illicit funds going to top 100 intermediary wallets by crime type2024For many crime types,only a handful of wallets hold the vast majority of illicit funds which

39、 may reflect thedegree of concentration in some parts of the illicit sector.The tactic of sending funds through numerous intermediary wallets before reaching the final destinationcomplicates the manual tracing process for investigators using block explorers.But for investigators andcompliance profes

40、sionals using Chainalysis,detecting illicit activity and tracing through intermediarywallets can be relatively simple.Crypto obfuscation servicesBecause investigators equipped with the right tools can easily trace funds through intermediary walletsback to their illicit sources,many bad actors deploy

41、 additional obfuscation methods and specialized cryptoassets in attempt to further conceal the source of funds.These tools share the common trait of breakingthe on-chain link between the destination and the origin of funds,unless advanced forensics techniquesare deployed.We will examine several of t

42、hese obfuscation methods below.Crypto mixersMixers,also known as tumblers,are services that blend the cryptocurrencies of many users together toobfuscate the origins and owners of the funds.While the primary function of mixers is to enhance privacy,it is important to recognize that not all transacti

43、ons processed through mixers are tied to illicit activity.In2022,mixers reached peak popularity,exceeding$1.5 billion of value received in April of 2022.Money Laundering and Cryptocurrency8Monthly total value received by mixers2017-2024Consistent with a general uptick in market activity,mixers have

44、begun to see a resurgence in 2024.When looking at the growth of individual mixing services overall,we see that WasabiWallet,JoinMarket,and Tornado Cash have grown the most.Money Laundering and Cryptocurrency9Quarterly indexed growth of fastest growing mixers2023-2024It is noteworthy that Tornado Cas

45、h in particular demonstrates sustained high growth over the past year,following a dramatic decline in usage after it was sanctioned in 2022.This is a trend we first noted in our2024 Crypto Crime Report,where we detailed how early 2023 marked an inflection point,when inflows tothe smart contract mixe

46、r began to increase again over time.Conversely,Samourai was on track to be a topperformer in terms of growth this year,but that momentum has since plummeted following the April 2024Department of Justice action against the founders and CEO.Privacy coinsPrivacy coins,such as Monero(XMR)and Zcash(ZEC),

47、offer enhanced anonymity features,making it moredifficult to trace transactions on those chains.Monero uses advanced cryptographic techniques such asring signatures,stealth addresses,and confidential transactions to obfuscate the sender,recipient,andtransaction amount.As we see below,Monero transact

48、ions are on the rise overall3.3The anomalous March 2024 spike in Monero transactions can be attributed to a spam event called Black Marble.Money Laundering and Cryptocurrency10Number of Monero transactions per month2014-2024While not all Monero transactions can be attributed to illicit activity,its

49、privacy features may be particularlyattractive to illicit actors.For example,terrorist organizations,such as the Islamic State in Khorasansmedia platform,Al Azaim Media,have advertised Monero donation addresses.Money Laundering and Cryptocurrency11Because the level of obfuscation afforded by privacy

50、 coins hides transaction details from public view,government agencies may consider investment in specialized blockchain analysis services that can maketracing Monero and other privacy coins possible.As detailed in our 2024 Crypto Crime Report,Moneros role in laundering activities is particularly evi

51、dent inMonero-friendly instant exchangers,which often lack compliance measures like Know Your Customer(KYC).These exchangers facilitate the conversion of cryptocurrencies to Monero,effectively breaking thetraceability chain.However,it is important to note that some regulators have banned privacy coi

52、ns,andmany exchanges,most recently Binance,have delisted Monero due to concerns over its potential for illicituse.Crypto bridgesCrypto bridges,which facilitate the transfer of assets between different blockchain networks,have becomepopular tools that enhance the cross-chain interoperability and use

53、cases of certain assets.As their overallusage grows,malicious actors increasingly attempt to leverage cross-chain bridges to obscure the originsof illicit funds by moving them across multiple blockchains.Money Laundering and Cryptocurrency12Although bridge transactions can be traced by investigators

54、 with the right tools,launderers create complexwebs of transactions by splitting funds into smaller amounts and transferring them across various chains,making it more time-consuming for investigators to untangle.When examining illicit flows to bridges,we can see that value has increased steadily ove

