Dusting involves sending tiny amounts of crypto to many addresses to later analyze transaction patterns, potentially deanonymizing users - a privacy and AML concern.

Ethereum uses an account-based ledger model where balances are maintained per account, similar to bank accounts, and transactions update balances directly. This differs from Bitcoin, Litecoin, and Monero, which use the UTXO (Unspent Transaction Output) model.
Understanding ledger models is important for AML transaction monitoring and blockchain analytics, as account-based systems enable different tracking and risk assessment approaches.

Upon identifying customer engagement with unhosted wallets or P2P transfers, the first step a VASP should take is to collect and assess data on such transactions. This assessment helps determine if these activities fall within the firm's risk appetite and what enhanced controls or actions may be needed.
Immediate account freezing (B) is not the first step without assessment; neither is allowing transfers (A) without risk consideration. Enhancing risk frameworks (D) is important but follows from an initial data-driven risk assessment.
Relevant guidance:
FATF Recommendations and DFSA AML Module require VASPs to maintain a risk-based approach that begins with data collection and risk assessment on unhosted wallet transactions.
The DFSA's 2023 Dear MLRO letters and thematic reviews stress proportionality and evidence-based responses rather than immediate punitive measures.
Enhanced due diligence (EDD) and risk mitigation measures, including potentially freezing accounts, come after assessment of the risk level【AML/VER25/05-24: Sections 4.1, 6.4, 13; 20230406Dear_MLRO_Letter_re_IEMS.pdf】.
Hence, C is the appropriate first action.

Blockchain's transparent ledger enables investigators to trace transaction histories indefinitely, aiding ML/TF detection.

EDD and internal review determine whether the activity is suspicious before regulatory reporting or freezing actions.