Risks and Challenges Associated with Bitcoin Transaction Monitoring for AML

August 2015 Risks and Challenges Associated with Bitcoin Transaction Monitoring for AML Olivia Greene, Senior Consultant Risk Advisory Why does Bitcoin present such an emergent risk to law enforcement and AML monitoring? This paper aims to establish a background history of Bitcoin development, and provides the reader with an interpretation of the risks commonly associated with these transactions. Furthermore, this paper seeks to address some of the problems faced by the AML community when attempting to monitor these transactions. Finally, this paper seeks to highlight recent regulatory guideline revisions issued by Federal and International regulatory authorities. The use of Bitcoin initially garnered little international attention, but as the practice became more widespread, the value of the electronic currency skyrocketed, thus making it a viable resource to transfer large sums via anonymous networks. Bitcoin s anonymity and irreversibility, make it susceptible to use in criminal transactions, including laundering money from illegal sales of drugs, firearms, weapons, and stolen personal information. 1 By early 2014, Bitcoin was receiving a good bit of media attention. The very public collapse of the trading platform Mt. Gox in February 2014, helped to make Bitcoin a household name. Bitcoin is a type of (VC). The Financial Crimes Enforcement Network (FinCEN) defines as a medium of exchange that operates like a currency in some environments, but does not have all the attributes of real currency. In particular, VC does not have legal tender status in any jurisdiction. 2 However, VC can be converted into legal tender using a fiat currency exchange medium. A Brief History of Bitcoin The concept of Bitcoin was introduced in a paper published by Satoshi Nakamoto in October of 2008. 3 He suggested that the peer-to-peer transfer of funds via the internet was expensive, because banks, caught in the middle as mediators, needed to mitigate the costs associated with the high risk of these transfers, and thus passed the costs on to their customers. The increase in cost therefore made small transactions needlessly cost-prohibitive. What was needed [to reduce cost and incrase trust], was an electronic payment system

based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without need for a trusted third party. (Nakamoto, 2008) Nakamoto defined Bitcoin as a chain of digital signatures [where] each owner transferred the coin to the next by digitally signing a hash of the previous transaction and [adding the] public key of the next owner to the end of the coin[ s digital signature]. What is Bitcoin Exactly? Bitcoin is a form of VC commonly known as Cryptocurrency. It was developed in early 2009, to facilitate the virtual purchase and trade of an electronic currency. It was designed to give users a trustworthy but anonymous method of rapid international transfer of value. Bitcoin operates under the concept that privacy and anonymity must be absolute, but that users must still have a way to trust in the authenticity of the transaction. Bitcoin is produced via a process called mining, in which analysts compete for new coin by running complex algorithms to find available blocks of data. These blocks are validated by other miners, and certified blocks of data are converted into new Bitcoin. Unlike U.S. dollars, which can be printed by the Federal Reserve without limit, Bitcoin are a finite quantity resource. There are approximately 12 million Bitcoin currently in existence and only 21 million Bitcoin can ever be created. Through mining, a block of 25 new Bitcoin is generated approximately every 10 minutes, for a total of approximately 3,600 new Bitcoin in the aggregate created each day. The amount of Bitcoin generated in each block is cut in half approximately every four years. In 2016, the amount will be reduced to 12.5 per block, then 6.25 four years thereafter, and so on. 4 The complexity of the algorithms required to mine Bitcoin also exponentially increase, slowing the production of new Bitcoin until they reach the zero threshold of 21 million. It is currently estimated, that Bitcoin mining will continue until as late as 2033. 