views

August 2015

Risks and Challenges Associated with Transaction Monitoring for AML Risk Advisory

Why does Bitcoin present such an emergent risk to law enforcement and AML monitoring? This paper aims to establish a background history of Bitcoin development, and provides the reader with an interpretation of the risks commonly associated with these transactions. Furthermore, this paper seeks to address some of the problems faced by the AML community when attempting to monitor these transactions. Finally, this paper seeks to highlight recent regulatory guideline revisions issued by Federal and International regulatory authorities.

The use of Bitcoin initially garnered little international attention, environments, but does not have all the attributes of real but as the practice became more widespread, the value of currency. In particular, VC does not have legal tender status the electronic currency skyrocketed, thus making it a viable in any jurisdiction.”2 However, VC can be converted into legal resource to transfer large sums via anonymous networks. tender using a fiat currency exchange medium. “Bitcoin’s anonymity and irreversibility, make it susceptible to use in criminal transactions, including laundering money from A Brief History of Bitcoin illegal sales of drugs, firearms, weapons, and stolen personal The concept of Bitcoin was introduced in a paper published by 1 information.” By early 2014, Bitcoin was receiving a good Satoshi Nakamoto in October of 2008.3 He suggested that the bit of media attention. The very public collapse of the trading peer-to-peer transfer of funds via the internet was expensive, platform Mt. Gox in February 2014, helped to make Bitcoin a because banks, caught in the middle as mediators, needed household name. to mitigate the costs associated with the high risk of these transfers, and thus passed the costs on to their customers. Bitcoin is a type of Virtual Currency (VC). The Financial Crimes The increase in cost therefore made small transactions Enforcement Network (FinCEN) defines Virtual Currency as needlessly cost-prohibitive. “What was needed [to reduce “a medium of exchange that operates like a currency in some cost and incrase trust], was an electronic

Assurance | Tax | Advisory | dhgllp.com views

based on cryptographic proof instead of trust, allowing any currently estimated, that Bitcoin mining will continue until as two willing parties to transact directly with each other without late as 2033.5 need for a trusted third party.” (Nakamoto, 2008) Nakamoto defined Bitcoin as “a chain of digital signatures [where] each VCs are designed to maintain the user’s anonymity, because owner transferred the coin to the next by digitally signing a they do not track or record any personal data on the users. hash of the previous transaction and [adding the] public key Users claim ownership by attaching their user key to a of the next owner to the end of the coin[‘s digital signature].” transaction prior to initiating it. Users can generate a new key for every transaction they initiate, and these keys are stored What is Bitcoin Exactly? in the user’s electronic wallet. Every time a Bitcoin is traded, Bitcoin is a form of VC commonly known as . a new user key is attached to the coin’s system file. These It was developed in early 2009, to facilitate the virtual keys are retained forever, giving a user the ability to trace purchase and trade of an electronic currency. It was designed the movements of that coin from its development to present to give users a trustworthy but anonymous method of rapid date. international transfer of value. Bitcoin operates under the concept that privacy and anonymity must be absolute, but The same system that makes Bitcoin anonymous, also gives that users must still have a way to trust in the authenticity of them their trustworthiness. Because the full transfer chain of the transaction. a Bitcoin is traceable, it is easy to determine if the Bitcoin is legitimate, and if the seller of the Bitcoin has the authority to Bitcoin is produced via a process called mining, in which transmit that coin to another user. This system was designed analysts compete for new coin by running complex algorithms so that users can trust in the validity of the currency they to find available blocks of data. These blocks are validated by are purchasing, without requiring the security of a trusted other miners, and certified blocks of data are converted into financial institution to lend legitimacy to the transaction, or new Bitcoin. “Unlike U.S. dollars, which can be printed by certify the funds. the Federal Reserve without limit, Bitcoin are a finite quantity resource. There are approximately 12 million Bitcoin currently Bitcoin Jurisdiction in existence and only 21 million Bitcoin can ever be created. On March 18, 2013, FinCEN6 issued an interpretive Through mining, a “block” of 25 new Bitcoin is generated guidance to establish regulatory jurisdictions over Bitcoin. approximately every 10 minutes, for a total of approximately According to the FinCEN report, “the Bank Secrecy Act 3,600 new Bitcoin in the aggregate created each day. The (“BSA”) [applies] to persons creating, obtaining, distributing, amount of Bitcoin generated in each block is cut in half exchanging, accepting, or transmitting virtual currencies. approximately every four years. In 2016, the amount will be FinCEN provided fairly narrow definitions of who is and is reduced to 12.5 per block, then 6.25 four years thereafter, not considered a relevant party in a Bitcoin exchange. Under 4 and so on.” FinCEN regulations, “the definition of a money transmitter does not differentiate between real currencies and convertible The complexity of the algorithms required to mine Bitcoin virtual currencies. Accepting and transmitting anything of also exponentially increase, slowing the production of new value that substitutes for currency makes a person a money Bitcoin until they reach the zero threshold of 21 million. It is

