Free resource

Financial crime glossary

Plain-English definitions of the terms investigators use every day, across AML, due diligence, US, UK, and EU reporting, sanctions, fraud, market abuse, and crypto.

Definitions are simplified for training and are not legal advice. Check current law and guidance before relying on them.

118 of 118 terms

314(a)US reporting & regulators: A USA PATRIOT Act provision under which FinCEN sends financial institutions lists of subjects law enforcement is investigating; institutions must search their records and report matches.Related: 314(b), FinCEN
314(b)US reporting & regulators: A USA PATRIOT Act provision that lets registered financial institutions share information with each other about possible money laundering or terrorist financing, with a safe harbor from liability.Related: 314(a)
50 Percent RuleSanctions: OFAC's rule that an entity owned 50% or more, directly or indirectly, in total by one or more blocked persons is itself blocked, even if it isn't on the SDN List. The UK and EU use a similar test of more than 50% ownership or control.Related: SDN List, Beneficial owner
Account takeoverATOFraud: When a criminal gains control of someone else's account, often through stolen credentials or social engineering, then changes contact details and moves money out.Related: Phishing, SIM swap, Social engineering
Address poisoningCrypto: Sending tiny or zero-value transactions from an address that looks like one the victim uses, hoping the victim copies the wrong address from their history and sends funds to the scammer.
Adverse mediaDue diligence: Negative news about a customer or counterparty, such as reports of fraud, corruption, or other crime. Checking adverse media is part of due diligence; an allegation in the news is not proof.Related: EDD
AlertAML basics: A flag raised by monitoring or screening that an investigator must review and close with a documented decision, such as filing a SAR or closing with a rationale.Related: Transaction monitoring, False positive
AMLAnti-money launderingAML basics: The laws, controls, and procedures financial institutions use to prevent, detect, and report money laundering. An AML program typically includes customer due diligence, transaction monitoring, investigations, reporting, training, and independent testing.Related: Money laundering, KYC, Transaction monitoring
AMLAAnti-Money Laundering AuthorityUK & EU: The EU authority for anti-money laundering and countering the financing of terrorism, based in Frankfurt. It coordinates national supervisors and will directly supervise some high-risk institutions.Related: AMLR
AMLREU Anti-Money Laundering RegulationUK & EU: Regulation (EU) 2024/1624, a single EU rulebook for AML that applies directly in every member state from July 10, 2027. Among other things it caps cash payments for goods and services at €10,000.Related: AMLA
APP fraudAuthorized push payment fraudUK & EU: Fraud in which the victim is tricked into sending a payment themselves, for example to a fake seller, investment, or 'safe account'. In the UK, payment firms must reimburse most victims under rules in force since October 2024.Related: Romance scam, Money mule
APSAdult Protective ServicesUS reporting & regulators: State or county agencies that investigate abuse, neglect, and financial exploitation of older and vulnerable adults. Banks can refer suspected exploitation to APS.Related: Elder financial exploitation
Beneficial ownerDue diligence: The real person who ultimately owns or controls a company or account. Under the US CDD Rule, banks identify each person owning 25% or more of a legal entity customer and one person with significant control.Related: CDD, Shell company
Binance settlementCrypto history: November 2023. The world's largest crypto exchange agreed to pay about $4.3 billion and its founder pleaded guilty to failing to maintain an effective AML program, after it let users trade without proper checks, including people in sanctioned countries. Why it matters: One of the largest corporate penalties in US history, and a signal that even the biggest exchanges face criminal liability for AML and sanctions failures. Its founder, Changpeng Zhao, served four months in prison and was pardoned in October 2025.
Bitfinex hackCrypto history: Hack in 2016; arrests in February 2022. About 120,000 BTC were stolen from a major exchange. Nearly six years later, a New York couple was arrested for laundering the funds and the US seized more than 94,000 BTC, worth about $3.6 billion at the time. Why it matters: The Justice Department's largest financial seizure at the time, and proof that stolen crypto can be traced years later as the thieves try to cash out.