5 VCs are designed to maintain the user s anonymity, because they do not track or record any personal data on the users. Users claim ownership by attaching their user key to a transaction prior to initiating it. Users can generate a new key for every transaction they initiate, and these keys are stored in the user s electronic wallet. Every time a Bitcoin is traded, a new user key is attached to the coin s system file. These keys are retained forever, giving a user the ability to trace the movements of that coin from its development to present date. The same system that makes Bitcoin anonymous, also gives them their trustworthiness. Because the full transfer chain of a Bitcoin is traceable, it is easy to determine if the Bitcoin is legitimate, and if the seller of the Bitcoin has the authority to transmit that coin to another user. This system was designed so that users can trust in the validity of the currency they are purchasing, without requiring the security of a trusted financial institution to lend legitimacy to the transaction, or certify the funds. Bitcoin Jurisdiction On March 18, 2013, FinCEN 6 issued an interpretive guidance to establish regulatory jurisdictions over Bitcoin. According to the FinCEN report, the Bank Secrecy Act ( BSA ) [applies] to persons creating, obtaining, distributing, exchanging, accepting, or transmitting virtual currencies. FinCEN provided fairly narrow definitions of who is and is not considered a relevant party in a Bitcoin exchange. Under FinCEN regulations, the definition of a money transmitter does not differentiate between real currencies and convertible virtual currencies. Accepting and transmitting anything of value that substitutes for currency makes a person a money 1 2 3 4 5 6 is mined using complex algorithms dealers sell the mined currency on exchange markets Users spend the internationally to pay for goods and services Payments are confirmed by users when they attach their key to the transaction Recipients save their newly earned in their e-wallets is converted into fiat currency 2

Monthly Average Closing Price of Bitcoin Trade Values Source: (CoinDesk, 2015) $1,400 $1,200 $1,000 $800 $600 $400 $200 0 4/2010 5/2010 6/2010 7/2010 8/2010 9/2010 10/2010 11/2010 12/2010 1/2011 2/2011 3/2011 4/2011 5/2011 6/2011 7/2011 8/2011 9/2011 10/2011 11/2011 12/2011 1/2012 2/2012 3/2012 4/2012 5/2012 6/2012 7/2012 8/2012 9/2012 10/2012 11/2012 12/2012 1/2013 2/2013 3/2013 4/2013 5/2013 6/2013 7/2013 8/2013 9/2013 10/2013 11/2013 12/2013 1/2014 2/2014 3/2014 4/2014 5/2014 6/2014 7/2014 8/2014 9/2014 10/2014 11/2014 12/2014 1/2015 2/2015 3/2015 4/2015 5/2015 6/2015 This chart shows the overall monthly fluctuation of Bitcoin trade values as reported on the CoinDesk BPI, one of the recognized Bitcoin exchanges. Although trade values vary by exchange, overall trade values are similar across global markets. The life time high of value of $ 1,147.25 reported in December 2013, occurred immediately prior to the Mt. Gox collapse. Notice that values never recovered that high. However, notice also, that Bitcoin values have been trading at a signifficantly more stable trend transmitter under the regulations implementing the BSA. Furthermore, the administrator of [a VC] repository will be a money transmitter to the extent that it allows transfers of value between persons [to] or from one location to another. In other words, the individuals who mine, purchase and trade Bitcoin will not be considered as money transmitters, but any person who performs currency exchanges of Bitcoin for real currency, acts as a middle man or facilitator of currency transfers, or administers a Bitcoin repository, will be considered a money transmitter and therefore subject to BSA regulation. Subject to this FinCEN guidance, administrators and Bitcoin exchangers are now required to register as Money Service Businesses (MSB) and are held to the same monitoring and reporting standards as MSB s. Institutional Risks Associated with Bitcoin At present, Bitcoin is an informal value transfer system (IVTS), an inherently high risk form of under-monitored currency transfer forum. Recent opinions issued by the U.S. Department of the Treasury and in particular FinCEN indicate that Bitcoin is starting to be recognized as a formal money service business, and laws are being developed internationally to improve monitoring capabilities. Numerous media articles have tied Bitcoin dealing to heinous terror attacks and large scale money laundering operations: The terror attacks on the French newspaper, Charlie Hebdo 7, perpetrated on January 7th, 2015 were allegedly funded in part through finances delivered via Bitcoin transactions. France issued a Declaration focusing specifically on digital currencies. It said that as a result of the terrorist attacks in Paris, decisive action needs to be taken in respect of terrorist financing. Regulators in France have requested that EU regulators adopt resolutions which would make Bitcoin and other cryptocurrency transactions essentially illegal in the Eurozone. 