WASHINGTON — For decades, the government has leaned on banks to help crack down on illicit finance, requiring them to comply with a bevy of anti-money-laundering rules. But as cryptocurrencies enter the mainstream, policymakers are increasingly looking at how to expand the federal AML regime to include digital assets.
The Financial Crimes Enforcement Network has been building up its resources to address cryptocurrency risks, such as hiring Michele Korver, a former Department of Justice official, as the agency's first-ever chief digital currency advisor. Congress also
But that is just a drop in the bucket compared to what observers say is needed to track suspicious activities among the more than 1 million cryptocurrency transactions completed every day. Some suggest lawmakers could mull broader reforms to apply Bank Secrecy Act requirements to cryptocurrency exchanges and other digital-asset firms.
"Congress has viewed cryptocurrency as a gap in the protection of the U.S. financial system from illicit funds,” said Ben Hutten, an attorney at Buckley. “The nature of illicit finance is that when one area becomes more heavily regulated, illicit financiers will look to the next. It's always going to be a little bit of a game of cat and mouse.”
Potential reforms include extending customer identification program requirements — now imposed on banks — to crypto firms, scrutinizing the activities of cryptocurrency companies more closely and conducting routine examinations. Policymakers can also ensure that Fincen has the technology to track illicit blockchain activities.
To some extent, the ambition of certain nonbanks to gain full-fledged bank powers will automatically subject them to AML requirements. Just Monday, Circle
Some cryptocurrency companies have been designated as money-services businesses, which are required by Fincen to have anti-money-laundering programs as part of their regulatory compliance.
But experts say they are still gaps between MSBs' requirements and those that banks must face.
“Fincen made certain crypto businesses subject to the [Bank Secrecy Act] by including them in the definition of a money services business,” said Dan Stipano, a partner at Davis Polk & Wardwell. “But unlike banks and broker- dealers, for example, they are not subject to the full universe of regulations.”
Hutten agreed that Fincen's AML enforcement for banks is inconsistent compared to the agency's regulation of MSBs.
“Essentially, you could have two crypto firms doing the same type of business and one could be regulated by Fincen as a money-service business and the other could be regulated as a bank, with different schemes of AML regulation, simply by virtue of where and how they chose to form and how they chose to be regulated,” Hutten said. “I think Fincen has some work to do to cohesively regulate the crypto business instead of shoehorning them into regulations designed for either money transmitters or banks.”
Thomas Vartanian, an industry attorney and former regulator, added that the decline in use of traditional banks means that the information that regulators currently gather when it comes to money laundering is inadequate.
“As we get more and more challenged by the bad guys’ use of sophisticated technological means of doing money laundering, we are more and more challenged by the ability to produce the kinds of information that the regulators actually need … to prevent money laundering, because they're only getting information that's quite limited in most cases,” said Vartanian. “If you're just getting information from banks or money transmitters, you're not getting the full financial picture.”
Securities and Exchange Commission Chairman Gary Gensler said last week that stablecoins, which are digital currencies pegged to normal currencies such as the U.S. dollar, and other cryptocurrencies are often used to avoid compliance with money laundering regulations.
“The use of stablecoins … may facilitate those seeking to sidestep a host of public policy goals connected to our traditional banking and financial system: anti-money laundering, tax compliance, sanctions, and the like,” said Gensler, a member of President Biden's working group on financial markets, which is preparing recommendations on how to regulate stablecoins.
Treasury Secretary Janet Yellen has numerous times raised concerns about the money laundering risks from cryptocurrencies.
“I see the promise of these new technologies, but I also see the reality: Cryptocurrencies have been used to launder the profits of online drug traffickers, they’ve been a tool to finance terrorism,” Yellen said earlier this year.
Lawmakers have already tried to crack down on tax evasion by crypto investors, adding a provision to the $1 trillion infrastructure package moving through Congress that would improve tax reporting in order to raise more revenue from digital asset positions.
Last year, Fincen also issued a proposal to require banks and money-services businesses to keep detailed records of transactions related to certain digital currencies held in unhosted wallets, or wallets controlled by individuals and not financial institutions.
Some recent concerns about cryptocurrencies enabling bad actors, while keeping their identities hidden, have centered on high-profile ransomware attacks in which criminals demand payment in bitcoin or another digital currency so the transactions cannot be tracked.
“We've got bad actors out there that are utilizing this technology that nobody ever thought [they] would,” said Sen. Jon Tester, D-Mont., who cited the more than $2 billion in bitcoin paid to those involved in the Colonial Pipeline hacking.
Ed Mills, a policy analyst with Raymond James, said the recent
“The emergence of the ransomware attacks, and the professionalization of the use of cryptocurrencies to transact in large numbers and have real potential impact on national security and on the economy, has changed the game for regulators, which makes them feel they have to act,” he said.
Unlike transactions through traditional financial institutions, which can be traced back to individuals, cryptocurrency transactions are not attached to the names of individuals or a company. However, they are recorded on a public ledger.
Stipano said the apparent anonymity of cryptocurrency transactions makes them appealing for criminals.
“The perpetrators of ransomware schemes almost always demand payment in bitcoin, because they believe that affords them greater anonymity,” said Stipano. “It's not complete anonymity, since the payments are tracked on a public ledger, but it's certainly greater anonymity than, for example, a wire transfer would provide. It is this perception of anonymity that makes cryptocurrency attractive to criminals.”
But Ross Delston, an independent attorney specializing in anti-money-laundering compliance, stressed that transactions in cryptocurrencies are not entirely anonymous.
“The names of the buyers and sellers are not revealed on the blockchain, but an awful lot of other information is embedded,” Delston said. “For example, there are vendors that can trace the IP addresses of computers used in these transactions, so that allows for geolocation. Also, vendors can track cryptocurrency movement into and out of dark web markets.”
Banks are currently required to have a Customer Identification Program, in which they collect identifying information about their account holders when accounts are opened, while money-services businesses are not subject to the same regulation.
“If you're a bank, or a depository institution, you’re subject to regular on-site examinations by your regulatory agencies, mainly driven by the fact that you're holding the public's insured deposit,” said Jo Ann Barefoot, CEO of the Alliance for Innovative Regulation. “And so companies that are not holding insured deposits have a much more remote, light-touch regulatory system around them.”
Despite growing concerns about regulators’ ability to crack down on illicit finance, some say that the fact that all cryptocurrency transactions are recorded on a blockchain should enable regulators to identify suspicious activities more easily.
Software companies like Chainalysis have helped regulators track down potential criminals.
“The tracing process takes seconds,” said Delston. “That does not get you to a name of a person, but it might get you to the location of a computer via the IP address. Not always, because those can be spoofed or hidden or put in far-flung countries. But law enforcement, I've heard representatives of the IRS say this publicly, they love it. They love the blockchain.”
Vartanian said that some of the vulnerabilities inherent in cryptocurrencies and other nonbanks with respect to money laundering could be addressed if regulators focus on activities rather than institutions.
“If you're creating money, you're involved in a financial activity, you ought to be regulated to the same extent that a bank is regulated, in terms of how it creates money by making loans or circulating checks,” Vartanian said. “We have to change the system to regulate financial activities, because if we don't, we allow all of the risks to reside in the nonregulated portion of the economy.”