BitMEXCrypto history: Charged October 2020. A crypto derivatives exchange and its founders were charged in the US with failing to run an AML program and with serving US customers without registering. The company later paid $100 million to settle with US regulators. Why it matters: Showed that offshore crypto platforms serving US customers can't avoid US AML requirements, and that executives can be held personally responsible for missing controls.
BitzlatoCrypto history: January 2023. A Hong Kong-registered crypto exchange with weak customer checks, used heavily by Russian darknet markets and ransomware actors, was cut off from the US financial system and its founder was arrested in Miami. Why it matters: The first use of a new US power to name a "primary money laundering concern" in connection with Russian illicit finance, barring US financial institutions from sending funds to or from it.
Blender.ioCrypto history: May 2022. A bitcoin mixing service was sanctioned for processing more than $20 million of funds North Korea's Lazarus Group stole in a major bridge hack. Why it matters: The first time OFAC sanctioned a crypto mixer, making dealings with it a sanctions violation for US persons, not just an AML red flag.
Blockchain explorerCrypto: A website that shows public blockchain data, such as an address's balance and transactions, used to trace crypto flows.
BlockingSanctions: Freezing property in which a sanctioned party has an interest, so it can't be moved, withdrawn, or used without a license. Some sanctions instead require rejecting the transaction.Related: Rejected transaction, OFAC
BSABank Secrecy ActUS reporting & regulators: The main US anti-money laundering law (1970). It requires financial institutions to keep records, file reports such as CTRs and SARs, and maintain an AML program.Related: FinCEN, CTR, SAR
BTC-eCrypto history: July 2017. A crypto exchange that ran with almost no customer checks and processed funds from ransomware, hacks, and fraud was shut down, and its alleged operator was arrested while on holiday in Greece. Why it matters: FinCEN fined the exchange about $110 million, its first action against a foreign-based exchange doing business with US customers, showing US AML rules reach exchanges abroad that serve Americans.
Business email compromiseBECFraud: A fraud in which criminals impersonate an executive, supplier, or other trusted contact by email to get a business to send a payment or change bank details.
Bust-outFraud: When a fraudster builds up an account or credit line with normal-looking activity, then suddenly maxes it out, often by depositing checks that will bounce and withdrawing the money before they return, and disappears.Related: Synthetic identity fraud, Check kiting
Bybit hackCrypto history: February 2025. Attackers stole about $1.5 billion in ether from an exchange during a routine transfer from its cold wallet. The FBI attributed it to North Korea. Why it matters: The largest crypto theft on record. The FBI asked exchanges and analytics firms to block addresses linked to the thieves, showing how fast the industry has to act to stop stolen funds being cashed out.
CDDCustomer due diligenceDue diligence: The standard checks on a customer: identity, beneficial owners, the nature and purpose of the relationship, and ongoing monitoring. In the US, the CDD Rule requires identifying beneficial owners of legal entity customers.Related: KYC, Beneficial owner, EDD
Chain hoppingCrypto: Moving crypto across different blockchains, often through bridges or swaps, to make tracing harder.Related: Mixer
ChargebackFraud: Reversing a card payment after the cardholder disputes it with their bank. Banks often give a provisional credit while they investigate. Falsely disputing your own purchases is sometimes called friendly fraud.Related: First-party fraud
Check kitingFraud: Writing checks between accounts at different banks to take advantage of the time it takes checks to clear, creating balances that don't really exist.Related: Uncollected funds, Bust-out
Check washingFraud: Stealing checks, often from the mail, and erasing the ink with chemicals so the payee and amount can be rewritten. The altered check clears against the real writer's account.Related: Check kiting
Colonial Pipeline ransomwareCrypto history: May 2021. A ransomware attack shut down a major US fuel pipeline, and the company paid about 75 BTC. Weeks later the US Justice Department traced and seized 63.7 BTC of the ransom. Why it matters: A landmark recovery: investigators followed the ransom on the public ledger to a wallet they could seize, showing ransom payments can be traced and taken back.