8 A news report dated February 10, 2015, stated that Pascal Reid and Michel Abner Espinoza were arrested on what a local prosecutor said may be the first state law charges over the use of Bitcoin as part of an alleged money laundering scheme. The men face two counts of money laundering and one count of engaging in an unlicensed money servicing business, according to court filings in Miami state court. The use of Bitcoin in the transactions is a new technological flourish to this very old crime, Miami-Dade State Attorney Katherine Fernandez 3

Rundle said in a statement. The arrests may be the first state prosecutions involving the use of Bitcoin in money laundering operations. 9 On January 27, 2014, the U.S. Attorney s Office for the Southern District of New York announced that criminal charges had been filed against Robert M. Faiella and Charlie Shrem, for engaging in a scheme to sell over $1 million in Bitcoin to users of Silk Road, the underground website that reportedly enabled its users to buy and sell illegal drugs anonymously and beyond the reach of law enforcement. Each defendant is charged with conspiring to commit money laundering and operating an unlicensed money transmitting business. Manhattan U.S. Attorney Preet Bharara said: As alleged, Robert Faiella and Charlie Shrem schemed to sell over $1 million in Bitcoin to criminals bent on trafficking narcotics. 10 According to a July 1, 2015 press release issued by the U.S. Department of Justice, a former DEA agent on the Silk Road Task Force investigation had been convicted of fraudulently obtaining VC worth over $700,000. Agent Carl Force, used invented online personas to fraudulently obtain Bitcoin. Carl M. Force, 46, of Baltimore, Maryland, pleaded guilty before U.S. District Judge Richard Seeborg of the Northern District of California to information charging him with money laundering, obstruction of justice and extortion under color of official right. Force s sentencing hearing is scheduled for October 19, 2015. To date, Force is one of two federal agents charged with crimes in connection to their roles in investigating the Silk Road. Shaun W. Bridges, 32, of Laurel, Maryland, a former Special Agent with the U.S. Secret Service, is charged in a two-count indictment with money laundering and obstruction of justice related to his diversion of over $800,000 in digital currency that he gained control over as part of the Silk Road investigation. 11 The promise of anonymity combined with the ease with which international trades can be completed makes Bitcoin attractive to criminal organizations. Once an individual has obtained Bitcoin, there is little information gathered to track the source or destination of funds. The only data gathered during the transaction process is the customer s individual transaction hash key and the geographical location associated with that transaction. Users can create a new hash key for every transaction they initiate, and hash keys are only stored in the user s electronic wallet. Even if the hash key information for a Bitcoin is obtained, it is difficult, if not impossible to identify any of the previous owners of that Bitcoin. Tracking the origin or destination of funds without knowing the identities of the hash key owners is therefore all but impossible. The same challenges faced by law enforcement when tracking the source or destination of funds, is also a problem for individual dealers. Bitcoin dealers have been recently identified as Money Service Businesses (MSB) and Money Transmitters. They are therefore required to monitor their transactions in keeping with the Bank Secrecy Act (BSA). Even if a Bitcoin trader or exchanger follows BSA regulations, gather proper documents in keeping with a customer identification process (CIP) and files Suspicious Activity Reports (SAR), they still have only limited information available about the transactions they are supporting. The lack of transparency guaranteed by Bitcoin s platform makes proper monitoring and reporting virtually challenging and the data reported by dealers is limited. How do we Monitor Bitcoin Transactions? Since users are not required to provide identifying information (driver s license, addresses, names, etc.), Bitcoin transactions only retain the approximate geographical location of each participant in the transfer history. There are