BUSTING ’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS

SEPTEMBER 2019 BUSTING BITCOIN’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS A deliberate design feature of Bitcoin is that it enables users to buy or sell anything without revealing their identity. Yet, paradoxically, all Bitcoin transactions are stored publicly and permanently on . Now, as seen in recent cases, enterprising US prosecutors and private plaintiffs’ lawyers are using software called blockchain explorer to crack Bitcoin’s anonymity. The US Treasury Financial Crimes Enforcement Network (FinCEN) also appears to suggest that financial institutions and crypto businesses should consider how explorer software could help them meet their own anti‑ (AML) and sanctions obligations.

How do explorers work? diligence including for compliance with AML/KYC obligations. Existing Blockchain explorer software can search compliance tools are unlikely to take the public Bitcoin blockchain (or other advantage of all the data points offered public blockchain platforms) and identify by blockchain technology. all transactions associated with a given public key. Finding interactions between In the US at least, there appears to be a that public key and a financial institution regulatory push for widespread adoption or other entity with AML/KYC or books of explorer software as a compliance and records retention requirements – tool. On October 1, 2018, FinCEN e.g. a regulated released Advisory 2018-A006, which exchange –that can be subpoenaed (or focuses on Iran’s attempts to gain made the subject of a search warrant), access to the global financial system means that personal information can be through its use of virtual currency for unlocked that could help identify the evasive purposes. FinCEN suggests that owners of the public key. financial institutions should take blockchain-specific countermeasures Explorers as a to counteract Iran’s efforts, compliance tool emphasizing that: Industry awareness of blockchain • Institutions should consider reviewing explorer technology is growing: an article blockchain ledgers for activity that may in the February 2019 edition of the U.S. originate or terminate in Iran. Department of Justice’s Journal of Federal Law and Practice, “Attribution in • Institutions can utilize technology Cases”, written by the created to monitor open Counsel in the Criminal and investigate transactions to or Division’s Money Laundering and Asset from peer to peer (P2P) Recovery Section, recognizes that exchange platforms. “third-party blockchain analysis software is used as anti-money laundering In November 2018, the Office of Foreign software by financial institutions Assets Control (OFAC) added the Bitcoin worldwide.” Accordingly, we expect to wallet addresses of two Iranian see increasing use for customer due ransomware operators to the Specially

2 CLIFFORD CHANCE BUSTING BITCOIN’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS Designated Nationals (SDN) list. In that enable one to search the data August 2019, OFAC added a dozen contained in the blockchain. Thus, for virtual currency wallet addresses of example, if an investigator learns of a Chinese narcotics traffickers to the SDN Bitcoin address associated with a list. Blockchain explorer software could particular scheme, the investigator can potentially be employed to screen the search the address through a upstream chain of provenance of virtual blockchain explorer in order to locate currency involved in any given possible Bitcoin transactions involving transaction for transfers involving that particular address. The block these addresses. explorer search can reveal the following transactional information: the Additionally, on May 9, 2019, FinCEN Bitcoin transaction ID and Date/Time released Advisory 2019-A003 to assist Stamp (in Universal Coordinated Time/ financial institutions in identifying UTC), the amount of Bitcoin (BTC) suspicious activity involving the use of transacted, the sender’s public key or virtual currencies for money laundering, Bitcoin address, and the receiver’s sanctions evasion, and other illicit public key or Bitcoin address. IP purposes, including “red flags” that are address information may also be particularly likely indicators of illicit revealed but the IP addresses may not activity. Red flag number 4 instructs be the true locations of the Bitcoin financial institutions to be alert for senders and receivers, because many situations where “blockchain analytics” exchangers and wallet providers may indicate that a wallet transferring virtual use proxy IPs or IPs that do not currency has a suspicious source of constitute the true location of the funds, e.g., a darknet marketplace. To computer or device used to access date, however, FinCEN has not, the to carry out the however, provided background on, or transaction. That being said, if an explained, these references to investigator is aware of a particular IP “blockchain analytics,” “reviewing address utilized by a subject, the blockchain ledgers” and utilizing investigator can use that IP address to “technology created to monitor open execute a search using the block blockchains.” We are hopeful that explorer online tool to identify any additional guidance for financial cryptocurrency transactions executed institutions will follow. using that IP address. Once a suspicious cryptocurrency transaction Explorers as a regulatory has been identified, and if it is investigation tool determined that the transaction was effected through a cryptocurrency Other US authorities have also payment processor, a subpoena can recognized the potential of blockchain be issued to the payment processor explorer technology for cracking the requesting, among other things, any anonymity otherwise afforded by many wallet address(es) associated with the . An article titled “A Shot transaction, any bank account in the Dark: Using Asset Forfeiture Tools number(s) registered to the user, and to Identify and Restrain Criminals’ any personal information linked to the Cryptocurrency” in the October 2018 account user (for example, name, edition of the U.S. Department of email, address, phone number, IP Justice’s Journal of Federal Law and logs, and credit card information).” Practice explains that: • “There are various online tools, called A second article in the February 2019 blockchain or block “explorers,” that edition of the same publication, titled are publicly available on the internet “Attribution in Cryptocurrency Cases”

