03 July 2014

Airing cyber-laundry: FATF takes on virtual currencies

The global standard-setter on AML/CTF has just released a ground-breaking paper on virtual currencies such as Bitcoin, in an effort to scope out how these currencies operate and the risks they pose. This alert highlights the key aspects of the paper and provides a snapshot of recent regulatory steps in a number of major jurisdictions.

Collaboration with global players

Ahead of its February 2014 meetings, the Financial Action Task Force (FATF) collectively prepared the first draft of "Virtual Currencies: Key Definitions and Potential AML/CTF Risks" (Paper) with delegates from Australia, Canada, Russia, the United Kingdom and the United States. The final version was released on 27 June 2014 with input from 10 delegations.

The Paper follows a 2013 FATF guidance paper on new payment products and services and expands upon previous efforts (including by the European Central Bank in 2012) to define virtual currencies.

The lack of momentum in regulating virtual currencies to date shows just how much regulators are struggling with the dichotomy of innovation versus risk and the transnational aspects of this new technology. This has made thought leadership and cooperation at a global level essential.

Why it matters

The Paper is symbolic of the swelling tide of regulatory concern about virtual currencies. Many regulators simply do not know how to tackle such payment methods without stifling innovation. Their global reach makes them difficult to pin down.

This marks the beginning of what will no doubt be an ongoing collaborative effort to set cohesive standards for virtual currencies and bring them within the global financial regulatory web. The end game? Entrepreneurs, meet big league financial regulation.

Three key outcomes

The Paper sets out to achieve three things:

  • Definitions - It defines the key aspects of virtual currencies - an essential start to meaningful international cooperation and ultimately, consistent regulation. FATF calls this the "common definitional vocabulary".
  • Risks - It identifies a number of money laundering and terrorism financing (ML/TF) risks inherent in virtual currencies.
  • Examples - It provides specific examples of how virtual currencies have been used in money laundering offences to date.

The following paragraphs elaborate on these outcomes further.

Defining the virtual currency world - how to "speak Bitcoin"

The Paper sets out technical definitions for major concepts used in the world of virtual currencies. These are helpful for anyone grappling with the new technology.

The following table synthesises the core elements into a quick "glossary".

Term Core elements Examples

Forms of currency - key concepts

Virtual currency

  • Digital representation of value
  • Can be digitally traded
  • Functions as a medium of exchange, unit of account and/or store of value
  • No legal tender status
  • Not guaranteed by any jurisdiction
  • Founded on agreement within community of users

Very broad range, including Bitcoin WebMoney, Second Life Linden Dollars and Q Coins. See under "Virtual currency types" below.

Fiat currency

Traditional form of "real currency", "real money" or "national currency"

  • Coin and paper money of a country
  • Designated as legal tender
  • In circulation
  • Customarily used and accepted as a medium of exchange in the country

USD, HKD, AUD, CNY, SGD etc

E-money

Digital representation of fiat currency

Any digital transfer mechanism for value that has legal tender status

Digital currency

Digital representation of either virtual currency or e-money

Any digital transfer mechanism for fiat currency or virtual currency

Types of virtual currency

Convertible

  • Private market for the virtual currency; not necessarily protected by law
  • Equivalent value in fiat currency
  • Can be exchanged for fiat currency

Bitcoin, Second Life Linden Dollars, WebMoney and e-Gold / Liberty Reserve (defunct)

Non-convertible

  • Closed currency intended to be specific to a particular virtual domain or world
  • Cannot be exchanged for fiat currency under rules governing use
  • Black secondary market may exist

Project Entropia Dollars, Q Coins and World of Warcraft Gold

Centralised
(majority of virtual currency transactions; can be convertible or non-convertible)

  • Single administrating authority that controls the system - issuance, registration, redemption etc
  • Exchange rate may be floating or pegged

Second Life Linden Dollars, PerfectMoney, WebMoney "WM units", World of Warcraft Gold and e-Gold / Liberty Reserve (defunct) 

Decentralised
(only relevant to convertible virtual currencies)

  • Distributed, open-source, math-based peer-to-peer virtual currency
  • No central administrating authority
  • No central monitoring or oversight

Bitcoin, LiteCoin and Ripple

Cryptocurrency

  • Decentralised virtual currency protected by cryptography
  • Protected by network of "miners" (see below)
  • Relies on public and private keys and cryptographic signatures to transfer value

Bitcoin - first decentralised virtual currency and cryptocurrency, launched in 2009

Altcoins

Math-based decentralised convertible virtual currencies other than bitcoins

Ripple, PeerCoin, Lite-coin, zerocoin, anoncoin and dogecoin

Tools

Anonymiser

Tools designed to obscure the source of a virtual currency transaction and facilitate anonymity

