You're not bound by AML/KYC requirements unless you're a reporting entity providing a financial service as defined by the relevant legislation in your country or a non-financial service to which those requirements apply (lawyers, accountants and jewellers have recently become "reporting entities providing a non-financial service" in Australia).

While you don't have any AML/KYC obligations, your bank does and they could actually freeze your account pending verification of your identity and proof of the source of funds if they have reason to believe the transaction is "suspicious".

The problem with using offshore finance centres is that they're often on the blacklists of compliant countries and incoming transactions from them will be flagged.  They're fine if you're prepared to spend your offshore funds within the offshore jurisdiction, not so much if you want to be able to spend the money in the country where you reside.  Services located in offshore financial centres are often set up to cater to clients moving huge amounts of money via wire transfer, whereas Bitcoin users are often looking to minimise fees as much as possible.  And of course you have the risk of such businesses being opaque, as was the case with MyBitcoin.

The combination of losses from fraud, fraud prevention measures and AML/KYC/CTF compliance pose a significant financial challenge for exchanges and I suspect that few have any realistic idea of just how high that overhead will be when they start an exchange with a couple of people.  Not only will they always be targets for fraud and hacking attempts, they will become bigger targets the more successful they become and more money will need to be spent on protecting themselves from various threats to their viability.  Locating offshore does nothing to minimise the risk of fraud or security breaches, both of which can send an exchange broke just as surely as banks freezing their funds.


Another fun thing is that AUSTRAC doesn't tell you specifically how you must assess risk and precisely what measures you must put in place but if you get it wrong you're open to being fined or prosecuted for non-compliance.

I'd recommend people read the MtGox AML/KYC Process Explained thread.  It addresses some of the issues which people frequently ask about and the process is pretty standard in most FATF member countries (although countries may have domestic laws which go beyond the 40 + 9 recommendations).

I think most people agree that if you want even quasi-anonymity and zero risk of your funds being frozen, then AML compliant organisations cannot guarantee those things.

I suggest getting the mods to sticky this at the top of the forum.  The issue comes up repeatedly and this thread will quickly drop off the page if it's not stickied.

If it's to do with "suspicious matters" as defined by the AML/CTF Act, Cryptoxchange literally cannot tell the OP any specifics, let alone a bunch of people on the internet - disclosing that information would be a criminal offence under the "tipping-off" provisions of the Act (most FATF countries have similar provisions).  They can ask him to verify his identity and control of the funding account and they can ask him to prove the source and destination of funds, but they can't tell him that they suspect him of tax evasion/money laundering/financing terrorism or whatever other financial activity is illegal under the Act (the people/organisations to whom they can disclose that information is extremely limited).

I'd like to see just one of the people who claims that an exchange has robbed them of a large amount of money take the matter to court - they all seem curiously reluctant to do so though.

Who knows - you're talking about someone resident in Singapore trading with a company based in Japan.  Often contracts made with minors aren't enforceable by the other party, although minors can be bound by certain types of contracts in some places and other types are absolutely illegal in some jurisdictions.

Just show us the money shot.

If the account belonged to xWaylab Inc, then that was the legal entity with which Mt Gox was dealing rather than zhoutong personally.

There could still be a problem even if he sends documents which are accepted as authentic.  There's more than one AML/KYC issue with this story but, yes, if the OP can satisfactorily identify himself then the possibility that CryptoXchange can simply make a complex Suspicious Matter Report to AUSTRAC and return his funds is there. 

Do you really think that a complaint which is essentially "they won't release my money because I refuse to identify myself as requested under AML/KYC requirements" is going to be found to 1) have substance or 2) have a reasonable prospect of success?

Even assuming that a court didn't outright dismiss the proceedings, they can be terminated by the Attorney-General or taken over by the DPP.

I would honestly like very much to see one of these cases go to court, just as I'd like to see alleged Bitcoin thefts investigated by traditional law enforcement agencies.  The reality seems to be that those who complain the loudest avoid these options because they don't want to be subjected to independent scrutiny which they can't control.

From wme.cc's own ToS regarding AML compliance.


I therefore presume that WME knows the identity of the person who sold him the allegedly stolen Bitcoins and has reported the suspicious activity.

From their own ToS regarding refunding of unverified accounts.


Well what do you know.  If you don't complete the registration and verification process to their satisfaction, they mightn't refund your deposits.


So you can pay money into your account in cash without verification, but transfers and withdrawals must be made through their bank accounts, which requires you to be a verified customer.


Criminal lawyers defend people accused by the state of having broken the law.  If the OP believes that a crime has been committed, then he needs to report it to Australian law enforcement.  You can't bring your own criminal lawyer to prosecute a criminal case.  Whether charges are laid and prosecuted is up to the Director of Public Prosecutions.   He could certainly try to recover his funds by civil action in the NSW courts system, though.  Hell, if the case ever got as far as even being listed for mention I'd show up for a front row seat each day.

That bit - at least - does make sense.  If the origin of that deposit was questionable, then CryptoXchange would be required to review all previous transactions, to review the original KYC information collected, and to apply enhanced verification requirements to the account - in essence, they would need to do the whole KYC process all over again but applying the far more stringent "high risk" requirements.

