Can You Really 'Know' a Customer Who Uses Bitcoin?

The long-running tension between anti-money-laundering rules and data privacy concerns is especially pronounced in the awkward relationship between regulated financial institutions and digital currency businesses.

A few fintech startups, such as Chainalysis and IdentityMind Global, have cropped up to help banks comply with know-your-customer and AML rules as they consider providing banking services to bitcoin-related businesses. The startups analyze bitcoin transactions for patterns and anomalies that might indicate criminal behavior.

The very existence of these startups raises questions about whether bitcoin users' privacy can be protected as banks try to comply with regulations that require them to understand their customers.

Anonymity, or more precisely pseudonymity, has always been a key feature of bitcoin. People and businesses (not all of them criminals) who don't want banks or the government to see their monetary transactions turn to bitcoin.

But the digital currency is not anonymous by default. Its public ledger, known as the blockchain, provides a trail of transactions that could be analyzed to find bad actors. It's possible to connect a bitcoin address (which is just an alphanumeric string) to a person or entity through network analysis, surveillance, or just Googling the address.

To bitcoin enthusiasts and privacy advocates, preserving the anonymity of bitcoin transactions is essential.

"Freedom of private financial transactions is as important as freedom of speech," said Justus Ranvier, co-founder of the Open Bitcoin Privacy Project, a volunteer organization that rates the most popular bitcoin wallets on protecting users' privacy. "I believe in the long Western tradition of placing a premium on freedom of speech because we know the downsides of restricting it are so severe. I don't believe it's any different with money."

Banks that want to serve companies such as bitcoin exchanges or wallet providers know that to do so they must follow know-your-customer and anti-money-laundering rules. (Silicon Valley Bank and Barclays are among the institutions exploring the field.) The Bank for International Settlements argued in a recent paper that AML compliance for bitcoin will be a key part of keeping criminal behavior such as money laundering at bay:

The relative anonymity of digital currencies may make them especially susceptible to money laundering and other criminal activities. The usefulness of a digital currency for such purposes will depend on how much record-keeping the mechanism maintains about the transactions, how involved third-party service providers are in the transactions, whether such third parties comply with anti-money laundering requirements, and how easy it is to move digital currency across borders and convert that currency into sovereign currency.

To meet AML/KYC requirements, banks serving bitcoin-related businesses need to do certain things, such as look at the source and destination of funds, according to Jonathan Levin, co-founder of Chainalysis. Companies need to know if money is coming from or going to sources they don't want to do business with.

"Oftentimes fraud alerts will be triggered in other parts of the fraud detection process, and they will be linked to some bad activity on the blockchain, and that will serve as a three-point strike — someone flipped their bank account a number of times, then you see a connection to a dark market and you know that something bad is going on," Levin said. "It's not necessarily the only check you're going to be able to do, but there is some expectation that financial intermediaries should be doing source and destination of funds type analysis."

Banks need to be aware of what their customers are doing, though not necessarily what their customers' customers are doing, he said.

"If I onboard someone like Western Union, I might know the volumes they put through, the frequency, the velocity, so when wires come in that don't match that, I need to be talking to my Western Union counterpart and understanding what happened there," he said. "Very similar stuff happens for bitcoin money service businesses. Because you're stepping into potentially a high-risk business, you would want to look at high-level metrics about what that company is doing." This is where services like Chainalysis come in, to conduct that analysis and provide an overall understanding of what the business is up to.

Even this kind of big-picture monitoring of the public ledger unsettles bitcoin's privacy-conscious early adopters.

"The way I see it, if their business is viable, then our work is incomplete," Ranvier said. "As long as Chainalysis has a viable business model, we know we have room for improvement."

Ranvier acknowledged that the bitcoin ledger is a public record. "Even if I were to say they don't have the right to, that doesn't stop anyone from analyzing the blockchain," he said.

But if anyone can compromise bitcoin users' privacy, "we see that as a bug that should be fixed, and we try to brainstorm ways to encourage software developers to close those bugs," Ranvier said.

Shortly after the terrorist attacks in Paris last month, several news outlets reported that the Islamic State was using bitcoin wallets to store and manage millions of dollars' worth of the currency. No proof was provided, however.

@Scott_Dueweke @MarcHochstein @joobid @newsbtc confirmation or not, the issue is this is technically possible. No KYC/AML to prevent it.

— Mariano Belinky (@belimad) November 14, 2015

But even if evidence showed terrorists were using bitcoin, privacy stalwarts see other dangers from government or private-sector snooping.

"Every technique that has a legitimate law enforcement use also has an illegitimate use for organized crime or political repression of dissidents," Ranvier said. "This is very much a two-edged sword. You could always come up with a scenario in which taking away privacy will cause a benefit in a certain situation, but the conversation never seems to talk about all the ways that power can be abused."

To former FDIC chairman William Isaac, the questions around how banks should handle KYC/AML compliance in the bitcoin realm are part of a broader need to review compliance rules that affect access to banking services.

"More and more people, companies, and countries are being denied access to the services of the banking system — particularly those with lower incomes who need it most," said Isaac, who is now senior managing director and global head of financial services at FTI Consulting in Sarasota, Fla. "What is the societal cost of this, what benefits flow from it, and are there less intrusive and more efficient ways to get the information we are seeking? Are we driving the money underground were it can't be tracked? Should we require greater protection by insisting on search warrants?"

No one should hold their breath waiting for bank regulations to change. Banks will have to tread lightly and communicate with their regulators as well as the bitcoin and privacy communities as they take their tentative first steps into bitcoin banking.

Penny Crosman is American Banker's editor at large. She welcomes feedback on her column at penny.crosman@sourcemedia.com.