Crypto Red Flags, Operation Shadow Hunter and PPP Fraud

September 18, 2020 7 minute read

FATF shares practical knowledge of virtual assets, the FCA drops cases, Operation Shadow Hunter claims a victory and there’s been illicit use of PPP funds.

We share our financial regulatory highlights from the week of 14 September 2020.

Red Flag Crypto FATF Report

FATF has released its latest report into virtual assets detailing red flag indicators for whether or not these assets are being used for money laundering.

The timing of the report, 14 September 2020, follows closely with a SWIFT report released earlier this year that found cryptocurrencies are rarely used for money laundering purposes. The report commented: “Identified cases of laundering through cryptocurrencies remain relatively small compared to the volumes of cash laundered through traditional methods.”

That does not mean that cryptocurrencies pose no threat at all. They have the potential for money laundering activity and should be monitored closely as a result, the SWIFT report went on to say: “In one major case, a significant cyber-crime group is estimated to have converted stolen funds obtained from ATM cashouts into cryptocurrency.”

So while cryptocurrency may not be the preferred avenue of money laundering for some criminals, it still represents a potential vector for money laundering. The FATF report examined 100 case studies to build its findings and has 13 case studies for review in the report itself as prime examples of red flag behavior for compliance officers to be on the lookout for.

The 13 examples can be grouped into roughly six categories that are presented as detectable indicators of money laundering using virtual assets (VAs) and virtual asset service providers (VASPs):

Technological features that increase anonymity — P2P exchanges, tumbling & mixing services or anonymity-enhanced crypto
– Use of decentralised wallet
– Use of IP address associated with Darknet Marketplace – Alpha Bay
– Use of mixing and tumbling with Darknet-based VASP Helix
– Use of multiple VA exchanges, false identification documents for CDD and prepaid cards
Geographical risks — relevant to countries with weak or no approach to VAs
– Multiple VAs and multiple transfers to foreign VASPs
– Multiple immediate transfers of large amount of VAs to overseas VASPs
– Bitcoin dealer operating unlicensed money transmitting businesses
Irregular & uncommon transaction patterns
Use of shell companies specifically examining Deep Dot Web
Transaction size or frequency doesn’t have a logical business explanation
– Transfers conducted in a recurrent time
Sender or recipient profiles and associated atypical behavior
– Customer profile does not match with regular high-value VA trading
– Scam victims turned mules
Source of funds or wealth
– Initial deposit inconsistent with customer profile
– Customer refusing to provide information on source of funds


While some of these examples are using now-defunct websites, seized and dismantled by authorities, such as Alpha Bay and Deep Dot Web — they provide specific and useful insight into how to detect money laundering using cryptocurrencies.

Crypto may not be the primary vector for money laundering now, but it is growing in popularity and is taking enough of the market-share of illicit cash that compliance teams need to pay attention to it. This guidance from FATF is a strong step in getting ahead of how new technology is used to facilitate financial crime.

FCA Cuts Criminal Caseload

The Financial Conduct Authority (FCA) revealed that it has had to drop 50% of its investigations into money laundering breaches in the UK since January 2020. It’s a blow in the fight against financial crime and is sure to cause some concern amongst compliance professionals across the country.

Seven out of 14 criminal investigations being looked into by the regulator have been stopped. Five of them were for purely criminal issues, the other two were ‘dual track’ and had the potential for criminal or civil proceedings being taken against them.

Dual track proceedings make up six of the remaining cases being investigated by the FCA and only one is single-track for criminal proceedings. This drastically reduces the chances that the regulator will see criminal outcomes for money laundering issues as the dual track cases may only be charged under civil issues.

There’s speculation that this is due to the monetary and resource costs of these investigations. Proving financial crime activity beyond reasonable doubt isn’t easy and in these tough economic times the regulator may be pursuing cases which are most likely to see a strong result.

