DIRECTORATE GENERAL FOR INTERNAL POLICIES POLICY DEPARTMENT FOR CITIZENS' RIGHTS AND CONSTITUTIONAL AFFAIRS COUNTER-TERRORISM Virtual currencies and terrorist financing: assessing the risks and evaluating responses STUDY Abstract This study, commissioned by the European Parliament’s Policy Department for Citizens’ Rights and Constitutional Affairs at the request of the TERR Committee, explores the terrorist financing (TF) risks of virtual currencies (VCs), including cryptocurrencies such as Bitcoin. It describes the features of VCs that present TF risks, and reviews the open source literature on terrorist use of virtual currencies to understand the current state and likely future manifestation of the risk. It then reviews the regulatory and law enforcement response in the EU and beyond, assessing the effectiveness of measures taken to date. Finally, it provides recommendations for EU policymakers and other relevant stakeholders for ensuring the TF risks of VCs are adequately mitigated. PE 604.970 EN ABOUT THE PUBLICATION This research paper was requested by the European Parliament's Special Committee on Terrorism and was commissioned, overseen and published by the Policy Department for Citizens’ Rights and Constitutional Affairs. Policy Departments provide independent expertise, both in-house and externally, to support European Parliament committees and other parliamentary bodies in shaping legislation and exercising democratic scrutiny over EU external and internal policies. To contact the Policy Department for Citizens’ Rights and Constitutional Affairs or to subscribe to its newsletter please write to: [email protected] RESPONSIBLE RESEARCH ADMINISTRATOR Kristiina MILT Policy Department for Citizens' Rights and Constitutional Affairs European Parliament B-1047 Brussels E-mail: [email protected] AUTHORS Tom KEATINGE, Director of the Centre for Financial Crime and Security Studies, Royal United Services Institute (coordinator) David CARLISLE, Centre for Financial Crime and Security Studies, Royal United Services Institute, etc. Florence KEEN, Centre for Financial Crime and Security Studies, Royal United Services Institute, etc. LINGUISTIC VERSION Original: EN Manuscript completed in May 2018 © European Union, 2018 This document is available on the internet at: http://www.europarl.europa.eu/supporting-analyses DISCLAIMER The opinions expressed in this document are the sole responsibility of the author and do not necessarily represent the official position of the European Parliament. Reproduction and translation for non-commercial purposes are authorised, provided the source is acknowledged and the publisher is given prior notice and sent a copy. Virtual currencies and terrorist financing: assessing the risks and evaluating responses ____________________________________________________________________________________________ CONTENTS CONTENTS 3 LIST OF ABBREVIATIONS 5 LIST OF TABLES 7 LIST OF MAPS 7 LIST OF FIGURES 7 EXECUTIVE SUMMARY 9 1. VIRTUAL CURRENCIES: DEFINITIONS, CHARACTERISTICS AND USES 12 1.1. Types of VCs, Their Features and Uses 12 1.1.1. Basic Definitions 12 1.1.2. Decentralised VCs (Cryptocurrencies) 13 1.1.3. Centralised VCs 18 2. BACKGROUND ON AML/CFT EFFORTS AND VIRTUAL CURRENCIES 20 2.1. New Payment Methods, FinTech and CFT Efforts 21 2.1.1. The FATF and New Technologies 21 2.1.2. The FATF and VCs 21 2.1.3. The EU Response 23 3. ASSESSING THE TERRORIST FINANCING RISKS OF VIRTUAL CURRENCIES 27 3.1. TF Risks in Context 27 3.2. TF Risk Features of VCs 30 3.2.1. Anonymity and Pseudonymity 30 3.2.2. P2P Cross-Border Transfer and Portability 38 3.2.3. Decentralisation 39 3.3. Other Potential Risks 42 3.3.1. The Convergence of Cybercrime and Terrorism 42 3.3.2 The Creation of Virtual Currencies and Other Advanced Uses 44 4. LEGAL AND REGULATORY MECHANISMS 46 4.1. The International Response 46 4.1.1. FATF and Virtual Currencies: Guidance for a Risk Based Approach 46 4.1.2. Non-EU Measures on VCs 47 4.2. EU Mechanisms 50 4.2.1. EU Fifth Anti-Money Laundering Directive 50 4.2.2. Innovative Approaches to VC Regulation Across Europe 53 4.3. The Role of Self-Regulation 55 3 Policy Department for Citizens' Rights and Constitutional Affairs ____________________________________________________________________________________________ 5. COOPERATION AND PARTNERSHIP ACROSS THE EU 57 5.1. EU Law Enforcement Responses to VCs 57 5.1.1. Europol’s Role 57 5.1.2. Other EU-Wide Initiatives 59 5.1.3. Member State Responses 59 5.2. The Role of Public-Private Partnership 61 6. POLICY RECOMMENDATIONS 63 6.1. Ensuring Effective, Robust and Comprehensive Regulation 63 6.2. Developing Law Enforcement Knowledge and Capacity 64 6.3. Developing an Enhanced Intelligence Picture 65 6.4. Enabling Public-Private