Any banker who thinks they don’t have clients who are invested in cryptocurrency is likely in for a surprise.
Digital currency has rapidly become mainstream. Visa lets people use bitcoin to make purchases through a debit card. Square allows customers to buy and sell bitcoins via its Cash App. Even Starbucks, along with Microsoft and Bakkt, is working on a way to let customers use digital currency to buy coffee. As of Friday, the total market value of all 2,070 digital currencies was $209 billion.
If a bank were to compare its payment data against the top 50 bitcoin exchanges, it would almost certainly find customers who have crypto wallets and crypto-related businesses, according to experts.
“You're probably going to find that you're knee deep and neck high,” said Sarah Di Stefano, director, head of AML advisory at Barclays Bank.
In 2015, Barclays checked its client database against the top 25 exchanges and found crypto-using clients in every business except for the investment bank.
“There was a big exposure there that we knew nothing about,” Di Stefano said. Barclays created a governance framework for monitoring cryptocurrency exchange-related activity and building cryptocurrency awareness into its due diligence when onboarding new clients.
Before banking a cryptocurrency exchange, for instance, Di Stefano will make an on-site visit and have the company demonstrate its systems, including how it monitors fiat currency transactions for the funding and defunding of wallets and how it monitors transactions in the exchange.
“How sophisticated are the tools they're using, what kind of reports are they producing, what happens when they spot something risky, do they shut it down, do they file a" suspicious activity report, Di Stefano said. “You can start to develop a view of what type of risk appetite they have, what types of controls they have in place."
She insists on meeting with the C-suite as well as compliance leaders.
Creating a window into crypto activity
Monitoring customers’ digital currency activity is easier said than done, however.
Many of the major digital currencies, including bitcoin and Ether, live on public ledgers where all transactions are recorded and can be viewed by anyone. But it can be hard to tell who is doing what. On the bitcoin blockchain, for instance, you can see cryptocurrency wallet addresses (which are strings of numbers) and the amounts, times and dates of the transactions.
“It's hard to tell what's going on; there's no entity mapping on the public blockchain,” says Samantha Stutman, financial institutions lead at Chainalysis, which has software that monitors digital currency transactions on behalf of banks, virtual currency exchanges, cryptocurrency businesses and law enforcement agencies. (Other providers of such software include Elliptic and CipherTrace.) It tracks bitcoin, Ether, Litecoin and Bitcoin Cash. Barclays is a client.
Chainalysis identifies darknet markets where people buy and sell illicit good and services. It also identifies legitimate, regulated exchanges like Coinbase, which has money transmitter licenses in several states and is regulated by the New York State Department of Financial Services.
Chainalysis identifies suspect services like peer-to-peer exchanges that match buyers and sellers and have little to no know-your-customer procedures in place, so people can sign up with fake email addresses. It identifies “mixers” or “tumblers” that obfuscate where funds are coming from. Someone might use a mixer for a legitimate reason, such as not wanting other crypto day traders to see their buying and selling activity, or to hide the fact that they’re laundering money.
“You can see these mixers,” Stutman said. “So if you're an exchange or a bank and you see funds coming from a mixer or going to a mixer, that could be categorized as potentially suspicious.”
Whenever virtual currencies are going to or from a suspect entity, Chainalysis will flag those transactions for enhanced due diligence.
If suspicious activity is reported for a virtual currency exchange client, Barclays will ask about it and want to hear that the exchange filed a suspicious activity report and closed the account. If the suspect site was a mixer, the bank would ask the exchange about the activity and whether it followed proper procedure.
If Barclays saw a regular customer had activity in a darknet, it would drill down to see if there was direct exposure between the client and a nefarious site like a drug marketplace. If there was, it would contact the customer and ask them to explain the transaction.
What if customers don't want to give the bank their crypto wallet address? “That tells me something, doesn't it?” Di Stefano said. The bank would do further due diligence on that customer.
One customer was collecting money from his family, telling them he was going to invest in bitcoin for them. By monitoring his activity in the Chainalysis software, the bank could see that he was gambling with the funds.
“They think you have no idea what they're doing because they think bitcoin is anonymous,” Di Stefano said. “They don't get that it's pseudonymous and at the end of every transaction there’s a wallet address and if you're on an exchange there's going to be a bank account or a credit card or a debit card attached to that account. So there is the ability to identify who's on either end of those transactions.”
Editor at Large Penny Crosman welcomes feedback at
