FATF 2025 Report: Financial Indicators to Detect Online Child Sexual Exploitation

Introduction: Understanding the FATF’s Focus on Online Child Sexual Exploitation

The Financial Action Task Force (FATF) has released a pivotal report in 2025 titled “Detecting, Disrupting and Investigating Online Child Sexual Exploitation: Using Financial Intelligence to Protect Children from Harm.” This comprehensive document addresses how financial intelligence can be leveraged to combat online child sexual exploitation (OCSE), a rapidly escalating cyber-enabled crime trend with devastating impacts on victims and their families.

For financial institutions, compliance officers, and Money Laundering Reporting Officers (MLROs), this report represents a critical resource. OCSE crimes fall under the FATF Glossary’s “designated categories of offences,” which means they’re within the purview of anti-money laundering (AML) frameworks. Consequently, a jurisdiction’s response to financial flows associated with OCSE could be considered during Mutual Evaluation Reports where relevant to their ML/TF risk context.

This article synthesizes the key findings, indicators, and recommendations from the FATF report, with a particular focus on how financial institutions can detect, report, and disrupt the financial flows associated with these crimes.

Global Context: Scale and Trajectory of Online Child Sexual Exploitation

The global scale of OCSE is alarming. Research from the University of Edinburgh estimates that approximately 300 million children worldwide—roughly one in eight—are affected by online sexual abuse and exploitation annually. The 2022 INTERPOL Global Crime Trend Summary ranked online child sexual exploitation among the top ten crime trends perceived as “high” or “very high” threats by member countries.

Even more concerning is the trajectory: 62% of INTERPOL member countries strongly expected these crimes to “increase” or “significantly increase.” By 2024, these crimes remained in the high threat category, with increased utilization of encrypted communications further complicating detection efforts.

The FATF report focuses on two distinct types of financially-motivated OCSE:

Live-streamed Sexual Abuse of Children (LSAC) – The broadcasting of sexual abuse of children for financial gain, specifically real-time transmission of material depicting a child in sexual activity that consumers pay to watch remotely.
Financial Sexual Extortion of Children (FSEC) – The threat of exposing sexually explicit images or video of a child unless they meet financial demands.

Understanding the Financial Flows of Online Child Sexual Exploitation

Live-streamed Sexual Abuse of Children (LSAC)

LSAC involves several actors:

Consumers: Individuals who pay to view live-streamed abuse, sometimes directing the nature of the abuse
Facilitators: Individuals who arrange the abuse
Abusers: Individuals who commit the sexual abuse (sometimes the same as facilitators)

Financial characteristics include:

Transactions typically range from €10-200 per instance
Consumers are predominantly from Australia, Europe, and North America
Abusers and facilitators are often located in Southeast Asia, though cases occur worldwide
Payments typically flow through Money or Value Transfer Services (MVTS), peer-to-peer payment systems, bank transfers, or virtual assets
Laundering mechanisms are generally unsophisticated, usually involving conversion to cash for day-to-day spending or purchases of lifestyle goods

Financial Sexual Extortion of Children (FSEC)

FSEC is a cyber-enabled crime combining fraud, extortion, and sexual exploitation. The process typically involves:

A perpetrator contacts a victim (usually a teenager) through social media
The perpetrator creates a false persona (“catfishing”)
The victim is manipulated into sharing sexually explicit content
The content is then used to extort money from the victim

Financial characteristics include:

Ransoms typically range from €50-1500, with initial payments usually under €250
Victims are predominantly teenage males, though female victims are increasing
Perpetrators are often based in Nigeria, the Philippines, and Côte d’Ivoire
Payment methods include MVTS, bank transfers, virtual assets, prepaid cards, gaming credits, and gift cards
Laundering typically involves simple conversion to day-to-day spending, though more significant proceeds have been used to purchase lifestyle goods

Financial Indicators for Detection

The FATF report provides detailed indicators to help financial institutions identify potential OCSE-related transactions. These indicators are crucial for transaction monitoring systems and staff awareness programs.

Indicators for Live-streamed Sexual Abuse of Children

General Indicators:

Transactions from developed countries to high-risk jurisdictions for child sexual exploitation
Significant age differences between remitters and receivers
Low-value, even-denominated amounts (€10-200)
Payments to receivers in another jurisdiction with no apparent legitimate connection
Transactions at irregular intervals but repeated on the same or successive days
Transactions made late at night or early morning (indicating different time zones)
Transaction purposes referencing social media usernames, sexual terms, or timing of material
Transaction descriptors such as “family support,” “school fees,” “assistance,” “medical bills,” etc.

Consumer Transaction Indicators:

Transactions to accounts in high-risk jurisdictions
Purchases on dating platforms, adult entertainment sites, webcam/livestreaming platforms
Purchases of video capture software
Connections to individuals charged with child exploitation offenses

Facilitator/Abuser Transaction Indicators:

Immediate withdrawal of received money remittances
Payments for premium features on social media platforms
Purchases of video capture software
Multiple similar-amount deposits from foreign sources
Payments to online file hosting platforms

Indicators for Financial Sexual Extortion of Children

General Indicators:

Transactions between individuals with no apparent relationship
Transactions generally under €500 (up to €1500) in even denominations
Initial transactions typically under €250
Multiple transactions over a short period then stopping entirely
Transactions to countries known for FSEC operations
Transaction references to social media, sexual terms, or threatening language

Victim Transaction Indicators:

Transactions by teenage or young adult males (and increasingly females)
Transactions originating from primarily English-speaking countries
Payments typically occurring between 7PM and 7AM
Rapid depletion of funds within hours
Uncharacteristic purchases of digital gift cards, gaming credits, or virtual assets
Evasiveness when questioned about transactions

Perpetrator Transaction Indicators:

