The virtual currency sector has exploded in the last few years. What began as one cryptocurrency in 2009 – Bitcoin – has ballooned into a market of more than 2200 in circulation as of July 2019. Even FaceBookcurrently has plans to roll out a new cryptocurrency – the Libra. The company has announced its target launch of the coin in the first half of 2020. Yet, financial institutions, regulatory bodies, and governments around the globe remain apprehensive about engaging with this sector due to its inherent risk.
In addition to the coins themselves, an entire industry of different business types, such as exchanges and wallets providers, has created a landscape that is almost as confusing as the terminology used to describe it.
For instance, do you know what the difference between a cryptocurrency, a virtual currency, and a digital currency is, or if they are all interchangeable?
According to a December 2018 Congressional Research Service Report that based their definitions on those provided by the Financial Action Task Force (FATF), a global money laundering watchdog based in Paris, virtual currency is “digital representations of value that be digitally traded and have no status as legal tender.”
Cryptocurrency is a type of virtual currency that can be converted into fiat currency and is “decentralized,” which means it operates on a distributed ledger (blockchain) as opposed to a central payment ledger.
Virtual fiat currency is a digital representation of fiat currency that can be digitally traded and can serve as money by government decree.
Digital currency is an overarching term that refers to both virtual fiat currency and cryptocurrency.
That’s just the tip of the digital iceberg. Depending on the jurisdiction and regulator, even the definitions for these terms are not universal. Also, some organizations like FATF are moving towards the term “asset” as opposed to “currency.” For the purpose of this article, I will use the term cryptocurrency primarily.
Why cryptocurrencies can be useful for sanctions dodgers
The UN Security Council, EU, and several countries including the US have placed broad prohibitions on dealings and transactions with designated persons and companies. These prohibitions are enforced with the help of financial institutions. Banks, credit card companies, and other financial institutions have internal compliance controls and automated systems in place to detect whether any designated persons or sanctioned activities are involved. Not catching a prohibited transaction can be very costly. Fines can run into the billions.
“Financial institutions monitor vigorously for potential sanctions risk, says Saskia Rietbroek, Executive Director of ACSS. “Especially the large financial institutions are risk-averse. They are nervous about processing even legal transactions involving Cuba or Iran due to past penalties for violating sanctions,” she adds.
However, for a bank or credit card company, in some instances, involvement with designated persons and sanctioned activities might be more difficult to detect when cryptocurrencies are involved.
This is why citizens from countries like Cuba or Iran who are prohibited from obtaining credit or debit cards for international use, may switch to cryptocurrencies like to purchase goods or services online, as well as for other business transactions. It is a way to be able to conduct transactions that they otherwise can’t due to controls by their bank.
Delphine Forma, Global Head of Compliance at Lykke, a cryptocurrency exchange based in Switzerland, says that sanctioned individuals first need to get access to cryptocurrencies. “An estimated 99% of crypto transactions take place through centralized exchanges which have controls in place and do sanctions screening, so it is very difficult for those individuals to get access to crypto.”
Instead, she says evaders could potentially get access in other ways, including:
- Peer-to-peer (p2p) trading: most p2p exchanges do not have KYC policies in place, and do not do any sanction screening allowing sanctioned individuals to get access to cryptocurrency. This can also be done on the darknet.
- The darknets: on the darknet you can get everything you want, from posting an ad in which you will advertise that you want to exchange XXXUSD to XXXBTC or XXX privacy coins to getting access to all types of illicit goods
- Cybercrime: For example, through hacking exchanges and ransomware. North Korean state-sponsored groups were recently sanctioned by the US Office of Foreign Assets Control (OFAC). The agency states that the cybergroups were responsible for the WannaCry attack and targeting“virtual Asset Providers and cryptocurrency exchanges to possibly assist in obfuscating revenue streams and cyber-enabled thefts that also potentially fund North Korea’s WMD and ballistic missile programs.”The groups stole more than $500 million in cryptocurrency, from five exchanges in Asia between January 2017 and September 2018.“
- Mining: Through cryptocurrency mining, (creating “virgin coins”). Mining involves using software to solve complicated mathematical equations to earn bitcoin or other cryptocurrency. It was recently reported by The Atlantic Council that Iranian citizens are taking advantage of Iran’s energy subsidies to power large mining operations and avoid sanctions.
- Privacy coins: Some coins such as Monero or ZCash advertise their anonymity and make it more difficult to trace transactions. Monero sets privacy as default, while with Zcashyou can choose to remain anonymous or not.
- “Crypto ATMs”: These enable the exchange of cash for crypto and vice versa in some instances. Currently, there are more than 5500 “crypto ATMs” worldwide with an estimated eight new installations a day. In the US, “crypto ATMs” are regulated and need to comply with AML and sanctions regulations. In the EU, they will be with the implementation of the 5th AML Directive. As of today, in the UK, the cash machines allow anyone to deposit sterling in exchange for bitcoin and other cryptocurrencies. It is possible to deposit up to 1500 pounds per day.