currently no regulations which govern monitoring or reporting of the virtual transactions involving a Bitcoin transfer. Transactions remain invisible to analysts until someone attempts to convert Bitcoin into legal currency. It is at this point in the transaction cycle, that Bitcoin leave the virtual space, and enter the regulated currency market. It is at this entry point, that analysts and regulators may have a chance to identify suspicious trends. Unlike the Bitcoin protocol, these exchanges are ultimately centralized: backed and run by people against whom laws can be enforced. In most jurisdictions, exchanges are subject to anti-money laundering laws that require certain kinds of businesses to know your customer (AML/KYC regulations). This involves formally identifying customers through official documentation typically passports and utility bills presenting yet another place where a Bitcoin wallet address can be related to a real world identity. 12 From a law enforcement perspective, monitoring the account activity and Suspicious Activity Reports filed by exchange dealers will yield the most useful data. According to various recent statements and guidelines issued by FinCEN 13 and the Financial Action Task Force (FATF) 14,15, as well as additions made to the FFIEC Examination Manual 16, the risks of Bitcoin transactions apply specifically to the points where VC is converted into Fiat and vice versa, as these are the points where physical transfers of tangible value take place. Guidance published in June 2015 17 by the FATF states that Currencies and their associated products and services present real money laundering and terrorist financing risk and make way for a number of predicate crimes tied to the opportunities these transactions provide. The guidance states specifically that only convertible Currencies are likely to 4

present Money Laundering and Terrorist Finance risks because they can be used to move value into and out of fiat currencies and regulated financial systems. FATF suggests that the best way to mitigate the risk associated with these types of transactions is to treat the currency converters as MSBs in all jurisdiction. Additionally, the guidance cautions against a blanket prohibition of Transactions as this policy would just drive the transactors further underground, effectively making it even more difficult to monitor VCs. Conclusion Based on recent regulatory trends, it is unlikely that Bitcoin transactions will be outlawed or eliminated any time soon. As you can see in Chart 1, Bitcoin values have increased significantly since their inception. The prospect of tangible profits makes Bitcoin attractive to a number of law abiding individuals, and it will be difficult to produce legislation that denies those individuals the right to speculate in this potentially lucrative, albeit volatile market. Trends in recent international regulations indicate that regulators prefer to adopt policies to remove these platforms from back rooms and black markets. Instead of passing laws that prohibit Bitcoin entirely, regulators have aimed to bolster regulations that reinforce self-monitoring and reporting requirements. These guidelines are designed to give regulators access to the involved transactors rather than driving such transaction mediums entirely underground. At an ABA conference held in Washington DC on June 26, 2015, Assistant Attorney General Leslie R. Caldwell reiterated that compliance and cooperation from exchanges, companies and other market actors can ensure that emerging technologies are not misused to fund and facilitate illicit activities. 18 Since the responsibility for monitoring, tracking and reporting falls primarily onto the shoulders of financial institutions, it is important for these institutions to develop programs and training geared towards a robust understanding of VC transactions. These transfers occur primarily outside of the accessible transaction space, and financial institutions can report on VC transactions only when funds enter or leave their client accounts. Establishing strong know your customer (KYC) and enhanced due diligence (EDD) processes so that analysts can recognize transfers that are outside of that customer s expected transaction pattern is key. VC transactions should be treated as MSB transfers and reports should be filed for suspicious activity following the same guidelines as applied to MSB activity. With vigilant monitoring of customer account activities and strong KYC programs, financial institutions are in a position to better insulate themselves from the potential reputational damage that IVTS transactions of this type present. Olivia Greene Senior Consultant Risk Management 703.970.0425 olivia.greene@dhgllp.com 1. Gilbert, R. N., & Blye, A. D. (2014, March 17). Bitcoin and Internet Payment Systems: Regulatory and Commercial Law Concerns. Retrieved June 24, 2015, from CFJBlaw.com: http://www.cfjblaw.com/bitcoin-internet-payment-systems-regulatory-and-commercial-law-concerns/#_edn4. 