ConsolidationCrypto: Pooling funds from many addresses into one, often seen when scammers sweep victims' deposit addresses into a single wallet before moving the money on in fewer, larger transfers.Related: Peel chain
Correspondent bankingDue diligence: One bank providing accounts and payment services to another bank, often in another country. It needs extra due diligence because the correspondent processes payments for customers it doesn't know directly.Related: Nested account
Crypto ATMCrypto: A kiosk that lets people buy (and sometimes sell) cryptocurrency with cash or a card. Its speed and cash access make it popular with scammers, who send victims to deposit cash, and with people laundering cash.Related: VASP, Money mule
CTRCurrency Transaction ReportUS reporting & regulators: A report US financial institutions file with FinCEN for cash transactions of more than $10,000 in one business day, adding up all of a customer's cash transactions that day. Filing a CTR is routine and not an accusation.Related: Structuring, BSA
DAMLDefence against money launderingUK & EU: A UK request to the NCA for consent to go ahead with a transaction involving suspected criminal property. The NCA has 7 working days to respond; if it refuses, a moratorium period follows during which the transaction can't proceed.Related: NCA, POCA
Dual-use goodsSanctions: Items with both civilian and military uses, such as certain electronics, machine tools, and chemicals, which are subject to export controls.Related: Transshipment
EDDEnhanced due diligenceDue diligence: Deeper checks for higher-risk customers, such as PEPs or businesses in high-risk sectors or countries: source of wealth and funds, adverse media, senior management approval, and closer monitoring.Related: PEP, Source of wealth, Adverse media
Elder financial exploitationEFEUS reporting & regulators: The illegal or improper use of an older adult's money or assets by a caregiver, relative, scammer, or other trusted person. US banks report it in SARs and may refer it to Adult Protective Services.Related: APS, Romance scam
EU Fifth Anti-Money Laundering Directive (5AMLD)Crypto history: Applied from January 2020. An EU law that brought crypto-to-fiat exchanges and custodian wallet providers into the scope of AML rules, with registration and customer due diligence. Why it matters: The first EU-wide AML rules for crypto businesses, the basis for national registration regimes before the EU's later crypto-specific regulation.
False positiveAML basics: An alert that, after review, does not indicate suspicious activity or a true sanctions match. Most monitoring and screening alerts are false positives, so documenting why is a core investigator skill.Related: Alert, True match
FATFFinancial Action Task ForceUK & EU: The intergovernmental body that sets global standards (the FATF Recommendations) for fighting money laundering and terrorist financing and evaluates how well countries apply them.Related: Travel Rule
FATF Travel Rule for cryptoCrypto history: June 2019. The global AML standard-setter updated its standards so that crypto service providers must be licensed or registered, supervised, and send originator and beneficiary information with transfers. Why it matters: Extended the "travel rule" that banks follow for wire transfers to crypto transfers between service providers, and pushed countries worldwide to regulate exchanges.
FCAFinancial Conduct AuthorityUK & EU: The UK regulator for financial firms' conduct, including their anti-money laundering systems and controls.
FinCENFinancial Crimes Enforcement NetworkUS reporting & regulators: The US Treasury bureau that administers the Bank Secrecy Act, receives SARs and CTRs, and acts as the US financial intelligence unit.Related: BSA, FIU
FinCEN's 2013 virtual currency guidanceCrypto history: March 2013. US guidance stating that businesses exchanging or administering convertible virtual currency are money transmitters, so they must register as money services businesses and follow the Bank Secrecy Act. Why it matters: Brought US crypto exchanges under AML rules: registration, an AML program, suspicious activity reporting, and recordkeeping. Later enforcement against exchanges and mixers rests on it.