Tor, DarkWallet and Bitcoin Laundry

Mixer
(laundry service, tumbler)

  • Type of anonymiser
  • Commingles actual transaction with dummy transactions
  • Makes it difficult to link specific virtual coins with a particular transaction
  • Obscures a user's intended recipient

Bitmixer.io, SharedCoin, Blockchain.info, Bitcoin Laundry, BitLaunder, Easycoin

Darknet
(cypherspace, Deep web, anonymous networks)

An underground network of computers that conceals true IP addresses - routes communications / transactions through multiple computers around the world and wraps them in numerous layers of encryption

Tor - previously "The Onion Network"

Virtual currency wallet

Means for holding, storing and transferring virtual currency

CoinBase, Multibit and Bitcoin Wallet

Cold Storage

Offline virtual currency wallet

Bitcoin wallet not connected to the Internet

Hot Storage

Online virtual currency wallet

Any virtual currency wallet connected to the Internet

Dark Wallet

Internet browser-based wallet that incorporates obscuring tools such as auto-anonymiser, decentralised trading, uncensorable crowed funding platforms, stock platforms and information black markets, and decentralised market places

Currently available on Chrome and potentially Firefox

Local Exchange Trading System (LETS)

  • Locally organised economic organisation
  • Uses a particular currency to denominate units of value to be traded or bartered in exchange for goods and services

Ithica Dollars and Mazacoin

Key players in virtual currency systems

Exchanger

Exchanges virtual currency for fiat currency or other value (including precious metals) in exchange for a fee / commission

Administrator

  • Issues a centralised virtual currency
  • Establishes rules for its use
  • Maintains a central payment ledger
  • Has authority to redeem / withdraw from circulation

User

Obtains virtual currency in exchange for real money, as payment for some activity or through mining (see "Miner" below) and:

  • uses it to purchase goods or services;
  • transfers it to others; and/or
  • holds it as a personal investment

Miner

  • Participates in decentralised virtual currency network by running special software to solve complex algorithms to validate transactions
  • Earn fees (typically in the virtual currency in question)
  • May also be users or exchangers

Wallet provider

Provides a means (eg software) for holding storing and transferring virtual currencies


Risk follows opportunity

The Paper acknowledges that virtual currencies can be used for a range of legitimate uses and indeed, assist in maximising payment efficiency and reducing transaction costs. They can also facilitate "micro-payments" for very low-cost items such as games or songs where traditional transaction costs are prohibitively high.

However, the Paper also identifies a number of potential risks, including the following:

  • Obscurity - Greater anonymity: non-face-to-face customer relationships, identity-obscuring tools etc
  • Dispersion - There may be no central server or service provider and no historical records; services are often segmented and there may be multi-jurisdictional elements - similar to trade finance
  • Oversight difficulties - No central oversight body; regulation and access to information complex
  • Software solutions trailing - No AML software (presently) to monitor and identify suspicious transaction patterns
  • Lax control opportunities exist - Centralised virtual currency operators may deliberately target jurisdictions with weak AML/CTF regimes
  • omplex enforcement - Enforcement difficult where multiple parties and jurisdictions are involved

Many of these risks reflect themes and risks that are already well known in the AML/CTF space. However, the virtual and dynamic nature of virtual currencies, coupled with their technical complexity, poses a unique confluence of risks and practical considerations that is forcing regulators onto a steep learning curve.

As FATF observes on the question of jurisdiction itself:

"Decentralised convertible virtual currencies allowing anonymous person-to-person transactions may seem to exist in a digital universe entirely outside the reach of any particular country." (emphasis added)

How does one regulate that? International cooperation is key.

Case studies - about as bad as it gets

Regulation typically follows scandal. In this vein, the Paper chronicles three case studies involving the abuse of virtual currencies for money laundering purposes. They demonstrate the scale and complexity of the virtual currency conundrum. All three were pursued in the United States (US) -still the most aggressive AML/CTF jurisdiction - although other jurisdictions have also been involved.

A quick rundown of the key aspects of these cases, as reported by FATF:

  • Liberty Reserve: Costa Rica-based money transmitter and convertible virtual currency ("Liberty Dollars") operator, which facilitated the movement of over USD6 billion in illicit proceeds. With more than one million users worldwide, it handled almost 55 million transactions, mostly illegal.

    Key issues 
    - No validation of identities - some with blatantly false names and addresses (eg "Joe Bogus" and "123 Fake Main Street, Completely Made Up City"). Offered a broad range of anonymisers, including hiding account numbers for transfers. Encouraged payment routing through certain third party exchangers in high-ML/TF risk countries.

    Pretended to shut down when it knew that it was being investigated by US authorities, but continued to operate through a set of shell companies, moving funds through accounts in Australia, Cyprus, China, Hong Kong, Morocco, Russia, Spain and other locations.

