{ "moduleCode": "IFF607", "title": "Crypto and virtual-assets layering", "levelCode": "L-02", "levelName": "Layering", "nqf": 6, "credits": 12, "notionalHours": 120, "lessons": [ { "id": "l2m3-1", "title": "VASPs, mixers and chain-hopping", "readingMinutes": 34, "objectives": [ "Define VASP scope under the FATF's functional approach.", "Distinguish custodial mixing from CoinJoin and explain why regulators treat non-custodial mixing tools as attracting operator liability.", "Explain the Tornado Cash sanctions designation and its 2024 appellate narrowing.", "Assess why stablecoins dominate illicit on/off-ramp flows and how issuer-level freezing works as a countermeasure." ], "keyTakeaways": [ "Chain-hopping through privacy chains such as Monero remains largely resistant to on-chain tracing, unlike transparent-ledger chains.", "US enforcement has extended criminal liability to non-custodial mixing tool operators (Samourai, 2024) even without custody of client funds.", "The Tornado Cash sanctions designation was legally novel and was substantially narrowed on appeal in 2024 regarding immutable smart contracts as 'property'." ], "keyTerms": [ { "term": "VASP (Virtual Asset Service Provider)", "definition": "The FATF's functional category covering exchanges, custodial wallet providers and certain DeFi front-ends performing exchange, transfer or custody services." }, { "term": "Chain-hopping", "definition": "Converting value across multiple blockchains, often via privacy coins or bridges, to break traceability." }, { "term": "CoinJoin", "definition": "A non-custodial technique combining multiple users' transactions into one, obscuring which input funded which output." }, { "term": "Stablecoin", "definition": "A crypto-asset pegged to a reference currency (typically USD), issued by a centralised entity capable of freezing specific addresses." }, { "term": "Cross-chain bridge", "definition": "A protocol locking an asset on one blockchain and minting a wrapped equivalent on another, creating a formal ledger discontinuity." } ] }, { "id": "l2m3-2", "title": "The travel rule, MiCA and the tax transparency instruments", "readingMinutes": 32, "objectives": [ "Explain the travel rule's core obligation and the sunrise-issue implementation gap.", "Summarise MiCA's CASP licensing regime and its relationship to the recast TFR.", "Distinguish CARF/DAC8 tax-transparency reporting from AML travel-rule obligations.", "Assess realistic sequencing for a developing-country administration without an existing CARF commitment." ], "keyTakeaways": [ "The travel rule cannot compel data collection where the counterparty is a self-hosted, non-VASP wallet.", "No universal messaging rail exists for travel-rule data equivalent to SWIFT, producing interoperability workarounds.", "MiCA's CASP licensing provisions became applicable from December 2024, operating alongside the recast TFR's AML obligations.", "CARF/DAC8 serve tax-transparency purposes distinct from AML obligations and will not generate exchanged data until 2026-2027 at the earliest." ], "keyTerms": [ { "term": "Travel rule", "definition": "FATF R.15 obligation requiring VASPs to collect, hold and transmit originator/beneficiary data for virtual-asset transfers above a threshold." }, { "term": "Sunrise issue", "definition": "The uneven timing and quality of travel-rule implementation across jurisdictions, complicating counterparty data exchange." }, { "term": "MiCA (Regulation (EU) 2023/1114)", "definition": "The EU's comprehensive crypto-asset market regulation, with CASP licensing provisions applicable from December 2024." }, { "term": "CARF / DAC8", "definition": "The OECD Crypto-Asset Reporting Framework and its EU implementing directive, extending automatic tax-information exchange to crypto-asset transactions from 2026-2027." } ] }, { "id": "l2m3-3", "title": "On-chain tracing: clustering, peel chains and evidential limits", "readingMinutes": 30, "objectives": [ "Explain the common-input-ownership and change-address clustering heuristics and their relative reliability.", "Describe peel-chain analysis and distinguish it from innocent wallet housekeeping patterns.", "Identify the evidential status and limits of commercial attribution databases.", "Recommend a capacity-building sequence for a developing-country FIU building on-chain tracing capability." ], "keyTakeaways": [ "Common-input-ownership remains the most reliable non-custodial clustering heuristic; change-address heuristics carry a meaningful false-positive rate.", "Peel chains are a distinctive but not conclusive laundering signature requiring corroborating context.", "Commercial attribution is probabilistic and vendor-dependent, not a cryptographic proof, and should be corroborated before being presented as conclusive.", "The evidential bottleneck in crypto investigations has shifted from data access to correct interpretation of a permanently public ledger." ], "keyTerms": [ { "term": "Common-input-ownership heuristic", "definition": "The inference that all addresses spending inputs within a single transaction share common control, since each requires the same signer's private key." }, { "term": "Change-address heuristic", "definition": "A less reliable technique distinguishing a transaction's payment output from its change output returned to the sender." }, { "term": "Peel chain", "definition": "A repeated pattern of spending a small