• Since cryptocurrency started showing up on the radars of traditional financial institutions, for many banks, they may view every transaction with the same risk lens – high, and report the incident with a weighting more focused on virtual value alone.
• But that may be a mistake, as a transaction between a brick-and-mortar bank account and a crypto exchange may be cover for a range of interlinked illicit activities, including human trafficking, if financial crime compliance professionals know how and where to look.
• By not analyzing bitcoin transactions in the context of the account activity as a whole, financial institutions may find themselves over-escalating alerts associated with cryptocurrency.
• At the same time, banks may be filing suspicious activity reports (SARs) with cryptocurrency transactions inaccurately being attributed to the wrong typologies or without even a specific typology stated – and missing underlying connections to trafficking networks.

By Seth Sattler
BSA Officer DigitalMint, Experteer, ATII, Founding Member, Anti-Human Trafficking Cryptocurrency Consortium (ATCC)

With editing and minor content additions by ACFCS VP of Content, Brian Monroe and contributions by Aaron Kahler, subject matter expert and founder and Chief Executive Officer, Anti-Human Trafficking Intelligence Initiative (ATII)

How to contextualize cryptocurrency transactions in a traditional depository account to assist with the proper identification of suspicious activity as it relates to human trafficking and sexual exploitation

Since cryptocurrency started showing up on the radars of traditional financial institutions, for many banks, they may view every transaction with the same risk lens – high, and report the incident with a weighting more focused on virtual value alone.

But that may be a mistake, as a transaction between a brick-and-mortar bank account and a crypto exchange may be cover for a range of interlinked illicit activities, including human trafficking, if financial crime compliance professionals know how and where to look.

But from the perspective of some banks, each crypto-tinged transaction, regardless of the context provided by the customer’s know-your-customer (KYC) information – a foundational block of any institution’s anti-money laundering program – and account history, was assumed to represent the red flags of a potential crime.

Well, that is, according to at-times alarmist news articles, blog posts, and guidance from outside consultants about the supposed rampant infiltration of the crypto sector by organized criminal groups, darknet markets and malicious and malignant hacking collectives.

However, by not analyzing bitcoin transactions in the context of the account activity as a whole, financial institutions may find themselves over-escalating alerts associated with cryptocurrency.

At the same time, banks may be filing suspicious activity reports (SARs) with cryptocurrency transactions inaccurately being attributed to the wrong typologies or without even a specific typology stated – and missing underlying connections to trafficking networks.

Banks also realize human trafficking is big business, minting slave traders some $150 billion worldwide per year.

Over the last decade, more individual banks, country financial intelligence units, regulators, investigators and watchdog groups have been working together to divine what tactics trafficking groups are using to monetize human suffering, move funds and support and grow their illicit networks.

At the global level, the Paris-based Financial Action Task Force (FATF), the international counter-crime compliance standard-setting body, has released several in-depth reports on how trafficking groups are capturing revenue and laundering the proceeds.

The most recent report in 2018 analyzed the money laundering risks tied to human trafficking and human smuggling and yielded insight on related financial flows, including regions at a higher risk for such crimes, such as source countries and destination countries.

As well, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) has highlighted that trafficking groups are more aggressively using “alternative” payment mechanisms, including virtual currency, prepaid cards and third-party payment processors – in some cases all three at the same time.

The following article will take a look at how crypto transactions, when viewed in the context of other account activity, can assist with the prevention of human trafficking.

As well, such a stratagem can do so while decreasing unneeded escalations and inaccurate SAR filings associated with crypto-currency transactions – a move that could help financial institutions better manage sparse investigative resources.  

In its October 2020 report, which builds on a seminal 2014 advisory by the bureau tied to HT and human smuggling, FinCEN detailed potential suspicious activities that institutions could see in AML transaction monitoring systems and even in human interactions at the teller level.

FinCEN specifically highlighted red flags and case studies involving crypto and human trafficking, including: “A customer frequently sends or receives funds via cryptocurrency to or from darknet markets or services known to be associated with illicit activity,” according to the bureau.

“This may include services that host advertising content for illicit services, sell illicit content, or financial institutions that allow prepaid cards to pay for cryptocurrencies without appropriate risk mitigation controls.”

