CMI010 · Sanctions

Cryptocurrency Evasion

Cryptocurrency Evasion is the use of virtual assets — wallet clusters and virtual-asset service providers (VASPs) — to move value around sanctions. It sits under the Crypto & Market Intelligence line (hence the CMI prefix) but ships in the sanctions suite because the exposure it measures is a sanctions exposure.

The finding is an on-chain / VASP finding: direct exposure to a designated wallet, mixer or tumbler use, or an unregistered VASP — weighted against the counterparty, the VASP's jurisdiction and any ownership link to a designated party. The on-chain signal dominates because it *is* the finding.

Risk indicators

On-chain / VASP

• Direct exposure to a sanctioned wallet
• Mixer / tumbler use
• Unregistered VASP

Jurisdiction

• VASP registered in a sanctioned jurisdiction
• VASP in a high-risk jurisdiction

Counterparty

• Counterparty sanctions exposure or adverse media

Ownership

• Owner designated, or in a sanctioned / high-risk jurisdiction

Investigation actions

1. Resolve the VASP / wallet cluster, its owner and counterparty.
2. Assess on-chain signals: sanctioned-wallet exposure, mixer use, unregistered VASP.
3. Classify the VASP jurisdiction (sanctioned / high-risk).
4. Score counterparty exposure and any ownership link to a designated party.
5. Aggregate; escalate at or above the threshold.

Detection logic

1. Resolve the VASP / wallet cluster, its owner and counterparty. 2. Assess on-chain signals: sanctioned-wallet exposure, mixer use, unregistered VASP. 3. Classify the VASP jurisdiction (sanctioned / high-risk). 4. Score counterparty exposure and any ownership link to a designated party. 5. Aggregate; escalate at or above the threshold.

Related typologies

Curated from fc-05-sanctions-exposure-analytics-toolkit/typologies/CMI010_Cryptocurrency_Evasion.md