1 2 3 4 5 6

Virtual Virtual Users spend Payments are Recipients Virtual Currency Currency the Virtual confirmed by save their Currency is “mined” dealers sell the Currency users when newly earned is converted using mined currency internationally they attach Virtual into fiat complex on exchange to pay for their “key” Currency in currency algorithms markets goods and to the their e-wallets services transaction

2 Assurance | Tax | Advisory | dhgllp.com views

Monthly Average Closing Price of Bitcoin Trade Values Source: (CoinDesk, 2015)

$1,400

$1,200

$1,000

$800

$600

$400

$200

0 4/2010 5/2010 6/2010 7/2010 8/2010 9/2010 1/2011 2/2011 3/2011 4/2011 5/2011 6/2011 7/2011 8/2011 9/2011 1/2012 2/2012 3/2012 4/2012 5/2012 6/2012 7/2012 8/2012 9/2012 1/2013 2/2013 3/2013 4/2013 5/2013 6/2013 7/2013 8/2013 9/2013 1/2014 2/2014 3/2014 4/2014 5/2014 6/2014 7/2014 8/2014 9/2014 1/2015 2/2015 3/2015 4/2015 5/2015 6/2015 10/2010 11/2010 12/2010 10/2011 11/2011 12/2011 10/2012 11/2012 12/2012 10/2013 11/2013 12/2013 10/2014 11/2014 12/2014

This chart shows the overall monthly fluctuation of Bitcoin trade values as reported on the CoinDesk BPI, one of the recognized Bitcoin exchanges. Although trade values vary by exchange, overall trade values are similar across global markets. The life time high of value of $ 1,147.25 reported in December 2013, occurred immediately prior to the Mt. Gox collapse. Notice that values never recovered that high. However, notice also, that Bitcoin values have been trading at a signifficantly more stable trend

transmitter under the regulations implementing the BSA.” Numerous media articles have tied Bitcoin dealing to heinous Furthermore, “the administrator of [a VC] repository will be terror attacks and large scale money laundering operations: a money transmitter to the extent that it allows transfers of value between persons [to] or from one location to another.” • The terror attacks on the French newspaper, Charlie 7 In other words, the individuals who mine, purchase and trade Hebdo , perpetrated on January 7th, 2015 were allegedly Bitcoin will not be considered as money transmitters, but funded in part through finances delivered via Bitcoin any person who performs currency exchanges of Bitcoin transactions. France issued a Declaration focusing for real currency, acts as a middle man or facilitator of specifically on digital currencies. It said that as a result of currency transfers, or administers a Bitcoin repository, will be the terrorist attacks in Paris, decisive action needs to be considered a money transmitter and therefore subject to BSA taken in respect of terrorist financing. Regulators in France regulation. Subject to this FinCEN guidance, administrators have requested that EU regulators adopt resolutions which and Bitcoin exchangers are now required to register as would make Bitcoin and other cryptocurrency transactions 8 Money Service Businesses (MSB) and are held to the same essentially illegal in the Eurozone. monitoring and reporting standards as MSB’s. • A news report dated February 10, 2015, stated that Pascal Reid and Michel Abner Espinoza were arrested on what Institutional Risks Associated with Bitcoin a local prosecutor said may be the first state law charges At present, Bitcoin is an informal value transfer system (IVTS), an over the use of Bitcoin Virtual Currency as part of an inherently high risk form of under-monitored currency transfer alleged money laundering scheme. The men face two forum. Recent opinions issued by the U.S. Department of the counts of money laundering and one count of engaging Treasury and in particular FinCEN indicate that Bitcoin is starting in an unlicensed money servicing business, according to to be recognized as a formal money service business, and laws court filings in Miami state court. “The use of Bitcoin in the are being developed internationally to improve monitoring transactions is a new technological flourish to this very old capabilities. crime,” Miami-Dade State Attorney Katherine Fernandez

