FinCEN Proposes New Regulation To Enhance Transparency In Convertible Virtual Currency Mixing And Combat Terrorist Financing | K2 Integrity
Summary of What Has Happened and What Is Yet to Come
On 19 October 2023, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) announced a Notice of Proposed Rule Making (NPRM), pursuant to section 311 of the USA PATRIOT Act, that “identifies international convertible virtual currency mixing (CVC mixing) as a class of transactions of primary money laundering concern.” This action represents the first time in history that FinCEN has designated an entire class of transactions as being of primary money laundering concern.[1]
The NPRM cites the “risks posed by the extensive use of CVC mixing services by a variety of illicit actors throughout the world and proposes a rule to increase transparency around CVC mixing to combat its use by malicious actors including Hamas, Palestinian Islamic Jihad, and the Democratic People’s Republic of Korea (DPRK).”[2] To that end, the proposal would require covered financial institutions to report information about a transaction when they know, suspect, or have reason to suspect it involves mixing.[3]
Implementation of the proposed special measure is yet to come. The NPRM details proposed steps that FinCEN seeks to take to mitigate the illicit financing risk associated with CVC mixers; however, the proposal is subject to a comment period (ending on 22 January 2024), with plans to take stakeholder feedback into consideration prior to implementation.
Virtual asset service providers (VASPs), particularly those regulated in the United States, should closely examine their risk appetite, risk exposure, and transaction monitoring processes in light of FinCEN’s determination that transactions with CVC mixers—as a class—are of primary money laundering concern. In addition, U.S.-regulated entities should assess both their exposure to CVC mixers and the operational impact of the proposed reporting obligations in preparation for the possibility that binding reporting requirements will go into effect in Q1 2024.
What the Alert Covers
This Policy Alert discusses (1) the rationale behind FinCEN’s NPRM on CVC mixers; (2) the background and context around the NPRM; (3) the detail and requirements of the proposal; (4) industry response to the proposed rule; and (5) key implications and considerations for relevant stakeholders, including regulated crypto firms.
Background and Context
The proposed rule on CVC mixers does not come as a surprise to the industry. The U.S. Department of the Treasury and U.S. law enforcement are clearly focused on the way cryptocurrency and related services such as CVC mixers have been exploited by criminals and sanctioned entities for illicit financing activities in recent years:
- On 6 May 2020, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated CVC mixer Blender.io under its cyber sanctions program, noting that Blender.io provided mixing services used by the DPRK to launder millions of dollars from the Axie Infinity hack.[4]
- In March 2022, the U.S. Department of the Treasury released its National Money Laundering Risk Assessment (NMLRA) highlighting the increased use by criminals of anonymity-enhancing technologies, including CVC mixers, to help obfuscate the movement or origin of funds.[5]
- On 8 August 2022, OFAC also designated Tornado Cash, a CVC mixer, for obfuscating the movement of more than $455 million stolen in March 2022 by the Lazarus Group.[6]
- On 15 March 2023, the U.S. Department of Justice (DOJ) announced a coordinated international takedown of ChipMixer, a darknet cryptocurrency “mixing” service responsible for laundering more than $3 billion worth of cryptocurrency between 2017 and February 2023, in furtherance of, among other activities, ransomware, darknet market, fraud, cryptocurrency heists, and other hacking schemes.[7]
The fact that this notice marks FinCEN’s first-ever designation of an entire class of transactions indicates to the industry and the world writ large that FinCEN views transactions with mixers as representing significant inherent financial crimes risk, prompting action for impacted entities. As FinCEN Director Andrea Gacki stated:
CVC mixing offers a critical service that allows players in the ransomware ecosystem, rogue state actors, and other criminals to fund their unlawful activities and obfuscate the flow of ill-gotten gains. […] This is FinCEN’s first ever use of the Section 311 authority to target a class of transactions of primary money laundering concern, and, just as with our efforts in the traditional financial system, Treasury will work to identify and root out the illicit use and abuse of the CVC ecosystem.[8]
As a reminder, Section 311 of the USA PATRIOT Act “grants the Secretary of the Treasury the authority, upon finding that reasonable grounds exist for concluding that a foreign jurisdiction, institution, class of transaction, or type of account is of ‘primary money laundering concern,’ to require domestic financial institutions and financial agencies to take certain ‘special measures’ against the entity of primary money laundering concern.”[9] The following special measures can be imposed individually, jointly, in any combination and in any sequence:
- Recordkeeping and reporting certain transactions (Note: this was the special measure chosen pursuant to the CVC Mixers NPRM);
- Collection of information relating to beneficial ownership;
- Collection of information relating to certain payable-through accounts;
- Collection of information relating to certain correspondent accounts; and
- Prohibition or conditions on the opening or maintaining of correspondent or payable-through accounts.[10]
When the Department of the Treasury issues a finding of primary money laundering concern, it is effective immediately. U.S. financial institutions should be alert to such findings and take them into account as part of their overall risk management programs.[11] Treasury typically issues an NPRM explaining which special measure(s) it proposes and requests comments from the public on the details included within the NPRM. Following the comment period and review of the comments received, FinCEN has three main options:
- Proceed with a final rule;
- Withdraw the finding and proposed rule; or
- Keep the matter open for further review.