55、r time,continuingthe trend we observed in our 2024 Crypto Crime Report.Monthly total and illicit value moving through bridges2020-2024There is a pronounced surge in illicit value starting in late 2023,with close to$234 million in illicit inflowsrecorded in January 2024 the highest value to date,larg

56、ely driven by funds flowing from Tornado Cashto bridges.Destination of illicit fundsWhile some cybercriminals may hold their ill-gotten gains in personal wallets for years presumably inhopes that authorities will turn their attention elsewhere most bad actors look to off-ramp funds fromcrypto to cas

57、h.Over 50%of illicit funds wind up at centralized exchanges,either directly or indirectly afterthe use of obfuscation techniques.Money Laundering and Cryptocurrency13Destination of funds leaving illicit wallets by month2019-2024Illicit actors might turn to centralized exchanges for laundering due to

58、 their high liquidity,ease ofconverting cryptocurrency to fiat,and integrations with traditional financial services that help blend illicitfunds with legitimate activities.There are currently hundreds of centralized services in any given year thatreceive over$1 million in illicit funds.However,a not

59、able downtrend in the volume received by centralizedexchanges from nearly$2 billion a month at peak to approximately$780 million a month suggestsincreased efficiency in the AML programs of centralized exchanges in detecting and mitigating launderingactivity.Concentration of cash-out pointsDespite a

60、dispersion across many services,there is a high concentration of illicit funds flowing to just fivecentralized exchanges.So far in 2024,there has been a particular surge in the use of just a few conversionservices for funds from darknet markets,fraud shops,and malware.Money Laundering and Cryptocurr

61、ency14Concentration of funds converting at top five centralized exchanges over time2020-2024Not only can Chainalysis analyze the types of services that are receiving illicit funds,but also the exactdeposit addresses that are receiving the funds.A deposit address is similar to a bank account in that

62、eachone tends to correspond to an individual account at the service.An interesting trend emerges when we look at the share of funds going to the top one hundred depositaddresses receiving the most illicit value in 2024.Actors attempting to cash out stolen funds tend to usefewer deposit addresses tha

63、n other types of crimes,driven by a few larger outlier hacks.In contrast,revenues from darknet marketplaces show the lowest concentration among the top hundred depositaddresses,speaking to the many vendors that use them.Money Laundering and Cryptocurrency15Money laundering concentration by crime typ

64、e:Share of totalillicit value received by top 100 deposit addresses2024Still,across all categories shown above,the top hundred deposit addresses take at least 15%of all illicitfunds in that category,indicating that the cybercrime community may be smaller than many suspect.Over-the-counter brokersOve

65、r-the-counter(OTC)crypto brokers facilitate large trades between two parties,ensuring privacy andoften better pricing for high-volume transactions.These brokers connect buyers and sellers directly througha broker-dealer network or OTC trading desks,bypassing public order books.While most OTCs are le

66、gitimate services,there are some that have emerged that do not require proper KYCprocedures for customers and oftentime specifically cater to off-ramping illicit funds.These OTCs can befound all over the world and can be difficult to identify,often requiring a combination of off-chain andon-chain in

67、telligence.Cybersecurity firm Cloudburst scrapes Telegram channels and looks for advertisements from these OTCs.They have recently identified many OTCs operating in China offering conversion services to fiat currencydirectly through Telegram channels.Below is an example advertisement for one such OT

68、C broker that promotes a 24-hour self-serviceredemption via Telegram.Their website,which advertises in Mandarin,boasts:We have sold a largeamount of USDT stolen from overseas.According to Cloudburst,this service claims to have shipped overthree million USDT daily in 2024.Once a connection is establi

69、shed on Telegram,customers receive adeposit address digitally to facilitate transactions.Money Laundering and Cryptocurrency16Some of these OTCs have an on-chain illicit footprint that can help profile the service in addition to theTelegram advertising.We can see another China-based OTC directly off

70、-ramping illicit funds,as shown inthe Reactor graph below.Money Laundering and Cryptocurrency17While OTCs in general are an important part of the regulated market,certain components make themattractive to criminals,particularly when regulatory requirements are unheeded.The crypto nexus in non-crypto