    End result 
    - Pursued by the US Department of Justice for operating an unregistered money transmitter business and money laundering. Liberty Reserve plus seven principals and employees charged in 2013.
  • Silk Road: "[G]lobal black-market cyber bazaar" facilitating the sale and purchase of illegal drugs, weapons, stolen identity information and other unlawful goods and services. Allegedly generated USD1.2 billion in sales revenue and USD80 million in commissions, which ranged from 8 to 15 per cent of total sales price.

    Key issues 
    - Operated on hidden Tor network and only accepted bitcoins for payment. Users could also adopt additional anonymisers to further obscure transactions and other information. Payments also sent through tumblers (mixers) so that payments could not be linked with any bitcoins leaving the Silk Road site.

    Interim result
    - Owner and operator charged with narcotics trafficking, computer hacking and money laundering conspiracies and indicted in February 2014. Website and 173,991 bitcoins (worth USD33.6 million at the time) seized. Investigation ongoing.
  • Western Express International: New York-based virtual currency exchanger and unregistered money transmitter that coordinated and facilitated online payment methods used by a multinational Internet-based "Western Express Cybercrime Group" (Group) (stolen credit card numbers and other personal information) and laundered its proceeds.

    Key issues
    Exchanged USD15 million in WebMoney and USD20 million in e-Gold for the Group and provided information and assistance on ways to move money anonymously to minimise / avoid reporting requirements. Used banks and traditional money transmitters to move large sums of money.

    End result
    - Western Express and Ukrainian owner/operator pleaded guilty to money laundering, fraud and conspiracy offences in February 2013 in New York State. Two others convicted in June 2013; others pleaded guilty in 2009.

It is easy to dismiss these as extreme cases that operate at the fringes of trade and the global financial system. However, the quantum of funds and users involved, coupled with their use of traditional market players such as banks and legitimate money transmitters, brings them to a pivotal (albeit obscured) part of modern finance that is impossible to ignore.

We are also seeing major financial market players entering the virtual currency space through a range of initiatives. The message from these cases? Tread carefully.

Regulatory action so far

Global regulators are also starting to grapple with virtual currencies. We expect this process to intensify following the release of the Paper and further FATF guidance as it emerges. The following chart illustrates recent developments in five key markets:

Airing cyber laundry

Next steps - it may be "Tulipmania", but we can't ignore it

Watch this space. Virtual currencies are evidently here to stay (at least for the time being) and regulators are hot on their heels.

We expect to see a great deal more regulatory interest in this issue - not just in the AML/CTF space, but also in areas such as licensing, prudential conduct, capital adequacy, reporting, consumer protection, competition and privacy.

In the meantime, it is essential for existing market players and entrepreneurs to understand and manage the risks. Speak to us if you have any questions.

Who does this affect?

  • Virtual currency administrators, exchangers, miners and users
  •  Financial services providers
  • Compliance and risk professionals

What do you need to do?

  • Understand the emerging regulatory framework for virtual currencies
  •  Understand the risks
  • Assess new initiatives carefully
  • Speak to us if you have any questions 

Disclaimer
This is general information only and should not be relied on as legal advice. We would be delighted to provide any advice you need. Note that King & Wood Mallesons does not practice Singapore or Japanese law. Information in this alert concerning those jurisdictions and other matters is based on publicly available information. Please contact us anytime if you have any questions.

The authors wish to acknowledge the valuable contributions of Lauren Dray and Suraj Sajnani to this alert.

Key contacts

Data Central

Have you checked out our new Data Hub? Data Central contains a range of resources to help our clients minimise the legal, regulatory and commercial risks this data-driven environment presents and ensure that its full value is being realised.

A Guide to Doing Business in China

We explore the key issues being considered by clients looking to unlock investment opportunities in the People’s Republic of China.

Doing Business in China
Share on LinkedIn Share on Facebook Share on Twitter
    You might also be interested in

    We sum up SFC's recent regulatory bulletin on its front-loaded approach on IPO applications and corporate transactions.

    19 February 2020

    We sum up three key papers issued by the FSB, as well as the developments from other influential global policy-makers.

    24 January 2020

    We analyse the HKMA's regulatory guidance on big data analytics and artificial intelligence applications.

    13 January 2020

    Based on an SFC circular on the use of external electronic data storage providers, we look into why organisations are moving to the Cloud.

    12 December 2019

    This site uses cookies to enhance your experience and to help us improve the site. Please see our Privacy Policy for further information. If you continue without changing your settings, we will assume that you are happy to receive these cookies. You can change your cookie settings at any time.

    For more information on which cookies we use then please refer to our Cookie Policy.