2. FinCEN. (2014, January 30). FIN-2014-R002 Application of FinCEN s Regulations to Software Development and Certain Investment Activity. Retrieved from FinCEN.gov: http://www.fincen.gov/news_room/rp/rulings/pdf/fin-2014-r002.pdf 3. Nakamoto, S. (2008, October 31). Bitcoin: A peer-to-peer Electronic Cash System. Cryptovst.co.uk, 1-9. Retrieved June 24, 2015. Note: The name Satoshi Nakamoto is believed to be a pseudonym, as the individual responsible for the initial paper was never positively identified. However, this paper appears to be the first commonly known hypothesis on the viability of cryptocurrency for financial transactions. 4. Nemirovsky, D. (2013, December 11). Why Financial Services Firms Should Prepare for Bitcoin. Retrieved from Law 360: http://www.law360.com/articles/494842/whyfinancial-services-firms-should-prepare-for-bitcoin 5. Hobson, D. (2013, Fall). What is Bitcoin? http://internet.jroepeumw.net/wp-content/uploads/2014/01/p40-hobson.pdf. XRDS, 20(1), 40-44. doi:10.1145/2510124 6. FinCEN. (2013, March 18). Application of FinCEN s Regulations to Persons Administering, Exchanigng, or Using. Retrieved June 24, 2015, from United States Department of the Treasury: http://fincen.gov/statutes_regs/guidance/html/fin-2013-g001.html 7. Duhaime, C. (2015, January 29). France Calls for Regulation of Bitcoin to Strengthen Counter-Terrorist Financing. Retrieved June 26, 2015, from Anti-Money Laundering Law in Canada: http://www.antimoneylaunderinglaw.com/2015/01/france-eu-call-for-expedited-regulation-of-bitcoin-to-strengthen-counter-terroristfinancing-efforts-following-charlie-hebdo-incident-and-an-end-to-all-anonymous-financial-transactions-through-repor.html 8. Duhaime, 2015 9. Nesmith, S. (2014, February 10). Miami Bitcoin Arrests may be First State Prosecution. Retrieved June 24, 2015, from Bloomberg Business: http://www.bloomberg. com/news/articles/2014-02-09/miami-bitcoin-arrests-may-be-first-state-prosecution 10. Department of Justice. (2014, January 27). Manhattan U.S. Attorney Announces Charges Against Bitcoin Exchangers, Including CEO of Bitcoin Exchange Company, for Scheme to Sell and Launder Over $1 Million in Bitcoins Related to Silk road Drug Trafficking. Retrieved June 24, 2015, from The United States Attorney s Office for the Southern District of New York: http://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-charges-against-bitcoin-exchangers-including-ceo 11. Department of Justice. (2015, July 1). Former Silk Road Task Force Agent Pleads Guilty to Extortion, Money Laundering and Obstruction. Retrieved from The United States Department of Justice: http://www.justice.gov/opa/pr/former-silk-road-task-force-agent-pleads-guilty-extortion-money-laundering-and-obstruction 12. Hobson, 2013 13. FinCEN, 2014 14. FATF. (2013, June). Guidance For a Risk-Based Approach: Prepaid Cards, Mobile Payments and Internet-Based Payment Services. Retrieved from FATF-GAFI.org: http://www.fatf-gafi.org/media/fatf/documents/recommendations/guidance-rba-npps.pdf 15. FATF. (2014, June). FATF Report: Currencies; Ke Definitions and Potential AML/CFT Risks. Retrieved from FATF-GAFI.org: http://www.fatf-gafi.org/media/fatf/ documents/reports/virtual-currency-key-definitions-and-potential-aml-cft-risks.pdf 16. FFIEC. (2014, December 8). Nonbank Financial Institutions - Overview. Retrieved from Federal Financial Instittuions Examination council Bank Secrecy Act / Anti- Money Laundering Infobase: http://www.ffiec.gov/bsa_aml_infobase/pages_manual/olm_091.htm 17. FATF. (2015, June). Guidance for a Risk-Based Approach to Currencies. Retrieved from FATF-GAFI.org: http://www.fatf-gafi.org/media/fatf/documents/reports/ Guidance-RBA--Currencies.pdf 18. Caldwell, L. R. (2015, June 26). Assistant Attorney General Leslie R. Caldwell Delivers Remarks at the ABA s National Institute on Bitcoin and Other Digital Currencies. Retrieved June 26, 2015, from The United States Department of Justice, Office of Public Affairs: http://www.justice.gov/opa/speech/assistant-attorney-general-leslie-rcaldwell-delivers-remarks-aba-s-national-institute 5