High Risk Exchanges (with minimal or "no KYC" and AML requirements) usually operate as “Parasite Exchanges” (Parasites VASP). Parasite exchanges exploit larger exchanges to provide digital asset trading services to users, usually without the host exchange's consent.
Most are based in Russia and Iran and are highly exposed to funds linked to sanctioned entities and other high-risk entities. VASP parasites therefore facilitate volume and illegal transactions, also offering mixing services. Due to regulatory pitfalls, regulated exchanges are highly susceptible to the risk posed by parasitic exchanges.
PARASITES VASP
Parasitic exchanges take advantage of the host exchange's higher liquidity and lower transaction fees by charging their members a slightly higher fee.
Parasitic have no contractual relationships with the exchange hosts they exploit, but operate without the permission or knowledge of their host. Multiple accounts are often created, registered under fake/stolen identities, using shell companies or different credentials to make it more difficult for the host exchange to track them by effectively spreading the trading volume across multiple accounts.
The percentage of illicit volume processed by parasitic exchanges is approximately 100 times higher than that of their host exchanges. However, parasitic exchanges represent a negligible share of their hosts' overall volumes and represent only a thin slice of the total illicit volume on exchanges.
In Iran, exchanges are subject to sanctions based on their jurisdiction. Russia is home to a number of high-risk exchanges, some of which have been sanctioned in recent years due to their illicit activities. One notable example was the parasitic exchange Suex, based in Russia and incorporated in the Czech Republic, which was complicit in laundering millions of dollars for Russian ransomware groups. Since then, other high-risk Russian exchanges, Chatex and Garantex, have followed suit, becoming subject to OFAC sanctions due to their involvement in money laundering in November 2021 and April 2022, respectively. Users may be attracted to the exchanges parasites for a variety of reasons, including their instant and anonymous trading services, minimal fees, and their tendency to support a wide range of cryptocurrencies and anonymous payment methods. Yet it is regulated exchanges that unknowingly share their infrastructure that bear the greatest risk from parasitic exchanges. Host parasitic exchanges and therefore potentially violate terms of service and facilitate illicit transactions.
EXAMPLES OF PARASITES VASP
Among the best-known examples are BTC-e (its founder Alexander Vinnick was arrested, there are probably links to the theft of BTC from Mt.gox), SUEX, Chatex, Bitzlato and Garantex. Exchange Chatex has come under investigation for facilitating payments resulting from ransomware scams and other cyber crimes. Chatex worked OTC through a Telegram bot facilitating anonymous transactions.
On September 21, 2021, OFAC took action against SUEX, a cryptocurrency exchange incorporated in the Czech Republic but operating in Russia. SUEX, which operated as a so-called "nested" exchange or "parasitic VASP", did not directly store its customers' cryptocurrencies. Instead, it relied on the infrastructure of a large global cryptocurrency exchange to conduct its transactions. SUEX took advantage of the greater liquidity and lower transaction costs of large multinational exchanges, while presenting customers with a customized interface that obscured the use of the real exchange. Using this relationship with a large exchange and access to money from unknown sources, SUEX was able to convert its clients' illicit money into physical money with full anonymity. He also worked as an OTC Desk, managing to convert large sums of money.
Chatex had direct ties to SUEX, using SUEX's function as a nested exchange to conduct transactions. The companies IZIBITS OU, Chatextech SIA and Hightrade Finance Ltd also came under investigation as they were linked to these two parasitic VASPs According to the Treasury, these three companies created the infrastructure for Chatex, enabling Chatex's operations and resulting illicit payments.
HOW DO THEY WORK
Parasitic exchanges connect to legitimate exchange platforms to disguise their illicit activities. They use these links to make transactions without raising suspicion. For example, they can deposit funds into a legitimate exchange, perform some transactions and then withdraw the clean funds. These exchanges use obfuscation technologies such as cryptocurrency mixers and tumblers to make transactions untraceable. This process mixes cryptocurrencies from different users to hide the origin and destination of the funds. Parasitic exchanges do not require their users to provide detailed identity information, avoiding KYC/AML regulations, facilitating anonymity. Criminals use fake identities or frontmen to open accounts on these exchanges. These frontmen can be consenting individuals or completely false identities created with forged documents. Accounts with fake documents are then opened to perform anonymous transactions and withdraw fiat funds. Parasitic exchanges often operate through intermediaries or peer-to-peer (P2P) exchange platforms that allow direct transactions between users with minimal KYC requirements.
From TRM Labs:
OPERATIONAL EXAMPLES OF A PARASITIC VASP
1) No KYC (or very lax) registration: A parasitic VASP allows users to register without requiring detailed identity verification (KYC). Users may use pseudonyms and provide minimal information. Users can create an account using just an email address and password, without having to upload identity documents.
2) Anonymous Exchange Offer: The parasitic VASP facilitates exchanges of cryptocurrencies for fiat or other cryptocurrencies without tracing the origin and destination of the funds. Often, these platforms offer mixing services to further obfuscate transactions. A user can deposit Bitcoin, use a mixing service offered by VASP to make the origin of the funds unrecognizable, and then convert the "mixed" Bitcoin into Monero (which offers additional anonymity features)
3) Use of Legitimate Exchanges: VASP use legitimate exchanges to access liquidity and to exploit the legitimacy of these exchanges to disguise their activities. This usually happens through accounts created with false identities or nominees. The VASP deposits large amounts of cryptocurrency to a legitimate exchange like Binance or Coinbase, executes several transactions to “clean” the funds, and then withdraws the funds into an anonymous wallet or fiat. They use legitimate accounts albeit with frontman accounts or fictitious companies (with stolen or fake documents) to trade large amounts of cryptocurrencies, improving the profitability of their illicit operations
4) Withdrawal and Conversion to Fiat: The clean funds are then withdrawn by the parasitic VASP and converted into fiat currency through various methods, often using intermediaries or payment services that do not require rigorous identity checks. After transferring funds to an anonymous wallet, the user can use a payment service such as PayPal, which may be connected to a fake identity account, to withdraw the funds to a bank account
HOW DO EXCHANGES MONITOR PARASITES VASP?
Exchanges can detect VASP parasites operating on their infrastructure through a combination of the following methods and tools:
1) Transaction monitoring: Examining the movement of funds into and out of wallets on the platform allows exchange hosts to spot patterns, such as high transaction volumes and repetitive deposits and withdrawals, that could indicate the existence of a parasitic exchange
2) Risk Scoring: Exchange hosts can evaluate user behavior via risk scoring systems. Large or frequent transactions with illicit counterparties can reveal the presence of a parasitic exchange
3) Compliance checks: Periodic audits of business and personal accounts can allow exchange hosts to identify users who appear to be running businesses through their personal accounts, running parasitic exchanges
4) Tracking (Intelligence): on-chain analysis can detect patterns indicative of parasitic exchanges (continuous reuse of wallets, routing of funds through multiple wallets before reaching the host exchange, interactions with exchanges with poor controls)
Are you interested in ways to earn crypto bonus? Check it out here: Some Sites To Earn Crypto Bonus (Old & New)
