Crypto Layering

In fiat currency money laundering, layering is a series of conversions or movements of funds to distance them from their illicit source. Layering methods include moving funds through different bank accounts, financial institutions, or jurisdictions; converting funds to or from other forms of value such as real estate; or use of opaque structures such as shell companies registered in secrecy jurisdictions. In crypto, comparable methods can be used to “layer” funds during the laundering process.

Most crypto layering activity ultimately relies on one or more of three core strategies:

1. Obscuring Identity
2. Obscuring Transaction Flow
3. Obscuring Jurisdiction

Many sophisticated laundering schemes combine several of these techniques. For example, illicit proceeds might be split (smurfing), moved through a peel chain, passed through a mixer, swapped across multiple blockchains, converted into a privacy coin, and eventually cashed out through a low-KYC exchange. From an AML perspective, the cumulative use of multiple layering techniques is often a stronger risk indicator than any single activity on its own.

1) Obscuring Identity

• Coins with Privacy Features: Some digital assets, such as Monero, have “privacy features” which are designed to conceal the details of the sending wallet, receiving wallet, or transaction amount. The objective is to increase anonymity and reduce traceability.
• Low/No-KYC Exchanges: Legitimate crypto businesses, such as brokerages and exchanges, in well-regulated jurisdictions complete CDD/KYC on their clients. While the wallet is “pseudonymous,” the exchange or brokerage has verified the identity of their client and knows the individual or business who owns/controls the wallet. This information can be provided to investigators. In contrast, unregulated or non-compliant exchanges apply low or no KYC requirements. Illicit actors may use low/no-KYC exchanges to minimize or remove the link between blockchain activity and their real-world identities. For example, crypto exchange Binance, which received regulatory penalties of more than $4 billion in 2023 for AML/CFT failures, permitted clients to trade using only an email address for identification. The Binance platform was used to process funds from terrorists, criminals, and sanctioned entities.[i]

2) Obscuring Transaction Flow

• Wallet-to-Wallet Transfers: Illicit actors may move funds through multiple wallets, often creating new wallets for each transfer. This creates complex transactions chains designed to increase investigative effort.
• Mixers and Tumblers: Mixers and tumblers pool funds from multiple sources and scramble them before redistributing the original amount minus a fee. Even though the blockchain may be public, it is difficult to identify which inbound transactions correspond with the outbound transactions from a mixer/tumbler.
• Peel-Chaining: Illicit actors may structure/smurf transactions by moving high-value funds through a series of wallets, with a small portion “peeled off” at each step while the remainder continues to the next wallet. This effectively breaks up large amounts of cryptocurrencies into smaller amounts through dozens of automated transactions, depositing them into different crypto wallet addresses.
• Chain Swapping (Chain-Hopping): Illicit actors may rapidly move illicit funds across different cryptocurrencies or blockchains to make the trail more difficult to follow as blockchain networks are not interconnected and have varying levels of transparency and monitoring capabilities.
• DeFi Protocols: Whether lending, liquidity pools, yield farming or staking arrangements, illicit actors may use decentralized finance protocols to create complex transaction trails through additional layers and interconnections.
• NFTs: Non-fungible tokens are used to move value, by purchasing NFTs with illicit funds, trading NFTs among controlled wallets or creating artificial transaction histories.

3) Obscuring Jurisdiction

• Cross-Border Transfers: Illicit actors may move assets through exchanges and service providers in multiple countries to exploit regulatory differences and move through weakly regulated environments.
• Offshore Entities: Combining crypto transactions with opaque legal entities including offshore companies, trusts, and complex ownership structures can make establishing beneficial ownership identification more difficult.

Actions for Financial Institutions

Financial institutions and other businesses operating in the crypto economy should ensure that they have crypto-specific controls in place to identify and manage risks, and businesses offering services to crypto clients should undertake detailed due diligence on client compliance programs to ensure their controls are effective, similar to the approach used by a correspondent bank to assess its respondent banks.

In addition to compliance controls applicable to all clients – such as completing KYC/CDD on clients in accordance with regulatory requirements and industry best practices to identify and verify the owner of the wallet – organizations should implement crypto-specific controls.

• Verify ownership/control of the wallet using a “Satoshi test,” if the wallet is self-hosted. A Satoshi test requires a client to transfer a small, randomly-generated amount of crypto from their wallet within a specific timeframe. A client who owns/controls the wallet will be easily able to complete this task.
• Consider whether coins with privacy features will be supported. While there may be some legitimate uses or motivations for using privacy coins, they present a high risk of illicit use compared with other types of crypto. A financial institution may decide that privacy coins are outside its risk appetite and that it will not support trading, custody, or other services.
• Integrate blockchain analytics into their screening and monitoring program. During onboarding and throughout the client lifecycle, client wallets should be screened to ensure they are not sanctioned or linked with illicit activity, such as receiving ransomware payments. Transactions should also be screened to ensure that the FI’s clients are not transacting with wallets that are sanctioned or linked with illicit activity.
• Establish policies for client activity which is higher risk – even if not provably illicit – such as sending or receiving funds from mixers/tumblers. Although using a mixer/tumbler is not usually illegal (unless the mixer/tumbler is sanctioned), it presents a higher risk that the crypto is the proceeds of criminality. Financial institutions should establish whether this is acceptable, ensure requirements are set out in client terms and conditions, monitor for non-compliance, investigate and report unusual activity, and consider client exit where appropriate.

As crypto becomes increasingly integrated into criminal organizations and laundering networks, financial institutions must be alert to these evolving methodologies and ensure their risk management programs adapt to include crypto-specific measures including policies and processes, technology, and training – as well as ensuring they apply an integrated and cross-functional approach. By doing so, financial institutions will be more effective at identifying illicit crypto activity while gaining the advantages of blockchain for their investigations, and supporting the commercial benefits of meeting the demand for crypto products and services.

[i] https://www.justice.gov/archives/opa/pr/binance-and-ceo-plead-guilty-federal-charges-4b-resolution