CCI Cryptocurrency Exchange Investigations 2 — Questions and Answers
Question 1: What is an address 'cluster' in the context of blockchain exchange investigations?
- A group of addresses identified as controlled by the same entity through heuristics like common-input ownership (Correct answer)
- A group of miners working together on a pool
- Multiple transactions confirmed in a single block
- A set of unconfirmed mempool transactions
Correct answer: A group of addresses identified as controlled by the same entity through heuristics like common-input ownership
A cluster is a group of cryptocurrency addresses attributed to the same controlling entity, most commonly identified through common-input-ownership heuristics.
Question 2: When investigating a cryptocurrency exchange, which legal instrument prevents the exchange from alerting the customer that their records are being sought?
- Non-disclosure order (gag order) accompanying the subpoena (Correct answer)
- Public court filing
- Press release from the agency
- Standard civil complaint
Correct answer: Non-disclosure order (gag order) accompanying the subpoena
A non-disclosure order (gag order) accompanying a subpoena legally prohibits the exchange from notifying the account holder that their records are under investigation.
Question 3: What is 'smurfing' in the context of cryptocurrency exchange investigations?
- Breaking large amounts into smaller transactions to stay below reporting thresholds (Correct answer)
- Using multiple stolen identities to open exchange accounts
- Layering funds through dozens of exchanges simultaneously
- Converting cryptocurrency to prepaid gift cards
Correct answer: Breaking large amounts into smaller transactions to stay below reporting thresholds
Smurfing is a structuring technique that breaks large amounts into smaller transactions specifically to avoid triggering mandatory reporting thresholds like the $10,000 CTR.
Question 4: Which US government agency maintains primary AML/KYC regulatory authority over domestic cryptocurrency exchanges?
- FinCEN (Financial Crimes Enforcement Network) (Correct answer)
- FBI
- DEA
- Homeland Security Investigations (HSI)
Correct answer: FinCEN (Financial Crimes Enforcement Network)
FinCEN, a bureau of the US Treasury Department, holds primary AML/KYC regulatory authority over cryptocurrency exchanges registered as MSBs in the United States.
Question 5: What is a Suspicious Activity Report (SAR) and who is required to file it?
- A confidential report filed by financial institutions including exchanges with FinCEN when suspicious activity is detected (Correct answer)
- A public police report filed by investigators
- A report filed by victims of crypto fraud to the FTC
- A quarterly tax filing submitted by exchanges to the IRS
Correct answer: A confidential report filed by financial institutions including exchanges with FinCEN when suspicious activity is detected
A SAR is a confidential report that financial institutions (including crypto exchanges) must file with FinCEN when transactions suggest potential money laundering or other criminal activity.
Question 6: An investigator receives exchange records showing a customer used a US driver's license but IP login records show consistent logins from a foreign country. What does this most likely indicate?
- Possible identity fraud, a synthetic identity, or a money mule account (Correct answer)
- Normal international travel patterns
- An exchange system logging error
- A legitimate corporate account
Correct answer: Possible identity fraud, a synthetic identity, or a money mule account
Consistent foreign IP logins despite US identity documentation suggests potential use of a fraudulent or synthetic identity, or that the account belongs to a money mule.
CCI Cryptocurrency Exchange Investigations 2
What is an address 'cluster' in the context of blockchain exchange investigations?