FINRAFinancial Industry Regulatory AuthorityUS reporting & regulators: The self-regulatory organization for US broker-dealers. It writes and enforces rules for brokerage firms, including surveillance for market manipulation.Related: SEC, Pump and dump
First-party fraudFraud: Fraud committed by the account holder themselves rather than by an outsider, for example falsely disputing their own purchases, depositing checks they know are bad, or running up credit they never intend to repay.Related: Chargeback, Bust-out
FIUFinancial intelligence unitUK & EU: A country's central agency that receives and analyzes suspicious activity or transaction reports and passes intelligence to law enforcement. FinCEN is the US FIU; the NCA's UK FIU fills the role in the UK.Related: STR, FinCEN, NCA
Front companyAML basics: A business that has real activity but is used to mix criminal proceeds with legitimate income or to act on behalf of a hidden party, such as a sanctioned person.Related: Shell company, Sanctions evasion
FTX collapseCrypto history: November 2022. One of the largest crypto exchanges collapsed into bankruptcy after it emerged that customer deposits had been moved to an affiliated trading firm. Its founder was convicted of fraud in 2023 and sentenced to 25 years. Why it matters: The biggest customer-fund failure in crypto, showing what goes wrong without segregated customer assets, real governance, and independent oversight.
Funnel accountAML basics: An account that receives deposits, often cash below reporting thresholds, in one place and is drained quickly by withdrawals or transfers somewhere else, frequently across states or borders.Related: Rapid movement of funds, Money mule
HawalaAML basics: An informal value transfer system in which brokers move value between countries through trust-based offsetting balances rather than wires. Legitimate and widely used, but it can be abused and may need to be registered as a money transmitter.
HelixCrypto history: Penalty October 2020. A bitcoin mixing service linked to a darknet search engine moved over $300 million for its users. US regulators fined its operator $60 million for running it as an unregistered money transmitter. Why it matters: The first FinCEN penalty against a mixer, establishing that mixing services are money transmitters that need to register, run an AML program, and file suspicious activity reports.
Huione GroupCrypto: A Cambodia-based financial conglomerate, including Huione Pay, that FinCEN found to be of primary money laundering concern for laundering proceeds of crypto investment scams and heists. FinCEN finalized a Section 311 rule cutting it off from the U.S. financial system in October 2025.Related: Pig butchering
Human traffickingAML basics: Using force, fraud, or coercion to exploit people for labor or commercial sex. Banks see it in patterns such as one person paying for several others' housing, travel, and online ads, or workers' wages being moved to someone else. In the US, FinCEN asks for the key term "HUMAN TRAFFICKING FIN-2020-A008" in related SARs.Related: Funnel account, Money mule
Hydra and Garantex sanctionsCrypto history: April 2022. German police shut down the world's largest darknet market, a Russian-language site that had handled billions in bitcoin, and the US sanctioned it and a Moscow-based crypto exchange the same day. Why it matters: Showed coordinated takedowns and sanctions against Russian illicit finance. OFAC listed more than 100 crypto addresses, so screening crypto addresses became part of sanctions compliance. Garantex's websites were seized in March 2025 and one of its administrators was arrested in India at US request.
Identity theftFraud: Using another person's personal details, such as name, date of birth, and ID or Social Security number, without permission, for example to open accounts, take out credit, or redirect their tax refunds and benefits. At a bank it often shows up as new account fraud.Related: Synthetic identity fraud, Bust-out, KYC
Insider fraudFraud: Fraud by or with the help of a bank employee, such as opening accounts for a fraud ring, overriding deposit holds, or changing contact details on customers' accounts so outsiders can take them over.Related: Account takeover, Bust-out
Insider tradingMarket abuse: Trading a security while in possession of material nonpublic information in breach of a duty, or tipping others who trade on it.Related: SEC
IntegrationAML basics: The final stage of money laundering: returning laundered funds to the criminal in a form that looks legitimate, such as property, luxury goods, business income, or loans.Related: Money laundering
KYCKnow your customerDue diligence: Verifying who a customer is and understanding what they do, so the institution can judge their risk and recognize activity that doesn't fit.Related: CDD, EDD
LayeringAML basics: The second stage of money laundering: moving funds through many transactions, accounts, entities, or countries to distance them from their source and make them hard to trace.Related: Money laundering, Shell company
Marking the closeMarket abuse: Trading near the end of the trading day to influence a security's closing price.Related: Pump and dump
MiCA and the EU travel ruleCrypto history: Fully applicable from December 2024. The EU's crypto-asset regulation created a single licensing regime for crypto service providers across the EU, and a companion law applied the travel rule to every crypto transfer between providers, with no minimum amount. Why it matters: Replaced country-by-country registration with one EU license and made originator and beneficiary information a requirement for crypto transfers in the EU.
