Red flags and typologies

Monitoring scenarios are only as good as the typologies behind them. A compliance team that cannot describe what laundering through its platform would look like cannot design rules to catch it, train analysts to recognize it, or show a supervisor that its coverage is complete. This lesson starts from the FATF list of red flags for virtual assets and turns seven common patterns into signals an analyst can test.

The FATF Red Flag Indicators

In September 2020 FATF published Virtual Assets: Red Flag Indicators of Money Laundering and Terrorist Financing, built from more than 100 case studies contributed by jurisdictions between 2017 and 2020. It groups the indicators under six headings:

The report makes two points that matter for practice. The list is not exhaustive, and no single indicator proves criminal activity: anonymity features, for instance, have legitimate uses. Indicators are reasons to look closer and to ask for an explanation, and they gain weight in combination and against the customer's profile.

From indicators to scenarios

A red flag becomes useful when it is mapped to data the firm holds and a response it can take. A simple typology map for each pattern records: the indicators involved, the data needed (on-chain, fiat, device, profile), the scenario or analytics model that covers it, and the investigation steps. The same map is the basis for the coverage assessment described in the lesson Tuning, metrics and model governance. Other FATF work adds typology detail, for example Countering Ransomware Financing (March 2023), which came with a list of potential risk indicators, and Illicit Financial Flows from Cyber-Enabled Fraud (November 2023), produced with the Egmont Group and INTERPOL.

Seven worked patterns

Structuring

Structuring splits value to stay below a threshold: the Travel Rule de minimis, an internal enhanced-review limit, an identity-verification tier or a reporting threshold. Signals include repeated transfers in a narrow band just below the limit, splitting one amount across several accounts or withdrawal addresses, and spreading transfers across days. A rule can count transfers between 80% and 100% of a threshold per customer per week. The innocent explanation is a product limit, such as a crypto ATM or card cap, which the analyst can check. Note that publishing internal thresholds to customers invites structuring around them.

Rapid in-and-out

Funds arrive and leave quickly with little or no trading: the platform is used as a pass-through to break the trail or to convert between assets and rails. Strong forms are crypto in and fiat out to a newly added bank account within hours, or fiat in and crypto out to an address never used before. Arbitrage traders and market makers also move fast, so the scenario needs segmentation, and the customer's declared activity is the first thing to check. The lesson Transaction monitoring for crypto businesses shows this scenario written as a SQL rule.

Peel chains to exchanges

In a peel chain, a large balance moves through a long sequence of transactions; each one "peels" a small amount to a destination, often an exchange deposit address, and sends the rest to a fresh address that repeats the process (see the IDFE-BA lesson Graph metrics and patterns). Public reporting on large thefts, including those attributed to DPRK-linked actors, has described peel chains feeding many exchange accounts. On an exchange, the signal is deposits whose backward trace leads to links in one chain, possibly across several customer accounts at once. A cluster of unrelated customers receiving peels from the same source points to a coordinated cash-out network rather than independent users.

Money mules

Money mules receive and pass on criminal proceeds, knowingly or not. In crypto they often open accounts in their own names, receive fiat from fraud victims or third parties, buy crypto and send it to an address provided by a controller. Signals: many unrelated fiat payers into one account; several accounts withdrawing to the same external address; shared devices, IP addresses or phone numbers across accounts; profiles that do not fit the volumes (students, recent arrivals, retirees); and accounts sold or rented, visible as a sudden change of device and location after onboarding. Mule networks are best found with network analysis linking accounts by shared attributes and shared counterparties, not by rules on one account at a time.

Investment and romance scams ("pig butchering")

In these scams a victim is groomed for weeks through social media, dating apps or "wrong number" messages, then persuaded to buy crypto on a legitimate exchange and send it to a fake investment platform that displays invented profits. Small early withdrawals build trust; larger deposits follow, and finally "fees" or "taxes" are demanded to release funds. UN reporting has linked large scam centers to human trafficking.

For a VASP whose customer is the victim, signals include a new customer with no crypto experience; large fiat deposits from savings, loans or retirement funds; immediate purchase of a stablecoin and withdrawal to a new external address; rising amounts at regular intervals; and destination clusters attributed to scams. The customer may be coached to say the transfers are their own investment. Responses are protective as well as reporting-related: in-app warnings, a call from a trained team, and holding a withdrawal while the risk is explained, all recorded. Here the customer is the victim, not the suspect, but the firm should still avoid disclosing any report it files.

Ransomware payments

Two sides are visible. A victim organization, often via an incident-response intermediary, makes an urgent first-time purchase of a large amount of crypto and sends it to one address. The criminal side receives funds, splits them, and moves them through mixers, privacy coins, chain hops or high-risk exchanges; FATF's 2020 indicators note that a staggered pattern followed by long inactivity is common in ransomware cases. For deposits, the key control is exposure to ransomware clusters in analytics. Some ransomware actors are designated, so the sanctions controls in the lesson Sanctions risks specific to crypto apply as well.

Nested exchanges

A nested exchange is a service that runs its business through an account at another VASP to use its liquidity or fiat access, while its own customers remain invisible to the host. Signals: an account registered as an individual or small company whose deposits come from thousands of unrelated senders; frequent sweeps out to a few addresses; an inflow exposure profile resembling an exchange; and counterparties in high-risk jurisdictions. The host is effectively providing correspondent-style services to an unknown VASP without due diligence. Typical outcomes are restriction, a request for licensing and AML evidence, exit, and consideration of a report.

Judging a pattern

For each pattern the analyst asks the same questions: Does the activity fit the customer's stated purpose and profile? Is there a credible innocent explanation, and can it be evidenced? How many independent indicators are present? What did the funds do before arrival and after departure? The answers determine whether the alert is closed, investigated further or escalated, as described in the lesson Alert triage and investigation.

Exam focus: the September 2020 FATF Red Flag Indicators and their six groups, with examples in each; that the list is not exhaustive and no single indicator proves crime; mapping indicators to data, scenarios and investigation steps; the signals and innocent explanations for structuring, rapid in-and-out, peel chains, money mules, pig-butchering scams, ransomware and nested exchanges; network analysis for mule detection; protective responses when the customer is a scam victim.