Worked example · 2022-20

Travel Rule Gap Exploitation — Sub-Threshold Structuring and VASP-Avoidant Routing — 2022–2025

Loss: Aggregate laundering volume routed through Travel Rule gaps estimated in billions across 2022–2025. Individual structuring cases documented by Chainalysis, TRM Labs, and Elliptic range from $1M to $50M+ per cluster.
OAK Techniques observed: OAK-T7.010 (Travel Rule Evasion) — sub-threshold structuring below FATF Travel Rule reporting thresholds; OAK-T7.002 (CEX Deposit-Address Layering) — exchanges used as off-ramp endpoints; OAK-T7.005 (Privacy-Chain Hops) — instant exchange to XMR as alternative Travel Rule bypass.
Attribution: pseudonymous — structuring clusters identified by blockchain-intelligence providers but individual operators not publicly named at per-cluster level.
Key teaching point: The Travel Rule (FATF Recommendation 16) creates a mandatory VASP-to-VASP information chokepoint for transactions above a jurisdiction-defined threshold (typically $1000). Launderers exploit three structural gaps: (1) sub-threshold structuring — breaking large transfers into sub-$1000 chunks that individually fall below reporting thresholds, mirroring fiat-AML CTR structuring that has existed since 1970; (2) VASP-avoidant routing — replacing VASP-to-VASP transfers with DeFi/bridge/non-custodial hops that fall outside Travel Rule scope entirely; (3) jurisdictional arbitrage — routing through VASPs in non-FATF-implementing jurisdictions. The Travel Rule information chokepoint is only as strong as its coverage perimeter; every entity type and jurisdiction outside the perimeter is a laundering rail. Detection approach: aggregate-per-cluster structuring detection (not per-transaction), VASP-avoidant chain topology analysis, and cross-VASP jurisdictional routing anomaly detection.
Structural signature: A cluster sending many transactions in the [$threshold - 5%, $threshold) range to the same beneficiary VASP within a compressed time window (24–72h). Transaction-amount histogram shows an anomalous spike just below threshold.
Operational cost tradeoff: The operator pays higher total gas fees (more transactions) and requires automation infrastructure (scripted or bot-driven sub-transaction generation). The cost is the gas overhead; the benefit is evasion of PII transmission.
FATF implementation gap exploited: The Travel Rule threshold is transaction-level, not cluster-level. A VASP compliance system that screens individual transactions against the threshold will not flag a cluster of sub-threshold transactions unless aggregate-volume monitoring is implemented.
Structural signature: A chain where VASP-to-VASP edge count is zero despite both origin and terminus being VASPs. All intermediate hops occur on non-VASP entities.
Operational cost tradeoff: The operator pays protocol fees (bridge fees, DEX swap fees) and assumes slippage risk and bridge-latency risk (cross-chain finality delays). The benefit is complete avoidance of Travel Rule-triggering events for the intermediate hops.
FATF implementation gap exploited: The Travel Rule applies to VASPs. DeFi protocols, cross-chain bridges operated by decentralised node networks, and non-custodial swap services are not categorised as VASPs in most implementing jurisdictions (as of FATF's 2023 guidance). The entities that intermediate the laundering chain are outside the Travel Rule perimeter by regulatory design or ambiguity.
Structural signature: A chain where VASP legs are routed through jurisdictions with FATF Travel Rule implementation status "non-implementing" or "weakly enforcing," particularly when the cluster has historically used implementing-jurisdiction VASPs and has shifted toward non-implementing-jurisdiction VASPs.
Operational cost tradeoff: The operator may accept lower-liquidity markets, higher withdrawal fees, and restricted trading pairs in exchange for the Travel Rule gap. The jurisdictional routing decision is a compliance-cost optimisation function.
FATF implementation gap exploited: FATF's 2023 status report documented that ~65% of jurisdictions had NOT enacted Travel Rule legislation for virtual assets. The non-implementing jurisdictions form a regulatory shadow perimeter through which Travel Rule-obligated VASPs in implementing jurisdictions cannot obtain originator/beneficiary information for inbound transactions.

Summary

FATF Recommendation 16 (the "Travel Rule") was extended to virtual assets and Virtual Asset Service Providers (VASPs) in June 2019, requiring originator and beneficiary VASPs to exchange and store PII for transactions above a threshold. FATF's 2023 implementation status report documented substantial jurisdictional gaps: as of mid-2023, only ~35% of jurisdictions had enacted Travel Rule legislation for virtual assets, and enforcement was uneven even among enacting jurisdictions.

