Cryptoasset Laundering: Mixers, Privacy Coins and DeFi

1. Why This Topic Matters for the CAMS Exam

Cryptoassets (also called virtual assets or VAs) have moved from the fringes of the financial system to a mainstream money laundering risk area. The FATF added virtual assets and Virtual Asset Service Providers (VASPs) to Recommendation 15 in 2018–2019, the United States has brought enforcement actions against mixers and exchanges, and the EU has extended its Transfer of Funds Regulation to cryptoassets under the MiCA framework. ACAMS treats this as a core sector risk because:

• Criminals exploit the pseudonymity, speed and borderless nature of blockchain transfers.
• Ransomware, darknet markets, investment scams (including so‑called pig butchering), sanctions evasion (notably by North Korea's Lazarus Group) and terrorist financing all rely on crypto layering techniques.
• Compliance professionals at banks must identify crypto exposure even when the institution does not touch crypto directly (for example, fiat on‑ramps and off‑ramps through customer accounts).
• Examiners expect candidates to recognise typologies, red flags, regulatory expectations and appropriate controls.

In the exam you are likely to see one to four questions touching on this area, usually framed as a scenario asking you to identify the most suspicious indicator, the best next step, or the correct regulatory concept.

2. Key Concepts and Vocabulary

Cryptoasset / Virtual Asset: A digital representation of value that can be digitally traded or transferred and used for payment or investment purposes (FATF definition). It excludes digital representations of fiat currency, securities and other financial assets already covered by the Recommendations.

VASP (Virtual Asset Service Provider): Any natural or legal person that, as a business, conducts one or more of the following for another person: exchange between VAs and fiat; exchange between one or more forms of VAs; transfer of VAs; safekeeping or administration of VAs; or participation in and provision of financial services related to an issuer's offer or sale of a VA. Under FATF standards VASPs must be licensed or registered and apply full AML/CFT obligations.

Hosted vs Unhosted (Self‑Hosted) Wallets: A hosted wallet is controlled by a VASP that holds the private keys and applies KYC. An unhosted wallet is controlled directly by the user with no intermediary – a key risk factor because no entity performs due diligence on the holder.

Blockchain Analytics: Tools (for example, Chainalysis, Elliptic, TRM Labs) that cluster addresses, trace flows and attribute wallets to known entities such as exchanges, mixers, darknet markets or sanctioned actors. These enable risk scoring of counterparties.

Travel Rule (FATF Recommendation 16 applied to VAs): Requires VASPs to obtain, hold and transmit required originator and beneficiary information for VA transfers, typically above a USD/EUR 1,000 threshold, and to make it available to competent authorities on request.

Chain Hopping: Rapidly converting one cryptocurrency into another (often across multiple blockchains) to break the audit trail.

Peel Chain: A layering technique where a large balance is moved through a long series of addresses, with small amounts peeled off at each step to exchanges or cash‑out points, making tracing laborious.

Nested Exchange / Instant Exchange: A smaller service that operates using accounts at a larger exchange, often without its own KYC, effectively hiding its customers behind the larger platform's infrastructure.

3. Mixers and Tumblers

What they are: Mixing services (also called tumblers) pool cryptocurrency from many users and redistribute it so that the link between the originating and receiving addresses is obscured. The user deposits coins and later withdraws different coins of equivalent value (minus a fee, often 1–3 percent) to a fresh address.

Types:
• Centralised custodial mixers – an operator takes custody of funds, mixes them and returns them (examples prosecuted or sanctioned: Helix, Bitcoin Fog, Blender.io, Sinbad, ChipMixer).
• Decentralised / non‑custodial mixers – smart contracts or coordination protocols that mix without a central custodian (for example, Tornado Cash on Ethereum, which was sanctioned by OFAC in 2022; CoinJoin implementations such as Wasabi Wallet or the Samourai Whirlpool, whose operators were charged in 2024).
• CoinJoin – a technique where multiple users combine inputs into a single transaction with many outputs of equal size, making it difficult to determine which input paid which output.

