QUESTION
We are writing
a policy for cryptocurrency compliance. We are a mid-sized nonbank. I am the
Compliance Manager, and I have two in support staff. Our Board of Directors
thinks cryptocurrency will continue to be a part of bank and nonbank
transactions. They retained a research firm that says it is growing quickly.
I recognize
that there are benefits to cryptocurrency. However, in writing this policy, we
see how it can also impact our Anti-Money Laundering safeguards. So, we need to
know the risks of cryptocurrency triggering our AML tripwires.
What are the safe
versus risky features of cryptocurrency?
ANSWER
Your question
comes at a time when cryptocurrency is a hot topic in banking and government
circles. Indeed, the Treasury Department views cryptocurrency as potentially
leading to economic instability due to increased fraud risk in the absence of
sufficient government regulation. The Washington Post reports:
“The Treasury Department will warn the
White House that cryptocurrencies could pose significant financial risks that
outweigh their benefits unless the government rolls out major new regulations,
according to two people familiar with the matter.”[i]
I speak with DC
political types all the time, and I can tell you that a good percentage of them
do not know what cryptocurrency is, let alone how to regulate it. Sometimes I
wonder if they only just recently figured out how to send an email. Several of
them are oblivious to how the Internet works, so I suppose they think it works
by magic.
But, there is
no mystery to cryptocurrency. It’s not magic.
Cryptocurrency
is establishing itself as a legitimate alternative to traditional finance. As
such, it should be regulated. And, as to linking it to Anti-Money Laundering
(AML), you are entirely correct: there is a direct interface with Know Your
Customer (KYC) processes and cryptocurrency.
Understand that
cryptocurrencies had a total market capitalization of $900 billion in June,
which jumped to $1 trillion in August.[ii]
That is astounding growth!
You’ll need to
become familiar with certain new terminology to make sense of cryptocurrency
compliance. I will embolden a few words that are particular to cryptocurrency.
So, let’s dig in!
What is
Cryptocurrency?
Some people
believe that cryptocurrency is impervious to scrutiny and appropriate
regulation. The notion here is that transactions are “transparent” because they
are kept in blockchain ledgers. Thus, it is erroneously thought,
cryptocurrency can’t be well-regulated. However, these are simply digital
ledgers that capture each transaction, which can be traced back to a wallet
address. Transactions are time-stamped and immutable because to alter
something in a ledger, every single block in the chain, across all its
distributed versions, would need to be changed.
There is also
the view that cryptocurrency is where criminals hang out to hide their
nefarious purposes. I don’t think that holds up to scrutiny. The fact is that
only 0.15% of such transaction volume was related to crime in 2021.[iii]
Is
cryptocurrency vulnerable to cyberattacks? Well, yes and no. Wallets are owned
and accessed by persons, which means they will be vulnerable to fraudsters and
cybercriminals.[iv] But
the blockchain technology that facilitates and records cryptocurrency
transactions is nearly impossible to edit and is rooted in cryptography. However,
cryptocurrency wallets need to be secured to protect them from attack.
It seems to me
that anyone who thinks cryptocurrency is a fad has not been paying attention.
It jumped by 567% in 2021[v]
and is forecasted to have a compound annual growth rate of 12.8% between 2021
and 2031.[vi]
I have read
that people in economies battling hyperinflation have avoided devaluation of
their hard-currency wages by exchanging them for digital currencies, which are
then used to pay for food and other products.[vii]
In economies with high remittance-based GDPs, cryptocurrency seems to be a fast
and reliable way to transfer funds overseas compared to traditional
alternatives, which may offer poor exchange rates. Some large financial
institutions also appear to recognize opportunities to mobilize in cryptocurrency
investing. Small companies seem to acknowledge that cryptocurrency can fill
financial access gaps in regions where the traditional finance market is more
limited.
But money
attracts thieves!
Criminality
and Cryptocurrency
Cash has
anonymity, but crypto currency does not! Cryptocurrency transactions are traceable
through the blockchain, and cryptocurrency wallets are represented by a
numbered key rather than held in a natural or legal person’s name. Therefore, KYC
is an essential tool in cryptocurrency compliance.
Blockchain
analysis can show the transaction history of a cryptocurrency coin or crypto
wallet, but criminals will still find ways to obfuscate their source of funds
and identities. The same risk and transaction patterns and factors used in KYC
for traditional financial products show evidence of similar criminals, such as money
launderers, cybercriminals, and traffickers. These crooks tend to adapt to and
use the efficiencies of new technology.
Vendors that
provide wallets to businesses and individuals must aim to have an accurate and
perpetual KYC record of persons they are onboarding and servicing. If there are
signs of criminality, law enforcement can trace the behavior and know who is
behind it.
As
cryptocurrency and its accessibility continue to grow, so does the evidence of
criminal activity. International financial compliance regulators such as the
Financial Action Task Force (FATF), the Financial Crimes Enforcement Network
(FinCEN), and the European Union are taking the lead in developing regulatory
approaches to virtual currencies. Although these efforts are critical,
regulation is still much too tenuous and loose. Regulations certainly do not
maintain international continuity.
Another transaction
medium is a “kiosk” that lets users purchase Bitcoins (and other
cryptocurrencies) using cash or a debit card. This “kiosk” is called a Bitcoin
Automated Teller Machine (BATM). The BATM is a quickly growing medium that
requires regulation. To get a sense of how quickly BATMs are being installed,
in June 2022 there were 37,786 BATMs available in seventy-eight countries.[viii]
As of today, there are nearly 38,723 BATMs.
Ratifying
policies and procedures for cryptocurrency transactions is “mission critical”
to a financial institution involved in cryptocurrency transactions. Frankly,
given the lack of comprehensive regulation, it is vital that banks and
financial institutions develop their own best practices and manage AML
strategies that will mitigate the risks bad actors pose, making sure due
diligence is as complete as possible.
Safe and
Risky Features
You asked about
distinguishing between safe and risky features of cryptocurrency. I believe
that a primary, reliable measure of risk is traceability. The blockchain
provides a record of transactions and ownership. But what if that history is
hidden, or nobody is reviewing it?
And, to be
sure, traceability in cryptocurrency and digital assets varies.
There are several
known ways that ownership is obscured in cryptocurrency transactions, and you
must ensure that your KYC initiatives account for them. I will provide four
examples.
1. Mixers
Also called tumblers, mixers aim to
hide the origin of their users’ funds by obscuring the transaction history of crypto
assets. For instance, Bitcoin Fog[ix]
allowed users to transfer funds from their crypto wallets into ‘the fog,’ where
the assets would be mixed with other users’ currencies to
anonymize the funds. After the currencies were mixed, the original user would
receive a random number of payouts, each containing a random amount of
cryptocurrency.[x]