How not to become a suspicious customer for the crypto exchange.

If a user makes strange transactions, it can be a reason to check and block their account. This can happen because of the use of anonymous services and for other reasons

The Financial Action Group Against Money Laundering (FATF) has released a report with criteria on which to identify suspicious users of cryptocurrency. These characteristics can be used by financial regulators, regulators, exchanges, and other industry participants to detect illegal activities involving digital assets.

IN FATF, in particular, offer to compare the amount of funds coming to the user's wallet and leaving it. If this indicator differs from the financial situation of the trader, it may be a signal of participation in money laundering or fraudulent schemes. An important indicator here will also be the presence of operations, the sources of which are many, and they are located in different parts of the world.

Another criterion is the recorded instances of users appearing on web resources related to illegal activities. In particular, this applies to platforms on which cryptocurrency is accepted, but there is no need for proof of identity, and the amount of transactions is limited, so as not to fall under the checks of financial regulators.

The FATF also suggested that users who use tools to remain anonymous were suspicious. First of all, we are talking about anonymous cryptocurrencies, such as Monero or zcash. They also mean "mixers" - special services for obfuscation of transactions that make them difficult to track. Separately, FATF singled out users who work from countries with weak digital industry regulation.

These criteria make sense, said Maria Stankevich, director of development of the EXMO exchange. She said that EXMO has long used these tools to track suspicious activity, but there are other indicators. Reasons for expedited verification are:

Entrys / conclusions of cryptocurrencies and fiat funds above the established limits

Suspicious user trading. For example, mass trades "to yourself in the minus", attempts to implement the scheme "pump and dump"

Suspicious account login: massive login from one IP address, password attempts.

Suspicious financial actions: inputs and withdrawals of funds without bidding, or with a small share of trades. Inputs by one system are the conclusions of another.

"Here is a living example of how we were able to block a huge amount that flowed from one well-known exchange, and return all the money in one piece in one way: two users with the same registration date made "test" top-ups for small amounts. After their top-up amounts become many times more, all this happens in a short period of time, and even users begin to trade at a loss," Stankevich shared.

She added that Exmo's involvement in the Crypto Defenders Alliance (CDA), which includes many major exchanges, plays a major role in the fight against crime. They communicate quickly in case of suspicions regarding any transactions.

The technical director of the CEX exchange told about other criteria of user suspicion. IO Dmitry Volkov. For example, if the fraudster enjoys the trust of the victim. The expert told about cases when clients were misled by "trust managers" by offering fraudulent investment schemes. Keeping records of addresses that were previously involved in fraudulent schemes is part of an anti-fraud program that helps prevent users from losing funds.

Volkov added that an important element in countering illegal activities in cryptocurrency is the identity verification procedure (KYC). This gives not only data about the user, but allows you to compose his psychological portrait, determine the type. Based on this, you can compare the actual behavior of the client with expectations and identify suspicious activity.

"There is an interesting AML/KYC property that not everyone thinks about - in the process we really recognize the customer or the type of customer. This allows you to determine the normal expected behavior of both the account and the customer when using the exchange. This means that we can identify situations where behavior is outside the expected format," Volkov said.

If a user is seen in suspicious activity, many exchanges reserve the right to temporarily block their account to clarify the circumstances. For example, in January, the Binance site did so. A possible reason was the appearance of a "dirty" cryptocurrency on the trader's balance sheet.

In early September, the IRS offered a $625,000 grant to a company that would be able to develop a product to track transactions in cryptocurrency. First of all, the initiative is aimed at hacking into the network of the anonymous Monero coin, but also refers to bitcoin. The agency is interested in monitoring operations, their date, time, amount and identification of users' wallets.