Crypto Incognito: New Regulation Targets Crypto’s Bad Reputation

In a July 2018 indictment by the US Department of Justice (DOJ) as part of a high profile probe by special counsel Robert Mueller’s investigation, 12 Russian operatives stand accused of hacking into the Democratic National Committee (DNC) to influence the outcome of the 2016 presidential election.   

The indictments provide a detailed account of how a group of Russians sought to sway the US election by employing cutting-edge technology and covert tactics. Part of the clandestine operation involved laundering the equivalent of $95,000 by “capitaliz[ing] on the perceived anonymity of cryptocurrencies such as bitcoin,” the indictment states.

Bitcoin is the first established cryptocurrency and one of the most well-known. It was created as a decentralized currency that allows peer-to-peer exchange, sidestepping interaction with a financial intermediary. Cryptocurrencies have revolutionized the way transaction data is transmitted through blockchains, and the transaction process, as well as the currency itself, have built a reputation for anonymity. However, bitcoin’s intended purpose, still an integral part of its blockchain today, is to provide a sort of pseudo-anonymity where detailed trails of each transaction can be uncovered while individual traders’ identities remain anonymous.

The Policy Department for Citizens’ Rights and Constitutional Affairs, a European Parliament think-tank, acknowledged in a May 2018 assessment that cryptos are “particularly vulnerable” to anonymity risks and suspicious activity because tools commonly used to identify customers, such as addresses and names, are excluded from bitcoin trades. In July 2018, the Financial Stability Board, in conjunction with G20 members, raised the alarm that although cryptos at present do not pose “global stability risks,” virtual currencies raise concerns “including consumer and investor protection, market integrity and money laundering/terrorist financing.”

In 2017, JPMorgan CEO Jamie Dimon said he would fire anyone trading cryptos because it’s “stupid” and will “blow up.” Several other large firms have followed suit, banning asset managers from trading cryptos, such as Merrill Lynch and Nordic giant Nordea.

But despite some pushback, the crypto market has been accelerating with big names signing on to cash in on the digital currencies. In 2017, BlackRock CEO Larry Fink called cryptos the “index of money laundering,” but reversed course in July of 2018 by assigning a BlackRock working group to explore the possibilities of cryptos and blockchain. Goldman Sachs floated the idea of opening up a crypto trading desk in its Wall Street office around the time Nasdaq announced a cryptos future trading option on its exchange.

“A lot of people first hearing about crypto associated it with things like the Silk Road, Ross Ulbricht, and dark web marketplaces that really painted bitcoin and the crypto space in a bad light very early on, which I don’t think is an accurate perception,” says Greg Pinn, head of strategy at regtech software vendor IComply. “That’s not the case with the way bitcoin is being transacted now, and a lot of the cryptos that have nothing to do with those marketplaces, but to a lot of people, first impressions matter. It will take time and regulatory focus and vendors with solutions to assist in bringing security to this industry.”

Regulating the Wild West

Crypto’s criminal-friendly reputation is bolstered by a largely unregulated environment.

Obi Nwosu, CEO and co-founder of Coinfloor, a UK-based cryptocurrency exchange, says one of the biggest concerns voiced by hesitant institutional investors to trade cryptos is money laundering. The 5th Anti-Money Laundering Directive (AMLD5) in Europe—which goes into effect in January 2020—addresses unidentified traders by requiring exchanges to gather customer data and perform proper due diligence checks.

AMLD5, an extension of AMLD4, requires firms operating as centralized exchanges or custodial wallet providers to follow the same anti-money laundering (AML) obligations as banks and financial institutions. The “obliged entities” will be required to collect the necessary data to effectively evaluate risks and conduct beneficial ownership identification, know your customer (KYC) protocols, transaction monitoring, and suspicious activity reporting.

“When you have minimal data and have very few data points to understand the customer, their background, history, and their propensity to commit financial crime, it is then a challenge to generate historic data and develop the risk models that allow you to then spot who are high-risk customers. These virtual currencies are going to have to consider [KYC],” says Matt Taylor, managing director of risk and compliance at Protiviti, a consulting firm.

Although AMLD5 is set to address financial crime risk, the onus has largely been on industry participants to make virtual currency less attractive for illegal purposes.

“Companies’ internal policies are the only way to stop and prevent [criminals from using cryptocurrencies for] the sexual exploitation of women and children, the movement of illicit gains from war crimes, and the movement of illicit gains from drug trafficking. You’re never going to convince these sort of bad actors to not be bad actors. The only way to motivate them is to make it difficult or impossible for them to move their money,” says IComply’s Pinn. “The industry is doing it now in the decentralized markets, but in the crypto space, it’s an area in an industry that is so new and so Wild West.”