“There is also the possibility of using permissioned blockchain for sanctioned states to transact between each other,” Ms. Forma adds. For instance, in March, the Russian State Duma approved the international use of SPFS (System for the Transfer of Financial Messages), a system similar to SWIFT. “The Chairman of the State Duma Committee on Financial Market has confirmed that Russia is in talks with Iran, Turkey, and India about joint use of SPFS,” according to the Cypher Trace, a 2019 Cryptocurrency anti-money laundering report.
Last year, the Venezuelan government launched a cryptocurrency called the “Petro.”President Maduro has made no secret of his intention to use the Petro explicitly to circumvent US sanctions against his country. The US government responded with Executive Order 13803. This prohibits any US person from dealing with certain debt or extensions of credit issues by Venezuela. The EO clarifies that US persons dealing with the Petro, which “appears to be an extension of credit” may be exposed to US sanctions risk.
More recently, according to PYMNTS.com, an online magazine, the Ministry of Economy and Planning of Cuba, another sanctioned country, is planning to explore the potential application of cryptocurrency in national and international commercial relations. Iran is also reportedly launching its own crypto called PayMon (“PMN”).
Risky or not risky
“The risk is not that different from other currency,” says Debra Geister, CEO of Section2 Financial Intelligence Solutions, LLC. The fact that cryptocurrency transcends borders, can be anonymous and is internet-based makes mitigating that risk more challenging. “The primary coins are pretty traceable. That is the benefit to them. When they move into secondary or alt coins, these currencies are harder to track. Some of them are anonymous, and so we lose the trail. It is similar to fiat currency; we cannot trace that well either,” she says.
Still, despite its vulnerabilities, Ms. says that the risk associated with cryptocurrency is “real but not as widely spread as the one associated with fiat currencies.”
This doesn’t mean it won’t catch on, however, particularly as it becomes more mainstream. AnotherCRS In Focus report says that “the risks could increase if virtual currencies were more widely adopted, such that daily financial life could be conducted for the most part in an entirely virtual currency universe.”
Companies like Lykke, are already prepared. They have robust know your customer (KYC) measures in place, including screening of all their customers, according to Ms. Forma. “We perform full KYC on all our customers applying a risk-based approach with different levels of checks depending on the risk” she says. “For instance, a customer located in a high-risk country, on top of our regular KYC checks, will also have to provide a duly completed full due diligence questionnaire and proof of funds before we open an account. Depending on the results of the due diligence checks we will or not open the account.”
It is where fiat currency and cryptocurrency intersect that carries the most risk for potential sanctions evasion activity, says Geister. This includes cryptocurrency exchanges and crypto ATM operators. In the US, these companies must register as money services businesses with the Financial Action Enforcement Network (FinCEN) and must comply with office of Foreign Assets Control (OFAC) regulations.
In Switzerland, cryptocurrency exchanges must comply with the country’s anti-money laundering laws, which includes customer due diligence. Ms. Forma explains that Swiss virtual asset service providers (VASPs) also must comply with a stricter approach than the US Travel Rule. According to the Swiss regulator FINMA: “Institutions supervised by FINMA are only permitted to send cryptocurrencies or other tokens to external wallets belonging to their own customers whose identity has already been verified and are only allowed to receive cryptocurrencies or tokens from such customers. FINMA-supervised institutions are thus not permitted to receive tokens from customers of other institutions or to send tokens to such customers. This practice applies as long as information about the sender and recipient cannot be transmitted reliably in the respective payment system. Unlike the FATF standard, this established practice applies in Switzerland without the exception of unregulated wallets and is, therefore, one of the most stringent in the world.”
Recent FATF guidance on the risk-based approach to cryptocurrency recommends that countries register cryptocurrency service providers and require that they have strong KYC procedures, including screening against designated entities. “This guidance subjects virtual asset service providers to the same compliance standards as financial institutions,” explains Ms. Forma.
FATF, in its guidance document, cautioned that financial institutions should not broadly exclude cryptocurrencies from their services and instead apply a risk-based approach. To do that, the first step is to have a compliance professional that understands the complexities of the industry. In addition, these are questions that you should include when onboarding one of these businesses:
- What is their business model?
- Are they registered?
- What cryptocurrencies do they work with?
- Do they have a robust compliance and risk management program in place?
- How do they monitor cryptocurrency transactions? And do they use any software to trace their origin, such as Chainalysis?
- What are their KYC practices, for example, how do they identify their customers?
- What is their screening process, and how do they handle any “hits”?
- What processes do they have for sanctions screening and anti-money laundering (AML) transaction monitoring and reporting?
- If they find any suspicious activity, what is their escalation process?
- What is their record-keeping policy?
- Do they have a training program in place?
- Do they have internal controls in place to establish effective OFAC/sanctions and AML/CFT policies, which include governance and compliance officer appointed at a management level?
- Do they regularly audit their compliance policies?
Despite their inherent risk, cryptocurrencies have the potential to allow for greater participation in the financial system by providing fast and low-cost transactions. This sector will continue to grow and require services from traditional financial institutions.
Rebecca Nelson, a specialist in international trade and finance with the CRS, stated in her testimony before Congress in July of this year that “the proliferation of cryptocurrencies has generated interest among some governments and large multinational corporations” and that if this happens “the usage of digital currencies could dramatically increase.”
By having policies in place now that considers the risk of cryptocurrencies and the businesses that service them, you better position your institution to take advantage of this growth and the increased revenue potential it has.