Anti-money laundering and cryptocurrencies – safe or too risky to touch?

Regulators are still grappling with cryptocurrencies, as Colin Whitmore, senior analyst for Aite Group says. Will the rule makers be able to solve the issues in the near future?

For many in the financial sector, cryptocurrencies have traditionally been viewed with suspicion and scepticism from an anti-money laundering (AML) perspective. Perceptions of substantial dark web use, a flood of unregistered exchanges, and the anonymity of end-users have alarmed many in the financial services industry, including financial institutions (FIs) and regulators alike. Some in the industry have publicly stated that virtual currencies are an ideal mechanism for fraud, money laundering, sanctions evasion, and other illicit activity. Yet, since the introduction of Bitcoin over a decade ago, the use of cryptocurrency is skyrocketing. Approximately 7% of consumers in the US now use or own cryptocurrency. Some countries across Latin America, Asia, and Africa have even higher rates of cryptocurrency ownership and use for a means of exchange, not just investments.

Is the growing use of cryptocurrencies a risk to the financial system? Is the financial sector being exposed to significant new AML risks by cryptocurrencies? Are they safe, or too risky to consider?

Financial institutions can no longer hide, claim ignorance or lack of knowledge, and even if they are not directly involved, for example by banking virtual asset service providers (VASPS) there is a strong chance they will be impacted indirectly through the use of cryptocurrencies by their customers (see Figure 1).

Figure 1 - Impacts of Cryptocurrencies

Evolving regulation for VASP and FIs

Regulators are grappling with cryptocurrencies. In the US, FinCEN has had regulation in place for several years and, in 2019, FinCEN issued amended guidance that bought cryptocurrencies into the remit of the travel rule, a move endorsed globally by the Financial Action Task Force (FATF). In Europe (including the UK), the 5th Anti-Money Laundering Directive brought cryptocurrencies into continent-wide AML requirements, including the registration of VASPs with country regulators. Progressively more regulators are including cryptocurrencies within their AML and financial services regulation and those who provide services, directly and indirectly, are coming into the regulators’ focus. Arguably this will make cryptocurrencies safer as there will be more transparency and an ‘even playing field’ for regulation globally, making it harder for illicit actors to hide their true identities and purpose. 

Tracing cryptocurrency

Unlike fiat currencies, especially cash, every cryptocurrency coin on the blockchain ledger is traceable and accountable, there is no hiding place on the distributed ledger. Specialist software vendors provide tools that provide means of tracing and tracking cryptocurrency coins. If tracing coins is less of an issue, why are there concerns from law enforcement and FIs?

Many regulated exchanges, wallet providers, and other VASPS have comprehensive AML programmes in place that stipulate the gathering of KYC/CDD information for customers and through established procedures can provide information to law enforcement.  However, other VASPs may have limited AML risk-based controls in place and others may have no form of customer identification in place, some by choice as they want to provide services outside of the regulation to illicit actors. 

There is increasing use of software by law enforcement, government agencies, FIs, and VASPS to assess, trace, and monitor cryptocurrencies and the wider eco-structure. This software not only provides the tracing of cryptocurrency but will allow VASPS and FIs the ability to assess their exposure, to understand which other VASPS they are dealing with, and the associated AML risk. Some of these specialist vendors now have partnered with traditional monitoring and screening vendors to provide integration into existing AML systems and processes. 

Conclusion 

In some respects, cryptocurrencies have deserved their reputation, and indeed are the mechanism of choice for many online criminal schemes such as ransomware or buying goods and services from the dark web. However, unlike traditional forms of payment, especially cash, the end-to-end payment chain is traceable and publicly available, arguably making it safer to trace the flows and understand what is happening, even if the end-users are not always not readily identifiable. As more and more VASPS are becoming regulated and putting in AML controls and programmes, the situation is improving and it could be said that the overall ML risk is decreasing, but with VASPS outside of regulation, there is still a gateway for criminals which will take many years to close down. 

Whatever the specific issues and concerns FIs have in respect to cryptocurrencies, their approach should be similar to all other areas of AML: understand the regulation, identify and perform a risk assessment, and ensure there are appropriate and adequate controls in place, including people, data, systems, and governance.

It is about risk assessment and mitigation - FIs need to assess and manage the risk, whether they are directly or indirectly involved; they cannot turn a blind eye to it. 

About Colin Whitmore

Colin Whitmore is a senior analyst in Aite Group’s Fraud & AML practice, specialising in AML and sanctions with over 20 years of experience within the banking and financial services, including Thompson Reuters, Aviva, Barclays, Royal Bank of Scotland, and HSBC.

About Aite Group

Aite Group is a global research and advisory firm delivering comprehensive, actionable advice on business, technology, and regulatory issues and their impact on financial services. With expertise in banking, insurance, wealth management, and capital markets, we partner with our clients, delivering insights to make their businesses smarter and stronger.