MixerCrypto: A service that pools and redistributes crypto from many users to break the link between where funds came from and where they go. Some mixers have been sanctioned.Related: Chain hopping
MLRsMoney Laundering Regulations 2017UK & EU: The UK regulations that set out customer due diligence, enhanced due diligence (including for PEPs), and risk assessment requirements for regulated businesses.Related: CDD, EDD, PEP
Money launderingAML basics: Making money from crime look legitimate by moving it through the financial system so its criminal origin is hidden. It is usually described in three stages: placement, layering, and integration.Related: Placement, Layering, Integration
Money muleAML basics: A person who receives and moves money for someone else, often fraud proceeds. Mules may be unwitting (recruited through fake jobs or romance), complicit (paid to let their account be used), or may sell their account outright.Related: Rapid movement of funds, Funnel account
MSBMoney services businessUS reporting & regulators: A business that transmits money, exchanges currency, cashes checks, or issues prepaid access or money orders for others. In the US, MSBs must register with FinCEN and usually need state licenses; moving money for others as a business without them is a crime.Related: Hawala, Funnel account
Mt. Gox collapseCrypto history: February 2014. The exchange that handled most of the world's bitcoin trading at the time halted withdrawals and filed for bankruptcy after losing roughly 850,000 BTC, about 200,000 of which were later found. Why it matters: Showed the risk of leaving customer funds with an exchange that has weak security and controls. Repaying creditors took about a decade, and the case shaped expectations for exchange custody and audits.
NCANational Crime AgencyUK & EU: The UK law enforcement agency whose UK Financial Intelligence Unit receives suspicious activity reports and DAML requests.Related: DAML, POCA
Nested accountDue diligence: When a foreign bank uses its correspondent account to give other banks access to the US or another financial system, so the correspondent bank processes payments for banks it hasn't vetted.Related: Correspondent banking
OFACOffice of Foreign Assets ControlUS reporting & regulators: The US Treasury office that administers and enforces economic sanctions and publishes the SDN List. Blocked or rejected transactions must be reported to OFAC within 10 business days.Related: SDN List, 50 Percent Rule
Off-rampCrypto: Where crypto is converted back to traditional currency, typically at an exchange or other VASP. A key point for identifying who controls the funds.Related: VASP
OFSIOffice of Financial Sanctions ImplementationUK & EU: The part of HM Treasury that implements and enforces UK financial sanctions. Firms report frozen assets and suspected breaches to OFSI.Related: Sanctions
Peel chainCrypto: A pattern where a large crypto balance is moved through a long series of transactions, each peeling off a small amount to a new address, often toward exchanges.
PEPPolitically exposed personDue diligence: Someone who holds or held a prominent public function, such as a senior official, judge, military leader, or executive of a state-owned company, plus their family members and close associates. PEPs aren't suspects, but their position brings a higher risk of bribery and corruption, so they get enhanced due diligence.Related: EDD, Source of wealth
PhishingFraud: Tricking someone into giving up login details or one-time codes through a fake message or website that looks like their bank. Text-message versions are called smishing, and phone-call versions vishing.Related: Account takeover, Social engineering
Pig butcheringFraud: A long-running investment scam that starts with a friendly or romantic contact and moves the victim into a fake investment platform, often crypto, taking larger and larger deposits before cutting contact.Related: Romance scam
PlacementAML basics: The first stage of money laundering: getting criminal proceeds, often cash, into the financial system, for example through deposits, money orders, or cash-intensive businesses.Related: Money laundering, Structuring
POCAProceeds of Crime Act 2002UK & EU: The main UK money laundering law. It creates the money laundering offenses, the duty for the regulated sector to report suspicion, and the tipping-off offense.Related: DAML, Tipping off
Prepaid accessFraud: Money loaded onto a card, code, or account in advance, such as gift cards, prepaid debit cards, and digital codes for app stores or games. It's easy to buy, resell, and move across borders, so it's used both to launder money and to collect payments from scam victims.Related: Money mule, Layering
Pump and dumpMarket abuse: Buying a thinly traded stock cheaply, promoting it with false or misleading claims to push the price up, then selling into the buying interest before the price collapses.Related: Marking the close, FINRA
Rapid movement of fundsAML basics: Money that comes into an account and leaves again within hours or days, often in similar amounts, leaving a low balance. A common red flag for pass-through, mule, and layering activity.Related: Funnel account, Money mule
Rejected transactionSanctions: A transaction a bank refuses to process because it would violate sanctions, without blocking any property, for example a payment to a sanctioned country with no blockable interest.Related: Blocking
Romance scamFraud: A fraud in which the criminal builds a fake relationship, usually online, then asks the victim for money for emergencies, travel, or investments.Related: Pig butchering, Elder financial exploitation
Ronin Bridge hackCrypto history: March 2022. Attackers stole about $620 million from the bridge behind a popular blockchain game. The FBI attributed it to North Korea's Lazarus Group, and OFAC added a wallet address used in the theft to Lazarus's sanctions entry. Why it matters: Highlighted North Korea's large-scale crypto theft and how sanctioned groups launder funds through mixers and bridges; it led directly to the first sanctions on a mixer weeks later.
