On October 19, 2023, the U.S. Department of the Treasury’s
(“Treasury”) Financial Crimes Enforcement Network
(FinCEN) announced a Notice of Proposed Rulemaking (NPRM) that
would implement new recordkeeping and reporting requirements on
domestic financial institutions and domestic financial agencies,
related to transactions that they know, suspect, or have reason to
suspect involve convertible virtual currency (CVC) mixing within or
involving a non-U.S. jurisdiction.
FinCEN issued the NPRM pursuant to Section 311 of the USA PATRIOT Act, which
provides the Secretary of the Treasury (the “Secretary”)
the authority to require domestic financial institutions and
domestic financial agencies to take “special measures”
where the Secretary finds reasonable grounds to conclude that a
class of transactions, institution, account, or foreign
jurisdiction is of “primary money laundering concern.”
The NPRM identifies international CVC mixing as a class of
transactions of primary money laundering concern, highlighting the
use of CVC mixing services by illicit actors including cyber
criminals and terrorist groups. According to FinCEN’s press release, the NPRM represents
FinCEN’s first use of Section 311 to target a class of
transactions.
Requirements Contained in the Proposed Rule
The proposed rule defines “CVC mixer” as any person,
group, service, code, tool, or function that facilitates CVC
mixing. “CVC mixing” is defined as the facilitation of
CVC transactions in a manner that obfuscates the source,
destination, or amount involved in one or more transactions,
regardless of the type of protocol or service used, such as: (1)
pooling or aggregating CVC from multiple persons, wallets,
addresses, or accounts; (2) using programmatic or algorithmic code
to coordinate, manage, or manipulate the structure of a
transaction; (3) splitting CVC for transmittal and transmitting the
CVC through a series of independent transactions; (4) creating and
using single-use wallets, addresses, or accounts, and sending CVC
through such wallets, addresses, or accounts through a series of
independent transactions; (5) exchanging between types of CVC or
other digital assets; or (6) facilitating user-initiated delays in
transactional activity.
The definition of CVC mixing excludes “the use of internal
protocols or processes to execute transactions by banks,
broker-dealers, or money services businesses, including virtual
asset service providers that would otherwise constitute CVC mixing,
provided that these financial institutions preserve records of the
source and destination of CVC transactions when using such internal
protocols and processes; and provide such records to regulators and
law enforcement, where required by law.”
The proposed rule would require financial institutions to report
information regarding transactions involving CVC mixing in or
involving a non-U.S. jurisdiction and the customer associated with
any such transaction, including:
- Amount of any CVC transferred, in both CVC and its U.S. dollar
equivalent when the transaction was initiated; - CVC type;
- CVC mixer used, if known;
- CVC wallet address associated with the mixer;
- CVC wallet address associated with the customer;
- Transaction hash;
- Date of transaction;
- IP address and time stamps associated with the
transaction; - Narrative description of the activity observed by the financial
institution, including summary of investigative steps taken; - Customer’s full name;
- Customer’s date of birth;
- Customer’s address;
- Email address associated with any and all accounts from which
or to which the CVC was transferred; and - Unique identifying number for the customer (Taxpayer
Identification Number, meaning an Employer Identification Number or
Social Security Number, or the foreign equivalent).
The proposed rule would require the foregoing information to be
reported to FinCEN within 30 days of initial detection of a
reportable transaction.
Significantly, the NPRM indicates FinCEN’s expectation that
both direct exposure and indirect exposure to CVC mixing involving
a non-U.S. jurisdiction would trigger the reporting requirement
under the proposed rule. For example, if CVC were sent from a mixer
to an intermediate wallet and then to a covered financial
institution, the rule’s reporting obligation would be
triggered; and the same would be true if CVC were sent from a
covered financial institution to an intermediary wallet and then to
a CVC mixer. But transactions that are only indirectly related to
CVC – such as a transfer of the fiat currency proceeds from
an exchange of CVC that was previously processed through a CVC
mixer – would fall outside the scope of the proposed
rule.
Implications of the Proposed Rule
Should the rule be adopted as proposed, covered financial
institutions will need to ensure that they collect the above-listed
reportable information, or prevent transactions involving CVC
mixers. Many financial institutions may already collect some or all
of the required information, but others would need to adjust their
data collection and retention practices. Some financial
institutions may simply decline to engage in transactions involving
CVC mixers.
Whether for the purpose of ensuring compliance with the
rule’s reporting obligation or for the purpose of declining
transactions involving CVC mixers, covered financial institutions
may also need to enhance their transaction surveillance frameworks
to identify direct and indirect exposure to non-U.S. CVC mixing, if
the proposed rule is adopted. According to the NPRM, “FinCEN
would expect covered financial institutions to employ a risk-based
approach” to compliance with the proposed rule,
“including by using the variously available free and paid
blockchain analytic tools commonly available.”
Another key issue is likely to be which platforms qualify as a
CVC mixer. The definition in the proposed rule is quite broad and
could capture a wide range of platforms that are not typically
considered mixers. For example, exchanging between types of CVC or
other digital assets would capture an array of decentralized
protocols, many of which would not fall into the exemption for
virtual asset service providers because they are not licensed or
registered as such. Additionally, if financial institutions (which
include most digital asset custodial exchanges and platforms, among
many other digital asset business models) decline to deal with CVC
mixers to ease their compliance burden, that could have a
significant impact on the liquidity and, potentially, viability of
those CVC mixers.
The Treasury has shown an increased interest in addressing
sanctions and money laundering-related concerns arising from CVC
mixing over the past two years. In 2022, the Treasury’s Office
of Foreign Assets Control (OFAC) designated virtual currency mixers
Blender.io and Tornado Cash as Specially Designated Nationals
(SDNs) (see Steptoe’s blog post on the designation of Tornado Cash for more
information).
Comment Period and Topics
In addition to inviting comments on all aspects of the proposed
rule, the NPRM posits a number of specific matters for commenters
to address, including, for example:
- What impact would this proposed rule have on legitimate
activity conducted by persons in the course of conducting financial
transactions? - Does the proposed definition of CVC mixing adequately
capture the activity of concern? If not, please provide suggested
revisions to the proposed definition that would better capture such
activity. Where possible, please provide information or examples to
illustrate how the recommended revisions would improve upon the
definition as proposed. - Does the proposed exception to the definition of CVC mixing
adequately account for legitimate activity conducted by VASPs and
other financial institutions?
The comment period for the NPRM closes on January 21, 2024.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
