Chapter 4 of 4 · 3 min

How AML rules detect dormant account reactivation and crypto-to-fiat money laundering

Learn how AML monitoring rules flag dormant account reactivation linked to suspicious activity and frequent crypto-to-fiat conversions that indicate layering.

TL;DW

Dormant account rules fire when unusual activity appears on accounts that have been inactive for a defined period. The most compelling signals combine reactivation with high-risk geographic exposure or a sudden change in transaction volume. Crypto-to-fiat conversion rules address the layering technique of cycling funds between virtual assets and fiat currency, often in small amounts that individually fall below reporting thresholds but collectively represent significant volume.

Watch: 10 AML Rules that Every Transaction Monitoring Team Should Consider

▶ Watch this chapter on YouTube from 9:34

Lesson · 3 parts

Accounts that have been inactive for an extended period and then resume transaction activity require review. The key question is whether the account is being accessed by the original holder or by a third party who gained unauthorized control. The alert is most meaningful when combined with a secondary signal: transfers directed toward high-risk jurisdictions, a sudden volume increase, or transaction types not previously seen on the account. Reactivation alone is not sufficient to determine risk without that corroborating context, and the investigation should treat the two together.

Virtual assets provide launderers with a mechanism to move funds across borders rapidly and with less regulatory visibility than traditional banking. Frequent small conversions between cryptocurrency and fiat currency, each individually below a reporting threshold, can cumulatively represent substantial money movement. The rule should aggregate conversion activity over a defined window rather than evaluating each transaction in isolation, to capture the full picture of layering volume. Both directions, fiat to crypto and crypto to fiat, must be monitored, because a rule covering only one direction creates a systematic blind spot.

These ten rules address the most common money laundering schemes across sectors: structuring, account integrity, unusual behavior, collusion, fund flow, geographic risk, rapid movement, cash placement, dormancy exploitation, and virtual asset cycling. Each one is a starting point for calibration, not a finished control. An effective monitoring program treats rules as living instruments: reviewed against alert quality data, updated as typologies evolve, and tested against your own alert closure outcomes to confirm each rule is generating actionable, proportionate signals. Rules that no longer surface meaningful patterns should be tuned or retired.

Study notes

Part 1 of 3 · 9:34 to 10:22

Rule 9: Dormant account reactivation monitoring

Concept A dormant account rule typically works in two stages. First, the system identifies accounts with no customer-initiated activity for a defined period, often six months to two years. Second, it monitors those flagged accounts for any new transaction. When a transaction occurs, the alert fires and the investigating team assesses whether the reactivation is consistent with the account's history and the account holder's current profile.

Example An account has been inactive for 22 months. Over the following four weeks, six transfers are initiated, all to beneficiaries in jurisdictions on your high-risk country list. The account holder's profile shows no business relationships or prior transaction history with those countries. The combination of dormancy, sudden activation, increased volume, and geographic risk makes this a strong candidate for a suspicious activity report.

Why it matters Dormant accounts are attractive to organized crime networks because they often belong to individuals who are no longer monitoring their finances closely, through illness, migration, incarceration, or bereavement. A taken-over dormant account carries an established transaction history that can make early suspicious transactions appear more consistent with past behavior. Monitoring reactivation disrupts this by triggering review at the first sign of resumed activity.

Part 2 of 3 · 10:22 to 11:34

Rule 10: Frequent crypto-to-fiat and fiat-to-crypto conversions

Concept The appeal of virtual assets to money launderers is the combination of speed, pseudonymity, and cross-border access. Unlike a bank transfer, a cryptocurrency transaction can move value to a wallet anywhere in the world within minutes, with no bank intermediary required. The conversion back to fiat currency is the highest-risk moment because it is where the funds re-enter the regulated financial system and become accessible as spendable money.

Example A customer makes 14 fiat-to-crypto conversions over a 30-day period, each between $800 and $1,200. Individually, each transaction is unremarkable. Cumulatively, they represent $14,000 moved into cryptocurrency in a single month, a volume inconsistent with the customer's declared annual income of $35,000. A rule that aggregates conversion activity over the month surfaces this customer for review, where a per-transaction rule would not.

