Money Laundering via Crypto: Article 209 of Ukraine's Criminal Code

Cryptocurrency does not create a “new” crime — it merely adds a technological layer to a long-familiar goal: making criminally obtained funds look legitimate. In Ukraine, liability for this is set out in Article 209 of the Criminal Code, and the duty to “see” suspicious crypto transactions has already been placed by law on providers of services connected with the circulation of virtual assets. Below I explain how such legalization is charged and investigated, and what exactly a forensic economist examines in the chain of fund movements.

Article 209 of the Criminal Code: crypto is a tool, not a separate offense

Article 209 of the Criminal Code of Ukraine establishes liability for the legalization (laundering) of property obtained through crime. The essence of the rule does not change because the funds pass through an exchange or a wallet: what is punishable are acts that give property of criminal origin the appearance of legitimacy — financial transactions, deals, changing the form or location of an asset, introducing it into legal circulation. Here cryptocurrency is merely the medium, convenient for the apparent anonymity of addresses and the speed of cross-border transfers.

The role of the predicate offense

Laundering is always secondary. Before one can speak of “laundering,” the proceeding must establish the source — a predicate (primary) socially dangerous unlawful act: embezzlement, fraud, tax evasion, illegal trafficking, a corruption offense, and so on. A cryptocurrency scheme typically looks like this:

• funds of criminal origin are moved into crypto (cash purchase, P2P, straw-man cards);
• the assets are “mixed” and dispersed across many addresses;
• on the way out they are converted back into fiat, now “clean,” to an account controlled by the beneficiary.

Without a proven predicate act, the mere fact of holding crypto or exchanging it for hryvnia is not a crime. This is a fundamental boundary I will return to when discussing the expert’s competence.

VASPs and financial monitoring: what Law No. 361-IX requires

The key instrument is Law of Ukraine No. 361-IX, “On Preventing and Countering the Legalization (Laundering) of Proceeds of Crime, the Financing of Terrorism and the Financing of the Proliferation of Weapons of Mass Destruction.” It is this law that added, to the primary financial-monitoring entities, providers of services connected with the circulation of virtual assets (in FATF terminology, VASPs — virtual asset service providers: crypto exchanges, exchangers, custodial services).

This means such providers are obliged, no less than a bank, to:

• identify and verify the client (KYC) and establish the ultimate beneficial owner;
• study the substance and purpose of transactions and ascertain the source of funds;
• detect and, in cases defined by law, halt suspicious transactions;
• report them to the State Financial Monitoring Service (Derzhfinmonitoring).

Derzhfinmonitoring accumulates these reports, analyzes them, and — where grounds exist — passes consolidated materials to law-enforcement bodies. Depending on the nature of the predicate, this may be the Bureau of Economic Security (BEB), the National Police, the Security Service (SBU), the State Bureau of Investigation (DBR), or the National Anti-Corruption Bureau (NABU); where the predicate is a tax offense, the State Tax Service (DPS) is also drawn into cooperation.

Threshold amounts: UAH 400,000 and 30,000

Under the current wording of Law No. 361-IX, two benchmarks for mandatory financial monitoring apply:

Indicator	Value
General threshold for mandatory financial monitoring	UAH 400,000
Threshold for virtual-asset service providers (and gambling operators)	UAH 30,000
Who reports	Primary financial-monitoring entity (bank, VASP, etc.)
To whom information is transmitted	Derzhfinmonitoring

The reduced threshold of UAH 30,000 is essentially the legislature’s response to the elevated risk of the crypto sector. It is precisely around this threshold that the most common monitoring-evasion schemes are built — which is what follows.

Typologies of money laundering through cryptocurrency

In financial-analysis practice, a few recognizable patterns recur. I will stress at once: none of them, on its own, proves a crime, but together they form a picture of artificial fund movement.

1. Splitting (smurfing / structuring). A large sum is broken into many small transfers or exchanges, each below the monitoring threshold (the same UAH 30,000). Often many “small” wallets or cards belonging to different people are involved.
2. Mixers (tumblers). Services that blend the crypto of many users to sever the “sender–recipient” link in the blockchain. The passage of funds through a known mixer is in itself a strong marker of an attempt to conceal the source.
3. P2P exchange. A direct exchange between individuals without a transparent intermediary, often for cash. It allows funds to be moved in or out while bypassing an exchange with its KYC procedures.
4. Crypto ↔ fiat conversion. The key link of any scheme: to use money in the real world, crypto must be turned into hryvnia or foreign currency, and vice versa. It is precisely at these conversion “joints” that the trail becomes visible.
5. Straw-man (nominee) wallets and drops. Addresses and accounts registered to uninvolved or controlled persons, through which funds merely pass in transit.

