I. Crypto 2.0’s Move Towards the Mainstream
Eighteen months after the watershed collapse of cryptocurrency exchange FTX, and buoyed by a 300% increase in the price of Bitcoin in the intervening period, the cryptocurrency sector is experiencing a resurgence and there is a renewed push to bring blockchain assets to mainstream financial markets. The Securities and Exchange Commission (SEC)’s January 2024 approval of Bitcoin-tracking Exchange Traded Funds (ETF) represented an inflection point in crypto’s attempted maturation from a fringe asset to broader consumer accessibility, and the mass market is responding. Since the SEC approval, for example, Blackrock’s Bitcoin ETF has reportedly become the fastest-growing ETF in history.
Despite crypto’s resilient appeal and seemingly inexorable push towards mainstream adoption, it remains a focus of intense regulatory scrutiny, evidenced by major cross-agency US law enforcement and regulatory actions against major first-wave players FTX, Binance and Terraform Labs, and their erstwhile leadership. The global crypto ecosystem continues to be a source of a broad range of critical international law enforcement concerns. Various crypto entities sanctioned by the US Office of Foreign Assets Control (OFAC) in 2023 have been accused of helping to fund a diverse array of illicit activities, such as state-sponsored cyber espionage, terrorism financing, romance (so-called “pig butchering”) scams, Russia and Iran sanctions evasion, Fentanyl production and arms dealing. The blockchain also continues to be the payment processing method of choice for the next generation of darknet markets as well as for emerging Chinese money laundering networks active in Europe and the US.
Many industry and government leaders are signaling a desire to confront this challenge, believing that the large regulatory settlements by Binance, Kraken and Coinbase represent a pivot towards transparency and compliance. If successfully implemented, the Binance consent order, in particular, has the potential to be a blueprint for a crypto exchange that can credibly address Anti-Money Laundering (AML) compliance risk in a mature regulatory environment. The order calls for remediating well-known industrywide governance weaknesses such as: a high-level commitment to compliance; employee guidance and training; internal risk assessment; and independent testing.
Notably, it calls for the establishment of policies, procedures and internal controls in key functions such as: Know Your Customer (KYC) protocols; sanctions monitoring; Suspicious Activity Report (SAR) management; customer offboarding; management override of controls; and law enforcement response. The cost of deploying the personnel and monitoring systems needed to meet these objectives has already required investments of hundreds of millions of dollars.
At the same time, markets around the world are making concerted efforts to provide a stable and transparent regulatory framework for good actors to thrive. For example, Hong Kong has proposed a licensing framework for virtual asset service providers and is moving towards legalising stablecoins, part of a broader “Fintech 2025” strategy that aims to position the former colony as a leader the fintech sector. Other markets in Southeast Asia, as well as in the Gulf and Europe are similarly attempting to strike the tricky regulatory balance between attracting crypto
investment and protecting consumers.
However, as we outline below, the sector remains a rapidly moving target for AML risk management professionals. The pace of crypto innovation continues to accelerate, particularly in technology focused on realising cryptocurrency’s earliest goal – becoming a medium for the completely private and borderless peer-to-peer transfer of value. The ongoing tension between the technology’s appeal to both licit and illicit clients will be a defining characteristic of the market for the foreseeable future.
II. The Challenges
As major crypto exchanges establish stronger oversight procedures and offer greater transparency within the confines of their own operations, alternative products and platforms have emerged to remove intermediaries from crypto transaction altogether. The interplay between the decentralised finance (DeFi) ecosystem and the new class of regulated crypto exchanges has already generated significant in-house compliance and law enforcement attention.
a. The DeFi Zone
What to do when there is no exchange at all? With enforcement attention to date largely targeting traditional crypto exchanges and crypto mixers, financial criminals are looking for ways to avoid third parties entirely in digital currency transactions. Enter DeFi, which uses decentralised exchanges and liquidity pools powered by automated smart contracts to eliminate transactional intermediaries, creating a potential haven from international law enforcement scrutiny. At the same time, DeFi platforms have been a major target for governance attacks and exploits, as hackers have taken advantage of flaws in the rules and security of liquidity pools to extract funds.