How criminals use them: Mixers are a classic layering tool. Ransomware operators, darknet vendors, hackers and sanctions evaders route proceeds through mixers before sending funds to exchanges for cash‑out. North Korean hacking groups have used mixers extensively to launder stolen funds from exchange and bridge hacks.

Regulatory treatment: In the United States, FinCEN has stated that mixers acting as money transmitters must register as MSBs and comply with the BSA; in 2023 FinCEN proposed designating international convertible virtual currency mixing as a primary money laundering concern under Section 311 of the USA PATRIOT Act. OFAC has sanctioned several mixers. Under FATF guidance, VASPs should treat exposure to mixers as a high‑risk indicator warranting enhanced due diligence (EDD) and possible suspicious activity reporting.

Key exam point: Use of a mixer is not itself illegal in every jurisdiction and some users seek legitimate privacy, but for AML purposes, receipt of funds directly from or sent directly to a known mixer is a strong red flag that generally requires investigation, EDD and consideration of a SAR/STR – especially when combined with other indicators such as structuring, rapid movement or links to illicit services.

4. Privacy Coins

What they are: Cryptocurrencies designed with built‑in anonymity features that hide the sender, receiver and/or amount. Unlike Bitcoin, where every transaction is publicly visible on a transparent ledger, privacy coins limit what analytics tools can see.

Main examples and technologies:
• Monero (XMR) – uses ring signatures (mixing a sender's output with decoys), stealth addresses (one‑time recipient addresses) and RingCT (confidential amounts). Privacy is mandatory by default, which makes it the most commonly cited privacy coin in darknet market and ransomware cases.
• Zcash (ZEC) – uses zero‑knowledge proofs (zk‑SNARKs) to allow optional shielded transactions; users may choose transparent or shielded addresses.
• Dash – offers an optional PrivateSend (CoinJoin‑based) feature.
• Others include Grin and Beam (Mimblewimble protocol).

Why they matter for AML: Privacy coins defeat most blockchain tracing. Swapping Bitcoin into Monero and back (sometimes called a Monero bridge or cross‑chain laundering) is a well‑documented layering method. Because of the risk, many regulated exchanges in jurisdictions such as Japan, South Korea, the UK and parts of the EU have delisted privacy coins, and some regulators treat their handling as inherently high risk.

Key exam point: If a scenario describes a customer repeatedly converting transparent cryptocurrencies into privacy coins and then back to fiat, or depositing privacy coins with no clear source, the correct answer will usually involve identifying this as high‑risk layering, applying EDD and considering a suspicious transaction report. Expect distractors suggesting the activity is low risk because it is lawful or technologically sophisticated.

5. DeFi – Decentralised Finance

What it is: DeFi refers to financial applications built on smart‑contract blockchains (mainly Ethereum and comparable networks) that allow users to trade, lend, borrow, earn yield and transfer value without a traditional intermediary. Key components include:
• Decentralised exchanges (DEXs) such as Uniswap – automated market makers that swap tokens directly from a user's wallet, usually without KYC.
• Lending and borrowing protocols such as Aave or Compound – users post collateral and borrow other tokens, which can be used to obscure the origin of funds.
• Cross‑chain bridges – protocols that move value between blockchains; they are both a chain‑hopping tool for launderers and frequent hacking targets (for example, Ronin Bridge, Wormhole, Nomad).
• Stablecoins – tokens pegged to fiat (USDT, USDC, DAI) widely used to park and move illicit value because of price stability; centrally issued stablecoins can be frozen by the issuer, which law enforcement increasingly uses.
• Liquidity pools and yield farming – depositing funds into pools and later withdrawing can create an apparent legitimate source of returns.
• NFTs – non‑fungible tokens have been used for wash trading and value transfer with subjective pricing.
• DAOs – decentralised autonomous organisations, which raise questions over who is the obliged entity.

How launderers exploit DeFi: Stolen or illicit funds are swapped repeatedly through DEXs, moved across bridges to other chains, converted to stablecoins, sometimes routed through a mixer, and finally sent to a centralised exchange or OTC broker for conversion to fiat. The absence of a KYC gatekeeper at each DeFi step, combined with speed and automation, makes this attractive.