Partnership 66 REFERENCES 67 ANNEX I - RELEVANT LEGAL AND REGULATORY MECHANISMS 80 ANNEX II - VALUES OF MAJOR CRYPTOCURRENCIES 84 ANNEX III - SIGNIFICANT LAW ENFORCEMENT ACTIONS 85 4 Virtual currencies and terrorist financing: assessing the risks and evaluating responses ____________________________________________________________________________________________ LIST OF ABBREVIATIONS AMLD Anti-Money Laundering Directive 5AMLD EU Fifth Anti-Money Laundering Directive AML/CFT Anti-money laundering and countering the financing of terrorism CDD Customer due diligence Dapps Decentralised applications DDoS Distributed denial of service attack DEX Decentralised exchange DLT Distributed ledger technology EBA European Banking Authority FATF Financial Action Task Force FCA UK Financial Conduct Authority FinCEN US Financial Crimes Enforcement Network FINMA Swiss Financial Market Supervisory Authority FIUs Financial intelligence units FSA Financial Services Agency of Japan FSRBs FATF-Style Regional Bodies G7 Group of Seven G20 Group of Twenty GDPR General Data Protection Regulation GFSC Gibraltar Financial Services Commission IOCTA Internet Organised Crime Threat Assessment ISIS Islamic State of Iraq and Syria ITMC Ibn Taymiyya Media Center 5 Policy Department for Citizens' Rights and Constitutional Affairs ____________________________________________________________________________________________ JMLIT Joint Money Laundering Intelligence Task Force KYC Know Your Customer MSB Money service business MSC Mujahideen Shura Council in the Environs of Jerusalem OCGs Organised crime groups LEAs Law enforcement agencies P2P Peer-to-peer PPP Public-private partnership RBA Risk-based approach STR Suspicious Transaction Report SNRA Supra-National Risk Assessment SPLC Southern Poverty Law Center TF Terrorist financing VC Virtual currency 6 Virtual currencies and terrorist financing: assessing the risks and evaluating responses ____________________________________________________________________________________________ LIST OF TABLES TABLE 1 Values of Major Cryptocurrencies................................................................. 83 TABLE 2 Significant Law Enforcement Actions............................................................. 84 LIST OF MAPS MAP 1 Map of Bitcoin ATMs in Austria by Number and Location.................................. 16 MAP 2 LocalBitcoins Map of Locations to Sell Bitcoins in Brussels................................ 41 LIST OF FIGURES FIGURE 1 A Bitcoin Transaction .................................................................................. 31 FIGURE 2 Neonazi Bitcoin Tracker ................................................................................ 31 FIGURE 3 Al-Sadaqah Twitter Account Requesting Donations in Bitcoin and Monero ........... 34 FIGURE 4 Image from Al-Sadaqah Twitter Account Requesting Alt-Coins .......................... 34 FIGURE 5 German Passports for Sale on the Dark Web ................................................... 37 FIGURE 6 Image of the WannaCry Ransomware Message Sent to Victims ......................... 43 FIGURE 7 LocalBitcoins Trading Volumes in India (March 2013 – April 2018) ..................... 52 7 Policy Department for Citizens' Rights and Constitutional Affairs ____________________________________________________________________________________________ FIGURE 8 AlphaBay and Hansa Pages After Seizure by Law Enforcement ......................... 58 8 Virtual currencies and terrorist financing: assessing the risks and evaluating responses ____________________________________________________________________________________________ EXECUTIVE SUMMARY Virtual currencies (VCs) - which include cryptocurrencies such as Bitcoin, as well as a range of other digital value-transfer methods – are innovative new technologies that enable digital transactions and the delivery of financial products and services in new online networks, environments and marketplaces. Consequently, some observers view VCs as important for furthering competition in payments services, expanding financial inclusion and enabling greater efficiency and speed in cross-border value transfer. Like other financial products and services, VCs have features that present risks for facilitating criminality, including money laundering and terrorist financing (TF). The borderless, peer-to- peer (P2P) nature of certain VCs offers the prospect for terrorist actors to transfer funds outside the regulated sector and beyond the purview of anti-money laundering and countering the financing of terrorism (AML/CFT) authorities. VCs also feature varying levels of anonymity and pseudonymity, which can enable the concealment of illicit activity. Instances of VCs’ illicit use in cybercrime and in encrypted