Virtual asset transaction monitoring and red flags

Build a complete monitoring data set

Normalise identifiers across chains and systems so a rule can see linked accounts, wallets and transfers. Preserve the raw source and transformation lineage needed to reproduce an alert. A monitoring rule built on partial data should document the blind spot instead of implying complete coverage.

• Customer, beneficial owner, risk rating, purpose, expected assets, expected value and frequency, source information and jurisdiction profile.
• Fiat deposits and withdrawals, payment instruments, bank-account holder, cash or crypto-ATM events, chargebacks and third-party funding.
• Wallet address, chain, token, contract, transaction hash, direction, timestamp, amount, fees, counterparties, destination tag or memo and cross-chain bridge activity.
• Device, IP, geolocation, session, account linking, authentication changes, API keys, withdrawal-address changes and failed verification events.
• Reliable sanctions, adverse intelligence, VASP registration and blockchain attribution with provider, version, time and confidence preserved.

Monitor customer and transaction behaviour

Compare current activity with the customer's history, stated purpose and similar customers using the same services. Monitor rapid movement after fiat funding, immediate withdrawals, velocity and value changes, chains of asset conversions without apparent rationale, pass-through wallets, unusual third-party funders, multiple linked accounts and sudden changes to devices or withdrawal destinations.

Apply risk-based intensity. Higher-risk customers and services may require more alerts or more frequent manual review. AUSTRAC expects monitoring measures to be checked regularly so the business can show that relevant activity is identified, alerts arrive in time and investigators respond appropriately.

Use virtual-asset-specific indicators

These are indicators, not automatic SMR conclusions. Tune them by asset, chain, service, customer segment, direction, proximity, attribution confidence, value and pattern. A broad rule that generates unmanageable false positives can obscure serious activity just as surely as a rule that never fires.

• Transfers involving wallets associated with unregistered or unregulated VASPs, OTC brokers, peer-to-peer platforms, mixers or higher-risk decentralised exchanges.
• Rapid virtual-asset-to-virtual-asset chains or rapid fiat and stablecoin conversions without a reasonable economic explanation.
• High-confidence blockchain exposure to scam receipts, ransomware, darknet markets, child exploitation, terrorism financing, sanctions or proliferation-financing concerns.
• Privacy-coin or anonymity-enhancing activity inconsistent with the customer's known profile and purpose.
• Multiple bank deposits in different names, rapid clearing to an intermediary wallet, apparent coaching, limited virtual-asset knowledge followed by a large outbound transfer, or a customer reporting they are sending funds for an investment opportunity.
• Account, identity, device or network features consistent with a mule, synthetic identity, account takeover or multiple accounts controlled by the same person.

Investigate and disposition alerts consistently

Give the investigator the relevant transaction path, customer profile, KYC and ownership information, fiat funding, device and account links, prior alerts, blockchain evidence and open-source or sanctions results. Record the question examined, material considered, limitations, customer contact where appropriate, conclusion and approver.

Use controlled dispositions such as explained activity, false positive, monitoring adjustment, KYC refresh, customer-risk update, enhanced CDD, restriction, exit or SMR review. Do not close an alert only because a customer supplied a plausible sentence; corroborate material facts proportionately. Restrict suspicious-matter information to authorised personnel and avoid customer contact that creates a tipping-off risk.

Move from indicators to an SMR decision

Review the whole matter to decide whether there are reasonable grounds for a relevant suspicion. AUSTRAC says one indicator may have a legitimate explanation and multiple indicators may be needed. Certainty that a crime occurred is not required. If reasonable grounds arise, submit the SMR within the applicable deadline: 24 hours for a terrorism-financing suspicion and three business days for other reportable suspicions.

An SMR can be required when a service is requested, started, completed, declined or attempted, depending on the facts. A transfer hold, account closure, law-enforcement referral, TTR or future self-hosted-wallet report does not replace the SMR analysis. Put wallet addresses and structured virtual-asset fields in the correct report fields rather than burying them only in narrative grounds.

Test monitoring effectiveness

Test data completeness, alert logic, thresholds, attribution freshness, scenario coverage, investigation quality, timeliness and reporting hand-off. Replay known typologies and synthetic cases across supported products and chains. Track alert volumes, aging, false-positive reasons, missed detections, model or vendor changes and overrides.

Update scenarios when AUSTRAC publishes new indicators, the business launches a product or chain, customer behaviour changes or an incident reveals a gap. Senior managers should approve material changes, and the business should retain the rule version and evidence that monitoring continued to operate during deployments and migrations.