CLIFFORD CHANCE 3 BUSTING BITCOIN’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS (see “Explorers as a compliance tool” security to be taken over the defendant’s above), underscores the point that using assets ahead of pending litigation. As a blockchain explorer technology to track result of using the explorer software, the a transaction to an exchange or payment plaintiffs were able to obtain additional processor may enable the transacting personal information about the party’s anonymity to be cracked due to defendant and the defendant’s assets, records maintained by such entities on including bank account information, from their customers: the defendant’s US wallet providers and crypto exchanges, shattering the • “On its own, viewing cryptocurrency defendant’s anonymity and taking control transactions on the blockchain shows of U.S.$30 million worth of his assets only the transfer of some quantity of pending the outcome of the litigation. funds from one string of letters and numbers to another at a point in time. What does this mean for Correlating that activity to real world crypto businesses? events – for example, the payment of funds by a victim or an undercover To the extent they aren’t already, financial agent – provides additional context. institutions dealing in cryptoassets The greatest value, however, may should be considering incorporating come from the ability to associate blockchain explorer technology into their certain addresses with known entities, AML and sanctions compliance particularly virtual currency exchanges. processes, as for US-based firms at The known entities may collect records least, the FinCEN Advisory 2018-A006 regarding the user’s true identity and appears to say they “can” and “should”. by tracing a target’s funds to the entity, law enforcement can glean valuable Crypto exchanges and wallet providers insight into a target’s true identity.” should also expect to be on the receiving end of an increasing number of Explorers as a requests to freeze customer assets, or to turn over personal identifying litigation tool information associated with a particular It’s not just regulators that can glean public key address, as part of court useful information and improve their proceedings or government position using blockchain explorer investigations. Exchanges and wallet software. A recent civil case related to providers must adopt policies and failed cryptocurrency purchases in the procedures that will allow them to store U.S. District Court of the Southern and retrieve such information, as the District of New York illustrates how volume of such requests is only likely to blockchain explorers can be used to increase in the future. Consideration of track down and freeze a party’s Bitcoin interaction with relevant data privacy ahead of a pending trial. In this case, the regimes will also be crucial here. plaintiffs monitored all of the defendant’s online activity, in the course of which The FinCEN Advisories indicate the likely they located a web forum post in which direction of travel that US (and other the defendant disclosed one of his jurisdictions’) authorities may increasingly Bitcoin public keys. They then hired a move toward in the future, as they London-based firm that provides attempt to trace transaction history blockchain explorer-type services to through immutable (and not quite trace the transaction history of the anonymous) public blockchains. defendant’s public key, discovering that roughly U.S.$30 million worth of were transferred from the defendant’s public key to several U.S.-based wallet and firms – , , Bittrex, and Poloniex () – that conduct activities in New York. The NY court granted the plaintiffs’ application for prejudgment attachment, i.e. a provisional remedy providing for

4 CLIFFORD CHANCE BUSTING BITCOIN’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS CONTACTS

Jesse Overall David Felsenthal Benjamin Peacock Associate Partner Associate New York New York New York T: +1 212 878 8289 T: +1 212 878 3452 T: +1 212 878 8051 E: jesse.overall@ E: david.felsenthal@ E: benjamin.peacock@ cliffordchance.com cliffordchance.com cliffordchance.com

David Adams Steven Gatti Megan Gordon Associate Partner Partner Washington DC Washington DC Washington DC T: +1 202 912 5067 T: +1 202 912 5095 T: +1 202 912 5021 E: davidg.adams@ E: steven.gatti@ E: megan.gordon@ cliffordchance.com cliffordchance.com cliffordchance.com

Peter Chapman Ellen Lake Laura Nixon Partner Senior Associate Senior Associate London London Knowledge Lawyer T: +44 207006 1896 T: +44 207006 8345 London E: peter.chapman@ E: ellen.lake@ T: +44 207006 8385 cliffordchance.com cliffordchance.com E: laura.nixon@ cliffordchance.com

CLIFFORD CHANCE 5 BUSTING BITCOIN’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS NOTES

6 CLIFFORD CHANCE BUSTING BITCOIN’S ANONYMITY – THE IMPLICATIONS FOR FINANCIAL INSTITUTIONS OUR INTERNATIONAL NETWORK 32 OFFICES IN 21 COUNTRIES

Abu Dhabi London São Paulo Amsterdam Luxembourg Seoul Barcelona Madrid Shanghai Beijing Milan Singapore Brussels Moscow Sydney Bucharest Munich Tokyo Casablanca Newcastle Warsaw Dubai New York Washington, D.C. Düsseldorf Paris Frankfurt Perth Riyadh* Hong Kong Prague Istanbul Rome

*Clifford Chance has a co-operation agreement with Abuhimed Alsheikh Alhagbani Law Firm in Riyadh Clifford Chance has a best friends relationship with Redcliffe Partners in Ukraine. This publication does not necessarily deal with every important topic nor cover every aspect of the topics with which it deals. It is not designed to provide legal or other advice. www.cliffordchance.com

Clifford Chance, 10 Upper Bank Street, London, E14 5JJ

© Clifford Chance September 2019

Clifford Chance LLP is a limited liability partnership registered in England and Wales under number OC323571 Registered office: 10 Upper Bank Street, London, E14 5JJ

We use the word ‘partner’ to refer to a member of Clifford Chance LLP, or an employee or consultant with equivalent standing and qualifications.

If you do not wish to receive further information from Clifford Chance about events or legal developments which we believe may be of interest to you, please either send an email to [email protected] or contact our database administrator by post at Clifford Chance LLP, 10 Upper Bank Street, Canary Wharf, London E14 5JJ.

Abu Dhabi • Amsterdam • Barcelona Beijing • Brussels • Bucharest Casablanca • Dubai • Düsseldorf Frankfurt • Hong Kong • Istanbul London • Luxembourg • Madrid Milan • Moscow • Munich • Newcastle New York • Paris • Perth • Prague Rome • São Paulo • Seoul • Shanghai Singapore • Sydney • Tokyo • Warsaw Washington, D.C.

Clifford Chance has a co-operation agreement with Abuhimed Alsheikh Alhagbani Law Firm in Riyadh.

Clifford Chance has a best friends relationship with Redcliffe Partners in Ukraine.

J20190402191616