71、 native money launderingNon-crypto native money laundering refers to the laundering of funds derived from off-chain criminalactivity,rather than funds derived directly from crypto-specific crimes like hacks or scams.As morefinancial transactions move on-chain overall,traditional money launderers are

72、 turning to cryptocurrenciesto facilitate their operations.Tracking non-crypto native money laundering can be difficult at scale outsideof the context of specific investigations,as concrete evidence linking funds to illicit activity is often scarce.But below,we leverage data science techniques to ex

73、amine some flags that might indicate this activity isoccurring.Typologies of suspicious on-chain activity and examples of heuristics that can helpidentify themThe relationship of traditional money laundering methods with blockchain has expanded the toolkitavailable to money launderers and their trac

74、ers.Monitoring financial flows for suspicious activity whichoften relies on heuristics and thresholds,such as in the Financial Action Task Force(FATF)s Red Flagguidance to describe behavior that could be suspicious.Additionally,guidance from the Financial CrimesEnforcement Network(FinCEN)suggests th

75、at potential money laundering and sanctions evasion related toRussia can be signaled by unexplained surges in value flows and other unusual transactional patterns.The use of blockchain data-driven heuristics can augment the existing workflows of compliance teams andinvestigators to help identify pot

76、entially suspicious on-chain activity.It is important to note in all of thesecases that the patterns identified are not,in isolation,a confirmation of wrongdoing.Money Laundering and Cryptocurrency18Repeated transfers just under reporting thresholdsWhile the threshold varies by country,FATF recommen

77、ds that cryptocurrency transactions exceeding$1,000 USD/EUR be subject to the Travel Rule,with the United States(U.S.)setting this value at$3,000USD.Additionally,the U.S.Bank Secrecy Act(BSA)requires reporting on cash transactions exceeding$10,000 USD.Transactions in excess of these values trigger a

78、dditional scrutiny,while transactions under thesethresholds,even by just a dollar,do not face the same level of inspection.The chart below displays the value of funds moving to centralized exchanges by transfer size for 2024year-to-date.It reveals a noticeable surge in transfers just below the$1,000

79、,$3,000,and$10,000thresholds,as well as just above it.The transfers slightly above these thresholds could potentially beattributed to rounding differences in exchange rates.The surges are typical patterns that are identifiedwhen bad actors are structuring payments to avoid triggering reporting requi

80、rements.Transactions justbelow reporting requirements is one of the red flag indicators FATF has highlighted for in guidance forVirtual Asset Service Providers(VASPs)to help identify suspicious behavior.Value of cryptocurrency under 12K moved to centralized exchanges by bucket size2024This suggests

81、that reporting requirements are likely to increase activity at the margins,just below andslightly above the reporting thresholds,in an attempt to avoid triggering additional scrutiny.Use of many intermediary wallets ahead of cash-outsAs discussed above,one popular method of layering in crypto-native

82、 money laundering involves sendingfunds through many intermediary personal wallets.Of course,the use of personal wallets is not inherentlysuspicious,but we can use data to answer questions about potentially suspicious behavior.Money Laundering and Cryptocurrency19For example:Do users send funds thro

83、ugh more intermediary wallets before converting funds atexchanges that have KYC verification versus those that do not?Indexed monthly growth of intermediary wallets used to move illicit funds at KYC vs.non-KYC exchanges2022-2024They do.The above chart illustrates that the number of intermediary wall

84、ets used by bad actors is growingfaster on KYC exchanges when compared to non-KYC exchanges.This may suggest that awareness ofAML/KYC obligations might be prompting this greater use of intermediary wallets in attempts to avoid thedetection of illicit activity.Although there are many legitimate reaso

85、ns for funds to pass through multiplewallets,exchanges might consider the number of intermediary wallets as a potential red flag indicator aspart of their overall risk assessment of a user.Use of consolidation walletsExchanges might also benefit from monitoring consolidation wallets that interact wi

86、th their service.Whenlaunderers layer funds through many intermediary wallets,the transaction flows are often not simple andlinear.Rather,the launderer might split funds off into many wallets and then reconsolidate the funds later,after multiple transactions.A consolidation wallet receives and combi