Regulatory position: FATF's updated 2021 guidance states that DeFi arrangements are not automatically outside the standards: where creators, owners, operators or other persons maintain control or sufficient influence over a DeFi arrangement, they may fall within the definition of a VASP even if the arrangement is marketed as decentralised. The practical challenge is attribution of responsibility. FinCEN and the US Treasury have published DeFi illicit finance risk assessments concluding that non‑compliance with AML obligations by many DeFi services is the most significant vulnerability.

Key exam point: The claimed decentralisation of a platform does not remove AML risk or, in the FATF's view, necessarily remove obligations. The correct response to DeFi exposure in a scenario is risk‑based: identify the exposure using analytics, assess the customer's explanation, and escalate where the pattern is inconsistent with the stated profile.

6. How Cryptoasset Laundering Works – The Three Stages Applied

Placement: Converting cash or illicit proceeds into crypto. Methods include crypto ATMs (often with weak KYC and used heavily in scams), peer‑to‑peer (P2P) platforms, OTC brokers, prepaid cards, money mules depositing cash into exchange‑linked bank accounts, and direct receipt of crypto from crimes such as ransomware or darknet sales (where the proceeds are already in crypto, so placement is effectively skipped).

Layering: Obscuring the trail through mixers, privacy coins, chain hopping, DEX swaps, bridges, peel chains, nested exchanges, gambling sites and rapid transfers between many self‑hosted wallets. Multiple techniques are often combined in sequence.

Integration: Cashing out through exchanges (often in weakly regulated jurisdictions), OTC desks, purchasing real estate or luxury goods with crypto, using crypto‑linked debit cards, or depositing fiat proceeds from an exchange into the banking system as apparent trading or investment gains.

7. Red Flags – FATF Virtual Asset Indicators and Beyond

The FATF published a dedicated report in 2020 on Virtual Asset Red Flag Indicators. Grouped themes that candidates should memorise:

Transaction patterns:
• Structuring VA transactions in small amounts just below record‑keeping or reporting thresholds.
• Multiple high‑value transactions in a short period, or immediately after account opening.
• Funds moved in and out of an account very quickly with no business rationale (pass‑through activity).
• Transfers to many unrelated wallets or from many unrelated sources, inconsistent with the customer's profile.
• Converting fiat to VA and back with no apparent purpose, incurring losses on fees.

Anonymity‑enhancing behaviours:
• Direct or indirect exposure to mixers or tumblers.
• Use of privacy coins, especially converting transparent coins into privacy coins.
• Use of unregistered or non‑compliant exchanges, nested services or P2P platforms with weak controls.
• Use of VPNs, Tor, or IP addresses in jurisdictions different from the stated residence.
• Multiple accounts under different names, or shared IP and device identifiers across supposedly unrelated customers.

Source of funds or wealth:
• Funds traceable to darknet markets, ransomware addresses, scam addresses, sanctioned addresses or hacks.
• A customer unable to explain the origin of a large crypto balance.
• Sudden wealth inconsistent with occupation.

Customer profile:
• Reluctance to provide KYC information, use of incomplete or forged documents.
• Elderly or financially vulnerable customers suddenly buying crypto (possible scam victim or mule).
• Customers acting on behalf of others; transactions directed by a third party.

Geographic:
• Links to jurisdictions with weak VASP regulation or on the FATF grey or black list.
• Use of exchanges located in high‑risk jurisdictions.