amount while returning the bulk of value to a new self-controlled change address, common in laundering and ransomware payment flows." }, { "term": "Attribution database", "definition": "A commercial analytics vendor's proprietary mapping of address clusters to named real-world entities, probabilistic and not independently auditable in most cases." } ] } ], "caseStudy": { "title": "Chain-hopping a ransomware payment through a bridge and a privacy coin", "jurisdiction": "Cross-border (originating African victim, downstream exchange in a non-cooperating jurisdiction)", "summary": "A ransomware payment made in Bitcoin by a Kenyan logistics firm was traced through a peel chain, across a cross-chain bridge, into Monero, before resurfacing at a centralised exchange as a stablecoin cash-out, testing the practical limits of on-chain tracing across every technique covered in this module.", "facts": [ "The victim paid a ransom in Bitcoin to an address provided by the attacker following a ransomware incident.", "Blockchain analysts identified a peel-chain pattern moving the bulk of funds through eleven intermediate addresses over six days.", "At the final hop before disappearing from Bitcoin's ledger, the funds passed through a cross-chain bridge and were converted to a wrapped-asset equivalent, then swapped into Monero via a decentralised exchange aggregator.", "The trail went cold for approximately three weeks while the funds were presumed to be held or moved within Monero's obscured ledger.", "A comparable value of USDT stablecoin later appeared, deposited to a centralised exchange account in a jurisdiction with limited FATF-standard implementation, opened using apparently fabricated KYC documents.", "The exchange, once alerted via a law-enforcement request, froze the remaining balance before full withdrawal, but roughly 40% of the traced value had already been withdrawn to a bank account." ], "investigativeQuestions": [ "At what specific point did the on-chain trail become unprovable using open-source heuristics alone?", "What corroborating evidence, beyond blockchain analysis, would be needed to connect the Monero-side reappearance to the original Bitcoin ransom with evidentiary confidence?", "What travel-rule obligations, if properly implemented by the receiving exchange, might have prevented onboarding using fabricated KYC documents?", "What asset-freezing mechanisms were available once the funds reached a stablecoin-issuing and centralised-exchange environment that were unavailable while the funds were in Bitcoin or Monero?", "How should a prosecutor frame the evidentiary gap during the Monero period in court, without overstating the certainty of the trace?" ], "learningPoints": [ "A sophisticated layering scheme can combine every technique in this module — peel chains, bridges, privacy coins and stablecoin off-ramping — in a single operation.", "Evidentiary gaps during a privacy-coin period should be disclosed and addressed with corroborating non-blockchain evidence, not minimised.", "Issuer-level and exchange-level freezing remain the most effective practical recovery tools, but only once funds re-enter a centralised, identifiable chokepoint.", "Weak travel-rule and KYC implementation at a single downstream exchange can undermine an otherwise well-executed multi-agency tracing effort." ] }, "quiz": [ { "number": 1, "type": "multiple_choice", "points": 1, "question": "Under FATF's functional approach, a VASP is defined by:", "options": [ "Its country of incorporation only", "The exchange, transfer or custody services it performs, regardless of form", "Whether it issues its own token", "Whether it operates a public blockchain node" ], "correctIndex": 1, "correctAnswer": "The exchange, transfer or custody services it performs, regardless of form", "rationale": "FATF's approach is functional: an entity performing VASP-type services is in scope regardless of its legal structure or branding." }, { "number": 2, "type": "multiple_choice", "points": 1, "question": "The 'sunrise issue' in travel-rule implementation refers to:", "options": [ "Time-zone delays in transaction settlement", "Uneven timing and quality of travel-rule adoption across jurisdictions", "The requirement to report transactions at sunrise UTC", "A specific FATF grace period for African states" ], "correctIndex": 1, "correctAnswer": "Uneven timing and quality of travel-rule adoption across jurisdictions", "rationale": "The sunrise issue describes the practical problem of counterparties in different jurisdictions reaching travel-rule compliance at different times, complicating data exchange." }, { "number": 3, "type": "multiple_choice", "points": 1, "question": "The Tornado Cash sanctions designation was legally significant because:", "options": [ "It was the first time software code was placed on the SDN list, later narrowed on appeal regarding immutable contracts as 'property'", "It banned all cryptocurrency in the United States", "It was later fully upheld without modification", "It applied only to Bitcoin transactions" ], "correctIndex": 0, "correctAnswer": "It was the first time software code was placed on the SDN list, later narrowed on appeal regarding immutable contracts as 'property'", "rationale": "OFAC's designation of Tornado Cash smart contracts was novel, and a 2024 appellate ruling narrowed the theory regarding immutable code as sanctionable