Additionally, financial criminals, most notably state actors such as the Lazarus Group, are increasingly turning to cross-chain bridges such as Renbridge to facilitate the movement of assets between blockchains, and, in so doing, obfuscate the origin of funds. This rush towards cross-chain bridges is largely a reaction to enforcement actions against crypto mixers, which were widely used as a laundering channel. Blockchain analysts report that since the August 2022 crackdown on mixers – including the US sanction of Tornado Cash – illicit funds traffic has shifted to cross-chain bridges. The widespread utilisation of these bridges – which, like other enabling crypto technologies, are also used for legitimate purposes such as removing technical barriers to cross-chain transactions – is significant because it allows much for greater mobility between wallets on less regulated exchanges and DeFi platforms and the centralised exchanges. Other incipient alternatives to mixers include privacy coins – such as Monero, Dash and Zcash – and privacy wallets – such as Wasabi – which borrow some of the privacy concepts of ephemeral messaging – such as single use “stealth” addresses – to further anonymise the flow of Bitcoin. These privacy products have been banned outright in a number of markets.
DeFi’s rise has not escaped regulatory attention. The US Commodity and Futures Trading Commission (CFTC), for example, is focusing on the organisers of decentralised finance operations, which, for all of their disintermediation, still need people, physical assets and funding to keep the lights on. Per a commissioned CFTC study issued earlier this year: “The architecture of DeFi involves key components across mutually supporting layers of technology and functionality critical to the delivery of financial products and services, specifically the physical/hardware, protocol, network, data, application, user, asset and market, and governance layers; all working to support operations and communications across networks with varying degrees of core characteristics of programmability and composability, automation, transparency, openness, and immutability and censorship resistance.”
While the restricted lists of OFAC and other global regulators have long targeted a broad range of individual crypto addresses, the DeFi/cross-chain bridge dynamic has highlighted a limitation of legacy blockchain monitoring tools, which, to this point, have allowed analysts mostly to screen against restricted wallet lists on a single-asset basis. As we discuss in section III, a more expansive screening methodology will be needed to track the inflow of potentially illicit funds in real time.
b. Virtual Operations, Mobile Identities
Even among the so-called “centralised exchanges”, the crypto industry is notable for distributed operations. Key business functions such as executive management, legal and compliance, data infrastructure and sales often have a global footprint. The question of jurisdiction for crypto entities, a fundamental point of contention since the birth of the industry, has been further complicated by the post-COVID trend towards virtual enterprises. Establishing the geography, the true physical location, of wallet and account holders is similarly difficult, with the ubiquitous use of geo-masking through virtual private network, or VPN, services.
The difficulty in pinpointing the location and identity of an account holder, exchange or other service provider impacts compliance monitoring risk in a number of ways. Most significantly, sanctioned entities often turn to intermediary markets to transfer assets and escape detection. Iranian, North Korean and Russian entities have reportedly turned to third-party nations – like Turkey, Lebanon and the UAE – to facilitate transactions in circumvention of US and global sanctions. Compliance professionals must be mindful not only of transactions originating from principal sanctioned jurisdictions, but also from transactions involving countries at elevated risk for aiding in sanctions avoidance.
Borderless virtual accounts also make identity verification and document validation a much more complex exercise, exposing potential critical skills gaps in the customer onboarding process. For example, it is inherently more difficult for a Singapore-based KYC reviewer to validate an Italian identity card than it is for, say, an analyst in the EU. Despite industry efforts to develop reliable international digital identity verification protocols, crypto operations must rely on 20th century sovereign documentation for the foreseeable future.
Meanwhile, other illicit actors, such as organised crime syndicates targeted in the last wave of enforcement activity, are attempting to relocate to friendlier jurisdictions in order to continue their exploits. This “great reshuffling” of host countries and market players in response to intense law enforcement attention requires a nimble approach to monitoring and reporting suspicious activity, as geographic centers of AML and crypto fraud risk move to new havens.