87、nes funds from several wallets or sources.If funds move throughmultiple separate intermediary wallets and then consolidate at a single address,this might suggest anattempt to avoid detection.The Chainalysis Crypto Investigations graph below demonstrates this type of behavior in a known scamgroup tar

88、geting the elderly.In this scenario,the scammer likely instructed their victims to use a specificservice,Exchange 1,to purchase crypto assets.Each victim was then directed to send funds to a differentMoney Laundering and Cryptocurrency20wallet controlled by the scammer.The scammer subsequently conso

89、lidated these funds into a single walletbefore cashing out at Exchange 2.Compliance teams at Exchange 1 would have difficulty directly linking the victims to the scammer,especially if the intermediary addresses are single-use with no prior ties to illicit activity unless theytraced the transactions

90、to the consolidation wallet.The use of many intermediaries prior to consolidation isa strategy to prevent the compliance team at Exchange 1 from understanding the connection between allthe victims that were sending funds.Money Laundering and Cryptocurrency21While the example above is relatively simp

91、le,more complex money laundering networks featureconsolidation wallets that aggregate funds from dozens or even hundreds of intermediary wallets.Querying Chainalysis data can point investigators to major consolidation wallets,which may serve asuseful leads.For example,this year so far,the top one hu

92、ndred bitcoin consolidation wallets in 2024 all ofwhich have transacted two hops away from an exchange received$968 million worth of bitcoin fromover 14,970 distinct addresses.Top 100 Bitcoin consolidation wallets by number of distinct sources for fund consolidation2024Further expanding the aperture

93、,we can identify over 1,500 consolidation wallets that have received a totalof$2.6 billion worth of bitcoin in 2024;each of those have received funds from at least ten differentwallets.Again,we cannot say for certain that this represents money laundering activity in fact,much of itlikely represents

94、legitimate economic flows.But this activity may warrant additional scrutiny.Payments made in rounded amountsThere are many legitimate reasons why cryptocurrency users might frequently transfer rounded amountsto conversion services.For instance,people often strive to become a“whole coiner”or attain a

95、 roundednumber in a given asset for psychological reasons.Nevertheless,it is important to consider how rounded payment amounts are often found in the moneylaundering patterns of known illicit actors.For instance,in the laundering activities of actors linked to theDemocratic Peoples Republic of Korea

96、(DPRK),launderers are known to break a large amount of funds intosmaller,rounded amounts and send these at high frequencies to conversion services.Below we see thatMoney Laundering and Cryptocurrency22actors suspected to be affiliated with DPRK sent four transactions totaling 308 BTC in rounded amou

97、nts toa deposit address on a centralized exchange over four days,presumably to off-ramp into fiat.Chainalysis data shows that most personal wallets engage in transfers of rounded amounts only three tofive times.Notably,only thirty three personal wallets have sent more than a thousand rounded amounts

98、 toa deposit address.That behavior may be indicative of methodical,professional money laundering or of aservice that pays out in rounded amounts,prompting deeper investigation.Money Laundering and Cryptocurrency23Total number of personal wallets by number of rounded transactions sentA potential reas

99、on for sending rounded amounts is that it is easier to find buyers at P2P exchanges,OTCs(over-the-counter brokers),or other informal services when dealing with whole units.For illicit actorslooking to cash out,time is often more critical than obtaining the best price,making speed a higher priorityat

100、 this stage of the laundering process.Regardless of the intention,investigators often flag many roundedamounts in an investigation as a noteworthy pattern.Suspiciously large fees using mixersAs discussed above,services like mixers are designed to obfuscate the trail between origin and destinationpoi

101、nts.However,the detailed record of on-chain events can still help identify suspicious activity.The chart below shows transaction fees from the sanctioned smart contract mixer Tornado Cash.Byexamining the 30-day moving average of fees,we can identify whether a transaction pays an abnormallylarge fee.

