Crypto Desks Inside Scam Compounds: What FATF Found
Some scam compounds run crypto exchange counters on site and buy other services from outside, while banks, exchanges and telecoms each see a slice that can look legitimate alone.
Key Takeaways
- FATF found exchange desks inside some compounds
- KK Park-linked wallets drew over $100 million
- Some proceeds moved onward within two minutes
- Indonesia blocked over 515,000 scam-linked accounts
The findings come from the Financial Action Task Force’s report on scam-compound financial flows, published on November 5 together with a set of principles for disrupting them.
A dealer’s counter behind the compound walls
FATF found dedicated over-the-counter counters inside some compounds, offering cryptocurrency exchange and domestic fund transfers. Over-the-counter means a dealer arranges the swap directly instead of matching orders on a public trading platform. The report does not claim that every compound has one, or say who owns the counters it found.
Where the counter sits changes the paper trail. When crypto is turned into spendable money on site, that conversion does not have to pass through a platform required to identify its customers and report suspicious activity. The money still moves, but the record a regulated exchange would have kept may never exist.
The counters are one piece of a wider arrangement. FATF describes scam compounds as networked criminal infrastructure: large physical sites, smaller decentralised cells and specialised service providers, tied together through common controllers. It documents compounds or related activity across Africa, Europe, the Americas and Asia, and estimates annual losses in the tens of billions of dollars.
KK Park: a trail that began with ransom payments
One of FATF’s case studies concerns KK Park, a compound in Myanmar. Drawing on work by Chainalysis and International Justice Mission (IJM), the report links a wallet cluster, meaning a group of addresses analysts attribute to one controller, to the compound. It reports more than $100 million in victim inflows, traced through laundering networks towards the points where crypto is turned into usable cash.
The starting point was not on the blockchain. In Chainalysis’ earlier public investigation, IJM supplied two addresses that families had been told to pay to free trafficked relatives. Both addresses also had links to known scam wallets. That earlier analysis counted just under $100 million flowing into the two addresses, without being able to separate scam proceeds from ransom; FATF’s figure covers a wider cluster. Neither number is a current balance or an amount returned to anyone.
The overlap says something about who works inside. Ransom paid for trafficked people landed in the same wallets as money taken from scam victims, which points to one operation both holding people and running the fraud. The U.S. Treasury describes the Prince Group network in similar terms, saying many of its operations are linked to compounds that rely on trafficked and coerced workers. Pursuing organisers and beneficiaries has to come with protection for the people forced to do the scamming.
Wallet links have limits. An onchain connection shows that funds moved between addresses; it does not show that every exchange or intermediary along the route knew what it was handling.
Why every institution sees a clean transaction
A typical victim payment shows the detection problem FATF describes. Someone buys real cryptocurrency on a regulated exchange and withdraws it to an address supplied by a supposed adviser. The bank transfer, the purchase and the withdrawal can all be genuine and personally approved, while the platform showing the investment’s growth is fake. The exchange’s checks confirm who the buyer is, not whether the adviser is honest.
Each party holds one piece. The victim has the messages and the website, the bank has the transfer, the exchange has the identity checks and the withdrawal address, and the mobile operator may know the customer was on a call while approving the payment. In FATF’s assessment, institutions see apparently legitimate transactions unless someone passes them the surrounding fraud indicators.
The GSMA’s Scam Signal initiative joins two of those pieces before the money leaves. It links mobile-network indicators to banks’ fraud checks, so a bank can weigh whether a customer approving a transfer may be under a scammer’s influence. A call is not proof of fraud, and the system does not require banks to receive what was said on it.
Two minutes to move, 72 hours to act
Speed sets the limits on all of this. FATF documents cases in which proceeds moved onward within two minutes, and its principles single out the first 24–72 hours after an incident is detected or reported for rapid cross-border action. That window is a reason to coordinate quickly, not a promise of recovery or a cut-off after which reporting is pointless.
Tracing the route and stopping the money are separate powers, and they sit with different parties:
Who can act on the funds
Blockchain analysts
Can: map where funds went and which services they touched.
Can’t: freeze anything.
Exchanges
Can: restrict funds in accounts they control.
Can’t: reach crypto already withdrawn to a self-held wallet.
Banks
Can: hold a payment or request a recall.
Can’t: guarantee a return once funds reach another institution.
Stablecoin issuers
Can: in some cases, block their tokens at specific addresses.
Can’t: act on assets with no central issuer, such as bitcoin.
Sanctions authorities
Can: block property within their jurisdiction.
Can’t: reach assets held entirely outside it.
Freezing funds also does not settle who gets them back. Ownership and restitution run on a separate track, covered in Coindoo’s look at why seized scam funds can take time to reach victims.
What to hand over if you’ve been targeted
The FBI’s cryptocurrency-scam guidance asks victims for evidence that ties the payment to the deception:
- Transaction hashes, wallet addresses, cryptocurrency type, amounts and timestamps.
- The exchanges or other services used to send funds.
- Scam websites, applications, messages, phone numbers and account identifiers.
- A timeline showing how contact began and how payment instructions were supplied.
Contact the bank or exchange first, since they are the parties able to hold funds, then report to the authorities. In the U.S., that route is IC3; elsewhere, it is usually the national police. The FBI encourages reports even when transaction details are incomplete, and warns that services offering to recover lost crypto can be a second scam.
Where FATF says the response is weaker
FATF’s own assessment is that countries are currently more effective at the downstream end, meaning victim payments, proceeds and asset tracing, than at the infrastructure behind them. Indonesia’s Anti-Scam Centre shows what that end can produce: more than 515,000 accounts blocked and roughly $10.9 million returned to victims between November 2024 and May 2026.
The upstream problem surfaced in a U.S. action on the same day as the report. Treasury’s Office of Foreign Assets Control sanctioned four individuals and 41 entities supporting the Prince Group, a network it had already targeted in October 2025 and June 2026. According to Treasury, the newly listed people and companies helped keep the group operating after those earlier designations by managing offshore companies and concealing who owned them. One executive sanctioned in June had transferred his Tokyo mansion to his wife after the October 2025 action.
That is the gap FATF’s principles are aimed at: removing a site, a wallet or a set of executives leaves the surrounding companies and service providers free to carry the business on. The principles call for upstream disruption alongside downstream recovery, for information sharing across sectors, and for a victim-centred approach. FATF also cautions that evidence of lasting effectiveness is still uneven. Published figures like Indonesia’s, counting accounts blocked, money returned and how quickly, are the kind of evidence that would show whether the end-to-end approach is working.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
