The adoption of cryptocurrency and blockchain technology has rapidly expanded, and financial institutions are finding that it may no longer be an option to opt out of crypto-related transactions because of associated risk. As a result, many financial institutions face challenges related to banking cryptocurrency service providers, the movement of proceeds from cryptocurrency transactions within existing accounts, and the use of blockchain records to help satisfy their compliance requirements. Cryptocurrency usage can pose a variety of risks, including fraud, economic sanctions, and anti-money laundering. This article focuses on AML risks that can be potentially mitigated.
Typical Transactions
In order to identify potential risks to financial institutions, it is important to understand how “paper,” or fiat, currencies (government-backed currencies such as the U.S. dollar and the euro) are exchanged for cryptocurrencies and vice versa. For individuals or entities to transact in cryptocurrency, typically they must open an account through a cryptocurrency service provider (such as an exchange or a digital asset storage company, commonly referred to as a “wallet”). Information about the customer opening the account—“know your customer” or KYC data—is gathered by the cryptocurrency service provider, and in return, the customer opens a digital wallet with that provider. Wallets serve like bank accounts, so the customer may open more than one and may have different wallets for different currencies (e.g., a fiat wallet denominated in U.S. dollars separate from a crypto wallet for bitcoin). Some cryptocurrency service providers, such as cryptocurrency wallets, provide access to a specific cryptocurrency, while others, such as cryptocurrency exchanges, facilitate conversions between fiat and cryptocurrencies.
The alternative to utilizing an exchange is a direct peer-to-peer transaction in which cryptocurrencies and fiat currencies are exchanged by two parties across different platforms (e.g., directly from one wallet to another and a simultaneous direct wire transfer between accounts at financial institutions).
Common Risks
Some of the top areas of AML risk for financial institutions when dealing with cryptocurrency are conversion risk, KYC risk, and transaction-monitoring risks.
Conversion Risk
For financial institutions, the point of conversion from a crypto to a fiat currency presents an opportunity for introduction of potentially suspicious funds into the banking system. Whether it involves a fiat exchange or a direct peer-to-peer transaction, the financial institution is the gateway for the newly converted cryptocurrency into the banking sector and fiat currency movement. As the conversion itself happens outside the financial institution, the transfer of these funds may not be flagged as cryptocurrency in origin.
If the conversion occurs at a cryptocurrency exchange, the funds transfer is typically initiated by the service provider, meaning funds (as fiat currency) may be transferred directly from the exchange's account at one financial institution to the recipient's account at another institution. The benefit of the type of transfer is that the cryptocurrency exchange is the originator and can be identified. Exchanges providing services involving the U.S. dollar are required to register as a money services business with the Financial Crimes Enforcement Network, or FinCEN. FinCEN requires cryptocurrency service providers to have their own AML compliance programs. Similar requirements exist in other countries, such as the U.K., Switzerland, and Japan. Since cryptocurrency service providers are required to register with FinCEN, financial institutions can identify if any of the transacting parties are not. For unregistered exchanges, the financial institution should proceed with heightened caution because the exchange's AML program may not meet the FinCEN standards, the exchange may not be gathering required information on its customers, and it may not be responsive to inquiry.
With peer-to-peer transactions, the conversion from crypto to fiat currency differs from conversions facilitated by cryptocurrency service providers. In peer-to-peer transactions, individuals or entities directly swap cryptocurrency for fiat currency. Cryptocurrencies are exchanged directly by sharing wallet information and the corresponding fiat currencies are exchanged via traditional bank transfer (e.g., physical cash exchange, wire transfer, Automated Clearing House transfers, etc.). The fiat transfer itself will look like any other transaction between two parties and only through inquiry or monitoring for out-of-pattern transactions can the cryptocurrency nexus be discovered.
KYC Risks
The foundation of cryptocurrency is rooted in anonymity, which is why providing banking services to cryptocurrency service providers poses regulatory and compliance risks for financial institutions. The risks can be viewed as similar to correspondent banking risks, since the financial institution has little insight into the cryptocurrency service provider's customer base.
Cryptocurrency wallet holders who utilize peer-to-peer transactions to move funds also pose regulatory and compliance risks, as the authentication and exchange between wallets bypasses financial institutions altogether. Only when the individual cryptocurrency wallet holder moves funds back to an account within a financial institution will the financial institution have a limited view of the wallet holder's cryptocurrency transactions. However, this limited view should change with the implementation of the Financial Action Task Force's newly released AML standards for cryptocurrency service providers. These standards require cryptocurrency service providers to collect and subsequently share information with other institutions about their customers, referred to as the “travel rule.”
