In a press briefing held by the Philippine National Police (PNP) on the killing of steel industry magnate Anson Que on May 5, 2025, authorities revealed that they discovered that unlicensed e-wallets linked to two casino junket operators were used to transfer and convert the ransom money to cryptocurrency.
With the money flow, they also traced that some portions of the ransom money went through different virtual asset service providers (VASPs), which led to two locally licensed crypto exchanges being subpoenaed.
Crypto Exchange’s Off-Ramp: The Involvement of VASPs
During the press briefing, PNP spokesperson Brigadier General Jean Fajardo presented the money flow of the ransom money in Que’s case
She then explained that ransom money was funneled through unregistered VASPs linked to casino junket operators 9 Dynasty and White Horse. These operators used unlicensed e-wallets that were neither registered with the Bangko Sentral ng Pilipinas (BSP) nor reported to the Anti-Money Laundering Council (AMLC).
Authorities then acknowledged that due to the complex nature of cryptocurrency transactions, they are experiencing difficulty in tracing the flow of funds.
“Hindi po ito iyong dati natin na kidnapping case kung saan ‘snatch and grab’ ang ginagawa—hinaharang ang sasakyan at sapilitang ina-abduct ang biktima at magde-demand ng ransom, (tapos) ide-deliver sa kanila nang palit-ulo at ire-release ang mga biktima. This time around po, ito pong kaso po na ito ay naging napakahirap imbestigahan on the part ng SITGdahil ito po ay dumaan sa money trail.”
Brig. Gen. Jean Fajardo, Spokesperson, Philippine National Police
[Translation: “This is not like our previous kidnapping cases that employ a snatch-and-grab scheme—where vehicles are blocked, victims are forcibly abducted, and ransom is demanded; then the victims are released after ransom is paid. This time, this particular case has become very difficult to investigate for the SITG because it involved following a money trail.”]
A day after Que’s body was found dead, a Special Investigation Task Group (SITG) was formed by the PNP with the aim of fast-tracking the investigation. It is led by PNP Chief of Directorial Staff Lieutenant General Edgardo Okubo.
In addition, investigators found that the cash was first deposited with the junket operators, then converted into cryptocurrency via unregulated wallets, moved through multiple digital platforms, and eventually parked on the blockchain.
“Kapag pinasok sa junket, kapag pinasok sa e-wallet, to cryptocurrency, doon po nawawala iyong pera… Once na napasok sa virtual (space), doon po nagkakaroon tayo ng problema because nobody knows who owns that e-wallet, it’s only numbers.”
Major General Rommel Marbil, Chief, Philippine National Police
[Translation: “When the money goes through a junket, then into an e-wallet, and swapped into cryptocurrency—that’s where the money disappears… Once it enters the virtual space, that’s where we run into problems because nobody knows who owns that e-wallet; it’s just numbers.”]
According to Atty. Emmett Manantan, the director of the AMLC, investigators tracked multiple movements across e-wallets as the ransom money was converted into cryptocurrency.
He clarified that the diagram shown during the briefing reflected only a fraction of the wallets involved, noting that many more were used.
While the transactions remain traceable, Manantan emphasized that rapid transfers between wallets make the process difficult to monitor.
“Meron po kasing exchanges na hindi registered dito sa Pilipinas. Meron po silang (PNP-ACG) na-indentify na two exchanges na registered dito which would allow us to see the KYC ng mga account holders. Pero yung ginamit po nila na exchanges na unregistered sa Pilipinas, that is the challenge po.”
Atty. Emmett Manantan, Director, Anti-Money Laundering Council
[Translation: “There are exchanges that are not registered here in the Philippines. The PNP-ACG has identified two exchanges that are registered locally, which would allow us to access the KYC information of account holders. But the exchanges they used were unregistered in the Philippines—that’s the challenge.”]
According to PNP Anti-Cybercrime Group (ACG) Director Brig. Gen. Bernard Yang, portions of the funds were later traced to foreign exchanges. And with the help of an international virtual asset service provider, authorities were able to track the flow and freeze around $79,800 in $USDT, or about ₱4.5 million.
Manantan also clarified that other funds are not yet withdrawn and are still on the blockchain.
Meanwhile, about the two locally registered VASP, the authorities confirmed that these have cooperated, while unregistered platforms provided no such transparency.
“Locally, sa virtual assets service provider, meron tayong dalawang company na napadalhan, hindi na po namin ime-mention ang pangalan, pero nakapag-provide na rin sila ng details for the KYC or ‘know your customer’ information. Naibigay na rin sa amin… At doon sa labas ng bansa ay nakapagpadala na rin tayo ng isang preservation order, at yung isa ay nakapag-reply na sa atin.”
Brig. Gen. Bernard Yang, Director, PNP Anti-Cybercrime Group
[Translation: “Locally, among the virtual asset service providers, there are two companies we were able to send requests to. We won’t mention their names, but they have already provided details for the KYC or ‘know your customer’ information. They’ve already given that to us… And for those outside the country, we’ve also sent out a preservation order, and one of them has already responded.”]
The Next Steps: What Will PNP, AMLC Do?
The PNP and AMLC are calling for the closure of illegal junket virtual asset service providers, revocation of casino agreements where applicable, and an expansion of entities classified as “covered persons” under the Anti-Money Laundering Act.
“We will also be considering and working for the freezing of assets and confiscation, kasama na rin po dito yung mga pondong konektado sa kidnap-for-ransom at money laundering kabilang na rin ang digital or virtual assets or commonly known as cryptocurrency.”
Brig. Gen. Jean Fajardo, Spokesperson, Philippine National Police
[Translation: “We will also be considering and working toward the freezing and confiscation of assets, including funds connected to kidnap-for-ransom and money laundering—this also covers digital or virtual assets, commonly known as cryptocurrency.”]
Authorities also seek stricter onboarding, improved know-your-customer (KYC) procedures, and stronger interagency coordination with the BSP, Philippine Amusement and Gaming Corporation, and foreign regulators.
Background on the Anson Que Case
Chinese Filipino businessman Anson Que, also known as Anson Tan, and his driver Armanie Pabillo were abducted and later found dead April 9, 2025, in Rodriguez, Rizal. A ₱200 million ransom was reportedly paid in batches.
The PNP named five suspects, including alleged masterminds David Tan Liao, who is already in custody. and Wenli Gong, or alias Kelly Tan Lim, who is still at large. Three other accomplices were identified, namely Ricardo Austria, Reymart Catequista, and Jonin Lin.
Kelly allegedly lured Que to a house in Bulacan, where he and his driver were held captive, and also orchestrated the transfer of the ransom money. She had prior charges for a 2022 kidnapping case but was released on bail in 2024.
Initially, Que’s son Alvin was implicated based on Liao’s unsubstantiated claims. However, the PNP has since moved to clear Alvin, citing lack of evidence, and is filing a motion to remove him from the list of respondents.
On April 19, 2025, PNP confirmed that it had sought the help of the AMLC and other government agencies to trace the money trail of the ₱200 million worth of cryptocurrencies that were part of the ransom payment.
A ₱10 million bounty is now offered for information leading to Kelly’s arrest, and authorities are also probing casino and junket operators’ potential accountability in the ransom laundering.
This article is published on BitPinas: PNP Subpoenas Local VASPs, ₱4.5M in Crypto Frozen by Foreign Exchange in Anson Que Case
What else is happening in Crypto Philippines and beyond?
