12.2 Transaction Risk Characteristics: Reversibility, Convertibility, Fund Integrity, and Privacy Coins
Key Takeaways
Card payments, ACH debits and SEPA direct debits can be reversed after settlement, while wires, instant payments and on-chain crypto transfers are generally final.
The core SEPA direct debit scheme gives payers an eight-week no-questions refund right for authorised debits and up to 13 months for unauthorised ones.
FinCEN treats convertible virtual currency, which has an equivalent value in real currency or substitutes for it, as value that can be money transmitted.
From 10 July 2027, the EU AML Regulation bars credit institutions, financial institutions and CASPs from keeping accounts that use anonymity-enhancing coins.
CAFCA sub-topic 3.7 names specific types of transactions and their risks: reversible versus non-reversible, convertible versus non-convertible, fund integrity, and cryptocurrency (privacy coins). These characteristics explain many FinTech fraud and laundering patterns, and why some product combinations need holds, limits or bans.
Reversible versus non-reversible
| Reversible (funding can be pulled back) | Non-reversible (final once sent) |
|---|---|
| Card payments: chargebacks under network rules and consumer-credit protections | Wire transfers once credited |
| ACH debits: returns, including unauthorised returns after settlement | Instant payments (FedNow, RTP, Faster Payments, SEPA Instant) |
| Direct debits: SEPA core scheme refunds (8 weeks for authorised, up to 13 months for unauthorised) | On-chain crypto transfers |
| Cheques: returned items days later | Cash withdrawals |
The core risk is rail arbitrage. A fraudster funds an account with a reversible method, such as a stolen card, an unauthorised ACH debit from a hijacked bank account, or a cheque that will bounce. They then exit through a non-reversible method, such as an instant transfer, a crypto withdrawal or a push-to-card payout. When the funding reverses, the FinTech carries the loss and has helped move criminal proceeds.
Controls:
- Funds availability holds, which delay withdrawals over irreversible rails after reversible deposits, with longer holds for new accounts.
- Limits that grow with account tenure and verified history.
- Ownership verification of funding accounts (next section).
- Monitoring for deposit-then-immediate-exit patterns.
Convertible versus non-convertible
Convertible value can be exchanged for fiat currency or other value. FinCEN's term convertible virtual currency (CVC) covers virtual currency that has an equivalent value in real currency or acts as a substitute for it. Businesses that transmit or exchange CVC for others are money transmitters (Chapter 3).
Non-convertible value works only inside a closed system. Examples include closed-loop gift cards redeemable at one merchant, loyalty points, and in-game currencies that cannot be cashed out.
| Convertible | Non-convertible | |
|---|---|---|
| Examples | Bitcoin, stablecoins, e-money redeemable at par, open-loop prepaid | Closed-loop store cards, loyalty points, closed in-game tokens |
| Laundering risk | Higher: value can leave the system | Lower, but watch for secondary markets that turn "closed" value into cash |
| Regulatory treatment | Money transmission, e-money or crypto rules usually apply | Often outside money transmission rules if truly closed |
Exam point: "closed-loop" products drift into convertibility when the platform adds cash-out, transfers between users or exchange features. A product change can bring a firm inside the regulatory perimeter (Chapter 18).
Fund integrity
Fund integrity asks two questions: are these funds really the customer's? and are they from a legitimate source?
- Ownership of the funding source. Does the name on the funding card or bank account match the customer? Third-party funding is a classic mule and fraud signal. Verify with account-ownership checks, micro-deposits or open-banking data. Payee-name checks also help. The UK has Confirmation of Payee, and the EU required Verification of Payee for euro credit transfers from October 2025.
- Taint and provenance. For crypto deposits, blockchain analytics show exposure to illicit sources (Chapter 13). For fiat, incoming funds linked to fraud reports, recalls or law enforcement requests undermine integrity.
- Consistency with profile. Funds that do not fit the customer's declared income or business call the source into question. That justifies source-of-funds questions.
Cryptocurrency: privacy coins
Privacy coins build in features that hide transaction details:
- Monero (XMR) uses ring signatures, stealth addresses and confidential transaction amounts by default.
- Zcash (ZEC) offers optional shielded transactions using zero-knowledge proofs.
Because a VASP cannot reliably trace these flows, many regulated exchanges have delisted privacy coins or restricted deposits and withdrawals, and some jurisdictions restrict them. In the EU, the AML Regulation will bar credit institutions, financial institutions and CASPs from keeping anonymous accounts or accounts using anonymity-enhancing coins from 10 July 2027. Even where privacy coins are allowed, firms treat swaps into or out of them as higher risk. Typical measures are enhanced due diligence, lower limits and close scrutiny of conversions just before or after a deposit.
Realistic exam scenario
A new wallet customer loads US$3,000 by debit card. Within ten minutes the customer buys stablecoins and withdraws them to an unhosted address. Four days later the card issuer reports the load as unauthorised. The pattern pairs reversible card funding with an irreversible crypto exit. The firm should file or consider a SAR as its rules require, block the device and identity elements, review similar accounts, and apply withdrawal holds for new accounts that load by card. It should also confirm that the card belongs to the customer.
Common exam traps
- "Instant payments can be recalled like ACH." Generally they cannot; settlement is final.
- Treating all gift cards as low-risk. Open-loop cards are convertible, and closed-loop cards can be resold for cash.
- Assuming a matching name proves fund integrity. Legitimate ownership and legitimate source are both required.
Which pattern best illustrates 'rail arbitrage' fraud?
A customer uses a closed-loop gift card at the store that issued it
A customer receives salary by ACH and pays rent by ACH each month
A business sends a wire to a supplier after its finance team approves an invoice
Card-loaded funds immediately withdrawn as an irreversible crypto transfer
A gaming platform's in-game tokens could only be spent inside the game. It now plans to let players cash tokens out to bank accounts and transfer them to other players. What is the main compliance implication?
Only consumer marketing and advertising rules will change
The tokens become convertible, which may bring money transmission rules
The platform must immediately apply for a full banking licence before launch
None, because the tokens are purely digital and have no physical form
Under the EU AML Regulation, what changes for CASPs regarding anonymity-enhancing coins from 10 July 2027?
CASPs may not maintain accounts that use anonymity-enhancing coins
CASPs must offer privacy coins to all retail customers who request them
Nothing changes, because MiCA alone governs privacy coins
CASPs may hold privacy coins only for customers who are PEPs
Sections you finish are checked off in the contents.