Forming the suspicion: the DPT typologies
Read the PDF edition (2 pages)
What makes a DPT transaction suspicious? The FATF's red-flag indicators of September 2020 and the ACIP typology papers give the taxonomy, and MAS expects a firm's monitoring rules and analyst training to reflect it.1 The indicators that recur in Singapore practice are the following. Structuring of fiat deposits or DPT purchases just below internal thresholds. Rapid conversion of deposited fiat into DPTs and immediate withdrawal to an external wallet, with no trading in between, which is the classic on-ramp for scam proceeds. Receipt of DPTs from addresses that analytics tools link to mixers, darknet markets, sanctioned entities, ransomware or hacked exchanges. Inbound transfers from many unrelated addresses consolidated and withdrawn to one. Use of privacy coins or chain-hopping across bridges. Customers whose declared occupation and income cannot support the volumes. Customers who are evasive about the source of tokens or whose explanations change. Transactions inconsistent with the stated purpose of the account.
Scam proceeds dominate Singapore's STR picture. The Singapore Police Force reported scam losses of several hundred million Singapore dollars a year from 2021 onwards, with a large share of victims' funds exiting the banking system through DPT exchanges.2 The typical pattern is that a victim is induced to transfer fiat to a mule account or directly to a DPT exchange account in their own name, to buy stablecoins and to send them to an address controlled by the scammer. From the exchange's side the customer is the victim, the deposit comes from the customer's own bank account and the withdrawal goes to an address the customer declares as their own. The red flags are subtle: a new customer, a first-time buyer, a large purchase relative to declared income, an immediate withdrawal, a destination address that analytics tools associate with known scam clusters. Sometimes the customer is on the telephone during the onboarding video call. MAS has pressed DPT licensees to intervene in exactly these cases, through transaction delays, warning messages and outbound calls, and treats a firm's scam-intervention statistics as part of its AML assessment.
Example
A Singapore DPT exchange onboards a 62-year-old retired teacher who declares annual income of S$ 30,000 and savings of S$ 400,000. Within a day of onboarding she deposits S$ 180,000 from her own bank account, buys USDT and instructs withdrawal to an address she has declared as hers, proving control by signed message. The analytics tool shows the address is fresh. Nothing in the transaction is unlawful on its face. The combination of age, first transaction, size relative to income, immediate withdrawal and a fresh address matches the scam typology in the firm's risk assessment. The firm's policy requires a hold and an outbound call. The call reveals that she is "investing with an adviser she met online" who told her to open the account. The firm declines the withdrawal, explains why, and files an STR identifying the destination address. The customer is angry. Three weeks later she thanks the firm. The STR, the call note and the hold are the file that shows MAS the monitoring works.
Notes
- FATF, Virtual Assets: Red Flag Indicators of Money Laundering and Terrorist Financing, September 2020, grouped into indicators related to transactions, transaction patterns, anonymity, senders and recipients, source of funds and geographical risks. ↩
- Singapore Police Force, Annual Scams and Cybercrime Brief 2023 and 2024, reporting total scam losses and the proportion of cases involving conversion to cryptocurrency. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.