Pitfall Focusing only on fiat-to-crypto conversions misses the offramp risk. A customer converting cryptocurrency into fiat may be layering proceeds that originated in another currency or asset class entirely. Your rules should monitor both directions of conversion and, where possible, link conversion patterns through account history to identify customers who regularly oscillate between fiat and crypto without a clear investment or operational rationale.

Part 3 of 3 · 11:34 to 12:36

Putting the ten rules to work: a self-audit framework

Try it Map your organization's current transaction monitoring rules against the ten categories covered in this course. For each category, identify whether you have at least one active rule, what its key parameters are, and when it was last reviewed for effectiveness. Any category with no active rule, or with a rule not reviewed in more than 12 months, is a gap worth prioritizing in your next compliance program review.

Why it matters Transaction monitoring rules degrade over time as criminals adapt to known detection patterns and as your business model evolves. A rule that was well-calibrated when written may generate excessive noise or miss emerging patterns two years later. Building a regular review cycle into your compliance calendar, tied to FATF updates, regulator guidance, and your own alert quality metrics, keeps your program fit for purpose and defensible under examination.

Do this

Complete the self-audit exercise: map your current rules to the ten categories in this course and document any gaps.
Schedule a calendar review of your high-risk country list to coincide with each FATF plenary, which publishes jurisdiction assessments approximately three times per year.

Key terms

Dormant account: An account with no customer-initiated transactions for an extended period, typically defined by each institution but often between six and 24 months.
Account reactivation: The resumption of transaction activity on a dormant account, which may indicate legitimate re-engagement or unauthorized third-party access.
Virtual asset: A digital representation of value that can be traded, transferred, or used for payment, including cryptocurrencies such as Bitcoin and Ethereum.
Fiat currency: Government-issued currency not backed by a commodity, such as US dollars, euros, or British pounds, distinct from cryptocurrencies.
Crypto-to-fiat conversion: The exchange of a cryptocurrency for a government-issued currency, or vice versa, commonly used in layering to obscure the origin of funds.

Key takeaways

Dormant account alerts gain investigative value when combined with a second signal, such as transactions to high-risk countries or an unusual transaction type not seen in the account's prior history.
Crypto-to-fiat conversion rules should monitor cumulative value over a window, not just individual transaction amounts, to catch layering through multiple small conversions.
These ten rules represent a starting point. An effective program continuously reviews rule performance and adds rules as new typologies emerge.

Watch out

Reactivated dormant accounts are not always suspicious. Inherited accounts, accounts from seasonal businesses, and accounts linked to individuals recently released from incarceration are all legitimate reactivation scenarios that require contextual judgment.
Many crypto exchanges impose their own reporting obligations, but those obligations do not eliminate the financial institution's monitoring duties on the fiat side of every conversion.

Check your understanding

What secondary signal most significantly increases the risk rating of a dormant account reactivation alert?

Transactions directed toward high-risk jurisdictions or counterparties, a sudden and significant increase in transaction volume, or a change in transaction type compared with the account's historical profile all materially increase risk. The presence of any one of these factors should accelerate the alert to a senior reviewer or trigger a more detailed investigation before a suspicious activity determination is made.

Why should a crypto-to-fiat conversion rule aggregate activity over a window rather than evaluating each transaction individually?

Money launderers deliberately keep individual conversion amounts small, often below any single-transaction reporting threshold. A rule that evaluates only individual transactions will miss the cumulative volume. Aggregating over 30 or 60 days reveals the total amount converted and surfaces patterns that are invisible at the transaction level, including the high-frequency, low-value cycling behavior characteristic of layering through crypto exchanges.

Of the ten rules covered in this course, which requires the most frequent maintenance and why?

The high-risk country rule requires the most active maintenance because the underlying risk lists change up to three times per year with FATF updates, and national regulatory bodies may publish additional guidance between those updates. A static list generates false negatives in real time as new countries are added to enhanced monitoring, making it one of the most operationally demanding rules to keep fit for purpose.

How AML rules detect dormant account reactivation and crypto-to-fiat money laundering

01 9:34 Concept Rule 9: Dormant account reactivation monitoring ▾

02 10:22 Concept Rule 10: Frequent crypto-to-fiat and fiat-to-crypto conversions ▾

03 11:34 Checkpoint Putting the ten rules to work: a self-audit framework ▾