Skip to content
Use cases · Exchanges & on/off-ramps

Stolen mobile money shouldn’t become USDT.

Fraudsters turn stolen M-Pesa, OPay or card money into USDT within the hour. On-chain, there’s no reversal. Sieve stops the cash-out and blocks sanctioned wallets.

For exchanges, P2P platforms and fiat on/off-ramps serving African users, from Nairobi to Lagos.

How it hits

Four ways the money goes missing.

Each looks like ordinary activity. Sieve scores every event in context, before the money moves.

  1. 01

    Sanctioned wallets

    A withdrawal to an address named by OFAC, such as a Lazarus Group wallet.

    Caught by Sanctioned crypto wallet: over a thousand listed addresses, blocked outright

  2. 02

    Crypto cash-out

    Stolen money arrives and leaves as USDT to a fresh wallet within the hour.

    Caught by Cash in, crypto straight out; crypto cash-out pattern

  3. 03

    Peel chains

    Funds split across five new wallets in one afternoon to break the trail.

    Caught by Many new wallets in a short time

  4. 04

    Travel Rule gaps

    A transfer above USD 1,000 with no originator or beneficiary details.

    Caught by Travel Rule information missing

A catch, step by step

Minutes of activity. One decision.

A story from the Crypto exchanges & on/off-ramps demo, run through the same engine as your events. Each reason is written for the analyst who acts on it.

M-Pesa in, USDT out, 26 minutesreplayed through the engine
  1. 09:02New account opened with basic KYC
  2. 09:07KES 120,000 paid in by M-Pesa from a strangerFiat in
  3. 09:22A new USDT withdrawal wallet addedNew payout wallet
  4. 09:28Withdrawal of KES 118,000 as USDT, on Ethereum
  5. DecisionBlocked
    • 98% of the KES 120,000 paid in by M-Pesa is leaving as crypto
    • Withdrawal wallet added 6 minutes ago
    • Account opened 26 minutes ago

Blocked before anything reaches the chain. Once confirmed, the next account using that wallet or device is caught too.

What Sieve does

Choose “Crypto exchanges & on/off-ramps” and these start enforcing.

Plain-English rules you can adjust, joined into fraud patterns. Everything else runs in Watch, scoring without acting, until you trust it.

Rules
  • Sanctioned crypto wallet
  • Cash in, crypto straight out
  • Many new wallets in a short time
  • Wallet address doesn’t fit the network
  • Travel Rule information missing
  • High-risk wallet exposure
Patterns
  • Crypto cash-out
  • New-account cash-out
  • Money mule
Integrate

Send these events. One endpoint.

  • payout.requestedCrypto withdrawals: method crypto, asset, a crypto_wallet destination with its network, and travel_rule.
  • transactionFiat deposits (mobile money, card, bank) and crypto deposits with the source wallet.
  • customer.updatedNew withdrawal wallets, as payout changes.
POST /v1/events
await sieve.events.create({
  type: 'payout.requested',
  customer_id: 'cus_1001',
  amount: 45200, currency: 'KES',
  method: 'crypto',
  asset: { code: 'USDT', amount: 350.25, network: 'tron' },
  destination: { type: 'crypto_wallet', account: 'TR7NHqjeKQxG…', network: 'tron' },
  travel_rule: { originator: { name: 'Wanjiru Kamau', account: 'cus_1001' },
                 beneficiary: { name: 'Wanjiru Kamau', address: 'TR7NHqjeKQxG…' }, self_hosted: true },
})
Compliance

What your regulator will ask, answered.

Sieve supports your obligations. It doesn’t replace your compliance team.

Kenya VASP Act 2025
Transaction monitoring, sanctions screening and Travel Rule records in one audit trail.
SEC Nigeria VASP rules
The same monitoring, screening and Travel Rule records, to support your SEC Nigeria obligations.
FATF Recommendations 15 & 16
Travel Rule data checked above the threshold and stored encrypted.
OFAC digital currency addresses
Listed wallets are blocked in either direction, refreshed at each list sync.
Book a demo

See it on a workspace built for you.

A private Crypto exchanges & on/off-ramps workspace for Kenya or Nigeria, with a month of traffic and the fraud above. We walk your team through a live catch.