Police: Part of Ransom Money on Anson Que Killing Went to Foreign VASPs, Two Local Crypto Exchanges

In a press briefing held by the Philippine National Police (PNP) on the killing of steel industry magnate Anson Que on May 5, 2025, authorities revealed that they discovered that unlicensed e-wallets linked to two casino junket operators were used to transfer and convert the ransom money to cryptocurrency. With the money flow, they also traced that some portions of the ransom money went through different virtual asset service providers (VASPs), which led to two locally licensed crypto exchanges being subpoenaed. Crypto Exchange’s Off-Ramp: The Involvement of VASPs During the press briefing, PNP spokesperson Brigadier General Jean Fajardo presented the money flow of the ransom money in Que’s case She then explained that ransom money was funneled through unregistered VASPs linked to casino junket operators 9 Dynasty and White Horse. These operators used unlicensed e-wallets that were neither registered with the Bangko Sentral ng Pilipinas (BSP) nor reported to the Anti-Money Laundering Council (AMLC). Authorities then acknowledged that due to the complex nature of cryptocurrency transactions, they are experiencing difficulty in tracing the flow of funds. [Translation: “This is not like our previous kidnapping cases that employ a snatch-and-grab scheme—where vehicles are blocked, victims are forcibly abducted, and ransom is demanded; then the victims are released after ransom is paid. This time, this particular case has become very difficult to investigate for the SITG because it involved following a money trail.”] A day after Que’s body was found dead, a Special Investigation Task Group (SITG) was formed by the PNP with the aim of fast-tracking the investigation. It is led by PNP Chief of Directorial Staff Lieutenant General Edgardo Okubo. In addition, investigators found that the cash was first deposited with the junket operators, then converted into cryptocurrency via unregulated wallets, moved through multiple digital platforms, and eventually parked on the blockchain. [Translation: “When the money goes through a junket, then into an e-wallet, and swapped into cryptocurrency—that’s where the money disappears... Once it enters the virtual space, that’s where we run into problems because nobody knows who owns that e-wallet; it’s just numbers.”] According to Atty. Emmett Manantan, the director of the AMLC, investigators tracked multiple movements across e-wallets as the ransom money was converted into cryptocurrency. He clarified that the diagram shown during the briefing reflected only a fraction of the wallets involved, noting that many more were used. While the transactions remain traceable, Manantan emphasized that rapid transfers between wallets make the process difficult to monitor. [Translation: “There are exchanges that are not registered here in the Philippines. The PNP-ACG has identified two exchanges that are registered locally, which would allow us to access the KYC information of account holders. But the exchanges they used were unregistered in the Philippines—that’s the challenge.”] According to PNP Anti-Cybercrime Group (ACG) Director Brig. Gen. Bernard Yang, portions of the funds were later traced to foreign exchanges. And with the help of an international virtual asset service provider, authorities were able to track the flow and freeze around $79,800 in $USDT, or about ₱4.5 million. Manantan also clarified that other funds are not yet withdrawn and are still on the blockchain. Meanwhile, about the two locally registered VASP, the authorities confirmed that these have cooperated, while unregistered platforms provided no such transparency. [Translation: “Locally, among the virtual asset service providers, there are two companies we were able to send requests to. We won’t mention their names, but they have already provided details for the KYC or ‘know your customer’ information. They’ve already given that to us... And for those outside the country, we’ve also sent out a preservation order, and one of them has already responded.”] The Next Steps: What Will PNP, AMLC Do? The PNP and AMLC are calling for the closure of illegal junket virtual asset service providers, revocation of casino agreements where applicable, and an expansion of entities classified as “covered persons” under the Anti-Money Laundering Act. [Translation: “We will also be considering and working toward the freezing and confiscation of assets, including funds connected to kidnap-for-ransom and money laundering—this also covers digital or virtual assets, commonly known as cryptocurrency.”] Authorities also seek stricter onboarding, improved know-your-customer (KYC) procedures, and stronger interagency coordination with the BSP, Philippine Amusement and Gaming Corporation, and foreign regulators. Background on the Anson Que Case Chinese Filipino businessman Anson Que, also known as Anson Tan, and his driver Armanie Pabillo were abducted and later found dead April 9, 2025, in Rodriguez, Rizal. A ₱200 million ransom was reportedly paid in batches. The PNP named five suspects, including alleged masterminds David Tan Liao, who is already in custody. and Wenli Gong, or alias Kelly Tan Lim, who is still at large. Three other accomplices were identified, namely Ricardo Austria, Reymart Catequista, and Jonin Lin. Kelly allegedly lured Que to a house in Bulacan, where he and his driver were held captive, and also orchestrated the transfer of the ransom money. She had prior charges for a 2022 kidnapping case but was released on bail in 2024. Initially, Que’s son Alvin was implicated based on Liao’s unsubstantiated claims. However, the PNP has since moved to clear Alvin, citing lack of evidence, and is filing a motion to remove him from the list of respondents. On April 19, 2025, PNP confirmed that it had sought the help of the AMLC and other government agencies to trace the money trail of the ₱200 million worth of cryptocurrencies that were part of the ransom payment. A ₱10 million bounty is now offered for information leading to Kelly’s arrest, and authorities are also probing casino and junket operators’ potential accountability in the ransom laundering. This article is published on BitPinas: PNP Subpoenas Local VASPs, ₱4.5M in Crypto Frozen by Foreign Exchange in Anson Que Case What else is happening in Crypto Philippines and beyond?