102、For example,if the average fee over the past 30 days is$1,a fee of$100 would be anomalouslylarge,while a fee of$1.01 would not.At the same time,paying$1.01 might be anomalous if fees areranging around 10 cents.Money Laundering and Cryptocurrency24Anomalously large Tornado Cash outgoing fees associat

103、ed with stolen fund inflows to the mixerThis method clearly categorizes transactions that prioritize speed(via higher fees)over economicefficiency.While transactions with anomalously high fees are not necessarily illicit or indicative of moneylaundering,it is notable that significant fee surges ofte

104、n coincide with inflows to Tornado Cash fromwallets holding stolen funds(indicated by the black lines in the chart,each representing a date of aprominent hack or theft).Analyzing fees might suggest efforts to quickly clear funds,potentially facilitatingthe laundering process and advancing it from th

105、e layering to the integration phase.Applying traditional money laundering detection techniques to the blockchainIn many ways,identifying novel on-chain patterns that might indicate laundering is similar to detectingthese activities in fiat currency,where the focus is on analyzing transaction pattern

106、s and anomalousactivities.Conventional money launderers are onboarding to crypto,with methods that resemble theirfiat-based strategies.While distinguishing between money laundering and legitimate transactionson-chain can be challenging,the insights from blockchain intelligence tools like Chainalysis

107、 are morepowerful due to the transparent and immutable nature of blockchain.Traditional finance(TradFi)reliesheavily on compliance procedures to trace the sources of funds,whereas blockchain offers clear visibility.Despite this,malicious actors are applying traditional laundering techniques to block

108、chain ecosystems inorder to attempt to evade detection.As the global acceptance of cryptocurrencies grows and barriers toentry diminish,Chainalysis expects this type of money laundering to become more significant,as illicitactors historically co-opt new technologies for their own purposes.Authoritie

109、s must navigate the usage of these heuristics carefully,ensuring they have robust evidence tosupport their claims without unduly disrupting legitimate financial operations.Money Laundering and Cryptocurrency25Anti-money laundering(AML):Policy and preventionstrategiesEffective prevention of money lau

110、ndering in both crypto native and non-crypto native scenarios requires amultifaceted approach.This includes regulatory measures,technological innovations,and globalcooperation.Strategies must be tailored to address the unique characteristics of cryptocurrencies whilereinforcing traditional anti-mone

111、y laundering(AML)measures.Overview of existing regulationsAs crypto assets enter the mainstream,countries across the world have steadily introduced regulationsaddressing various properties of cryptocurrency,including anti-money laundering(AML)and Counteringthe Financing of Terrorism(CFT)measures,cou

112、nter proliferation financing(CPF),consumer protectionmeasures,market conduct policies,and prudential requirements.To that end,the intergovernmentalFinancial Action Task Force(FATF)has issued guidance laying out a comprehensive framework forcountries to implement in order to combat money laundering a

113、ctivities.Anti-money laundering(AML)requirementsAML requirements,including Know Your Customer(KYC)rules,are foundational regulations requiringfinancial institutions,including VASPs,to take a number of measures to prevent money laundering.Thisincludes verifying the identities of their customers and m

114、onitoring their transactions for suspicious activity.Travel RuleThe Travel Rule mandates that financial institutions,including VASPs,obtain,and in many cases,alsoshare information about the originator and beneficiary of transactions over a certain threshold,ensuringtransparency and traceability.Whil

115、e public blockchains provide unparalleled visibility into transaction flows,their pseudonymous naturenecessitates a different approach to abide by the Travel Rule.To this end,regulatory technologies suchas Chainalysis partnership with Notabene and VerifyVAS are allowing VASPs to enhance theircomplia

116、nce strategies.Stablecoin issuers and freezing capabilitiesMost stablecoins,such as USDT(Tether)and USDC(USD Coin),are issued by centralized entities that havethe authority to control and manage their smart contracts.As such,these issuers can proactively monitortransactions for suspicious activity a

117、nd freeze funds when necessary.This capability allows issuers toswiftly respond to law enforcement requests.For instance,both Tether(USDT)and Circle(USDC)have previously indicated that they have frozenaddresses associated with illicit activities.Tether tells Chainalysis that they have frozen an esti

118、mated 1,600addresses holding funds worth approximately 1,500,000,000 USDT.Money Laundering and Cryptocurrency26Leading regulatory frameworksIn 2019,the intergovernmental Financial Action Task Force(FATF)issued detailed guidance on theapplication of AML/CFT standards in the virtual asset sector for c