3 Assurance | Tax | Advisory | dhgllp.com views

Rundle said in a statement. The “arrests may be the first The same challenges faced by law enforcement when tracking state prosecutions involving the use of Bitcoin in money the source or destination of funds, is also a problem for individual laundering operations.”9 dealers. Bitcoin dealers have been recently identified as Money Service Businesses (MSB) and Money Transmitters. They are • On January 27, 2014, the U.S. Attorney’s Office for the therefore required to monitor their transactions in keeping with Southern District of New York announced that criminal the Bank Secrecy Act (BSA). Even if a Bitcoin trader or exchanger charges had been filed against Robert M. Faiella and follows BSA regulations, gather proper documents in keeping Charlie Shrem, for engaging in a scheme to sell over $1 with a customer identification process (CIP) and files Suspicious million in Bitcoin to users of “Silk Road,” the underground Activity Reports (SAR), they still have only limited information website that reportedly enabled its users to buy and sell available about the transactions they are supporting. The lack illegal drugs anonymously and beyond the reach of law of transparency guaranteed by Bitcoin’s platform makes proper enforcement. Each defendant is charged with conspiring monitoring and reporting virtually challenging and the data to commit money laundering and operating an unlicensed reported by dealers is limited. money transmitting business. Manhattan U.S. Attorney Preet Bharara said: “As alleged, Robert Faiella and How do we Monitor Bitcoin Transactions? Charlie Shrem schemed to sell over $1 million in Bitcoin to criminals bent on trafficking narcotics.10 Since users are not required to provide identifying information (driver’s license, addresses, names, etc.), Bitcoin transactions • According to a July 1, 2015 press release issued by the only retain the approximate geographical location of each U.S. Department of Justice, a former DEA agent on the participant in the transfer history. There are currently no Silk Road Task Force investigation had been convicted regulations which govern monitoring or reporting of the virtual of fraudulently obtaining VC worth over $700,000. Agent transactions involving a Bitcoin transfer. Transactions remain Carl Force, used invented online personas to fraudulently invisible to analysts until someone attempts to convert Bitcoin obtain Bitcoin. Carl M. Force, 46, of Baltimore, Maryland, into legal currency. It is at this point in the transaction cycle, that pleaded guilty before U.S. District Judge Richard Seeborg Bitcoin leave the virtual space, and enter the regulated currency of the Northern District of California to information market. It is at this entry point, that analysts and regulators may charging him with money laundering, obstruction of have a chance to identify suspicious trends. justice and extortion under color of official right. Force’s sentencing hearing is scheduled for October 19, 2015. “Unlike the Bitcoin protocol, these exchanges are ultimately To date, Force is one of two federal agents charged with centralized: backed and run by people against whom laws crimes in connection to their roles in investigating the can be enforced. In most jurisdictions, exchanges are subject Silk Road. Shaun W. Bridges, 32, of Laurel, Maryland, to “anti-money laundering” laws that require certain kinds of a former Special Agent with the U.S. Secret Service, is businesses to “know your customer” (AML/KYC regulations). charged in a two-count indictment with money laundering This involves formally identifying customers through official and obstruction of justice related to his diversion of over documentation—typically passports and utility bills—presenting $800,000 in that he gained control over as yet another place where a Bitcoin wallet address can be related part of the Silk Road investigation.11 to a real world identity.”12 From a law enforcement perspective, monitoring the account activity and Suspicious Activity Reports The promise of anonymity combined with the ease with which filed by exchange dealers will yield the most useful data. international trades can be completed makes Bitcoin attractive to criminal organizations. Once an individual has obtained According to various recent statements and guidelines issued Bitcoin, there is little information gathered to track the source by FinCEN13 and the Financial Action Task Force (FATF)14,15, as or destination of funds. The only data gathered during the well as additions made to the FFIEC Examination Manual16, transaction process is the customer’s individual transaction the risks of Bitcoin transactions apply specifically to the points hash key and the geographical location associated with where VC is converted into Fiat Currency and vice versa, as that transaction. Users can create a new hash key for every these are the points where physical transfers of tangible value transaction they initiate, and hash keys are only stored in the take place. Guidance published in June 201517 by the FATF user’s electronic wallet. Even if the hash key information for a states that Virtual Currencies and their associated products and Bitcoin is obtained, it is difficult, if not impossible to identify any services present real money laundering and terrorist financing of the previous owners of that Bitcoin. Tracking the origin or risk and make way for a number of predicate crimes tied to the destination of funds without knowing the identities of the hash opportunities these transactions provide. The guidance states key owners is therefore all but impossible. specifically that only convertible Virtual Currencies are likely to

