Licensed VASP, Unhosted Wallets and Missing Travel Rule Data
A Hong Kong-licensed virtual asset service provider has a corporate customer, BlockBay Ltd, registered in Hong Kong and declaring software development with monthly turnover of about US$200,000. Over 10 days, BlockBay receives 37 deposits from 22 unhosted wallets totalling US$1.2 million in Bitcoin and Ether. The funds are almost immediately withdrawn to three addresses. Blockchain analytics shows one withdrawal address has indirect exposure to a darknet marketplace, and another is a mixer. BlockBay says it is “doing OTC trading for friends” and provides screenshots of chat messages as evidence of source of funds. For 19 incoming transfers, the required originator or beneficiary information is missing. The customer refuses to identify the wallet owners, saying that would breach their privacy.
1. Identify the red flags and explain why they matter for a licensed VASP under a risk-based approach.
Read the worked answer
The red flags include: a declared software business receiving large volumes of crypto from many unhosted wallets; rapid pass-through to a small number of addresses; exposure to a darknet marketplace and a mixer; missing Travel Rule information for 19 transfers; screenshots of chats as the only source-of-funds evidence; refusal to identify counterparties; and a volume that is inconsistent with the stated monthly turnover.
These matter because unhosted wallets reduce the VASP’s ability to identify the counterparty, and mixers are designed to obscure the audit trail. Darknet exposure is a high-risk indicator even if indirect. Missing originator and beneficiary information undermines the VASP’s ability to comply with the Travel Rule and to conduct counterparty due diligence. The “OTC trading for friends” explanation is not a business model that can be risk-managed without identifying the friends, their wallets and the source of their funds. The customer’s privacy objection does not override AML/CFT obligations.
2. What enhanced due diligence and wallet-screening steps should the VASP take before processing further transactions?
Read the worked answer
The VASP should conduct EDD on BlockBay and its beneficial owners, including ownership, business model, expected transaction profile and source of funds. It should obtain full wallet attribution for the 22 sending addresses and three receiving addresses, and run enhanced blockchain analytics on all of them, including indirect exposure, clustering and sanctions screening. The customer should be asked to identify the wallet owners and explain the economic purpose of each transfer. The VASP should also obtain the missing Travel Rule data or, where the counterparty is an unhosted wallet, apply its risk-based measures for unhosted wallet transfers, such as ownership verification through a signed message or additional corroborating evidence.
Screenshots of chats are weak evidence. The VASP should seek independent evidence such as bank records, contracts or exchange statements. Until these steps are complete, further deposits and withdrawals should be restricted. The decision and rationale should be documented.
3. Should the VASP file an STR and terminate the relationship? Address timing and the risk of tipping-off.
Read the worked answer
The VASP should escalate to its MLRO immediately. The combination of darknet and mixer exposure, rapid pass-through, missing Travel Rule data and refusal to identify counterparties gives reasonable grounds to suspect money laundering. An STR should be filed promptly with JFIU once suspicion is formed; the VASP should not wait for all documentation before reporting. It may continue limited investigation, but it should not process further high-risk transfers while suspicion remains unresolved.
Termination is a commercial and risk decision, but the MLRO should consider exit if the customer will not cooperate. Any exit should be carried out without disclosing that an STR has been filed. Staff should avoid telling the customer that the account is being closed “because of suspicious crypto”. A neutral explanation based on inability to meet documentation or risk requirements is safer. The VASP should retain wallet records, analytics and correspondence in line with record-keeping obligations.