The rule requires cryptocurrency service providers to send customer data, including names and account numbers, to financial institutions when transferring funds. There are several factors complicating the implementation of the travel rule, including the cryptocurrency service provider's existing infrastructure and the lack of an industry consensus on the governance of the information-sharing process.
The KYC factors of banking cryptocurrency service providers versus individuals who maintain cryptocurrency wallets pose significant levels of risk but differ in nature.
At the highest level, financial institutions that choose to provide banking services to cryptocurrency service providers need to understand the cryptocurrency service provider's business. Questions the financial institution should consider include:
• Does the cryptocurrency service provider only provide cryptocurrency-to-cryptocurrency services or does it also facilitate conversion from fiat to cryptocurrency and back?
• Why does the cryptocurrency service provider want to establish an account?
• What is the makeup of the cryptocurrency service provider's current customer base (e.g., individuals, entities, geographic location) and what is their expected range of activity?
• Will the account be used to run the business or to pay out its customers’ conversions?
• What is the expected source of funds for the account (e.g., transaction fees or crypto trading)?
Financial institutions will also need to understand the cryptocurrency service provider's AML program and know what type of KYC data it gathers on its own customers. Financial institutions may consider sending requests for information to their cryptocurrency service provider customers to gain comfort. One advantage of cryptocurrency is that the blockchain technology used to track its movement can be helpful with KYC compliance. Blockchain technology maintains the permanent and publicly available record of all the transactions in the chain, which can help piece together the cryptocurrency service provider customer's cryptocurrency transaction history.
On the other hand, identifying individual customers with depository relationships who transact in cryptocurrency is not a straightforward process. Bank customers who hold and transact in cryptocurrency are not easily identifiable through their everyday relationship. These customers may be sending and receiving fiat currency directly to and from other individuals and may transact with a cryptocurrency currency provider very infrequently. If a bank has a reason to believe that a customer is acting as an unregistered cryptocurrency service provider, it should actively inquire about the customer's source of funds for individual accounts that reflect activity outside the customer's profile.
Transaction-Monitoring Risk
Since cryptocurrency transactions occur outside of traditional financial institutions, traditional scenario monitoring may not be equipped to adequately identify cryptocurrency risks. As an alternative, financial institutions may have to adjust monitoring efforts and review processes to identify when the proceeds of a cryptocurrency transaction are being introduced into the banking sector's money flow. A few ways institutions may accomplish this include:
• Triggering alerts on transfers from cryptocurrency service providers (if not already segmented)
• Isolating transactions reflecting key words related to cryptocurrencies
• Asking customers about out-of-pattern transactions
• Examining wires from other geographies and identifying rapid movement of deposited funds
While some of these patterns may not be cryptocurrency-specific AML risks, the review of the alerted activity may need to be conducted with a cryptocurrency lens in addition to typical AML procedures.
In terms of monitoring, the audit trail provided by the blockchain can serve as a valuable resource but is limited to the specific chain. Although the record is anonymous, the wallet numbers are consistent. As converted funds are transferred to an institution and the wallet holder provides his or her unique identifier, an institution can perform monitoring and eventually trace the source of funds. This tracing results in what is known as verified sources of funds and can promote a better relationship between crypto and fiat currencies.
One limitation to the blockchain technology is that there are many different chains. Individuals looking to launder suspicious activity may exchange currencies often to switch from one chain to another. If unlicensed exchanges are utilized during this layering, there may be limited KYC information stored and a lack of an audit trail.
Conclusion
It is becoming increasingly difficult, if not impossible, for some financial institutions to avoid interaction with cryptocurrency. Those with risk of exposure, whether wanted or not, need to be aware of the AML issues related to these types of transactions.
The regulatory landscape involving cryptocurrencies is continuously evolving. Countries are issuing guidance for providers and financial institutions to follow and they are also appointing regulators to oversee the industry. Financial institutions are at the forefront of protecting the banking sector from AML risks related to cryptocurrency transactions and for this reason they should hold their customers accountable for their transactions.
As financial institutions develop cryptocurrency-specific policies, increase risk awareness internally and across the industry, and determine their cryptocurrency risk tolerance, they will be able to tailor their AML programs accordingly.