8. Controls Expected of VASPs and Traditional Institutions

• Risk assessment that explicitly covers crypto products, customers and exposure, updated for new typologies.
• CDD and EDD, including identification of beneficial owners of corporate customers and source of funds/wealth for high‑risk VA activity.
• Blockchain analytics to screen deposit and withdrawal addresses against mixers, sanctioned addresses, darknet and scam clusters; risk scoring of counterparties.
• Sanctions screening of wallet addresses (OFAC publishes digital currency addresses on the SDN list) and of counterparties.
• Travel Rule compliance through interoperable messaging solutions, with policies for transfers to and from unhosted wallets (for example, collecting information from the customer and applying additional verification).
• Transaction monitoring tuned to crypto‑specific scenarios such as rapid pass‑through, mixer exposure and structuring at crypto ATMs.
• Suspicious activity reporting and cooperation with law enforcement, including providing address and transaction‑hash details.
• Governance: licensing or registration, independent audit, training and a designated compliance officer.
• For banks: identifying customers who are VASPs or crypto ATM operators, applying appropriate due diligence on those business customers, and monitoring retail customers' fiat flows to and from exchanges.

9. Regulatory and Enforcement Landscape to Know

• FATF: Recommendation 15 and its Interpretive Note (2019); Updated Guidance for a Risk‑Based Approach to VAs and VASPs (2021); Travel Rule; red flag indicators report (2020); ongoing targeted updates on implementation.
• United States: FinCEN 2013 and 2019 guidance classifying exchangers and administrators of convertible virtual currency as money transmitters; BSA obligations for crypto MSBs; OFAC sanctions on mixers and addresses; Department of Justice prosecutions of mixer operators and exchanges; enforcement actions such as the record 2023 penalties against a major global exchange for AML failures.
• European Union: Markets in Crypto‑Assets Regulation (MiCA) and the recast Transfer of Funds Regulation extending Travel Rule obligations to crypto‑asset service providers; the AML package bringing CASPs fully within obliged‑entity scope.
• United Kingdom: FCA registration of cryptoasset businesses under the Money Laundering Regulations and the Travel Rule in force from 2023.
• Asia: Japan's early licensing regime and restrictions on privacy coins; Singapore's Payment Services Act; Hong Kong's VASP licensing.

You do not need every date, but you should be able to recognise the role of FATF Recommendation 15, the Travel Rule threshold concept, OFAC's sanctioning of mixers, and the principle that regulation follows function rather than technology.

10. Exam Tips: Answering Questions on Cryptoasset Laundering: Mixers, Privacy Coins and DeFi

Tip 1 – Think in terms of the laundering cycle. When a scenario describes crypto activity, mentally label each step as placement, layering or integration. Mixers, privacy coins, chain hopping and DeFi swaps are almost always layering. Cash‑to‑crypto at ATMs or via mules is placement. Cash‑out through an exchange into a bank account is integration. Questions frequently ask which stage a described activity represents.

Tip 2 – Legal does not mean low risk. A common distractor states that because mixers or privacy coins are legal, or because DeFi is decentralised, no action is needed. The CAMS perspective is risk‑based: these features increase risk and require enhanced scrutiny, not automatic exoneration.

Tip 3 – Prefer the risk‑based, proportionate answer. If asked for the best next step, options such as immediately closing the account or reporting the customer to police without review are usually wrong. The right answer typically involves gathering information (blockchain analytics, source of funds enquiry), escalating to the compliance function, applying EDD and determining whether a SAR/STR is warranted. Equally, doing nothing is wrong when clear red flags exist.

Tip 4 – Know the FATF vocabulary precisely. Be ready to define VA, VASP, hosted and unhosted wallets, and the Travel Rule. If an option uses FATF language correctly it is often the credited answer. Remember that FATF says DeFi platforms with identifiable controlling persons may be VASPs.

Tip 5 – Combine indicators. The most suspicious option in a multiple‑choice question is usually the one combining two or more red flags, for example: funds received directly from a mixer and rapidly withdrawn to an exchange in a high‑risk jurisdiction. Single, explainable facts (a customer owns some Bitcoin) are rarely the answer.

Tip 6 – Remember non‑crypto institutions have exposure. Scenarios set at a bank may involve a customer receiving frequent deposits from crypto exchanges, a business customer that turns out to be an unregistered exchanger, or cash deposits consistent with crypto ATM operations. Recognise that the bank must assess this exposure and may need to file a report even though it never touches crypto.