The FCA’s Executive Director of Enforcement and Market Oversight, Mark Steward has been issuing rhetoric on cracking down on financial crime. While giving a speech in February 2020, Steward commented: “We may impose tougher sanctions where we see firms failing to correct relevant deficiencies and make good losses to consumers caused by those firms’ failings. We may also reduce sanctions to give credit for rapidly-commenced, proactive, co-operative and thorough remediation, especially consumer redress.”

It follows that the cases left to the FCA may be those where it is especially certain that it will be able to issue more punitive sanctions on firms as a warning to others in the sector — the FCA has a record of only bringing cases against the worst rule breakers.

Operation Shadow Hunter

A crime ring that facilitated the movement of over HK$3 billion ($384 million) in laundered money has been broken up by the Hong Kong Customs Authority.

Launched on 10 September 2020, Operation Shadow Hunter saw significant results. The HK$3 billion crime ring is the highest value of its kind to ever be handled by Hong Kong Customs, six locals have been arrested in connection with the crime ring.

The criminals were using a money services operator (MSO) to launder the money and Customs was able to freeze HK$30 million ($3.8 million) in assets — as well as suspend the license of the MSO.

The money laundering ring was identified by customs earlier in the year and the investigation took months. The operation consisted of a raid on four residences and the MSO – the arrests were made with the charge of conspiring to deal with property known or reasonably believed to represent the proceeds of an indictable offence (money laundering). Five of the people involved were family members and the sixth was the licensee of the MSO.

Over one hundred personal bank accounts had been opened by the family members across numerous local banks in Hong Kong since 2018. HK$170 million ($21.7 million) moved using these accounts was related to the MSO. The money and high-value transactions involved with these accounts were at odds with the financial lives of the family which indicated illicit behavior at first glance – a demonstrable use case for transaction monitoring.

The MSO licensee was arrested due to a belief that they conspired with the family to commit money laundering. There is also an ongoing concern that the licensee used third party bank accounts, also known as money mules (attend our webinar on their rise), to assist with other transactions from unknown sources.

Hong Kong Customs also stressed to the public that they risk charges of money laundering if they use personal bank accounts to deal with money from unknown sources.

Seven Accused of Laundering PPP Funds

Seven individuals in Georgia and South Carolina have been accused of laundering more than $750,000 obtained under false pretenses — over half of which were PPP funds — US officials announced on 10 September 2020. Agents also confiscated over $2.1 million from 12 bank accounts for forfeiture.

According to the indictment, the illicit activity began in October 2019, with a scheme to move funds obtained through a fraudulent tax return out of a business account associated with Wild Stylz Entertainment LLC. Three individuals — Lauren Duhart, Joshua Smith and Steve Lewis — allegedly acted as brokers between Christopher Agard, owner of Wild Stylz, and other individuals who, acting as money mules, agreed to receive the funds into their accounts as part of the laundering process for a fee.

Prosecutors say Agard transferred $378,000 to a business account associated with Henry Duffield, who wrote checks to conspirators to withdraw the funds. Checks totaling $200,000 were deposited at a casino in North Carolina, where the conspirators allegedly spent an hour or two gambling before cashing out and leaving with just under that amount. Proceeds were then distributed amongst the scheme’s participants.

Then in May 2020, Agard submitted a PPP loan application for Wild Stylz. He supposedly included fabricated supporting documentation that misrepresented employee totals and payroll expenses. The application was approved, and Wild Stylz received a loan totaling approximately $397,000. Those funds, according to prosecutors, were distributed to numerous accounts in the conspirators’ names to mask their source.

Interestingly, law enforcement had been investigating a heroin and meth trafficking ring in Greenville when this case surfaced. It appears that the two cases are connected by a common party: one of the men involved in the drug trafficking scheme, Roosevelt Hunt, also helped move the allegedly illicitly obtained funds out of Wild Stylz’s business account. Hunt pleaded guilty two weeks ago to charges related to his involvement in both schemes.