Why crypto anonymity is overstated

The common belief that “blockchain is anonymous” is long outdated. A public blockchain is, on the contrary, an immutable and fully transparent ledger of all transfers. De-anonymization occurs at the points of contact with the real world: KYC at an exchange, a bank top-up, an IP address, a phone number, a payment card. That is why even a tangled chain of addresses can often be “unwound” to a specific person.

The travel rule and identifying address owners

One of the key requirements for VASPs is the so-called travel rule. Its essence: a transfer of virtual assets must “travel” together with data on the sender and the recipient, so that the parties to a transaction can be established at every stage. This directly complicates the anonymous movement of funds between services.

For an investigation this provides two footholds:

• VASP data under the travel rule — who initiated a transfer, to whose address, and in what volume;
• blockchain analytics — linking crypto addresses to real persons through address clustering, connections with identified exchange accounts, and transaction history.

It is precisely the combination of on-chain data (the blockchain itself) and off-chain data (KYC, banking, the travel rule) that makes it possible to establish the actual owner of an address. Without this link, “tying” the movement of crypto to a specific beneficiary is impossible, and any conclusion remains an assumption.

What forensic economic examination investigates

When a case reaches the pre-trial investigation or the court, the factual side becomes decisive: from where, to where, and in what volume did the funds move, and is that movement consistent with the laundering theory? The answer is given by forensic economic examination, ordered under the procedure set out in the Criminal Procedure Code of Ukraine (KPK); the institution itself is governed by the Law of Ukraine “On Forensic Expert Activity”, and the procedure for ordering and conducting it by the Instruction approved by Order of the Ministry of Justice of Ukraine No. 53/5.

Within the bounds of specialized economic knowledge, the expert:

• consolidates scattered data from exchanges, wallets, bank statements, and travel-rule materials into a single register of transactions;
• reconstructs the chain of fund movement — “who → to whom → how much → when → on what basis” — including the crypto ↔ fiat conversion points;
• records signs of artificiality — splitting below the threshold, transit character, passage through mixers, turnover that does not match real activity;
• compares the sums brought into legal circulation with declared income and its sources.

An important boundary of competence: the forensic economist does not charge the act under Article 209 and does not establish guilt or intent — that is exclusively the function of the investigation and the court. Nor does the expert draw a legal conclusion about “laundering” in the absence of a proven predicate offense. The correct formulation is different: the expert documents that the funds passed in transit, were split below the threshold, were converted, and did not match declared income — and leaves the legal assessment to the body that ordered the examination.

A typical business mistake: crypto without AML and KYC

The most frequent risk visible in expert work lies not in deliberate schemes but in the carelessness of a bona fide business. A company starts accepting payment in cryptocurrency “because it’s convenient,” without having built any procedures. The consequences:

• no KYC — you don’t know whose funds you are accepting, and you may become a link in someone else’s laundering scheme;
• no check on the source of assets — the crypto accepted may turn out to be “dirty,” with a history leading to a mixer or a stolen wallet;
• no record-keeping or rate capture — later you can neither confirm the reality of the transaction nor correctly calculate tax obligations;
• no internal monitoring — split inflows below the threshold pass unnoticed.

What a business that works, or plans to work, with virtual assets should do:

• introduce basic KYC/AML procedures — counterparty identification and verification of the source of funds;
• work with service providers that comply with financial-monitoring requirements, rather than through dubious P2P channels;
• keep primary data for every transaction — addresses, sums, the rate on the date, the basis for the payment;
• where necessary, commission an independent assessment of fund-movement risks before an investigator takes an interest.

Accepting crypto without AML procedures is not a saving — it is shifting someone else’s risk onto your own balance sheet.

Practical guidance for the parties

• For the investigator / detective — frame questions to the expert about the movement of funds and its correspondence to the documents, rather than asking to “confirm laundering”; provide the full data set (exchange exports, bank statements, travel-rule materials).
• For defense counsel — check whether the expert has gone beyond their competence and whether the predicate offense is proven, without which a conclusion about legalization is vulnerable in court.
• For the business owner — understand that crypto payments without KYC create risk even in the absence of ill intent, and keep primary data for every transaction.

Money laundering through cryptocurrency looks technologically complex, but it is uncovered by the same methods as “classic” schemes — the painstaking reconstruction of the chain of movements and its comparison with real activity. If you are a party to a proceeding, the head of a business working with virtual assets, or you need an independent reconstruction of a chain of crypto transactions, a considered consultation and a professional forensic economic examination will help you build a position grounded in facts. Get in touch — I will review your question within the bounds of expert competence.