Accounts receiving multiple unrelated transactions
Quick removal of received funds
Payments for privacy/anonymity services
Association with multiple prepaid cards or gift cards
Lifestyle inconsistent with declared income sources

Detection and Investigation Best Practices

The FATF report emphasizes several approaches for effectively detecting and investigating OCSE:

Financial Intelligence as a Critical Resource

Unlike many crimes where victim reporting is key, OCSE is vastly underreported due to victims’ embarrassment, age, vulnerability, or fear. Financial transactions and information are therefore critical resources for detection. Examples of effective financial intelligence utilization include:

The Australian Federal Police using financial intelligence to build offender profiles
National Australia Bank creating daily alerts for potential FSEC victims, followed by referrals to the Australian Centre to Counter Child Exploitation
Indonesia’s FIU (PPATK) tracing suspicious international transactions to identify LSAC networks
Canada’s Project Shadow, a public-private partnership led by Scotiabank and the Canadian Centre for Child Protection

Public-Private Partnerships

Strong cooperation between public authorities and private sector entities is essential. Notable examples include:

The Lantern Coalition, an alliance of global technology companies working together to combat OCSE across multiple platforms
Partnerships between banks and law enforcement for real-time detection of FSEC payments
Collaboration with social media platforms to identify suspicious accounts and activities

Victim-Centric Investigative Strategies

The report emphasizes that investigatory techniques must prioritize victim needs through trauma-informed responses. Investigations should:

Focus first on safeguarding children
Develop strategies that reduce reliance on victim testimony
Use financial intelligence to provide less traumatic routes of investigation
Implement intelligence development processes that minimize time delays

International Cooperation

Given the cross-border nature of these crimes, international cooperation is fundamental. The report highlights:

The importance of sharing referrals and intelligence across jurisdictions
Joint operations like “Operation Cyber Guardian” between Singapore, Hong Kong, and Korean police
The critical role of proactive intelligence sharing across borders

Asset Recovery and Pursuing Proceeds

The FATF report notes that asset recovery laws can be effectively applied to OCSE cases, though this appears underutilized. Examples include:

Australian authorities successfully confiscating a home used for LSAC-related offenses
U.S. courts ordering restitution to victims in FSEC cases

These measures not only punish offenders but can provide resources for victim support and crime prevention initiatives.

Recommendations for Financial Institutions and Compliance Teams

Based on the FATF report, financial institutions should consider the following approaches:

Integrate OCSE indicators into transaction monitoring systems

Implement the specific indicators for both LSAC and FSEC identified in the report
Regularly update these indicators as typologies evolve

Adopt a victim-centered approach

Prioritize rapid reporting of suspicious transactions to potentially safeguard victims
Consider the human impact behind transactions, not just compliance obligations

Enhance staff awareness and training

Train front-line staff to recognize potential OCSE indicators
Develop specialized training for compliance teams focused on these crimes

Implement real-time detection capabilities

Consider near real-time monitoring for FSEC indicators, especially for teenage account holders
Develop protocols for swift intervention when FSEC is suspected

Strengthen public-private partnerships

Actively participate in information-sharing initiatives with law enforcement
Engage with industry groups focused on combating OCSE

Consider innovative approaches to customer engagement

As demonstrated by some VASPs, enhanced customer engagement can help detect victims under coercion
Develop protocols for welfare checks when extortion is suspected

Improve cross-platform detection

Where legally permissible, share information with other financial institutions
Participate in initiatives that allow cross-platform identification of suspicious patterns

Challenges and Emerging Threats

The FATF report identifies several challenges and emerging threats that financial institutions should be aware of:

Technological evolution: Increasing encryption and anonymization tools make detection more difficult
Cross-platform operation: Offenders operating across multiple platforms and financial institutions creates challenges for detection
AI-generated content: “Nudifying” technology and generative AI may increase instances of FSEC
Potential involvement of organized crime: Evidence suggests criminal business structures may increasingly exploit OCSE opportunities

Conclusion: A Call to Action for Financial Institutions

The FATF report makes clear that combating OCSE requires a multifaceted response, with financial institutions playing a crucial role. While the financial proceeds may appear modest compared to other crimes, the human cost is immeasurable.

For compliance officers and MLROs, this represents both a responsibility and an opportunity. By implementing robust detection systems, training staff effectively, and collaborating closely with law enforcement and other stakeholders, financial institutions can make a significant difference in detecting, disrupting, and preventing these crimes.

The financial sector’s unique visibility into transaction flows positions it as a critical line of defense in protecting vulnerable children. As the FATF report concludes, “one child facing such consequences of having their life dramatically altered is too many and all stakeholders must bring all available tools to bear to mitigate this risk to children.”

Key Actionable Takeaways

Review and update transaction monitoring rules to incorporate the specific OCSE indicators from the FATF report
Establish dedicated workflows for handling potential OCSE-related suspicious activity reports
Develop specialized training modules for staff on recognizing OCSE financial patterns
Consider near real-time monitoring capabilities for accounts of younger customers
Establish direct communication channels with relevant law enforcement units
Participate in public-private partnerships focused on combating OCSE
Ensure suspicious transaction reports relating to OCSE include appropriate references and keywords to facilitate analysis by FIUs
Develop clear escalation procedures for potential OCSE cases that prioritize rapid response
Include OCSE in institutional risk assessments and control frameworks
Regularly review and update approaches based on evolving typologies and threats

Disclaimer: This article is based on the Financial Action Task Force (FATF) 2025 report “Detecting, Disrupting and Investigating Online Child Sexual Exploitation: Using Financial Intelligence to Protect Children from Harm.” While efforts have been made to accurately represent the report’s content, readers are encouraged to consult the original document for comprehensive guidance.