Criminals keen to capitalize on crypto’s perceived anonymity may be let down by blockchain’s extensive and public transaction data trail.

Coinfloor currently reports any suspicious activity executed on its exchange, says Nwosu, but under EU and US law, this is not a requirement. Some exchanges choose to provide this data willingly in order to build trust among larger institutions, he says.

“For well-run [crypto] exchanges, we get KYC data to understand who our customer is, where the source of the funds are, where the funds are going,” says Nwosu. “In collecting this data, we kind of close the loop.”

Masked Money

Despite blockchain’s data trails, there are areas still in need of a security bolster.

Tom Keatinge, director of the Centre for Financial Crime and Security Studies at Royal United Services Institute for Defence and Security Studies (RUSI), says bad actors could use peer-to-peer trading or other gateways to exchange secure cryptos into cash, or crypto-to-crypto trades to convert currency into more anonymous coins, to disguise their transaction history or any KYC data. The AMLD5 fails to cover those types of trades.

“It’s obviously much more difficult to check [crypto exchanged via non-established methods] so while it’s right to focus on those real-world–to–virtual-world exchanges, it is probably a missed opportunity [by regulators],” Keatinge says. “It’s going to take 18 months for the AMLD5 to go into law, so when we’re 18 months down the road we might regret not having also regulated crypto-to-crypto exchanges to the extent that it’s possible.”

The Policy Department for Citizens’ Rights and Constitutional Affairs’ assessment states that the industry’s rapid evolution may make it easier to “undertake the conversion of bitcoin for privacy coins without KYC or other measures being applied at the point of exchange.”

Pinn says for regulators and institutions already “stretched very thin,” it’s difficult to create and enforce rules and so the burden is on data providers to manage crypto data. “The risk is regulators moving so fast that they may regulate something that should not be regulated, or overregulate, which is the balance they are trying to maintain,” he says.

As crypto trading evolves, so do new technologies, and they may create risks regulators are not equipped to handle. Although coins are traceable and provide substantial data on the blockchains, there are ways to add a layer of anonymity. CoinJoin and DarkWallet, which champion secrecy, have introduced technology such as “mixers” and “tumblers” designed to muddy the data trails of crypto transactions.  

One popular dark wallet provider, Samourai, states on its website: “We are privacy activists who have dedicated our lives to creating the software that Silicon Valley will never build, the regulators never allow, and the VCs will never invest in.”

“While certainly not all mixing activity is illegal, one recent study suggests that mixers account for a disproportionate amount of laundering of illicit bitcoins and that much of this illicit mixing activity takes place through a very small number of mixers,” according to the Policy Department for Citizens’ Rights and Constitutional Affairs assessment.

Another area of concern for regulators or hesitant investors is coins with stronger anonymity features than bitcoin or Etherum, which integrate privacy features that hide transaction or identity data. 

“The process for tracking and tracing [more anonymous coins] is harder. It is challenging if you’re an exchange; you want to know where your customers are getting their money from,” says Nwosu. “We wouldn’t list Monero or anonymity-focused coins as a currency, because at this point in time we can’t see the deposited money, and we won’t have the ability to see where it came from. With regulation, it’s going to be interesting to see if exchanges that currently have a Monero [or similarly anonymous currencies], how they handle it.”

Monero could not be reached for comment, but Zcash is a coin that uses cryptography to enhance privacy methods for investors and seeks to limit the amount of public data on investor transactions and histories. Zcash COO Jack Gavigan says exchanges trading Zcash can still fully be compliant with AMLD5 KYC data demands and customer due diligence (CDD).

“If [investors] use a shielded Zcash transaction, only they and the exchange know the details of that transaction. The exchange knows who’s made the deposit—if they didn’t, they wouldn’t know which account to credit the deposit to—and the very fact that person has an account means that they have been through the KYC/CDD process,” Gavigan says, adding that it’s a level of privacy on par with traditional banks. “It’s similar in nature to depositing cash into a bank account. Cash is an inherently anonymous means of payment, but if I walk into a bank and deposit $10,000 into my account, I’m still subject to the same KYC and AML checks.”