III. Using the Entire Toolbox
The emergent challenges outlined in the previous section share a common denominator: the conversion of crime proceeds into a thing of tangible value requires transactional “on-ramps” and “off-ramps”, places where criminal proceeds – often in the form of more volatile tokens – can be converted into Bitcoin, stablecoin or fiat currencies. This means the next generation of crypto compliance systems needs to focus on adjusting risk identification models to raise alerts when such attempts are made at various stages of the customer lifecycle – onboarding, account monitoring, transaction monitoring, suspicious activity reporting and, if required, account closing and engagement with law enforcement. The process must keep pace with the shifting environment and employ a multifaceted approach that uses a variety of strategies and tools.
a. Enhanced KYC
Strong crypto KYC should follow the same general risk-rated processes employed by traditional financial institutions: 1) Client Acceptance Policy, which defines the customer types and supporting information required for account opening; 2) Customer Identification Program, where customer information is collected, validated and risk rated; and 3) Customer Due Diligence/Enhanced Due Diligence, where customer risk factors such as account purpose, source of funds, ultimate beneficial ownership and political exposure are considered.
As discussed, certain aspects of the traditional KYC process present heightened risk in crypto organisations. For example, account applicants commonly evade Customer Identification/Due Diligence/Enhanced Due Diligence control by falsifying or reusing identity documents or using identity information stolen during hacks and cyber exploits. This practice frequently goes undetected due, in part, to the aforementioned knowledge gaps regarding identification standards in relevant markets, a problem exacerbated by KYC staff resource constraints. At a minimum, identifying details on accounts, such as addresses, contact telephone numbers, photographs and national ID numbers should be digitised and cross-referenceable so that duplicate information can be detected and investigated. Software-as-a-service tools being introduced will help automate the global document collection and validation process, but will not replace improved staff training and awareness.
Critical assessment of the source of customer funds has also been a prevalent weakness in crypto Due Diligence/Enhanced Due Diligence programs. Large scale financial frauds – particularly multi-billion-dollar romance or “pig butchering” scams – have relied heavily on extensive coordinated networks of innocuous-appearing “front” account holders; people who could never come close to justifying the volume of transactional activity in which they engage. Similarly, international money laundering syndicates that support narco-trafficking use accounts opened by overseas students and small shop owners; accounts with highly disproportional trading volumes. Enhanced scrutiny and documentary requirements, as well as greater professional skepticism among analysts regarding sources of customer wealth, will be required to interrupt these networks at both the account onboarding and monitoring stages.
b. Enhanced Account Risk Monitoring
It is crucial to monitor account activity to see if is in line with that expected of the holder who completed the KYC process and ensure that seemingly unrelated accounts are not, in fact, being coordinated by undisclosed third parties. This type of account monitoring, which occurs in addition to the real-time transaction monitoring process performed by blockchain analytics tools, should be included in the scope of independent testing programs. Given the prevalence of VPN geo-blocking services, data analytical review of internet protocol (IP) address patterns related to account activity can be a powerful risk detector. For example, multiple account logins to a single account from IP addresses in an array of jurisdictions can indicate a deliberate masking of user location. Similar tests can be performed on other account data points. Account login times can be analysed to detect likely user time zones. Customer device IDs can be tracked to detect devices that access multiple accounts. Cross-referencing such data can identify potential signs of laundering activity. Further, as they become more embedded in data analytics and AML monitoring platforms, AI and machine learning applications can recognise account behaviour anomalies and patterns and refer such transactions for further investigation.
c. Next-generation Blockchain Analysis
To this point, blockchain analytics have served as a crucial point of vigilance for conducting pre-transaction wallet screening, as well as supporting customer diligence and suspicious activity investigations. However, as noted, in light of greatly increased cross-chain mobility, it is no longer sufficient to perform single-wallet screening exclusively. As the crypto tracing picture has become substantially more complex, blockchain analytics models are being expanded to detect links to high-risk decentralised exchanges and cross-chain bridges, as well as to “grey” exchanges – meaning those with weaker AML governance. So-called “clustering analytics” looks upstream and downstream to identify connections to bundles of addresses that may be under the control of known or suspected bad actors. The presence of such linkages can, in itself, be a sufficient basis for reporting suspicious activity.
d. Applying OSINT and HUMINT
Finally, there will be points during the KYC or monitoring process where the information available in account documentation, account activity or blockchain analytics is insufficient to fully gauge the potential AML risk of a customer relationship or transaction. This is particularly true where potential risk factors have been identified and the organisation must decide whether to onboard a customer or report potential suspicious activity. In these cases, decisions may hinge on verifying beneficial ownership, location and undisclosed connections to illicit parties. Further investigation may also be necessary to respond to the substantial volume of international law enforcement inquiries that crypto organisations receive on a continual basis.
