FATF Red Flag Indicators: How to Check Them on the Blockchain

In September 2020 the Financial Action Task Force, the body that sets anti-money-laundering standards for its member countries, published its red flag indicators for virtual assets. The list draws on more than 100 case studies. Some of the flags can be read straight off a blockchain. Others need what only an exchange or bank holds, such as customer records and IP addresses. Below we sort them, then run four of the on-chain checks live with the Bitquery MCP server.

The six groups of red flags

FATF group	Example red flags	Can the ledger show it?
Transaction size	Many transfers just under a reporting threshold; high-value transfers in quick succession	Yes
Transaction patterns	Many unrelated wallets paying one wallet that moves the funds on; new wallets with large first deposits	Yes
Anonymity	Mixers and tumblers, privacy coins, peer-to-peer exchanges	Mostly
Senders and recipients	Several accounts under different names, unusual IP addresses, thin customer records	Rarely: these live in an exchange's own records
Source of funds	Funds linked to fraud, ransomware, darknet markets or sanctions	Yes, through address labels
Geography	Exchanges in countries with weak or no rules for virtual assets	Partly, through exchange and sanctions labels

The ledger answers the questions about money: how much, how often, from whom and to whom. It cannot say who is behind an address. So an on-chain check narrows the list of transfers worth a look, and the exchange's customer records do the rest.

Four checks, run live

We ran each check on Ethereum with the MCP server between 8 and 16 October 2026. Each one shows the question we gave the AI and the tool it called.

1. Transfers just under a threshold

Splitting money into amounts just below a reporting limit is called structuring. The FATF suggests $1,000 or €1,000 as the limit for its "travel rule", which makes exchanges pass sender and receiver details along with a transfer. US banks report cash transactions above $10,000. Those are the lines to watch.

We asked: "Over 8 to 14 October 2026, how many USDT transfers on Ethereum fell just under $1,000 and $10,000, against just over?" The AI used eth_transfers_raw_sql.

USDT transfers, 8 to 14 Oct 2026	Count
$900 to $999.99	45,818
$1,000 to $1,099.99	66,298
$9,000 to $9,999.99	14,499
$10,000 to $10,999.99	19,381

Across the whole network there is no bulge below either line. Round sums win: 24,302 transfers were for exactly $1,000 and 7,670 for exactly $10,000. Structuring shows up wallet by wallet, not in totals.

We asked: "Which wallets sent at least 20 USDT transfers between $9,000 and $9,999.99 that week, and almost none above $10,000?" The AI used eth_transfers_raw_sql, then labels_for_addresses.

The top result looks like a textbook case: 0x76c8…617b sent 53 transfers of exactly $9,999.20, about $530,000 in all, to a single address. The labels explain it. The sender is a Bybit deposit address and the receiver is Bybit's hot wallet. This is an exchange moving customer deposits into its own wallet, in fixed amounts just under $10,000. It is not a customer avoiding a report.

That is the most useful lesson of the four checks. A size or timing rule alone flags exchanges, payment firms and bots. Label every flagged address before anyone treats it as suspicious.

2. Many senders, one receiver

We asked: "Profile 0x1d50588c0aa11959a5c28831ce3dc5f1d3120d29: how many addresses paid it, and where did it send the money?" The AI used eth_address_profile, then address_labels.

What the ledger shows	Figure
Distinct addresses that paid it	184
Transfers out	1, on 24 April 2018
Distinct addresses it paid	1
Label	Phishing

The FATF describes this funnel: many unrelated wallets pay in, and the money leaves in one payment. Here the label explains it: Bitquery's directory marks the address as a phishing address. The same check on an unlabelled address is a lead worth following one step further.

3. Mixer deposits

We asked: "How much ETH went into the Tornado Cash router 0xd90e…f31b between 15 September and 14 October 2026, and in what sizes?" The AI used eth_transfers_raw_sql.

Deposit size	Deposits	Depositing wallets
0.1 ETH	5,181	1,595
1 ETH	2,374	689
10 ETH	972	292
100 ETH	381	78

That is about 50,700 ETH in 30 days. The US Treasury lifted its sanctions on Tornado Cash in March 2025, but the FATF still treats mixer use as a red flag. A deposit in one of these fixed sizes, or a withdrawal that arrives from the mixer, is the kind of transfer an exchange should ask about. Our Ronin bridge trace shows the pattern from a real theft: 334 deposits of exactly 100 ETH in five days.

4. Sanctions and high-risk geography

We asked: "Which sanctions lists does Bitquery's label directory cover, and is a given address on one?" The AI used find_label_values, then labels_for_addresses.

The directory carries sanctioned addresses from lists published by the US Treasury (OFAC), the UK, the EU, France and Japan. They include darknet markets such as Hydra, exchanges such as Garantex and Grinex, and wallets tied to North Korea's Lazarus Group. One call checks a whole list of counterparties against all of them. For the geography flag, exchange labels name the service at the end of a trace. Compare it with the FATF's list of high-risk and monitored jurisdictions.

What the ledger cannot tell you

Several FATF flags need records no blockchain holds: customer names and ID documents, IP addresses, card payments and the reasons a customer gives. An on-chain screen is one input to an exchange's or bank's monitoring, not a replacement for it. It is also only as good as its labels. An unlabelled address is unknown, not clean.

Run the checks yourself

Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing and labels sit on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.

Which wallets sent at least 20 USDT transfers between $9,000 and
$9,999.99 on Ethereum in the last 7 days? Label each sender and
receiver.

How many addresses paid 0x..., and where did it send the money?

Check these counterparties against sanctions, mixer, darknet and
scam labels: 0x..., 0x..., 0x...

For a full trace, see how the Upbit hackers split 342,000 stolen ETH.

Frequently asked questions

What are the FATF red flag indicators for virtual assets?

A list the FATF published in September 2020, drawn from more than 100 cases, of signs that crypto transfers may be linked to money laundering or terrorist financing. They fall into six groups: transaction size, transaction patterns, anonymity, senders and recipients, source of funds, and geography.

Can blockchain data alone detect money laundering?

No. It shows amounts, timing and counterparties, and labels can tie addresses to exchanges, mixers, scams and sanctioned entities. Who controls an address, and why they moved the money, usually comes from an exchange's customer records.

Why did the structuring check flag an exchange?

Exchanges move customer deposits into their own wallets in fixed amounts. A rule that looks only at size and frequency cannot tell that apart from a customer splitting money to dodge a report. Checking labels first removes most of these false alarms.

Related reading

• Crypto money laundering: how it works and how it is traced
• How to trace Bitcoin transactions and addresses
• How the Upbit hackers split 342,000 stolen ETH

---

First published in May 2024 by Divyasshree. Rewritten on 16 October 2026: the GraphQL examples and Coinpath were replaced with four checks run live through the Bitquery MCP server, the indicator list was checked against the FATF's own summary, and AI tools helped run the queries and draft the text. Bitquery sells the MCP server named above. This article is for information only and is not legal or compliance advice.