119、ombating illicit financial activities.Sincethen,regulators worldwide have been working to incorporate FATFs global standards into their ownregulatory frameworks,in effort to achieve a cohesive and unified approach to digital asset AML regulationon a global scale.European UnionIn 2018,the European Un

120、ion(EU)adopted the Fifth Anti-Money Laundering Directive(5AMLD),to combatmoney laundering and terrorism financing related to digital assets.This directive required nationaltransposition by EU Member States and came into effect in January 2020,extending AML requirements toVASPs.Additionally,the exist

121、ing Transfer of Funds Regulation(TFR)the EUs implementation of theTravel Rule has been updated to also include crypto asset transactions by VASPs,effective December2024,alongside the provisions for crypto-asset service providers under the Markets in Crypto-AssetRegulation(MiCA).5AMLD requires greate

122、r transparency in financial and crypto asset transactions and beneficialownership information.VASPs must conduct enhanced due diligence on high-risk customers andtransactions,including identifying and verifying the identities of clients involved in complex or largescale transactions.It also encourag

123、es cooperation and information sharing between MemberStates and financial intelligence units(FIUs)to effectively combat money laundering and terroristfinancing on a broader scale.TFR requires financial institutions,including VASPs,to obtain and partly verify information onoriginator and beneficiary

124、and when transacting with another VASP transfer this informationin advance of,or simultaneously,with sending a crypto asset transaction.Receiving VASPs mustverify the accuracy of the information received before making crypto assets available to customers.In 2023,to further harmonize the approach to

125、AML supervision among EU Member States,the EUhas also adopted a set of three new AML regulations,collectively known as the“AML package.”Anti-Money Laundering Regulation(AMLR):Replacing parts of 5AMLD,AMLR introducesthe EUs first“single AML rulebook”for obliged entities,applicable from July 2027.Anti

126、-Money Laundering Regulation Authority(AMLAR):Establishes the EUs firstsupranational AML Authority(AMLA)to harmonize supervision of obliged entities in theEU.AMLA is expected to be working on EU-wide policies from 2025,and directlysupervising firms from 2028.Anti-Money Laundering Directive 6(6AMLD):

127、Repeals 5AMLD directs EU Member Statesto implement changes into national laws within three years,focusing on the organizationof national AML/CFT supervision,such as financial intelligence units(FIU.)SingaporeSingapore is known for its robust regulatory framework.The Monetary Authority of Singapore(M

128、AS)administers the AML/CFT regulatory regime for financial institutions,including crypto businesses.Crypto businesses operating in Singapore(known locally as digital payment token serviceproviders)are regulated under the Payment Services Act(PSA),which first came into effect inMoney Laundering and C

129、ryptocurrency27January 2020.AML/CFT requirements for crypto businesses are set out in MAS Notice PSN02,andare supplemented by detailed guidance.MAS continues to enhance its regulatory framework for crypto businesses,most recentlyexpanding the scope of regulation by bringing into force the Payment Se

130、rvices(Amendment)Act2021.This Act expanded the range of crypto businesses subject to AML/CFT and other regulationto cover custodial service providers,as well as businesses facilitating the transmission or exchangeof crypto,even where the latter does not come into possession of customer assets.Singap

131、ore recently published an updated National Money Laundering Risk Assessment as itprepares for its upcoming FATF Mutual Evaluation.Hong KongHong Kong authorities are known for their thorough supervision across different risk areas,includingAML/CFT.In Hong Kong,the Securities and Futures Commission(SF

132、C)is the primary regulator for virtualasset trading platforms(VATPs),while the Hong Kong Monetary Authority oversees the activities of banksand will eventually oversee stablecoin issuers.In December 2022,Hong Kongs Anti-Money Laundering and Counter-Terrorist FinancingOrdinance(AMLO)was amended to fo

133、rmally cover the operation of virtual asset businesses.Thenew regulatory regime for VATPs came into force on 1 June 2023.Strict and granular AML/CFT requirements for VATPs are set out in a standalone chapter of theGuideline on Anti-Money Laundering and Counter-Financing of Terrorism for LicensedCorp

134、orations.The guidelines include lists of red flags and indicators of money laundering risk orsuspicious activities.In addition,in February 2024,Hong Kong authorities issued proposals for the regulation of OTCcrypto service providers.Under the proposals,OTC platforms would need to be licensed by theC