Samourai WalletCrypto history: Charged April 2024. The founders of a bitcoin wallet with built-in mixing features were charged with laundering criminal proceeds and running an unlicensed money transmitting business. Why it matters: Tested how far money transmitter rules reach privacy tools that developers build and run, a continuing debate in crypto compliance. Both founders pleaded guilty in July 2025 and were sentenced to prison terms of four and five years.
SanctionsSanctions: Restrictions governments impose on countries, people, companies, or sectors, such as asset freezes and bans on dealing with them, to pursue foreign policy and security goals.Related: OFAC, SDN List, OFSI
Sanctions evasionSanctions: Getting around sanctions, for example by using front companies, third-country intermediaries, falsified documents, or transshipment to hide a sanctioned party's involvement.Related: Front company, Transshipment
SARSuspicious Activity ReportUS reporting & regulators: A confidential report a financial institution files with FinCEN when it detects possibly suspicious activity. US banks generally file within 30 calendar days of initial detection (up to 60 days if no suspect has been identified). Telling the subject a SAR was filed is prohibited.Related: FinCEN, Tipping off
SDN ListSpecially Designated Nationals and Blocked Persons ListSanctions: OFAC's main sanctions list. US persons must block the property of listed parties and generally may not deal with them. Each entry shows the sanctions program and identifiers such as dates of birth, addresses, and ID numbers.Related: OFAC, 50 Percent Rule
SECSecurities and Exchange CommissionUS reporting & regulators: The US federal regulator for securities markets. It enforces securities laws, including those against fraud, insider trading, and manipulation.Related: FINRA, Insider trading
Shell companyAML basics: A company with no real operations, employees, or assets, often used to hide who owns or controls money. Shell companies can be legitimate, but they are a common layering tool.Related: Front company, Beneficial owner
Silk RoadCrypto history: Shut down October 2013. An online black market for drugs and other illegal goods, reachable only through Tor and paid for in bitcoin. The FBI shut it down in 2013 and its founder was later sentenced to life in prison. Why it matters: The first large darknet market, and an early lesson that bitcoin is traceable: investigators followed payments on the public ledger. In 2020 the US seized about 69,000 BTC that a hacker had stolen from the market years earlier. Its founder, Ross Ulbricht, was pardoned in January 2025.
SIM swapFraud: Moving a victim's mobile number to a SIM card the fraudster controls, usually by fooling the phone carrier, so text-message codes for password resets and payments go to the fraudster. A sign is the customer's phone suddenly losing service.Related: Account takeover
SmurfingAML basics: A form of structuring that uses several people (smurfs) to make small deposits or purchases on behalf of one person, so no single transaction or person draws attention.Related: Structuring, Money mule
Social engineeringFraud: Manipulating people, such as customers or bank staff, into giving access or information, for example by posing as the customer on a call-center line and answering security questions with leaked personal data.Related: Account takeover, Phishing
Source of fundsDue diligence: Where the money for a specific transaction or deposit came from, such as a property sale or a salary payment.Related: Source of wealth
Source of wealthDue diligence: How a customer built their overall wealth, for example salary, an inheritance, or selling a business. Different from source of funds, which is about a specific transaction.Related: Source of funds, EDD
SpoofingMarket abuse: Placing orders you intend to cancel before they execute, to mislead other traders about supply or demand and move the price.