It's also possible that for some reason the bank refused the transaction/s pending more thorough KYC/AML information.

I do too because even if you're perfectly legitimate, it only takes one suspicious transaction detected by a bank or other financial service provider for the account/s containing customer deposits to be frozen.  Hell, the DoJ can even seize the domain if they believe it's being used to facilitate crime and nobody's going to be moving funds in or out any time soon if that happens.

It's estimated that tens of billions of dollars were exported from Russia illegally last year.


For that reason alone, large transactions originating either directly or indirectly from Russia or which involve Russian nationals are closely monitored by FATF member countries world-wide.

Oh, I believe this bit.


The problem is that it obscures the true origin of the funds and that pretty much automatically triggers more stringent AML/KYC requirements.  It also sounds like the OP tried to change the destination of the withdrawals.  Once anything "suspicious" like that comes into play, the onus is on the customer to provide proof of their identity and of the legitimacy of the transaction and the funds.  Service providers ask for specific documents in order to help the customer prove those things and to prevent themselves being fined for non-compliance and/or prosecuted for aiding and sbetting money laundering, tax evasion, terrorism financing or whatever.

I'm beginning to think there needs to be an "AML/KYC and You" sticky at the top of this forum.

Ultimately they can't keep the money.  He'll either satisfactorily identify himself and the origin and destination of the funds as required by AML/KYC laws and his fund will be returned to him or eventually his funds will be transferred to one of the government unclaimed money funds from which he can recover ti upon providing proof of his identity and the legitimacy of the funds.

What CryptoXchange cannot do is simply ignore suspicious matters.  If they fail to carry out OCDD and enhanced KYC in relation to suspicuous transactions/accounts, they are liable to huge fines if it turns out that the account was being used for illegal purposes - and unlike Wachovia, I doubt  that CryptoXchange can afford huge fines or that the prospect of imprisonment is an attractive one.


And CryptoXchange can pay a certified document examiner to check the authenticity of the documents.

Yes.  Primarily AUSTRAC.  There's a positive obligation to comply with the requirements of the AML/CTF Act and the Rules Instrument - which means that it's mandatory for services to whom the Act and Rules apply to take certain kinds of actions and report certain matters without any request from AUSTRAC being required.  They are additionally required under the Act to co-operate with "requests" from AUSTRAC - AUSTRAC does not require a court order to compel such co-operation as their authority is written into the Act and non-co-operation is an offence.  Information obtained by AUSTRAC may form the basis of criminal prosecutions by other agencies.

Under the Act "tipping off" is an offence.  A reporting entity must conduct ongoing customer due diligence and apply enhanced know your customer requirements if "suspicious" circumstances a rise, but it is an offence to disclose to a customer that a Suspicious Matters Report has been filed with AUSTRAC.  Requiring additional identification and proof of control of the funding account does not count as "tipping off" and neither does asking the customer about the source and destination of funds (in fact verifying these as legitimate can be a requirement of OCDD under certain circumstances).


It probably wasn't required from the jump.  There's a minimum amount of KYC information which must be collected from all customers but all sorts of things can trigger the requirement to obtain additional information/proof of identity etc.  While many large financial institutions continue to use the 100 points ID system - it was mandatory at one point and their systems are already set up for it - many smaller organisations only apply enhanced KYC protocols when the need arises because it's a large administrative burden.  Where a customer fits on the risk matrix can change with a single transaction, and when it changes different requirements apply.

The OP doesn't need to take this to court.  AUSTRAC is the body in charge of regulating and enforcing AML/KYC/CTF compliance.  They are absolutely the people to complain to if a service provider is suspected of using AML/KYC requirements to steal user funds and perfectly capable of determining whether the OP's ID documents are authentic.  If AUSTRAC says the documents and transactions are fine, CryptoXchange has no AML/KYC grounds on which to retain the funds/BTC.  If the OP would rather write off $100,000 than subject his ID documents to AUSTRAC's scrutiny, people need to ask themselves why that might be the case as all international funds transfer instructions must be reported to AUSTRAC anyway, regardless of value.

Authorising the payments could be seen as taking a management role in the business.  If it's not a "safe harbour activity" (and it's probably not), then the limited partner cannot do it and retain limited liability.

Core Credit Ltd (now Bitcoinica Consultancy Ltd) is the general partner in Bitcoinica LP and people have been led to believe that the general partners are "the Intersango guys".  If that's not the case and Bitcoinica Ltd is actually controlled by Tihan's group of investors, then people need to be made aware of that.

It's really not that simple, which is why when people go to the media about their bank having allegedly done something terrible the bank only comments in general terms along the lines of "looking into the complaint".  There really isn't a blanket authorisation for public disclosure of financial information which a customer can give - the authorisation needs to be insanely specific and it needs to state the lawful purpose for which the information can be disclosed (providing information to a message board so they can form an opinion wouldn't count as the kind of "lawful purpose" required by the various privacy acts).

OP really needs to get his lawyer to file a complaint with AUSTRAC.  There'll be no problem getting his funds released if AUSTRAC determines that his identity verification documents meet the required standards for AML/KYC compliance standards and that his transactions are legitimate.