Crypto → Fiat
Conversion Playbook

1. Scope & rules of engagement

This playbook describes conversion engineering: turning on-chain balances into bankable fiat with controlled risk of freeze, KYT flags, and operational leakage. It is an ops document for operator-owned flows and lab/cashout design under authorized engagement.

2. Decision tree

AMOUNT?
├─ < $2k USD
│   └─ P2P / card ramp / small CEX (if clean) → bank or cash
├─ $2k – $25k
│   └─ hygiene hop → mid CEX or OTC desk → staggered wire
├─ $25k – $150k
│   └─ multi-hop + OTC preferred · split landings · time buffer
└─ > $150k
    └─ OTC-only primary · multi-entity landing · compliance story pre-built

TAINT?
├─ clean / own mint / CEX-withdraw history → short path OK
├─ mixed / unknown cluster → hygiene mandatory
└─ known high-risk (mixer-adjacent, exploit labels) → long hop + OTC, no retail CEX

“Taint” here means how a commercial KYT product or CEX risk engine is likely to score the funds, not a moral label. Score before you move.

3. Phase 0 — Assess

3.1 Inventory

• Chains, tokens, native balances, NFT dust (ignore or burn later).
• Wallet software: hot / hardware / multi-sig / CEX residual.
• Exact USD notionals at current mid; gas + bridge fee budget (2–8% depending on path).

3.2 Score taint (quick)

1. Run address through 1–2 KYT UIs or APIs (see appendix).
2. Check label exposure: stolen, sanctions, darknet, mixer, ransomware, gambling.
3. Classify: clean mixed hot

3.3 Choose destination shape

• Bank wire — needs clean story + KYC identity.
• Cash / P2P — lower paper trail, higher street risk.
• Stablecoin park — intermediate; not fiat, but de-risks volatility.
• Card spend — virtual/physical crypto cards; good for burn, bad for large cashout.

4. Phase 1 — Consolidate & hygiene

4.1 Consolidation

• Sweep to a fresh ops intermediate wallet (hardware preferred for size).
• Do not consolidate unrelated hot clusters into one address if you want path diversity later.
• Leave dust if sweeping would link many source clusters unnecessarily.

4.2 Hygiene patterns (engineering)

5. Phase 2 — Hops & bridges

5.1 Preferred hop graph (generic)

source wallet(s)
    → intermediate A (same chain, swap to liquid major)
        → bridge to secondary chain (or L2)
            → intermediate B (swap again)
                → venue deposit address (unique)

5.2 Chain preferences (ops defaults)

• Liquidity majors: BTC, ETH, USDT/USDC, BNB, SOL, TRX.
• CEX-friendly stables: USDT (TRC20 / BEP20 / ERC20) — pick the network the venue expects.
• Avoid for large off-ramp: obscure low-liquidity tokens, unvetted bridges, “privacy coin → CEX” without OTC.

5.3 Bridge selection criteria

1. Volume and age of bridge contract.
2. Whether destination chain has liquid CEX/OTC.
3. Historical exploit status (if bridge is under active incident → skip).
4. Fee vs. size (don’t pay 4% to hop $800).

6. Phase 3 — Conversion venues

6.1 Venue matrix

6.2 CEX path (clean / mixed-clean)

1. Use a long-lived KYC account with normal history if available — brand-new accounts + large deposit = review queue.
2. Deposit only the reshaped asset/network the UI shows.
3. Trade to the fiat pair or stable, then withdraw fiat via preferred rail.
4. If deposit sits “under review” > SLA → do not spam support with contradictions; one clean narrative.

6.3 P2P path

• Prefer escrow platforms over raw Telegram meets for first contact.
• Match method: bank transfer / mobile money / cash — pick what your landing identity can receive without bounce.
• Split orders under platform soft limits; different counterparties.
• Record release only after irreversible fiat settlement (not “pending” bank status).

6.4 OTC path (preferred > ~$25k)

1. RFQ with 2–3 desks; compare spread + settlement options (wire, USDT park, multi-currency).
2. Share only the due-diligence pack they require — consistent story across desks.
3. Settle in tranches if desk or bank prefers; never wire full size into an untested bank corridor.

6.5 What not to do at venues

• Deposit → instant full withdraw of same asset (pass-through flag).
• Round-trip mixer → CEX in < 1h with identical amounts.
• Login from high-risk IP/ASN right after large deposit.
• Change KYC name / bank beneficiary mid-flow.

