Suspicious activity reporting · Lesson 3 of 5
Freezes, law-enforcement requests and asset recovery
7 min read
After a theft, a ransomware attack or a large fraud, stolen crypto-assets can cross several chains and services within hours, and the moments when they pass through a regulated provider are the main chances to stop them. A VASP that handles requests and freezes well helps return funds to victims; one that handles them badly either lets the funds go or freezes customers' assets without a sound basis. This lesson covers the operational side: requests, holds, issuer freezes, seizure transfers and cooperation.
Types of requests
Authorities contact VASPs through several channels, and each has a different legal basis and urgency. The details are national, but the categories are common.
| Request | Typical purpose | Key handling points |
|---|---|---|
| FIU request for additional information | Follow-up on a report, or analysis of another firm's report | FATF R.29 lets the FIU obtain additional information from reporting entities; usually a deadline; confidential |
| Production order or information request | Customer records, transaction history, IP and device data for an investigation | Check legal basis, scope and issuing authority; produce only what is asked |
| Preservation request | Keep records that might otherwise be deleted, pending a formal order | Apply a legal hold; preserve before the formal order arrives |
| Freeze, restraint or seizure order | Stop movement of identified assets, or transfer them to the authorities | Act immediately once verified; record balances and time of action |
| Emergency disclosure request | Imminent threat to life or serious harm | Narrow, fast, documented; formal process follows |
| Foreign request | A foreign authority seeks data or a freeze | Usually must come through domestic channels such as mutual legal assistance or the local FIU |
Every request goes through the same steps: log it, verify it, review it legally, act within scope, record what was done, and respect any non-disclosure condition. Requests are confidential in the same way as reports; the customer is not told unless the law and the authority allow it.
Verification deserves emphasis. Criminals send forged "police requests" and fake court orders to obtain customer data or to have a competitor's account frozen. Verify through a channel the firm finds independently (the authority's published contact, a known liaison officer, a secure portal), never only through details in the request itself.
{
"request_id": "LER-2026-0381",
"received": "2026-10-14T08:22:00Z",
"type": "freeze_order",
"issuer": "competent authority, Country B",
"verified_via": "call-back to published switchboard, officer ID confirmed",
"legal_review": "in scope; domestic recognition confirmed",
"assets": [{"customer_id": "C-77310", "asset": "USDC", "amount": "48,215.00"}],
"action": "account frozen 2026-10-14T09:05:00Z; balances recorded",
"non_disclosure": true,
"related_str": "STR-2026-1172"
}The register entry records when the request arrived, how authenticity was confirmed, the legal view, exactly which assets were affected, and when the action took effect. Linking it to a related report helps later reviews and management information.
Voluntary freezes and holds
Not every freeze starts with an order. A VASP may learn of stolen funds from a victim, another exchange, an industry alert or its own monitoring, often before any authority has acted. Whether the firm can hold the funds depends on national law and on its customer terms, which usually allow it to suspend activity during a compliance review. Some authorities can also suspend transactions themselves: the FATF revisions to the asset recovery standards in October 2023 added a power for competent authorities to suspend transactions linked to money laundering, terrorist financing and serious crime, and made non-conviction-based confiscation a requirement.
A voluntary hold is a risk decision that must be documented.
| Situation | Typical action |
|---|---|
| Credible theft alert; deposit traced directly from the theft address | Hold the deposited amount, investigate, report to the FIU, contact the authorities |
| Victim claim with transaction evidence; funds traced through several hops | Hold pending review if the trace is strong; ask the victim to report to the police; file a report if suspicion is formed |
| Unverified claim, weak or long trace | Do not freeze; flag the account for monitoring and record the claim |
| Funds from a designated address | Sanctions procedure: freeze and report as the regime requires |
Holds should be proportionate (the traced amount, not the whole account where avoidable), time-limited, and reviewed. A hold that becomes indefinite without any authority acting exposes the firm to complaints and litigation. It also raises tipping-off questions, since the customer will notice; staff use neutral wording.
