From the recent FinCEN Alert: Sanctions Evasion using crypto red flags

Select Red Flag Indicators

A customer’s transactions are initiated from or sent to the following types of Internet Protocol (IP) addresses: non-trusted sources; locations in Russia, Belarus, FATF-identified jurisdictions with AML/CFT/CP deficiencies,19 and comprehensively sanctioned jurisdictions; or IP addresses previously flagged as suspicious.
A customer’s transactions are connected to CVC addresses listed on OFAC’s Specially Designated Nationals and Blocked Persons List.
A customer uses a CVC exchanger or foreign-located MSB in a high-risk jurisdiction with AML/CFT/CP deficiencies, particularly for CVC entities and activities, including inadequate “know-your-customer” or customer due diligence measures.

Link:

Mr. Watchlist