Cryptocurrency Money Laundering Red Flags
40+ red flags for detecting money laundering in cryptocurrency transactions. Drawn from FIN-2019-G001, FIN-2021-A004, and FinCEN virtual currency guidance — each record shows its attribution tier.
Cryptocurrency Money Laundering Red Flags: What Compliance Officers Need to Know
Cryptocurrency money laundering red flags are on-chain and customer behaviors that may indicate illicit use of virtual assets. Common examples include deposits routed straight to mixers or privacy coins, chain-hopping across blockchains, and rapid crypto-to-fiat conversion with no trading history. Each indicator is weighed in context before a filing decision.
Cryptocurrency exchanges and virtual asset service providers (VASPs) face rapidly evolving money laundering threats that traditional financial institutions rarely encounter. FinCEN's FIN-2019-G001 guidance on convertible virtual currencies, the ransomware advisory (FIN-2021-A004), and the 2024 deepfake fraud alert (FIN-2024-Alert004) together provide the regulatory framework for detecting illicit activity in blockchain-based transactions.
The unique characteristics of cryptocurrency - pseudonymous wallet addresses, cross-border accessibility, decentralized exchanges, privacy coins, and mixing services - create both opportunities for legitimate innovation and channels for money laundering, sanctions evasion, terrorist financing, and ransomware payment processing.
This page covers the most critical cryptocurrency money laundering red flags, including mixer/tumbler usage, privacy coin conversions, chain-hopping across multiple blockchains, wash trading, synthetic identity KYC fraud, account takeover patterns, and sanctions evasion through exchange hopping and VPN-enabled access.
41+ BSA Red Flags
Customer provides a government-issued ID that fails automated verification checks, with the photo showing signs of AI-generated manipulation or deepfake alteration.
Customer passes initial KYC with a real SSN but fabricated supporting documents, creating a synthetic identity that only fails when cross-referenced with credit bureau or tax records.
Customer’s account is accessed after credential stuffing attack, with login from a new device and immediate withdrawal of all funds to an external wallet not previously associated with the account.
Customer deposits virtual currency and immediately sends it to a mixing service, tumbler, or privacy-enhancing wallet that obscures the transaction trail on the blockchain.
Customer repeatedly conducts transactions just below the exchange’s reporting or recordkeeping thresholds, suggesting intentional structuring to avoid compliance detection.
Customer deposits virtual currency traced to a known darknet marketplace, ransomware wallet, or sanctioned address, and attempts to trade or withdraw the funds immediately.
Customer uses a privacy coin (e.g., Monero, Zcash) to convert from a transparent blockchain to an obfuscated one, with the original funds traceable to a sanctioned jurisdiction or SDN-listed entity.
Business customer routes cross-border payments through multiple cryptocurrency exchanges in different jurisdictions to avoid sanctions screening and regulatory reporting in their home country.
Exchange customer sends funds to a smart contract address linked to a decentralized mixer or cross-chain bridge known to be used by sanctioned entities to obfuscate transaction origins.
Customer’s account receives a large deposit of virtual currency shortly after a known exchange hack, with the incoming funds traceable to the hacker’s wallet address published in breach disclosures.
Business customer receives virtual currency from a ransomware payment wallet and immediately converts it to fiat, with no prior history of providing cybersecurity or incident response services.
Customer’s 2FA is bypassed through SIM swap or phishing, resulting in unauthorized withdrawal of all virtual currency holdings to an external wallet with no transaction history.
What to Do When a Red Flag Appears
Not every red flag is suspicious activity, and a single indicator never automatically requires a Suspicious Activity Report. What matters is a consistent, documented process for evaluating indicators before deciding whether to escalate or file. The steps below describe that process.
- 1
Observe and record
Capture what you saw: the customer, the transaction, the amount, the date, and the specific indicator that caught your attention. Contemporaneous notes are far more useful than a reconstruction weeks later.
- 2
Compare against the expected profile
Weigh the activity against what you already know about the customer, their business, and their normal transaction pattern. A single red flag outside context means much less than a pattern that contradicts the profile.
- 3
Investigate before deciding
A red flag is a reason to look closer, not a conclusion. Gather the supporting facts, ask reasonable questions, and review related activity across accounts, products, and time periods.
- 4
Escalate through your procedure
Route the review to your designated compliance officer or BSA officer using the escalation path documented in your program. Staff should never be left to decide on their own whether to report.
- 5
Document the decision and the reasoning
Whether you file or not, write down what you found, what you concluded, and why. Examiners look for a documented, consistent decision process, not a perfect outcome on every case.
- 6
File a SAR when the facts support it
If the facts meet the filing threshold and suggest illegal activity, evasion of the BSA, or no apparent lawful purpose, file the Suspicious Activity Report within the required timeframe. Filing is confidential.
- 7
Retain records for the required period
Keep the investigation notes, supporting documents, and a copy of any SAR filed for at least five years, consistent with BSA recordkeeping expectations for your industry.
This is an educational framework, not legal or regulatory advice. Your program and your regulator determine the exact escalation, filing, and retention requirements that apply to your business.
More AML Red Flags by Industry
Common Questions About Cryptocurrency Money Laundering Red Flags
What are the top cryptocurrency money laundering red flags?
The top crypto money laundering red flags include: customers depositing funds and immediately sending them to mixing services or privacy coins; transactions just below exchange reporting thresholds; funds traced to known darknet marketplaces or ransomware wallets; rapid cross-blockchain transfers (chain-hopping) through decentralized bridges; round-dollar stablecoin velocity with no commercial purpose; and VPN or Tor exit node access from high-risk jurisdictions.
Do cryptocurrency exchanges have to file SARs?
Yes. Under FinCEN's 2013 guidance and FIN-2019-G001, cryptocurrency exchanges operating in the U.S. are classified as money services businesses (MSBs) and must comply with all BSA requirements including SAR filing, CTR filing, and maintaining a written AML program. Exchanges must file SARs for suspicious transactions of $2,000 or more.
What is a "mixer" or "tumbler" and why is it a red flag?
A mixer (or tumbler) is a service that pools cryptocurrency from multiple users and redistributes it to obfuscate the transaction trail on the blockchain. While mixers claim legitimate privacy purposes, FinCEN has identified them as primary tools for money laundering and sanctions evasion. Customers who deposit crypto and immediately send it to a mixer or privacy coin wallet should be considered high-risk and potentially reported via SAR.
How do criminals use privacy coins for money laundering?
Privacy coins like Monero and Zcash use advanced cryptographic techniques to hide transaction amounts, sender addresses, and recipient addresses on their blockchains. FinCEN's sanctions evasion advisories note that sanctioned individuals and entities increasingly convert transparent cryptocurrencies (like Bitcoin) to privacy coins to break the audit trail before cashing out through offshore exchanges with weak AML controls.
What are chain-hopping and cross-chain bridge red flags?
Chain-hopping involves moving funds across multiple blockchains (e.g., Bitcoin → Ethereum → Solana) using decentralized cross-chain bridges to obscure the transaction trail. Red flags include customers who deposit funds, trade through multiple altcoin pairs with no apparent investment strategy, and withdraw to a different wallet in a different jurisdiction - all within minutes or hours.
More BSA Red Flags & Compliance Resources
Money Laundering Red Flags
427+ money laundering indicators organized by the three stages: placement, layering, and integration. Each flag cites a FinCEN or federal so...
FinCEN Red Flags for Fintech Companies
35+ BSA red flags for fintech companies under 31 CFR § 1022. Drawn from FIN-2020-A007, the 2024 Financial Trend Analysis on identity, and Fi...
BSA Red Flags List
427+ Bank Secrecy Act red flags covering every compliance category, industry, and risk level. Each flag cites a FinCEN, FFIEC, or federal so...
AML Red Flag Library
Browse all 427+ BSA red flags across 13 regulated industries. Searchable by keyword, filter by category, industry, or risk level.
Explore related AML-BSA compliance resources
Regulatory sources and guidance
Official Guidance
The indicators on this page draw on primary FinCEN, FFIEC, and federal regulatory material rather than third-party commentary. Always confirm current requirements against the official source.
FinCEN FIN-2019-G001 ("Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies") explains when virtual currency businesses are money transmitters, what an administrator or exchanger must do to comply with the BSA, and the AML program, registration, reporting, and recordkeeping obligations that apply to convertible virtual currency activity.
OFAC administers and enforces U.S. economic and trade sanctions. All U.S. persons, including nonprofits, must comply with OFAC sanctions. Screening donors, grantees, vendors, and counterparties against the SDN List and other sanctions lists is the standard control, and they may need an OFAC license before operating in or sending funds to comprehensively sanctioned jurisdictions.
31 U.S.C. § 5318(h) is the statutory basis requiring every "financial institution" to establish anti-money laundering programs. This Bank Secrecy Act provision is the foundation for all industry-specific AML regulations issued by FinCEN, including those for MSBs, mortgage lenders, casinos, and insurance companies.
FinCEN publishes advisories, alerts, and guidance that describe the red flags and typologies for specific financial crimes, industries, and emerging threats. Advisories are the primary source for industry-specific suspicious activity indicators and are frequently updated as new schemes emerge.
Knowing the red flags is only part of an effective AML program
For virtual asset businesses, red flag monitoring is most effective when paired with a written AML program, blockchain analytics, and training on emerging typologies such as mixers, bridges, and sanctions evasion.
Browse All 40+ Cryptocurrency Red Flags
Access the complete AML Red Flag Library with 427+ BSA red flags. Filter by crypto-specific categories including mixers, privacy coins, ransomware, and sanctions evasion.