Tip 7 – Watch for sanctions angles. Mixer and DeFi questions often carry a sanctions dimension (North Korea, sanctioned mixers, SDN‑listed wallet addresses). If a scenario mentions a sanctioned address, screening and blocking or rejecting obligations arise in addition to AML reporting.

Tip 8 – Distinguish the technologies. Do not confuse a mixer (service that pools and redistributes coins) with a privacy coin (a cryptocurrency with protocol‑level anonymity) or a DEX (a non‑custodial trading venue). Questions may test whether you can identify which tool is being described from its features – ring signatures and stealth addresses point to Monero; zero‑knowledge proofs point to Zcash; smart‑contract pools of equal denominations point to a mixer like Tornado Cash; automated token swaps without KYC point to a DEX.

Tip 9 – Red flags come from the customer's profile mismatch. The anchor for suspicion in every CAMS question is inconsistency with expected activity. Ask: does the volume, frequency, counterparty type and geography fit what the institution knows about this customer? If not, the behaviour is reportable regardless of the sophistication of the technology.

Tip 10 – Manage time and read every option. Crypto scenarios can be long. Identify the question stem first (what is being asked – stage, red flag, next step, regulatory concept), then skim the scenario for the relevant facts. Eliminate options that are absolute (always, never), that ignore the risk‑based approach, or that confuse roles (for example, placing an obligation on the customer rather than the institution).

11. Practice Scenarios

Scenario A: A new retail customer of a crypto exchange deposits Bitcoin traced by analytics to a known mixing service, converts it to a stablecoin within minutes and withdraws to an address linked to an exchange in a jurisdiction with no VASP regulation. Which action is most appropriate?
Best answer: Escalate for enhanced due diligence including source of funds, consider restricting the account pending review, and evaluate filing a suspicious activity report. Why: Mixer exposure plus rapid pass‑through plus high‑risk jurisdiction are combined red flags; the risk‑based response is investigation and reporting rather than ignoring the activity or immediately terminating without documentation.

Scenario B: A bank's business customer described as a software consultancy receives large, frequent cash deposits across many branches and sends wires to several crypto exchanges. What is the main concern?
Best answer: The customer may be operating as an unregistered money services business or crypto exchanger using the bank as a conduit, indicating placement of illicit cash and the need for EDD and potential SAR filing.

Scenario C: A customer explains that they regularly convert Bitcoin into Monero and back to protect their financial privacy from competitors. The amounts far exceed their declared income. Which stage and risk does this represent?
Best answer: Layering using a privacy coin to break the transaction trail; the mismatch with income is the key red flag requiring source of wealth verification and consideration of reporting.

Scenario D: Which statement best reflects the FATF position on DeFi?
Best answer: A DeFi arrangement may fall within the VASP definition where identifiable persons maintain control or sufficient influence over it, so decentralisation does not automatically exclude AML obligations.

12. One‑Page Revision Summary

• Crypto laundering uses the same three stages as traditional laundering; mixers, privacy coins and DeFi are primarily layering tools.
• Mixers pool and redistribute coins to break links; several have been sanctioned or prosecuted; exposure is a high‑risk indicator.
• Privacy coins (Monero, Zcash, Dash) obscure sender, receiver and amount at the protocol level, defeating analytics; many regulated exchanges have delisted them.
• DeFi (DEXs, bridges, lending, stablecoins) enables rapid, KYC‑free chain hopping; FATF says controlling persons may still be VASPs.
• FATF Recommendation 15, the Travel Rule, red flag indicators, OFAC address sanctions and FinCEN MSB classification are the key regulatory anchors.
• Core red flags: structuring, rapid pass‑through, mixer or privacy coin use, unregistered exchanges, high‑risk jurisdictions, IP or device anomalies, profile mismatch, links to darknet, ransomware, scams or sanctioned actors.
• Controls: risk assessment, KYC/EDD, blockchain analytics, sanctions screening of addresses, Travel Rule, tailored monitoring, SAR/STR filing.
• Exam approach: identify the stage, combine indicators, choose the proportionate risk‑based action, and never assume that legality or decentralisation equals low risk.