4 Assurance | Tax | Advisory | dhgllp.com views

present Money Laundering and Terrorist Finance risks because Assistant Attorney General Leslie R. Caldwell reiterated that they can be used to move value into and out of fiat currencies and “compliance and cooperation from exchanges, companies and regulated financial systems. FATF suggests that the best way other market actors can ensure that emerging technologies are to mitigate the risk associated with these types of transactions not misused to fund and facilitate illicit activities.”18 is to treat the currency converters as MSBs in all jurisdiction. Additionally, the guidance cautions against a blanket prohibition Since the responsibility for monitoring, tracking and reporting of Virtual Currency Transactions as this policy would just drive falls primarily onto the shoulders of financial institutions, it is the transactors further underground, effectively making it even important for these institutions to develop programs and training more difficult to monitor VCs. geared towards a robust understanding of VC transactions. These transfers occur primarily outside of the accessible Conclusion transaction space, and financial institutions can report on Based on recent regulatory trends, it is unlikely that Bitcoin VC transactions only when funds enter or leave their client transactions will be outlawed or eliminated any time soon. accounts. Establishing strong know your customer (KYC) and As you can see in Chart 1, Bitcoin values have increased enhanced due diligence (EDD) processes so that analysts can significantly since their inception. The prospect of tangible recognize transfers that are outside of that customer’s expected profits makes Bitcoin attractive to a number of law abiding transaction pattern is key. VC transactions should be treated as individuals, and it will be difficult to produce legislation that MSB transfers and reports should be filed for suspicious activity denies those individuals the right to speculate in this potentially following the same guidelines as applied to MSB activity. With lucrative, albeit volatile market. Trends in recent international vigilant monitoring of customer account activities and strong regulations indicate that regulators prefer to adopt policies to KYC programs, financial institutions are in a position to better remove these platforms from back rooms and black markets. insulate themselves from the potential reputational damage that Instead of passing laws that prohibit Bitcoin entirely, regulators IVTS transactions of this type present. have aimed to bolster regulations that reinforce self-monitoring and reporting requirements. These guidelines are designed to Olivia Greene give regulators access to the involved transactors rather than Senior Consultant | Risk Management driving such transaction mediums entirely underground. At an 703.970.0425 ABA conference held in Washington DC on June 26, 2015, [email protected]