property." }, { "number": 4, "type": "multiple_choice", "points": 1, "question": "Regulation (EU) 2023/1114 (MiCA) primarily establishes:", "options": [ "An EU-wide travel-rule messaging protocol", "Licensing, prudential and disclosure requirements for crypto-asset service providers and token issuers", "The CARF tax reporting framework", "A ban on stablecoins in the EU" ], "correctIndex": 1, "correctAnswer": "Licensing, prudential and disclosure requirements for crypto-asset service providers and token issuers", "rationale": "MiCA is the EU's market-regulation instrument for CASPs and token issuers, distinct from the AML-focused TFR." }, { "number": 5, "type": "multiple_choice", "points": 1, "question": "CARF and DAC8 are best characterised as:", "options": [ "AML travel-rule instruments", "Tax-transparency automatic-exchange instruments, distinct from AML obligations", "Sanctions regimes", "Blockchain technical standards" ], "correctIndex": 1, "correctAnswer": "Tax-transparency automatic-exchange instruments, distinct from AML obligations", "rationale": "CARF and its EU implementing directive DAC8 extend automatic tax-information exchange to crypto-assets, a distinct purpose from AML travel-rule compliance." }, { "number": 6, "type": "multiple_choice", "points": 1, "question": "The common-input-ownership heuristic infers shared control because:", "options": [ "All inputs in a transaction must be signed by the keys of their respective controllers, implying common authorisation of the spend", "Blockchain explorers label addresses automatically", "Exchanges publish customer lists", "Bitcoin transactions are only ever single-input" ], "correctIndex": 0, "correctAnswer": "All inputs in a transaction must be signed by the keys of their respective controllers, implying common authorisation of the spend", "rationale": "Because signing a multi-input transaction requires each input's private key, common authorisation implies common control at the time of the transaction." }, { "number": 7, "type": "multiple_choice", "points": 1, "question": "Monero defeats on-chain clustering primarily because:", "options": [ "It is not a real blockchain", "Its default protocol obscures sender, receiver and amount via ring signatures and stealth addresses", "It has no exchanges", "It only supports small transaction amounts" ], "correctIndex": 1, "correctAnswer": "Its default protocol obscures sender, receiver and amount via ring signatures and stealth addresses", "rationale": "Monero's privacy-by-default design defeats the transparency assumptions underlying Bitcoin/Ethereum clustering heuristics." }, { "number": 8, "type": "multiple_choice", "points": 1, "question": "Commercial blockchain-analytics attribution evidence should be treated in court proceedings as:", "options": [ "Conclusive, self-proving fact requiring no corroboration", "A probabilistic inference requiring corroboration and disclosure of the underlying heuristic chain", "Inadmissible in all jurisdictions", "Equivalent to a notarised confession" ], "correctIndex": 1, "correctAnswer": "A probabilistic inference requiring corroboration and disclosure of the underlying heuristic chain", "rationale": "Attribution is a proprietary, probabilistic inference and should be corroborated with independent evidence before being relied upon as conclusive." } ], "essayPrompts": [ { "number": 1, "prompt": "Evaluate whether the travel rule can ever achieve correspondent-banking-equivalent transparency given the structural presence of self-hosted wallets, and propose realistic policy alternatives.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 2, "prompt": "Assess the evidentiary risks of relying on commercial blockchain-analytics attribution in a criminal prosecution, drawing on the Tornado Cash appellate narrowing as an example of legal uncertainty in this space.", "wordGuide": "1200-1500", "weightingPercent": 30 }, { "number": 3, "prompt": "Argue for a capacity-building sequence a mid-sized African FIU should follow to build credible on-chain tracing capability ahead of eventual CARF participation, given constrained budgets.", "wordGuide": "1200-1500", "weightingPercent": 30 } ], "assignment": { "prompt": "Produce a technical briefing note, suitable for a Director-General, explaining (1) what a travel-rule record can and cannot prove, (2) what an on-chain clustering trace can and cannot prove, and (3) what combination of the two, plus traditional MLA channels, would be required to build a prosecutable case against a hypothetical chain-hopping scheme moving value from a licensed domestic exchange through a bridge and a privacy coin to an offshore off-ramp.", "wordGuide": "2000-2500", "weightingPercent": 35 }, "rubric": { "criteria": [ { "criterion": "Legal and regulatory accuracy", "weight": 25 }, { "criterion": "Typology and mechanism analysis", "weight": 25 }, { "criterion": "Evidence and application to the facts", "weight": 20 }, { "criterion": "Investigative or policy judgement", "weight": 15 }, { "criterion": "Structure, referencing and professional expression", "weight": 15 } ], "bands": [ { "band": "Distinction", "range": "75-100" }, { "band": "Meritorious", "range": "65-74" }, { "band": "Competent", "range": "50-64" }, { "band": "Marginal", "range": "40-49" }, { "band": "Not competent", "range": "0-39" } ], "subMinimum": "40% in the assignment component" }, "exportedAt": "2026-08-14T13:05:13.196Z" }