Cryptocurrency and money laundering: FINTRAC issues “red flag” guidance

Any dealing by a “reporting entity” in virtual currency in Canada is subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (the “PCMLTFA”) and associated Regulations. For example, reporting entities (“REs”) must submit a suspicious transactions report (“STR”) any time they have reasonable grounds to suspect that a transaction, or attempted transaction, is related to the commission of a money laundering offence or terrorist activity.

The Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) defines “Virtual Currency” as:

1. a digital representation of value that can be used for payment or investment purposes, that is not a fiat currency and that can be readily exchanged for funds or for another virtual currency that can be readily exchanged for funds; or
2. a private key of a cryptographic system that enables a person or entity to have access to a digital representation of value referred to in paragraph (a).

In early December, FINTRAC released a publication that shares some of the most common indicators of money laundering and terrorist financing with respect to virtual currency transactions. The guidance on suspicious transaction was developed through a review of money laundering (“ML”) and terrorist financing (“TF”) cases, consultations with selected REs, a review of the STRs, and reports published by the Financial Action Task Force and Egmont Group.

While FINTRAC’s list of indicators is not exhaustive, it does provide helpful real-world examples of what can constitute unusual or suspicious transactions. These indicators are applicable to suspected  money laundering and/or terrorist financing, but may not apply to all business activities.

It is important to note that detecting, preventing and deterring ML/TF starts with properly identifying parties involved in a given transaction. Below is a brief explanation of some of the indicators shared by FINTRAC.

1. Person/entity only has privacy coins or has a high value in privacy coins. Privacy coins are cryptocurrencies that keep the transaction anonymous and untraceable. Multiple methods are used to shield a person/entity’s identity. Some of these tactics includes changing addresses for each transaction. For example, Monero allows for a dual-key stealth address protocol. Other ML/TF indicators relating to private coin are instances where the person/entity does not want or cannot provide information about the source of the privacy coins in their possession.

    

2. Exchanging bitcoin in large volumes for privacy coins. Contrary to privacy coins, Bitcoin transactions are publically-recorded on blockchain and are easily accessible and traceable. It can be significant and suspicious, then, when a party undertakes a large-scale exchange of Bitcoin to privacy coins.

    

3. The addresses used are flagged on blocked persons lists such as the watch list of the Office of Foreign Assets Control (the “OFAC”). The OFAC is an agency within the United States (“US”) Department of the Treasury. It administers and enforces US economic sanctions. The OFAC provides a list of persons and entities that are restricted from directly or indirectly engaging in trade or financial transactions in the US. Other law enforcement agencies around the world provide similar lists.

    

4. The white paper is of poor quality, incomplete, misleading, and has limited information. A white paper is a document created by the founders and/or developers of a new blockchain project before its initial coin offering (“ICO”). The digital document plays a crucial role in the due diligence process by helping investors to verify whether a project is legitimate. It contains information which relates to technology, methodology, and the product service being launched. Any obvious issues with the white paper is an important indicator of the legitimacy of the underlying cryptocurrency.

    

5. Pump and dump ICOs. The “pump and dump” is a fraudulent scheme whereby the person/entity accumulates a commodity, and artificially inflates the price by spreading misinformation (through advertisement, social media ads, or endorsements) only to sell it to unsuspecting buyers at a higher price. Because the price of the commodity has been artificially inflated, the buyers will be at a loss. In a cryptocurrency context, the scheme takes place in online chatrooms where group members assist in spreading misinformation about a coin so that it can be sold at a higher price to unsuspecting buyers online. One of many ways to identify a “pump and dump” scheme is by flagging unknown coins that rise suddenly and substantially with no business explanation.  

    

6. Transactions take place in staggered and regular patterns in a short period of time. Converting fiat to virtual currency and virtual currency to fiat with no business explanation. Such transactions are common in ransomware-related cases, as the transactions are completed within a 24-hour period, and are not recorded afterwards for long periods of time.

    

7. High volume and frequency of transfers between different types of virtual currencies. One should be critical of these types of transactions absent a valid business explanation (e.g. portfolio diversification).

    

8. Customers using identification credentials (such as IP addresses and residential addresses) that are shared with other accounts within the same short period. In a case study, such behaviour revealed the potential use of money mules by professional money launderers to launder ill-gotten gains.

    

9. Abnormally high commission fees as compared to industry standards. The exchange of the virtual currency is conducted at a potential loss as a result. This is especially the case when the transaction has no logical business explanation.

    

10. There is no information about the token’s creation, such as a smart contract, a code, or other technical information. A smart contract outlines the contexts of a contractual agreement. It is a computer program designed to digitally facilitate a transaction, allowing parties to verify and enforce the contract. A smart contract is stored on the blockchain. Reporting, tracking and monitoring accounts in accordance with anti-money laundering (“AML”) regulations can be automated by the use of smart contracts. Because smart contracts, and their underlying technology is now widespread and relatively easy to implement, their absence can be a significant indicator of criminal activity.

     

11. Mixing and tumbling services are used before the virtual currency gets transferred to multiple wallets, where the funds are cashed out. Mixers/tumblers is a service used to mask a transaction making it anonymous and untraceable. As implied by the term, a mixer/tumbler mixes different streams of potentially identifiable cryptocurrencies before sending them to their recipients, breaking the connection between the original transaction and the recipients address. As the business uses for this type of technology is to exploit anonymity, its presence is a strong indicator of criminal activity.

Other indicators can be found here.

When must a STR be submitted?

A STR report should be submitted as soon as is practicable after a RE has taken measures to establish reasonable grounds to suspect that an ML or TF transaction is being committed. Such measures include: screening and identifying the suspicious transaction, assessing facts and context surrounding the transaction, and/or linking the transaction to a ML/TF indicator. 

According to FINTRAC’s guidance policies, for the purpose of an STR, a fact is either an event, action, occurrence or element that happened or existed. It is not merely an opinion. Examples include: the date, time, location, type, and amount of a transaction. Context is the surrounding circumstances that explain a situation or transaction.

Note that there is no reporting threshold under the Canadian anti-money laundering regime. REs must have a system that relies on specific alerts or triggering events to signal when to assess a transaction. Such systems should be alert to: (i) unusual patterns in a transaction; (ii) any transaction that exploits the anonymity that is typically associated with virtual currency; (iii) unusual behaviour from senders and recipients; (iv) the source of funds; and (v) any geographical risks typically associated with transferring currency to jurisdictions with little or with inadequate AML regulations. 

With the use of digital currencies on the rise, it is important for REs to be ever-vigilant in creating and updating policies to combat the use of digital currencies for criminal activity. The indicators identified by FINTRAC are a valuable resource that can help REs in preventing virtual currency money laundering activities. 

This article provides only general information about legal issues and developments, and is not intended to provide specific legal advice. Please see our disclaimer for more details.