7. Phase 4 — Fiat landing

7.1 Bank readiness

• Account aged and used for ordinary activity before large crypto-sourced wires.
• Beneficiary name matches KYC / OTC contract exactly.
• Know the bank’s crypto policy; some auto-RFI any exchange-tagged wire.

7.2 Narrative (when asked)

Prepare a one-paragraph source-of-funds story that matches the paper trail (exchange statements, OTC invoice, contract). Do not improvise per agent call.

7.3 Staggered landing

Week 0  dust test wire
Week 1  10–20% tranche
Week 2  30–40% tranche
Week 3+ remainder if no RFI

7.4 Cash landing

• Limits, camera coverage, transport risk.
• Never schedule multi-counterparty cash meets from the same device identity pattern.

8. Sizing & timing

9. KYT / chain analysis awareness

Commercial engines (Chainalysis, TRM, Elliptic, Merkle Science, etc.) score deposits for CEX/OTC. Your job is not to “beat math forever” — it is to avoid obvious high-risk features and keep scores below venue thresholds.

9.1 Features that raise scores

• Direct edges to labeled high-risk clusters.
• Peel-chain / mixer-like structures with known heuristics.
• Fresh wallet + large first deposit + fast exit.
• Reuse of addresses across many counterparties.

9.2 Features that help

• Interaction with major DEX pools and bridges over time.
• Non-unique amounts; organic fee patterns.
• Prior normal CEX history on the receiving account.
• Delay between hops.

9.3 Pre-deposit gate

1. Score final hop address / tx pattern.
2. If elevated → extra hop or route to OTC, not retail CEX.
3. Dust-test deposit ($20–100) before main size on new venue accounts.

10. OpSec baseline

• Identity silos: KYC persona, banking, email, phone, device, residential story stay consistent within a silo and never cross-contaminate with another silo.
• Network: stable residential or clean VPS exit per silo; no Tor→CEX login right after deposit.
• Devices: dedicated browser profile / phone per silo; hardware wallet offline for large keys.
• Comms: OTC/P2P only on silo-matched accounts; no personal TG linked.
• Logging: private ops log (local) of txids, amounts, times, venues — needed for freeze response; never commit secrets to this site.

11. Quick runbooks

RB-1 · Micro (< $2k) — speed

1. Swap to venue-preferred stable on a liquid DEX if needed.
2. P2P escrow sell → local bank/mobile money or crypto card spend.
3. Done. Log counterparty + receipt.

RB-2 · Mid ($10k–$50k) — balanced

1. Sweep → intermediate A; swap to ETH or USDT; non-round size.
2. Bridge once; wait ≥ 6–24h.
3. Swap again on destination; send to CEX deposit (unique address).
4. Dust-test if account/path new; then main deposit.
5. Trade → fiat rail; 2–3 outbound tranches.

RB-3 · Large (> $50k) — OTC

1. Hygiene hop to desk-agreed asset/chain.
2. RFQ lock; send to desk deposit with memo/ref as specified.
3. Settlement schedule in contract; first small wire validates corridor.
4. Complete tranches; archive statements.

RB-4 · Hot / high-risk score

1. Do not touch KYC retail CEX.
2. Long hygiene graph + time; consider OTC that accepts higher risk (wider spread).
3. If no acceptable desk → park in stables on self-custody and reassess; forcing a path is how freezes happen.

12. Freeze / incident response

1. Stop movement on related addresses and accounts.
2. Snapshot balances, open tickets, last txids, support chat.
3. Single narrative for support — align with SoF docs.
4. Do not open parallel accounts to “retry” the same funds while review is open (correlates harder).
5. Legal threshold: if amount/legal exposure warrants counsel, escalate before more emails.
6. Write postmortem into ops log: which heuristic likely fired; update this playbook.

13. Pre-flight checklist

• Inventory complete (chain, asset, USD, gas budget)
• Taint scored; path matches score
• Destination venue + fiat rail chosen
• Silo identity / device / IP ready
• Intermediate wallets funded for gas only
• Amount reshape plan (splits, non-round)
• Time delays scheduled
• Dust-test planned for new venues
• SoF narrative + docs staged
• Freeze IR contacts known
• Ops log template ready (local, not this site)
• No live keys / bank full numbers in chat or public pages

14. Appendix — tools

Venue names above are illustrative of market categories. Operator maintains the live allow-list of desks and accounts in private config — not on this host.