But when it comes to filling their coffers, traffickers prefer to obfuscate the money trail.

In addition to payment via cash, “traffickers also have accepted payment via credit cards, prepaid cards, mobile payment applications, and convertible virtual currency,” according to the FinCEN.

“Buyers of commercial sex use prepaid cards—a method of payment using funds paid in advance, which can be acquired anonymously with cash or on darknet websites—to register with escort websites and to purchase sexual services, flights, throw-away phones, and hotel rooms.”

But how do these trafficking groups even connect with buyers? They buy ads.

“Illicit actors also use virtual currency to advertise commercial sex online,” according to the FinCEN advisory, noting that in recent years trafficking groups swim together multiple nebulous payment types to maximize anonymity, including prepaid cards, peer-to-peer, or P2P crypto exchanges and the like to fool AML teams.  

For example, human traffickers have “purchased prepaid cards, and then used the cards to purchase virtual currency on a peer-to-peer exchange platform,” FinCEN stated.

“Human traffickers then use the virtual currency to buy online advertisements that feature commercial sex acts to obtain customers.”

FinCEN also has identified transactions in which human traffickers use “third-party payment processors (TPPPs) to wire funds, which gives the appearance that the TPPP is the originator or beneficiary of the wire transfer and conceals the true originator or beneficiary.”

The tactics can allow trafficking groups, in some cases, to never leave a given region, using cam sites and TPPPs to move funds with nary a second glance from banks.

“For example, human traffickers facilitate payments via TPPPs for the operation of online escort services and online streaming services that use voice-over Internet protocol technology,” FinCEN stated in the advisory. “Human traffickers and their facilitators use TPPPs to wire funds to individuals or businesses both domestically and abroad.”

The advisory called out a recent case study where a group used crypto and prepaid cards to fund operations.

Here are the details:  

In April 2016, law enforcement agents from Homeland Security Investigations (HSI) in El Paso, Texas, responded to a call made to local police regarding a woman who was being forcibly held by an individual identified as “Tae” at a motel.

Officers discovered two adult victims when they searched the motel room. Police located William “Tae” Harris, who was stopped while driving a suspect vehicle in the area.

He possessed a semi-automatic firearm. Harris and his passenger, Dean Hall, were members of the West Side City Crips gang from Phoenix, Arizona. The subsequent HSI investigation revealed that Harris and Hall brought the victims to Texas from Arizona, where the victims were forced into prostitution, beaten, and suffered threats of violence.

HSI determined that at least three other West Side City Crips were operating a prostitution scheme in El Paso.

During a forensic extraction of Harris’ mobile phone, HSI discovered bitcoin transaction data and was able to exploit Harris’ bitcoin wallet information. Evidence revealed that the group’s illicit activity revolved around the purchase of Vanilla Visa prepaid credit cards, which were then used to purchase bitcoin on the Paxful virtual currency exchange.

Those bitcoins were used to purchase prostitution ads on the now defunct Backpage.com.

Furthermore, during Harris’ prosecution, HSI uncovered and disrupted an attempted murder for-hire in which Harris planned to have a key witness and her sister murdered.

In January 2018, Hall and Harris were convicted and sentenced for violating several antitrafficking statutes. Hall was sentenced to 90 months’ imprisonment and five years of supervised release, and Harris was sentenced to 180 months’ imprisonment and ten years of supervised release.

When cryptocurrency first gained mainstream exposure, its notoriety primarily stemmed from news stories detailing every way a criminal could use it to better facilitate criminal activity.

With the public rise and fall of darknet websites, exchanges flaunting minimal KYC requirements, banks banning crypto activity, and articles being published daily about the newest criminal enterprise using cryptocurrency, perception of transactions involving cryptocurrency started to move towards the transactions being the nefarious activity and not a red flag suggesting the presence of illicitly-gained value.

It was this altering of perception that assisted in creating gaps in coverage when the intention of any implemented investigative policy and procedure involving crypto monitoring was to enhance transaction monitoring.

At the same time, better parsing out the nuances tied to a crypto transaction could also help law enforcement investigators as rather than filing a SAR highlighting a transaction is simply linked to the virtual asset world, you can produce a filing that better details related counterparties, exchanges used, regions and even IP and Bitcoin addresses.