StablecoinCrypto: A crypto token designed to hold a steady value, usually one U.S. dollar, such as USDT (issued by Tether) or USDC (issued by Circle). Because the issuer controls the token contract, it can freeze addresses and, with legal process, burn and reissue seized tokens.Related: Off-ramp
STRSuspicious transaction reportUK & EU: The name used in many countries, including most of the EU, for a suspicious activity report filed with the national FIU.Related: SAR, FIU
StructuringAML basics: Breaking cash transactions into smaller amounts to avoid a reporting or recordkeeping requirement, such as the US $10,000 Currency Transaction Report. In the US it is a crime even if the money itself is legitimate.Related: CTR, Smurfing
SUEXCrypto history: September 2021. An over-the-counter crypto broker was found to have handled proceeds from at least eight ransomware variants, with more than 40% of its known transactions tied to illicit actors. Why it matters: The first time OFAC sanctioned a crypto exchange, putting exchanges on notice that facilitating ransomware payments carries sanctions risk.
Synthetic identity fraudFraud: Creating a new, fake identity by combining real and made-up information, such as a real Social Security number with a different name, then building credit and borrowing with no intent to repay.
Tipping offUK & EU: Telling someone, directly or indirectly, that a suspicious activity report has been made or an investigation is under way, in a way that could prejudice it. An offense in the UK and prohibited in the US and EU.Related: SAR, POCA
Tornado Cash sanctionsCrypto history: August 2022. The US sanctioned an Ethereum mixing service run by smart contracts (code on the blockchain) after finding it had laundered billions, including funds stolen by North Korea. Why it matters: The first sanctions on software that no company controls, which raised hard legal questions. In 2024 a US appeals court ruled that its immutable smart contracts weren't "property" that could be sanctioned. Treasury removed it from the sanctions list in March 2025.
Trade-based money launderingTBMLAML basics: Moving value through trade by misrepresenting goods or prices: over- or under-invoicing, invoicing the same shipment more than once, or describing goods falsely.Related: Transshipment
Transaction monitoringAML basics: Automated rules or models that review customer activity and generate alerts when it matches patterns associated with financial crime, such as cash just under a threshold or rapid movement of funds.Related: Alert, False positive
TransshipmentSanctions: Shipping goods through an intermediate country before their final destination. Legitimate on its own, but often used to hide that goods are going to a sanctioned country.Related: Sanctions evasion, Dual-use goods
Travel RuleUS reporting & regulators: The requirement for institutions to pass originator and beneficiary information along with funds transfers. In the US it applies to transfers of $3,000 or more; FATF applies a similar rule to virtual asset transfers.Related: FATF, VASP
True matchSanctions: A screening alert where the customer or counterparty really is the listed party, shown by identifiers such as date of birth, nationality, address, or registration number lining up, not just a similar name.Related: False positive, Blocking
Twitter hackCrypto history: July 2020. Attackers took over dozens of high-profile accounts, including those of politicians and company founders, and posted a "send bitcoin and get double back" scam. A teenager was later identified as the mastermind. Why it matters: Investigators traced the scam payments on the blockchain and through exchanges that held identity records for the accounts involved, a clear case of exchange KYC making an anonymous-looking scam traceable.
Uncollected fundsFraud: Money from a deposited check that the bank has made available before the check has actually been paid by the other bank. If the check comes back unpaid, the credit is reversed, and any money already withdrawn becomes a loss.Related: Check kiting
VASPVirtual asset service providerCrypto: A business that exchanges, transfers, or holds crypto assets for customers, such as an exchange or custodial wallet provider. FATF expects VASPs to apply AML controls.Related: Travel Rule, Off-ramp
Wash tradingMarket abuse: Buying and selling the same security with no real change in ownership, to create a false impression of activity or price.