In these cases, there is often a wealth of public domain information that can add context to information gathered during the KYC process. Open source intelligence (OSINT) can provide detail on corporate ownership and control, political exposure, criminal and civil litigation, and client reputation. Despite the pseudonymous nature of the technology, crypto figures are notoriously active social media users, and social media can often provide clues for those interested in connecting digital identities to actual ones. Where OSINT falls short, human source intelligence (HUMINT) – i.e., discreet inquiries with knowledgeable individuals – can often provide leads or useful context.
IV. Conclusion
This chapter has outlined, at a high level, the risk landscape currently faced by cryptocurrency organisations looking to establish viable and sustainable AML compliance programs. It highlights the need for a multidisciplinary set of strategies and tools that can provide both data-intensive screening and deep-dive investigative capabilities as required in a risk-based compliance function. In reckoning with the stunning pace of technological change in the crypto industry, the conclusion to be drawn is that the compliance response demands continuous improvement and creativity to strike the delicate balance between innovation and financial crime risk.
John Auerbach is a Managing Director based in the New York office. John has 25 years of experience managing complex domestic and international corporate investigations, litigation, compliance assessments and M&A advisory projects. He specialises in corporate integrity issues related to anti-bribery and corruption, AML & sanctions compliance, third-party risk management and financial fraud. John is also an experienced Third Party Risk Management specialist, having designed and implemented global screening and transaction monitoring programs related to KYC/Vendor, international sanctions and export control compliance. As a forensic investigation, business intelligence, and compliance specialist, he has led numerous high-profile investigations and compliance reviews around the world in response to US and overseas regulatory enforcement, including Foreign Corrupt Practices Act (FCPA), money laundering, antitrust, anti-dumping and sanctions violations, as well as securities fraud and accounting restatement matters. He has particular experience conducting these matters within the financial services and cryptocurrency sectors.
Howard Master is based in Nardello & Co.’s New York office, and is a Partner and Counsel to the CEO of Nardello & Co. Howard supports the firm’s global practices, including: white-collar criminal defence; anti-corruption and fraud investigations; civil litigation and arbitration support; and monitorship and compliance efforts. Howard also advises the firm on major strategic initiatives. He has led investigations for major cryptocurrency exchanges, as well as other significant matters for corporate and individual clients in criminal, litigation and bankruptcy proceedings. Howard joined Nardello & Co. after an acclaimed career as a leader, investigator and trial lawyer in federal, state and local prosecutors’ offices. At the US Attorney’s Office for the Southern District of New York, where he served as a white-collar crime prosecutor and later as Deputy Chief of the Criminal Division and Criminal Health Care Fraud Coordinator, Howard investigated and prosecuted individual and corporate wrongdoers responsible for major corruption scandals and financial crimes, including: those involved in the largest fraud, kickback and money laundering scheme ever perpetrated against New York City; Sheldon Silver, the longtime leader of the New York State Legislature, who received millions of dollars in bribes; and corporate executives at a major pharmaceutical company who carried out a $10 million kickback and money laundering scheme.
Christopher Urben is a Managing Director based in Nardello & Co.’s Washington, D.C. office. With 25 years of global investigative experience with the US Drug Enforcement Administration (DEA), Chris has an incredible track record of leading sophisticated international money laundering and threat finance investigations. Prior to joining the firm, Chris was responsible for developing and leading sensitive global undercover DEA operations that dismantled several of the most significant transnational criminal organisations. Having extensive working relationships with the Southern and Eastern Districts of New York, he is proficient in building successful cases resulting in either plea deals or convictions. Chris worked for more than 12 years in the New York and New Jersey Divisions of the DEA. He was also assigned two DEA overseas tours in Europe totaling 10 years’ experience collaborating with international law enforcement agencies. From 2004–2008, Chris did a tour in Brussels and Luxembourg with the Brussels Tri-Mission (US Embassy Brussels, US Mission to the European Union, and USNATO). From 2012–2018, Chris was Country Attaché in charge of US interests for the DEA in Northern Europe (Denmark, Sweden, Norway, Finland and Iceland) and also the Baltic countries (Estonia, Lithuania and Latvia). In these roles, Chris developed an extensive global network in various fields of law, finance and international investigations.
*Originally published in Global Legal Group’s ‘International Comparative Legal Guide – Anti Money Laundering 2024′