As cryptocurrency gained traction in the financial world and access to bitcoin became more widespread (See: Exchanges, bitcoin ATMs or BTMs, etc.) and criminal enterprises started shifting from more traditional financial products (See: Paypal, Venmo, Western Union, MoneyGram, etc.) to cryptocurrency it was inevitable that the human trafficking industry would begin to utilize it.

The pseudo-anonymous nature, quick access to exchanges in numerous countries, little to no cross border transaction controls, and countless crypto companies having minimal KYC and AML controls in place made it an ideal product for the illicit industry.

However, potentially the most beneficial aspect of using cryptocurrency was that, due to banking perceptions of the new currency, it inadvertently further hid the nature of the transaction.

By using cryptocurrency as an offender, a pattern of transaction history that would otherwise suggest human trafficking would be overshadowed by the cryptocurrency and the focus on investigations would turn to risks solely associated with crypto.

This focus would result in Suspicious Activity Reports (USA-FinCEN) and Suspicious Transaction Reports (Canada-FINTRAC) being primarily filed due to cryptocurrency transactions in the account as that is what would be potentially deemed suspicious by an investigator.

Once this report is analyzed by law enforcement, typically an investigative body with more training and exposure to cryptocurrency, the lack of red flags addressed in the report outside of the crypto transactions could result in the noted suspect being overlooked.

In order to negate this potential oversight, financial institutions need to view cryptocurrency as a financial product that, when in tandem with other known red flags associated with specific typologies, could suggest illicit activity but is not illicit on its own.

For the purpose of human trafficking, it must be noted that cryptocurrency could be used as payment to the trafficker, remittance of funds to a “leader,” and/or dispersion of profits to all involved in trafficking the individual, which would typically be periodic large cryptocurrency purchases and remittances.

Additionally, cryptocurrency could be used for payments to ad sites, pornography sites, and activities related to nightly prostitution, which all would typically involve more frequent low dollar transactions.

The result: a variety of transaction amounts and frequencies, at all times of the day, that all may be indicative of human trafficking.

Banks should also, as part of their due diligence on direct virtual exchange customers or even exchanges depositing and withdrawing from customer and corporate accounts, risk rate those exchanges through the vantage point of human trafficking regional hubs, including source countries, transit routes and destination jurisdictions.

That could help an institution understand when a virtual exchange could be – wittingly or unwittingly – heavily transacting with regions and entities at a higher risk for human trafficking or displaying related red flags.

A recent FATF report highlighted how and where traffickers are ensnaring victims in a given region and international funding and corporeal flows.

Here is a snapshot:  

Transnational trafficking flows are increasingly complex – victims are exploited within and between regions.

While many countries are source and destination countries, most countries tend to be either predominantly a source or predominantly a destination of trafficking victims.

The United Nations Office on Drugs and Crime (UNODC) found most victims detected were trafficked within the same geographical region.

For the majority of detected victims of transnational trafficking identified in the UNODC’s study, the origin country was in the same geographical region as the destination, which includes domestic trafficking.

Common regional trafficking flows include victims trafficked from South Eastern Europe to Western Europe, from the Andean countries to the Southern Cone in South America, from East Asia to the Pacific, or victims trafficked across a single international border into neighboring countries.

In trans-regional trafficking, countries with developed economies remain key destinations, while victims tend to originate from countries with less developed economies.

The UNODC found that the Middle East, as well as most countries in Western and Southern Europe and North America, reported being destinations for trans-regional and long-distance trafficking.

In particular, they found that the wealthier the country of destination, the greater the number of detected victims from outside the immediate region.  

In Western and Southern Europe, detected victims held 137 different citizenships, particularly from Central and South-Eastern Europe (47%), SubSaharan Africa (16%) and East Asia (7%).

Similarly, North American countries detected victims from more than 90 countries of origin. The most prominent transregional trafficking flow in the study was from East Asia, as 16% of the detected victims in North America are citizens of East-Asian countries.

Trafficking victims from countries in Sub-Saharan Africa and East Asia are trafficked to the widest range of destinations. The UNODC found that 69 countries reported to have detected victims from Sub-Saharan Africa between 2012 and 2014.

To read the full FATF report, click here.

