Crypto and Digital Assets

Sequences of small value-varying transactions preceding a step change in volume, activity that settles just below alerting thresholds across several distinct rules at once, and customers whose behaviour changes within days of a rule being retuned.

Small repeated payments, often at unusual hours, to money transfer beneficiaries in a small number of jurisdictions with no family or trade connection to the customer; use of prepaid instruments or virtual assets by a customer with no other digital activity; and payment values clustered in narrow bands.

Statements with no fees or charges across months, running balances consistent to the penny, logos at incorrect aspect ratio, institution codes in the wrong format, identity photographs internally inconsistent or inconsistent with stated age, third-party webcam plugins during liveness checks.

Emulator and virtual-camera artefacts in the capture stream, device and app-integrity signals that contradict a genuine handset, repeated onboarding attempts from the same device fingerprint under different identities, and capture metadata inconsistent with the phone the customer claims to hold.

Thin-file customers who behave impeccably for months, clusters sharing partial attributes such as address, device or contact details, credit files that begin abruptly in adulthood, and accounts whose only real purpose emerges long after onboarding.

Transaction sequences with machine timing and sizing characteristics, activity that reshapes itself shortly after a control is changed, and volumes of small movements that exceed what any manual operation could sustain.

For a VASP: deposits whose immediate provenance is a bridge or DEX contract rather than an identifiable counterparty, and short holding times between receipt and onward swap. For a bank: fiat settlement from an exchange whose own inbound provenance cannot be evidenced.

Fiat on-ramp and off-ramp volumes at exchanges and OTC desks, and customers whose banked income disappears while spending continues. The settlement itself never touches the banking system.

Exposure is indirect and sits at the fiat edges: payment institutions, exchanges and correspondent relationships with entities in the group's network. The prohibition itself is the compliance obligation.

Victim-side outbound payments escalating over weeks to newly added payees and exchange accounts, followed by indemnity claims and recall requests once the victim realises. The collection accounts show inbound from many unconnected individuals.

For a VASP: deposits with mixer-adjacent provenance, or swap history through privacy assets. For a bank: exposure arrives already laundered, at the off-ramp.

Victim-side: an urgent, unexplained payment to an exchange or a specialist incident-response intermediary. Insurer and IR-firm accounts are a concentration point.

ATM operator and OTC broker settlement accounts with cash deposit volumes inconsistent with a retail customer base, and customers whose card spending continues after banked income stops.

A single institutional customer whose deposit and withdrawal counterparties number in the thousands, activity patterns inconsistent with a single beneficial owner, and onward flows to jurisdictions the customer does not operate in.

Numerous customers each receiving modest, regular exchange settlements with no other economic profile, sharing device, address or beneficiary characteristics.

Marketplace settlement receipts where buyer and seller are ultimately the same interest, and gaming or marketplace platform accounts with volumes unrelated to any player base.

The same tooling signature across customers with no other connection: identical document templates, shared device or capture characteristics, and mule accounts appearing in coordinated batches rather than individually.

Small recurring outbound payments to campaigns, appeals or virtual asset addresses associated with proscribed causes; a charity whose disbursement pattern does not match its stated programme; and clusters of small transfers converging on a single beneficiary.

For VASPs: deposits traceable to designated addresses, and institutional counterparties who cannot evidence their own inbound provenance. For banks: correspondent exposure to intermediaries in the cash-out chain.

Payroll and contractor payments to accounts whose device and location signals contradict the stated worker location, several apparently unrelated contractors sharing payment infrastructure, and rapid onward transfer of net pay.