135、ustoms and Excise Department and would need to comply with AML/CFT obligations.The United KingdomThe UK has taken proactive steps to disrupt money laundering operations with proactive nationalenforcement measures and a strong emphasis on educating businesses and the public about AML risksand complia

136、nce obligations.The UK Financial Conduct Authority(FCA)is the AML/CFT supervisor of crypto businesses(cryptocurrency exchange providers and custodians)under the Money Laundering,TerroristFinancing and Transfer of Funds(Information on the Payer)Regulations 2017.This means thatsince January 2020,firms

137、 have been required to register for a crypto license and thereafter aresubject to FCA supervision and to comply with the same AML/CFT requirements as financialinstitutions.UK law enforcement agencies have the authority to seize crypto assets suspected of beinginvolved in money laundering activities

138、prior to making arrests.This approach helps prevent themovement and dissipation of illicit funds.The UK has established specialized units within The National Economic Crime Centre(NECC)andMetropolitan Police Service(MPS)that focus on investigating and prosecuting money launderingand financial crimes

139、.These units leverage technology and blockchain analytics to track and traceillicit financial flows.Money Laundering and Cryptocurrency28Collaboration between public and private sectors is a cornerstone of the UKs AML/CFT strategy.Initiatives like the Joint Money Laundering Intelligence Taskforce(JM

140、LIT)facilitate informationsharing and cooperation between the private sector and law enforcement agencies.While JMLIThas driven successes across multiple investigations the Joint Money Laundering Steering Group(JMLSG),another public-private sector partnership,has proven fundamental to producing form

141、allyrecognised guidance to assist firms,including VASPs,in understanding and complying with theirAML/CFT obligations.The United Arab EmiratesThe United Arab Emirates introduced AML/CFT obligations for Virtual Asset Service Providers(VASPs)through amendments to its principal AML/CFT legislation,Feder

142、al Decree-Law No.(20)of 2018.Followingthese amendments,various regulatory authorities,including the Financial Services Regulatory Authority(FSRA)in ADGM,the Virtual Assets Regulatory Authority(VARA)in Dubai,and the Dubai FinancialServices Authority(DFSA)in DIFC,have provided for AML/CFT requirements

143、 for VASPs within theirrespective jurisdictions.In 2023,the Central Bank of the UAE(CBUAE)issued guidance for licensed financial institutions tomanage AML/CFT risks related to virtual assets and VASPs.In 2024,the CBUAE released thePayment Token Services Regulations,which impose AML/CFT obligations o

144、n payment tokenservice providers,ensuring they adhere to stringent standards.In line with the risk-based approach,the VASPs are required to conduct risk assessments from anML/FT perspective.This involves identifying the specific risks the VASP is exposed to andimplementing appropriate controls to mi

145、tigate these risks.VASPs are also required to monitor transactions and report suspicious activities to the FinancialIntelligence Unit(FIU)using the goAML platform.The United StatesWhile the broader cryptocurrency-specific regulatory landscape in the United States is still evolving,it hasbeen clear f

146、or over a decade that cryptocurrency businesses are subject to AML requirements and mustmonitor their platforms for illicit activity.In 2013,the Financial Crimes Enforcement Network(FinCEN)explained that cryptocurrency exchanges constitute money service businesses(MSBs)subject to regulationunder the

147、 Bank Secrecy Act.In 2019,FinCEN provided additional guidance clarifying which othercryptocurrency businesses met the definition of an MSB and addressing other unique compliance issuesrelated to cryptocurrencies.The Bank Secrecy Act(BSA)is the primary legal framework governing AML regulations in the

148、 U.S.BSA requires that financial institutions,including cryptocurrency businesses,assist governmentswith identifying and stopping money laundering activities.FinCEN is responsible for creating and enforcing AML regulations,providing guidance forcompliance and collecting financial transaction data th

149、rough reports such as currency transactionreports(CTRs)and suspicious activity reports(SARs).The BSA requires financial institutions,including MSBs,to implement a risk-based AML programand to collect and verify their customers identity,known as Know Your Customer(KYC).Money Laundering and Cryptocurr