1. Gilbert, R. N., & Blye, A. D. (2014, March 17). Bitcoin and Internet Payment Systems: Regulatory and Commercial Law Concerns. Retrieved June 24, 2015, from CFJBlaw.com: http://www.cfjblaw.com/bitcoin-internet-payment-systems-regulatory-and-commercial-law-concerns/#_edn4. 2. FinCEN. (2014, January 30). FIN-2014-R002 Application of FinCEN’s Regulations to Virtual Currency Software Development and Certain Investment Activity. Retrieved from FinCEN.gov: http://www.fincen.gov/news_room/rp/rulings/pdf/FIN-2014-R002.pdf 3. Nakamoto, S. (2008, October 31). Bitcoin: A peer-to-Peer Electronic Cash System. Cryptovst.co.uk, 1-9. Retrieved June 24, 2015. Note: The name Satoshi Nakamoto is believed to be a pseudonym, as the individual responsible for the initial paper was never positively identified. However, this paper appears to be the first commonly known hypothesis on the viability of cryptocurrency for financial transactions. 4. Nemirovsky, D. (2013, December 11). Why Financial Services Firms Should Prepare for Bitcoin. Retrieved from Law 360: http://www.law360.com/articles/494842/why- financial-services-firms-should-prepare-for-bitcoin 5. Hobson, D. (2013, Fall). What is Bitcoin? http://internet.jroepeumw.net/wp-content/uploads/2014/01/p40-hobson.pdf. XRDS, 20(1), 40-44. doi:10.1145/2510124 6. FinCEN. (2013, March 18). Application of FinCEN’s Regulations to Persons Administering, Exchanigng, or Using Virtual Currency. Retrieved June 24, 2015, from United States Department of the Treasury: http://fincen.gov/statutes_regs/guidance/html/FIN-2013-G001.html 7. Duhaime, C. (2015, January 29). France Calls for Regulation of Bitcoin to Strengthen Counter-Terrorist Financing. Retrieved June 26, 2015, from Anti-Money Laundering Law in Canada: http://www.antimoneylaunderinglaw.com/2015/01/france-eu-call-for-expedited-regulation-of-bitcoin-to-strengthen-counter-terrorist- financing-efforts-following-charlie-hebdo-incident-and-an-end-to-all-anonymous-financial-transactions-through-repor.html 8. Duhaime, 2015 9. Nesmith, S. (2014, February 10). Miami Bitcoin Arrests may be First State Prosecution. Retrieved June 24, 2015, from Bloomberg Business: http://www.bloomberg. com/news/articles/2014-02-09/miami-bitcoin-arrests-may-be-first-state-prosecution 10. Department of Justice. (2014, January 27). Manhattan U.S. Attorney Announces Charges Against Bitcoin Exchangers, Including CEO of Bitcoin Exchange Company, for Scheme to Sell and Launder Over $1 Million in Related to Silk road Drug Trafficking. Retrieved June 24, 2015, from The United States Attorney’s Office for the Southern District of New York: http://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-charges-against-bitcoin-exchangers-including-ceo 11. Department of Justice. (2015, July 1). Former Silk Road Task Force Agent Pleads Guilty to Extortion, Money Laundering and Obstruction. Retrieved from The United States Department of Justice: http://www.justice.gov/opa/pr/former-silk-road-task-force-agent-pleads-guilty-extortion-money-laundering-and-obstruction 12. Hobson, 2013 13. FinCEN, 2014 14. FATF. (2013, June). Guidance For a Risk-Based Approach: Prepaid Cards, Mobile Payments and Internet-Based Payment Services. Retrieved from FATF-GAFI.org: http://www.fatf-gafi.org/media/fatf/documents/recommendations/guidance-rba-npps.pdf 15. FATF. (2014, June). FATF Report: Virtual Currencies; Ke Definitions and Potential AML/CFT Risks. Retrieved from FATF-GAFI.org: http://www.fatf-gafi.org/media/fatf/ documents/reports/virtual-currency-key-definitions-and-potential-aml-cft-risks.pdf 16. FFIEC. (2014, December 8). Nonbank Financial Institutions - Overview. Retrieved from Federal Financial Instittuions Examination council Bank Secrecy Act / Anti- Money Laundering Infobase: http://www.ffiec.gov/bsa_aml_infobase/pages_manual/olm_091.htm 17. FATF. (2015, June). Guidance for a Risk-Based Approach to Virtual Currencies. Retrieved from FATF-GAFI.org: http://www.fatf-gafi.org/media/fatf/documents/reports/ Guidance-RBA-Virtual-Currencies.pdf 18. Caldwell, L. R. (2015, June 26). Assistant Attorney General Leslie R. Caldwell Delivers Remarks at the ABA’s National Institute on Bitcoin and Other Digital Currencies. Retrieved June 26, 2015, from The United States Department of Justice, Office of Public Affairs: http://www.justice.gov/opa/speech/assistant-attorney-general-leslie-r- caldwell-delivers-remarks-aba-s-national-institute

5 Assurance | Tax | Advisory | dhgllp.com