Gavigan says Zcash is designed to support compliance and welcomes measures to prohibit financial crime, such as the US Bank Secrecy Act Travel Rule, which produces encrypted memo fields attaching information to shielded transactions and the Payments Disclosure, which allows Zcash to share details of a transaction with regulators. Gavigan also points to how Gemini exchange recently received permission to trade Zcash by the New York Department of Financial Services (NYDFS) as further evidence of how European exchanges can list Zcash while still adhering to AMLD5.

“The inclusion of these features reflects the importance we place on ensuring Zcash users and the institutions that support Zcash are able to meet their regulatory obligations, and they’re an example of how this new technology can proffer new approaches for regulation and compliance that have not been possible in the past, with a view to improving regulation and reducing the costs of compliance,” he says. “We’re keen to work with regulators to explore how we can make improvements in this area by putting our heads together and combining their in-depth knowledge of the challenges they and the firms they regulate face, with our scientific and technology expertise.”

Henrik Andersson CIO of Apollo Capital, an Australian Crypto Fund that manages portfolios of crypto assets, acknowledges that technology can be used for both good and bad, but he believes crypto assets are ultimately a “force of good in the world as it enables permissionless innovation for everyone with an internet connection.”

He says the privacy component, specifically for Zcash, is “important” and that it is particularly pivotal for people “living under an oppressive government,” where trading cryptos is “essential for survival.”

Data to the Rescue

According to Europol, £3 billion to £4 billion of criminal money is laundered through virtual currencies globally, a relatively small percentage of cryptos’ overall market activity amounting to €500 billion ($578 billion).

Andersson says financial crime within the crypto space is “exaggerated” and as dark markets are closed, traditional players such as Intercontinental Exchange and Goldman Sachs are “now waking up to the reality that investors like exposure and that these are assets are here to stay.” 

Cryptos have valid uses in hedging, foreign exchange (FX) markings, and other regulated products, says Protiviti’s Taylor. “There’s this perception that bitcoin or virtual currency is there to feed the dark web and the sin side, but there are absolutely really legitimate reasons for using it,” he says. “Plenty of exchanges are putting in place controls to mirror the more regular financial services institutions.”

Coinfloor’s Nwosu says the fears about cryptos and financial crime are outdated. “By monitoring the blockchain and looking at transactions to see where it’s gone and where it’s come from, we can see that around 2012, about 30 percent of transactions at peak were related to movements in darknet markets and so on, so maybe it was a valid concern at that time. But now, based on the end of last year, it was well into one percent. What that means is that the vast majority of volume is now related to movements in exchanges,” he says, adding that the real concerns now are centered around spot exchanges, and cash settled futures to prohibit price manipulation.

Zcash’s Gavigan says the societal good outweighs the small cost of outliers using virtual currencies for illicit purposes. “With virtual currencies, we’re talking about a technology that enables the remittance of value to anyone in the world with access to the internet. Its peer-to-peer nature means that it’s faster than any existing payments network, and eliminates the economic rent that accrues to the middlemen in the traditional financial system,” he says. “[Virtual currency] has the potential to increase the velocity of money in developed economies—thereby supporting economic growth—and to unlock access to financial services for hundreds of millions, if not billions, of people in developing economies.”

Continuous data sharing and collection will be key to achieving widespread trust in the crypto market.

Rick McDonell, the former executive secretary of the Financial Action Task Force (FATF) and executive director of ACAMS, says the right parties need to collaborate on a regulatory solution even though the products are “complicated” and there’s a “multiplicity of them.” He says financial institutions are willing to create public–private partnerships to share data in order to mitigate financial crime.

In a report prepared for the Ecofin meeting of EU finance ministers and central bank governors in September 2018, the report concluded that regulatory frameworks such as AMLD5 were necessary to limit illicit activity and promoted cross-border data sharing to mitigate global stability risks. A central policy initiative promoted more uniformity in EU policies on virtual currency frameworks.

“The public policy approach to crypto assets requires global coordination on key regulatory questions,” the report states. “Limiting money laundering and terrorism finance or preventing tax evasion requires international cooperation, and even more so in the world of crypto assets. But since access to crypto exchanges essentially only requires access to the internet, consumer and investor protection for crypto exchanges would benefit from a global approach.”

The Joint Chiefs of Global Tax Enforcement (J5), established in July 2018 as a mode for combatting international tax crime and money laundering, is collaboration between tax authorities from the US, Australia, Canada, the Netherlands, and the UK, and is one such effort to investigate and share data on tax evasion and money laundering in cryptos. Globally consistent regulations covering all jurisdictions will be paramount in preventing criminals from side-stepping regulations to engage in illegal activity, and they are an essential step toward building the investor confidence necessary for crypto’s continued rise.