150、ency29Strategies for crypto-native and non-crypto native scenariosMoney laundering touches every aspect of illicit activity,requiring a holistic and adaptive approach toanti-money laundering(AML)and risk management.As blockchain technology evolves,AML strategiesmust also evolve to counter new tactic

151、s and ensure regulations keep pace with technologicaldevelopments.Enhanced KYC and AML protocolsEnsuring stringent Know YourCustomer(KYC)and anti-money laundering(AML)measures for both cryptoexchanges and traditional financial institutions is imperative.This includes verifying identities,monitoringt

152、ransactions,and flagging suspicious activities.Transaction monitoring systemsBoth traditional financial institutions and crypto exchanges are increasingly implementing advancedtransaction monitoring systems that use machine learning and artificial intelligence to detect unusualpatterns indicative of

153、 money laundering.Chainalysis Crypto Compliance solutions are increasinglyemployed by crypto businesses and financial institutions to flag suspicious activity in real-time.Number of transactions screened by Chainalysis2018-2024The number of transactions screened by compliance products such as Chaina

154、lysis is on the rise,indicatinga growing commitment among companies to prevent illicit funds from exiting the ecosystem.Cross-border collaboration and public-private partnershipsGlobal cooperation is critical in the fight against money laundering.Criminals often exploit regulatory gapsbetween jurisd

155、ictions,making coordinated international efforts absolutely essential.This includesMoney Laundering and Cryptocurrency30harmonizing regulations,sharing intelligence,and conducting joint operations.Collaboration between thepublic and private sectors to share information and best practices for combati

156、ng money laundering shouldbe encouraged.Failing to implement robust compliance programs can have irreparable consequences,including regulatorypenalties,loss of consumer trust,and complete exclusion from the financial system.Both traditional andcrypto-native financial institutions must prioritize str

157、ong AML measures to avoid these risks and ensure theintegrity of their operations.The role of technology and innovation in money laundering preventionThe future of crypto investigations and compliance is fundamentally driven by blockchain intelligence andthe power of underlying data to identify susp

158、icious activity for lead generation.Data analysis plays acrucial role in identifying and neutralizing the most pressing threats in the crypto ecosystem a realmwhere a single wallet address can illuminate vast networks of criminal abuse.Balancing privacy and security is essential to protect legitimat

159、e users while preventing misuse.Managingcompliance costs is also critical to avoid disproportionately impacting small businesses and startups,fostering innovation while maintaining regulatory integrity.As the ecosystem evolves,ongoing educationand skill development are also imperative to stay ahead

160、of emerging threats.A deep understanding ofblockchain technology and its intersections with criminal activity enables institutions to implement precisecontrols tailored to their specific risk profiles.Technology empowers institutions to improve efficiency and outcomes while reducing reliance oncumbe

161、rsome reporting requirements.Automated systems can quickly analyze large volumes of data,identify risks,and generate actionable insights,improving overall AML effectiveness.The interplay between blockchain intelligence and data-driven insights is the cornerstone of cryptoinvestigation and compliance

162、.By leveraging advanced technology,managing compliance,and investing ineducation,the crypto ecosystem can achieve a sustainable and secure framework that fosters innovationwhile protecting against illicit activities.Money Laundering and Cryptocurrency31Building trustin blockchainsAbout ChainalysisCh

163、ainalysis,the leader in blockchain intelligence,makes it easy to connect the movement of digital assetsto real-world services.Organizations can track illicit activity,manage risk exposure,and develop innovativemarket solutions with intelligent customer insights.Our mission is to build trust in block

164、chains,blendingsafety and security with an unwavering commitment to growth and innovation.For more information,.FOR MORE INSIGHTSFOLLOW US ON X IN TOUCHFOLLOW US ON LINKEDIN material is not intended to provide legal,tax,financial,investment,regulatory or other professional advice,nor is it to bereli

165、ed upon as a professional opinion.Recipients should consult their own advisors before making these types of decisions.Chainalysis does not guarantee or warrant the accuracy,completeness,timeliness,suitability or validity of the informationherein,and assumes no obligation to update any forward-looking statements to reflect any circumstances that may arise afterthe date such statements are made.Chainalysis has no responsibility or liability for any decision made or any other acts oromissions in connection with Recipients use of this material.