Most staff in banks and payment firms do not see a wallet or a blockchain. What they see is a card payment to an exchange, a transfer labelled “wallet withdrawal”, or a business account that starts receiving settlements from a payment provider. So the payment side is where unusual activity can be noticed, even if you know little about crypto.
Buying, holding and selling crypto is lawful in many places, and most customers who do it have ordinary reasons. This article is not about treating crypto customers as suspect. It is about recognising the situations that deserve a second look and knowing what to do next.
Where crypto shows up in payment data
Two terms cover most of what you will see. An on-ramp is any route by which a customer turns money into crypto, such as a bank transfer or card payment to an exchange or a broker. An off-ramp is the reverse: crypto turned back into money the customer can spend, such as a transfer arriving from an exchange, a card top-up or a payout labelled “crypto cash-out”.
The firms on the other side are usually called virtual asset service providers, or VASPs: businesses that exchange, transfer or hold crypto for other people. In many places they must register or hold a licence and follow AML rules, depending on the law that applies to them. Public blockchains record addresses rather than names, so identity checks sit with those firms and the banks and payment providers around them.
Some customers are not crypto firms but still touch crypto. A shop may accept crypto through a payment provider and be paid in ordinary money. A payments company may collect small card payments from many people and pass the funds on to platforms.
What routine activity looks like
Routine activity is often easy to recognise. A customer makes regular, modest payments to a well-established platform, perhaps with occasional withdrawals back, and the amounts fit their income and savings. A shop receives settlements from a payment provider it has used for some time, in line with its trading. None of this is suspicious in itself.
The most useful comparison is the customer’s own history, not the product. Higher risk is not the same as suspicion: crypto activity may mean a relationship needs to be understood and documented more carefully, which is different from believing something is wrong.
Signs that deserve a closer look
The signs below are reasons to look more closely, not proof of anything. A single one often has an innocent explanation.
- A sudden large payment, or several in quick succession, to a platform from a customer with no earlier crypto activity and steady, modest finances
- Repeated payments to a platform or payment company that nobody can identify, or that advertises that it does not check who its users are
- A customer who seems to be following someone else’s instructions, or who repeats lines such as “guaranteed returns” or “move your money to a safe account”
- A customer who cannot say what the platform is, who runs it or why the money is going there
- Money that arrives from a platform and leaves again almost at once to another account, with no clear reason
- Many small payments from unconnected people into one business, followed by large transfers on to crypto platforms, with little clarity about who the business serves
- A customer who says their wealth comes from crypto, but whose account of how and when it arose does not hang together
Some of these signs can point to a customer who is being targeted by a scam rather than one who is doing anything wrong. Crypto can be one step in an investment, romance or impersonation scam, where the victim is persuaded to send money to a platform. Sometimes the right response is to protect the customer, and your fraud procedure may apply alongside, or instead of, an AML report.
Scenario
Ines Calder has banked with Brindlemoor Savings for many years, with a steady salary and modest savings. Over two weeks she sends three large transfers to a payment company the bank’s staff do not recognise, each described as “crypto investment”. When Dev, a customer service adviser, speaks to her about a fourth, she says an online contact has been advising her, that the opportunity is closing and that she should not discuss it with the bank. She cannot say who runs the platform or how she would withdraw her money. Dev does not challenge her or mention any concern. He writes down what he saw and what she said in her own words, including the payment company’s name as it appears on the transfers, and sends it to the MLRO or equivalent compliance contact under the bank’s procedure.
What matters here: Crypto alone did not raise the concern. The change from Ines’s usual pattern, the pressure from a third party and her uncertainty about the platform did. Dev stayed within his role: he recorded facts instead of guessing at a crime, and he did not confront her or discuss any internal concern with her. Whether to pause a payment, speak to Ines or make a report is for the people trained and authorised to decide.
What to do when something stands out
Write down the facts while they are fresh. Note what changed, which platform or payment company appears in the payment details, whether money was going in or out, and what the customer said in their own words. Keep to what you saw and heard; you do not need to decide whether it is fraud, money laundering or something else.
Then pass it on promptly through your institution’s procedure, which normally means the MLRO or equivalent compliance contact, or a fraud team where scams are handled separately. Describe the crypto element in plain language, so that someone with no crypto background can follow it.
Just as important is what not to do. Do not investigate on your own, contact the platform or any other third party, or put your concern to the customer. Do not refuse or delay a request unless your procedure tells you to. Depending on the law that applies to you, telling a customer that a concern has been raised or a report made may be prohibited, a rule often called tipping off. If the customer asks questions, ask your compliance contact how to respond.
The compliance team weighs what you pass on against information you cannot see and decides what happens next, including whether a report is needed. A note that turns out to have an innocent explanation is not wasted effort.
Key points
- On the payment side, crypto appears as money going to or from platforms that exchange, hold or transfer it, known as on-ramps and off-ramps.
- Using crypto is lawful in many places, so compare activity with the customer’s own history rather than judging the product.
- Sudden large payments, platforms nobody can identify, coached customers and pass-through of funds are reasons to look closer, not proof.
- Some cases involve a customer who is being targeted by a scam, so the fraud route can matter as much as the AML route.
- Record the facts, escalate through your procedure to the MLRO or equivalent compliance contact, and do not investigate, confront the customer or tip them off.
For a grounding in the core concepts behind this article, take the free course AML Foundations & Core Concepts. The Resources page links to official sources and offers two quick references, the Red Flags Frontline Checklist and the Internal Escalation Note template, both free with a learner account.