Language selection


Operational alert: Laundering of proceeds from online child sexual exploitation

Reference: FINTRAC-2020-OA001
December 2020


The purpose of this Operational Alert is to support reporting entities in recognizing financial transactions suspected of being related to the laundering of funds associated to child sexual exploitation, particularly online child sexual exploitation. Through financial transaction reports, FINTRAC is able to facilitate the detection, prevention and deterrence of all stages of money laundering (placement, layering and integration) and the financing of terrorist activities by providing actionable financial intelligence disclosures to law enforcement and national security agencies. This Operational Alert provides money laundering indicators as a result of the analysis of FINTRAC disclosures and Reporting suspicious transactions to FINTRAC (STRs) related to online child sexual exploitation.

Project Shadow

is a public-private partnership initiative co-led by Scotiabank and the Canadian Centre for Child Protection, supported by Canadian law enforcement agencies and FINTRAC to combat online child sexual exploitation. The objective of the project is to improve the collective understanding of the threat, and to improve the detection of the facilitation and laundering of the proceeds from online child sexual exploitation.


Online child sexual exploitation is defined by the Virtual Global Taskforce as “offences related to possessing, distributing, producing and accessing child pornography [or, more accurately, child sexual abuse material or child sexual exploitation material], online grooming and luring”.Footnote 1 It is a disturbing global crime targeting children.

The ease of Internet accessibility as a result of a growing number of affordable Internet-enabled devices, along with a growing number of children using the Internet at a younger age have given perpetrators increased access to children for sexual purposes.Footnote 2 Further, technological advancements have increased the production and consumption of child sexual exploitation material for a very low cost.Footnote 3 Perpetrators have also increased their use of encryption services, anonymization technologies, the dark web, online file hosting and file sharing to avoid detection. They also solicit children online for sexual purposes on many online platforms children useFootnote 4, and distributeFootnote 5 child sexual exploitation material mostly through online peer-to-peer sharing platforms and increasingly through social media. As well, the COVID-19 pandemic since early 2020 has served as an accelerator of and has contributed to an increase in the consumption and production of child sexual exploitation material, while also pushing offenders to adapt their online environment to avoid detection.Footnote 6

The financial dimension of online child sexual exploitation includes payments, purchases and proceeds associated to the access, consumption, production, and distribution of the illicit material. There is also increased risk of virtual currencies being used as payment for online child sexual exploitation material. Furthermore, some perpetrators coerce or groom tween (children between 8 and 12 years old) and teen victims to share sexual images or videos of themselves then threaten and extort their victims for money or additional sexual material. This is known as “sextortion”.Footnote 7 However, most perpetrators commit child sexual exploitation offences for sexual gratification and not for financial gain.

Overview of FINTRAC’s analysis of disclosures and STRs related to online child sexual exploitation

Based on FINTRAC’s analysis of disclosures and assessment of STRs related to online child sexual exploitationFootnote 8, perpetrators and suspected perpetratorsFootnote 9 were nearly all males, located in all Canadian provinces and territories. They were employed in a wide range of occupations and the majority of these individuals were aged in their 40s and 50s. Consumers of online child sexual exploitation were the most common perpetrator role observed.

Transactions were primarily outgoing funds transfers to another country —particularly to jurisdictions of concern for child sexual exploitation (see Figure 1 for characteristics of those transfers). Most funds were sent through money services businesses (MSBs). The top 10 jurisdictions receiving transfers were: Philippines, Thailand, Colombia, United States, Ghana, Ukraine, Dominican Republic, Romania, Jamaica and Russia. In the Philippines, transfers were primarily received through MSBs and pawn shops. Transfers were usually sent in the evening hours (mostly between 6 p.m. and 9 p.m., regardless of Canadian time zone), mostly on Thursdays and Fridays and least on Sundays.

Figure 1. Characteristics of perpetrators’/ suspected perpetrators’ international funds transfers

FINTRAC assesses that numerous other purchases and payments indicate that the perpetrators/suspected perpetrators likely spent a large portion of time on the Internet (e.g., online purchases, app purchases, online gaming and gambling, use of online video and communication technologies, use of online file storage), often consumed material on online adult entertainment platforms (which may include imbedded child sexual exploitation material) and were likely concerned about their online privacy and anonymity. Transactions also heavily involved payment processors.

Reasonable grounds to suspect and how to use indicators

Reporting entities’ decision to submit a suspicious transaction report to FINTRAC (for either a completed or attempted financial transaction) requires more than a “gut feel” or “hunch,” although proof of money laundering is not required. Reporting entities are to consider the facts related to a transaction and its context that can, when taken together, give rise to reasonable grounds to suspect that the transaction is related to the laundering or attempted laundering of proceeds of crime.

Indicators of money laundering can be thought of as red flags indicating that something may very well be wrong. Red flags typically stem from one or more characteristics, behaviours, patterns and other contextual factors related to financial transactions that make them appear inconsistent with what is expected or considered normal. Reporting entities’ review of the trail of indicators may follow various scenarios and lead to different conclusions depending on whether the level of suspicion is strengthened or weakened (see Reporting suspicious transactions to FINTRAC).

Money laundering indicators

Below are money laundering indicators related to online child sexual exploitation derived from FINTRAC’s analysis and reflect the types and patterns of transactions, contextual factors and those that emphasize the importance of knowing your client. These indicators should not be treated in isolation; on their own, these indicators may not be indicative of money laundering or other suspicious activity. They should be assessed by reporting entities in combination with what they know about their client and other factors surrounding the transactions to determine if there are reasonable grounds to suspect that a transaction or attempted transaction is related to the commission or attempted commission of a money laundering offence. Considering several indicators may reveal otherwise unknown links that taken together could lead to reasonable grounds to suspect that the transaction is related to online child sexual exploitation offences and/or the laundering of proceeds derived from those crimes, it is a constellation of factors that strengthen the determination of suspicion. These indicators aim to help reporting entities in their analysis and assessment of suspicious activity.

Money laundering indicators related to possible perpetrators who are consumers and/or facilitatorsFootnote * of online child sexual exploitation

Money laundering indicators related to possible perpetrators who are producers of online child sexual exploitation material

Financial indicators possibly related to online child sexual exploitation in the form of luring

Reporting to FINTRAC

To facilitate FINTRAC’s disclosure process, please include the term #Project SHADOW or #SHADOW in Part G-Description of suspicious activity on the Suspicious Transaction Report. See also, Reporting suspicious transactions to FINTRAC.



Telephone: 1-866-346-8722 (toll-free)

Facsimile: 613-943-7931

Mail: FINTRAC, 24th Floor, 234 Laurier Avenue West, Ottawa ON K1P 1H7, Canada

FINTRAC operational alerts provide up-to-date indicators of suspicious financial transactions and high-risk factors related to new, re-emerging or particularly topical methods of money laundering and terrorist activity financing.


For more information on child sexual exploitation as well as associated financial intelligence, please consult the following resources:



Date Modified: