Approaching a VASP Can Tip Off the Target

caution

Core idea

Not every service that answers a law-enforcement request is on your side. Some exchangers are themselves laundering vehicles, some are outright scams, and some have a standing policy of telling the customer that law enforcement has been asking about their account. Sending the request is an act with consequences, and where the service or its customer can still move the funds, the consequence can be that the balance is gone before the reply arrives.

Components

Why it happens

The unregulated end of the market competes on discretion. A service whose customers value not being identified has a commercial reason to warn them, and no supervisor to answer to for doing it.
Registration status is not visible from the interface. GAFILAT notes that unregistered providers actively conceal their jurisdiction, using intermediaries to register domains, DNS records that hide the real holder, or hosting as a Tor hidden service. A polished front end says nothing about who receives your letter.
Mixers, tumblers and crypto-gambling sites concentrate criminal proceeds, so they are exactly the services a trace tends to reach and exactly the ones least likely to behave like a regulated counterparty.

What to do instead

Establish what the service actually is before you write to it: jurisdiction, licensing or registration status, supervisor, and whether it has a real compliance function. Your specialist unit, your FIU, or Europol can tell you. The handbook points to a Europol-published contact list of exchanges and compliant entities available to law enforcement and judicial authorities.
Where the service is not trusted, treat the records request as an overt investigative step with a timing decision attached, not as routine correspondence. Sequence it against the securing measure rather than ahead of it.
Where the funds are the objective rather than the records, get the freeze or seizure instrument ready first, so the request and the restraint land together.
Remember that an arrest is a tipping-off event too. If the target is one of a group and others hold copies of the key, news of the arrest can move the funds as effectively as a letter to an exchange.

When to use

Before any first contact with a service that is not a known, licensed and supervised exchange, and when planning the sequencing of an arrest in a case where co-offenders may hold copies of the key.

Avoid when

This is not an argument for never approaching a service. A cooperative exchange is still the single most productive choke point in most cases, and delay has its own cost under Time-Decay of Crypto Evidence. The point is that the approach is a timed operational act, not administrative correspondence.

Example

A trace terminates at a small no-KYC swap service with a slick site and no stated jurisdiction. A subpoena goes out on the assumption it behaves like a regulated exchange. The service has no obligation to anyone, forwards the enquiry to its customer, and the balance moves the same day. The records request became the trigger for the loss it was meant to prevent.

Investigator OPSEC Checklist · VASP Records: What to Request and What Exists · Compelling VASP Disclosure: The Legal-Process Ladder · Service Choke-Points: What Each Service Type Can Give You · VASP Types and What Each Interaction Means · Exchange Tiers and the Escalation Clock · Freezing Funds with an Exchange Email · Time-Decay of Crypto Evidence · Manage Both Digital Footprints (OPSEC) · Lawful Collection: Pretexting Poisons the Evidence · Cooperating Instant Exchanges as Pivot Points