Stablecoin issuer freezes
Many fiat-backed stablecoin contracts include administrative functions that let the issuer block an address from transferring tokens and, in some designs, burn and reissue them. FATF's targeted report on stablecoins and unhosted wallets (3 March 2026) noted that some jurisdictions require issuers to build such programmable controls, including freezes and deny-lists, so they can act in the secondary market.
For a VASP, issuer freezes matter in two ways:
- When funds are outside the VASP. If stolen stablecoins sit in an unhosted wallet, only the issuer can stop them. The VASP's useful contribution is fast, precise information to the authorities: the token contract, the chain, the addresses and txids, and the trace. Issuers usually act on requests from law enforcement under their own policies.
- When the VASP holds tokens at a blocked address. The firm's own wallet may be caught by an issuer freeze, for example a deposit address that received stolen funds. Treasury and compliance need a procedure to identify affected balances and customers.
Limits are real. Not all tokens can be frozen; criminals swap stablecoins into native assets or privacy-focused coins quickly; and an issuer freeze locks the tokens without returning them to anyone. Recovery still needs a legal process.
Seizure cooperation
When an authority orders seized assets transferred to it, the VASP moves value on-chain, so the process needs the same discipline as any treasury operation. FATF's Asset Recovery Guidance and Best Practices (November 2025) treats recovery from exchange-held wallets as one of the main routes for seizing virtual assets, alongside obtaining private keys and issuer freezes, and stresses speed and secure custody once assets are seized. A sound procedure includes:
- Verify the order and the destination address directly with the authority, through an independent channel.
- Confirm the exact assets, amounts and chains, including tokens and any accrued rewards.
- Send a small test transaction and have the authority confirm receipt.
- Execute the main transfer under dual control, from a segregated wallet if possible.
- Record txids, block heights, amounts and fees, and give the authority a signed confirmation.
- Update the customer account and keep the records with the order.
Cross-border cooperation
Crypto cases are almost always international, but a VASP should not answer foreign authorities directly unless its own law allows it. Cooperation runs through official channels: FIU-to-FIU exchange through the Egmont Group, police-to-police channels such as INTERPOL, and mutual legal assistance for formal evidence and confiscation (FATF Recommendations 37, 38 and 40). Mutual legal assistance can be slow, so authorities first ask for preservation or an urgent freeze, and some cybercrime treaties provide for expedited preservation of data.
A VASP can make cross-border work faster by publishing a law-enforcement contact point, answering domestic requests quickly, keeping records retrievable, and filing reports that name foreign counterparties clearly, so its own FIU can pass them on.
Working with victims and partnerships
Victims often contact the VASP that received their funds. Staff should treat them carefully without promising recovery: take the facts and transaction evidence, explain that the firm cannot share information about another customer, and urge a report to the police. Victims are a prime target for recovery scams, in which fraudsters pose as investigators or lawyers offering to retrieve funds for a fee; warning victims about them is part of good practice.
Public-private partnerships let authorities and firms share information faster than case-by-case requests allow, within the limits of national law. Some focus on tactical cases (live thefts, specific networks), others on strategic typologies. Industry alert channels between exchanges after major hacks work on the same principle. The theft of about USD 1.46 billion from the exchange Bybit in February 2025, attributed to North Korean actors, illustrated both sides: some funds were frozen by exchanges and issuers, but most were moved through swaps, bridges and brokers before they could be stopped. Speed, verified information and ready procedures decide outcomes.
Exam focus: the main request types (FIU follow-up, production, preservation, freeze or seizure, emergency, foreign) and the common handling steps; verifying requests through independent channels because forged requests exist; when a voluntary hold is reasonable and how to keep it proportionate and documented; the October 2023 FATF asset recovery changes (power to suspend transactions, non-conviction-based confiscation); what stablecoin issuer freezes can and cannot do and the VASP's role; a controlled seizure transfer with test transaction and records; why foreign requests go through official channels; protecting victims, including from recovery scams, and the role of public-private partnerships.