FCIBT flashcards
FCIBT · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Append-only ledger
- A data structure in which records are added and never modified; each block references the hash of its predecessor, so tampering with history breaks all later links.
- UTXO
- Unspent transaction output. Bitcoin balances are the sum of unspent outputs; a transaction consumes whole outputs and creates new ones, returning change to a fresh address.
- Account nonce
- A per-address counter in account-model chains such as Ethereum. Each transaction must use the next nonce, so one stuck transaction blocks all later ones from the same sender.
- Satoshi and wei
- Smallest units: 1 bitcoin equals 100,000,000 satoshi; 1 ether equals 10^18 wei. Investigators record amounts in base units to avoid rounding disputes.
- Hard fork
- A backward-incompatible protocol change that can split the chain. Forks share history up to the split block, so pre-fork addresses exist on both chains.
- Virtual asset service provider
- FATF term for a business conducting exchange, transfer, safekeeping, or participation in financial services on behalf of customers in virtual assets.
- Pig butchering
- A romance or investment fraud that builds trust over time, then directs the victim to a fake trading platform. Proceeds are layered through mule accounts and stablecoins.
- Stablecoin freeze function
- An issuer-controlled blacklist in the token contract that blocks a specific address from transferring. It is a key disruption lever for stolen or sanctioned funds.
- Predicate offence
- The underlying crime (fraud, drug trafficking, tax evasion) that generates proceeds. Money laundering is charged separately from the offence that produced the funds.
- Common-input-ownership
- A heuristic assuming that all inputs signed together in one transaction are controlled by the same entity, because each input requires its own private key signature.
- Peeling chain
- A pattern where a large input is repeatedly split, sending a payment and returning change to a new address each time. Following the change trail often reaches a service deposit.
- Change address
- The output returning leftover value to the sender. It is identified heuristically, often as the output that is not a round number or a known payment address.
- Bridge lock-and-mint
- A cross-chain pattern where assets are locked on the source chain and a wrapped representation is minted on the destination. Tracing must follow both transactions.
- Clustering
- Grouping addresses presumed to share one controller, primarily via common-input-ownership. Clusters are estimates, not identities, and require corroboration before attribution.
- CoinJoin false positive
- A transaction jointly signed by unrelated parties with equal outputs. Common-input-ownership wrongly merges their addresses, so CoinJoin clusters must be excluded or flagged.
- Deposit address attribution
- Many exchanges assign a unique, permanent deposit address per customer. Matching that address to a person requires exchange records obtained by subpoena or legal request.
- Attribution confidence tier
- A label (confirmed, probable, possible) recording how strongly evidence supports an entity attribution. Confirmed means documented by the entity or a court record.
- Tornado Cash
- An Ethereum mixing protocol using smart contracts. OFAC designated it in August 2022; analysts must check the current list status and date before relying on it.
- Anonymity set
- The number of possible originators a withdrawal could belong to. Larger, well-mixed pools with time delays are harder to trace than small or single-participant pools.
- Privacy coin
- A cryptocurrency that hides sender, receiver, or amount by default, such as Monero with ring signatures and RingCT. Transparent-ledger analytics are largely ineffective.
- Chain hopping
- Moving value across chains via bridges or swaps to break tracing continuity. Each hop must be recorded with chain, tx hash, asset, amount, and timestamp.
- Nested VASP relationship
- A VASP that accesses another VASP's accounts to serve its own customers. It obscures the ultimate originator and requires enhanced due diligence.
- Proof of reserves
- An attestation that an exchange holds stated assets. It is not a full audit unless liabilities (customer deposits) are also verified at the same date.
- Crypto ATM red flag
- Repeated small purchases just under the ID threshold, use of a third party's wallet, or a nervous customer guided by phone. Structuring indicators warrant a suspicious transaction report.
- Travel rule
- FATF Recommendation 16 as applied to virtual assets: originating and beneficiary VASPs must exchange originator and beneficiary identifying information on transfers.
- OFAC 50 percent rule
- An entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is itself blocked, even if it does not appear separately on the SDN list.
- Tipping off
- Disclosing a suspicious transaction report or the fact of an investigation to the subject. Prohibited in most AML regimes and a criminal offence in many.
- Record retention period
- The statutory time KYC and transaction records must be kept, commonly five years after the relationship ends or the transaction occurs. Local law may require longer.
- Chain of custody
- A chronological log of who collected, handled, and transferred each evidence item, when, and how. Unbroken custody supports admissibility and evidentiary weight.
- Evidence hash
- A cryptographic digest such as SHA-256 computed at collection and re-verified at each handoff. It proves the file or image was not altered.
- Preservation letter
- A formal request asking a service provider to retain records, such as account data, before a subpoena or mutual legal assistance request is served.
- Fact versus inference
- A reporting rule: on-chain data and obtained records are facts; heuristic attributions are inferences. Each conclusion states its method and confidence level.