The takeaway for fincrime compliance professionals: if they see a virtual exchange engaging in more activity with a given individual or corporate account, query the exchange to see if they also transact with entities in places like Thailand, the Philippines, Africa and Mexico – particularly if the crypto exchange also sends funds to nail salons, massage parlors, escort sites and porn and cam sites.

As well, if the crypto exchange is unwilling to talk about its compliance program with the bank, has no dedicated AML officer or doesn’t engage in transaction monitoring or has little to no knowledge about the red flags of human trafficking, that should be a detail that raises the risk of that exchange – maybe even enough to drop the account.

Bank AML teams should also make use of all of the tools at their disposal to see if any exchanges they have engaged in transactions with have been tied to darknet markets, trafficking groups or sex sites.

Third party crypto analytics firms, like Chainalysis, and others, have created bespoke algorithms, databases and engaged in their own investigations and partnered with law enforcement on tracing illicit actors, complicit crypto exchanges and trafficking groups and their laundering methods.

Banks should also reach out to crypto exchanges themselves to share information as both are considered “financial institutions” under Patriot Act Section 314 (b) purposes, which would allow virtual value exchanges and brick-and-mortar banks to share information on individuals suspected of money laundering, terror financing and other specified unlawful activities that generate tainted funding.  

Although adding context to crypto-related transactions is key when attempting to identify and accurately report suspicious activity, it is also important to note that crypto transactions are not equal in risk or could be what an investigator thinks is obvious illicit activity.

Take for instance ACH transactions related to crypto exchanges. While certain exchanges are tailored more towards day traders, others prefer to be a “common man’s” entry to cryptocurrency.

Furthermore, some exchanges have differing KYC requirements, onboarding procedures, or regulatory oversight – these differences can be particularly stark depending on the size of the exchange, the region it calls home in the physical world and the expertise of the AML professionals employed at the operation, if they have any at all.

Researching and understanding the variations between these exchanges will assist in identifying customers attempting to obfuscate the nature of their transactions.

With this being said, all cryptocurrency transactions are not ACH or wire transfers to a known exchange.

For instance, Bitcoin ATMs (BTMs) are primarily cash to bitcoin, and, therefore, cryptocurrency transactions may be best identified by cash ATM withdrawals near or at locations where BTMs exist.

Additionally, just as exchanges do not all have the same level of AML or KYC controls in place, BTMs vary drastically in the KYC requirements, AML monitoring, and transactional limits in place.

Lastly, well-established brokerage and money transmission services such as Robinhood and Square now provide crypto exchange services thus resulting in ACH transfers to these services potentially representing crypto purchases.  

When cryptocurrency transactions are seen on an account, a holistic review of the account should be conducted to attempt to contextualize the nature of the transaction.

Some questions to consider helping risk rank the transaction and determine ties to trafficking groups: Is the customer investing? Have they recently used money remittance services and altered the medium used to do this?

Or, are there other red flags that suggest a known typology, such as human trafficking, that in conjunction with cryptocurrency transactions suggests that the customer is using crypto for nefarious purposes.

For instance, it is understood that red flags associated with human trafficking include, but are not limited to, debit card purchases at clothing stores and lingerie stores, as traffickers will often purchase clothing for victims.

Additionally, as victims need to be moved geographically numerous purchases related to flights, hotels, motels, travel sites, buses, or car rentals are often witnessed on an account.

Furthermore, victimization as it relates to prostitution often occurs at common places with identifiable transaction records such as casinos, truck stops, motels, hotel bars, and high-end bars or clubs.

Finally, as traffickers often try to provide some basic level of care to victims, numerous purchases related to tv streaming sites and prepaid debit cards, when witnessed on an account with the aforementioned red flags, may indicate nefarious activities.

As human trafficking is a financially motivated crime, the financial system inevitably must play a major role in preventing victimization.

With this being said, in order for criminal activity such as this to be identified early or prevented altogether, traditional financial institutions need to address the shift to crypto as a preferred financial medium while also recognizing that cryptocurrency does not explicitly mean nefarious activity is occurring.

By viewing cryptocurrency account activity in the context created by additional transaction patterns in the account, not only will more specific criminal activity be detected by financial institutions, but this will result in SARs/STRs provided to law enforcement with more relevant, timely and actionable intelligence.