The Travel Rule gap creates a structural laundering opportunity that mirrors the fiat-AML experience: just as currency transaction report (CTR) structuring ($10,000 threshold in the US under the Bank Secrecy Act) spawned an entire sub-regulatory structuring industry, the Travel Rule's $1000 threshold spawned a sub-threshold structuring pattern in crypto. The difference is that crypto launderers have an additional option that fiat launderers lack: VASP-avoidant routing through DeFi protocols, cross-chain bridges, non-custodial swap services, and privacy chains that fall entirely outside the Travel Rule perimeter.

Industry-forensic data from Chainalysis, TRM Labs, and Elliptic has documented a sustained shift toward these patterns from 2022 onward, accelerated by Tornado Cash OFAC sanctions (August 2022) that reduced single-chain mixer availability and forced launderers to innovate around compliance chokepoints more broadly.

Three Travel Rule evasion patterns

Pattern 1: Sub-threshold structuring

The operator splits a large transfer into hundreds or thousands of individual transactions, each just below the Travel Rule threshold (e.g., $900 on a $1000 threshold). Each individual transaction avoids triggering Travel Rule information exchange. Aggregate volume can reach tens of millions.

Pattern 2: VASP-avoidant routing

The operator replaces all intermediate VASP-to-VASP hops with non-VASP infrastructure: DeFi protocols (Uniswap, Curve), cross-chain bridges (THORChain, Stargate), non-custodial swap services (eXch, ChangeNow), and DEX aggregators (1inch, ParaSwap). The chain uses VASPs only at the initial deposit and final withdrawal legs.

Pattern 3: Jurisdictional arbitrage

The operator purposefully selects VASPs in jurisdictions that have not implemented (or weakly enforce) the Travel Rule for one or both legs of the VASP-to-VASP transfer.

What defenders observed

Travel Rule structuring is a cluster-level signal, not a transaction-level signal. Per-transaction threshold checking is insufficient. Effective detection requires aggregate-per-cluster volume monitoring, transaction-amount histogram analysis for threshold-proximity spikes, and temporal compression analysis (structuring transactions arrive in bursts, not evenly distributed across time).
VASP-avoidant routing is measurable at the chain-topology level. Compute the fraction of hops that occur on VASP infrastructure vs. non-VASP infrastructure. A chain with zero VASP-to-VASP hops despite VASP entry and exit is a detectable structural signature regardless of the specific protocols used.
Jurisdictional routing anomalies are detectable via VASP domicile cross-referencing. For a given cluster, compare the Travel Rule implementation status of VASPs used before and after a known triggering event (e.g., OFAC designation, exchange hack attribution). A shift toward non-implementing jurisdictions post-event is a T7.010 signal.
The FATF Travel Rule implementation gap map is a launderer route-planning resource. Publicly available FATF implementation-status assessments effectively tell launderers which jurisdictions to route through. The gap between implementation status publication and actual enforcement is itself a laundering-information surface.

What this example tells contributors

T7.010 should exist as a standalone technique. The Travel Rule evasion surface is a distinct compliance chokepoint that does not reduce to T7.002 (CEX layering — the KYC gap) or T7.005 (privacy-chain hops — a specific evasion method). T7.010 names the structural gap between Travel Rule coverage and non-coverage, and three distinct evasion patterns.
Sub-threshold structuring detection requires aggregate-per-cluster analytics. Single-transaction threshold screening is the compliance equivalent of signature-based antivirus: it catches naive operators who don't know the threshold. Aggregate-per-cluster structuring detection catches operators who know the threshold and structure around it.
The VASP definition boundary is the Travel Rule perimeter. Every entity type outside the VASP definition (DeFi protocol, cross-chain bridge, non-custodial swap service, privacy chain) is a Travel Rule-free routing zone. Expanding the Travel Rule perimeter requires regulatory clarity on which non-VASP entities trigger information-transmission obligations.
FATF jurisdictional implementation is a monitoring data source. The FATF Travel Rule implementation status map should be consumed as a live compliance data source. Launderers route through non-implementing jurisdictions; compliance teams should flag transactions routed through those jurisdictions.

Public references

[fatf2021virtualassets] — FATF Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021). The foundational Travel Rule extension document.
[fatftravelrule2023] — FATF Travel Rule implementation status report (2023). Documents the ~35% implementation rate and per-jurisdiction gap analysis.
[chainalysis2024laundering] — Chainalysis crypto laundering report (2024), including sub-threshold structuring pattern documentation.
Travel Rule solution providers: Notabene, TRISA, OpenVASP, Sygna — VASP-to-VASP information-transmission infrastructure. Provider adoption rates are documented in FATF implementation reports.
Sub-threshold structuring is documented in Chainalysis / TRM / Elliptic research products; per-cluster named cases are not publicly attributable because structuring clusters are identified via confidential VASP data.