It is also important to note that Section 311 actions are different from OFAC designations, which trigger asset freezing obligations for U.S. persons and prohibit virtually all dealings with the designated persons. By contrast, Section 311 actions can impose a wide range of compliance obligations and do not necessarily require obliged entities to discontinue all dealings with target entities, jurisdictions, or classes of transactions.
Detailed Overview
In its 19 October NPRM publication on CVC mixers, FinCEN clarified that it plans to apply the first special measure, “recordkeeping and reporting certain transactions,” to “certain transactions,” defined in this case as any “transaction in CVC by, through, or to the covered financial institution that the covered financial institution knows, suspects, or has reason to suspect involves CVC mixing within or involving a jurisdiction outside the United States.”[12]
FinCEN defines CVC mixing as:
The facilitation of CVC transactions in a manner that obfuscates the source, destination, or amount involved in one or more transactions, regardless of the type of protocol or service used, such as: (1) pooling or aggregating CVC from multiple persons, wallets, addresses, or accounts; (2) using programmatic or algorithmic code to coordinate, manage, or manipulate the structure of a transaction; (3) splitting CVC for transmittal and transmitting the CVC through a series of independent transactions; (4) creating and using single-use wallets, addresses, or accounts, and sending CVC through such wallets, addresses, or accounts through a series of independent transactions; (5) exchanging between types of CVC or other digital assets; or (6) facilitating user-initiated delays in transactional activity.[13]
Though quite broad, it should be noted that the above six examples are just that—examples—and are not meant to constitute an exhaustive list. Notably, the key element of the definition focuses on obfuscation or concealing of the source, destination, and/or amount of funds involved in a transaction; however, based on K2 Integrity’s conversations with industry participants, some VASPs may challenge the examples provided in FinCEN’s definition through the NPRM process.
Regarding the specific reporting requirements under special measure one, FinCEN proposes both transaction-related reporting obligations and customer-related reporting obligations:[14]
Transaction Reportable Information
- Amount of any CVC transferred, in both CVC and its U.S. dollar equivalent when the transaction was initiated
- CVC type
- CVC mixer used, if known
- CVC wallet address associated with the mixer
- CVC wallet address associated with the customer
- Transaction hash
- Date of transaction
- IP addresses and time stamps associated with the covered transaction
- Narrative
Customer Reportable Information
- Customer’s full name
- Customer’s date of birth
- Address
- Email address associated with any and all accounts from which or to which the CVC was transferred
- Unique identifying number
The proposed regulation would require covered financial institutions to “collect, maintain records of, and report to FinCEN within 30 calendar days of initial detection of a covered transaction, in the manner that FinCEN may prescribe, certain information regarding covered transactions that involve CVC mixing.”[15] Notably, this requirement would apply in addition to any suspicious activity reporting requirements observed by covered institutions. Of further note, it is telling that FinCEN selected the reporting special measure, suggesting that information collection and increased transparency—rather than customer de-risking or transaction restrictions–are at the core of the designation.
Industry Response
In drafting this alert, K2 Integrity canvassed several leading U.S. VASPs to gauge their reaction to the FinCEN notice. We found that at least one heavily regulated firm already takes a very conservative approach with respect to CVC mixers, seeking to limit exposure to customers that have either direct or indirect exposure to CVC mixers and to treat such exposure as de facto worthy of investigation; accordingly, the firm has not expressed material concerns about added reporting requirements. Other VASPs, however, are exploring a written response to the NPRM and are conducting a legal and policy analysis to assess definitional issues and implications while taking a “wait and see approach” before making programmatic changes. Most firms acknowledged that CVC mixer transactions alert as high-risk through blockchain analytics tools, though not all view these alerts as automatically warranting investigations. Accordingly, these firms acknowledged that reporting requirements are likely to increase their compliance teams’ operational burden.
Key Implications and Considerations
Although the NPRM is still in the comment period phase and a decision on the proposed rule will likely not be made for at least three months, there are still immediate implications for covered institutions, including steps that ought to be taken should the proposed rule go into effect. K2 Integrity, therefore, recommends that relevant firms and industry players:
- Respond to FinCEN’s request for comment on or before 22 January 2024, to the extent firms require clarity on the scope/definition of mixers as well as to express any feedback given that this is the first time FinCEN has proposed applying measures to an entire class of transactions.
- Consider treating CVC mixers as very high risk and generate alerts on customers transacting with mixers—in other words, subjecting any transaction involving mixers to some kind of risk-based review and including prior exposure to mixers as a factor that may impact a customer’s risk rating going forward.
- Consider performing a risk review/lookback to assess prior exposure to mixers and determine how the newly proposed reporting requirements will impact operational processes and resource capacity going forward should the reporting requirements go into effect.[16]
- Remember that if the proposed reporting requirements go into effect, such requirements would be in addition to, rather than in lieu of, SAR filing obligations, and would require narratives to be written, which has implications for compliance resourcing/operations.
- Relatedly, the reporting requirements if effected would also amplify the need to examine transactions involving mixers for potential SAR filing obligations.
- Ensure that proper transaction monitoring and blockchain analytics tools and processes are in place to effectively identify (i.e., alert on) direct and indirect exposure to mixers, and then take the appropriate actions in line with one’s risk appetite and compliance obligations.
- Continue following movement around the NPRM and other FinCEN publications (including potential guidance) on the topic of CVC mixers to evaluate whether any internal controls and/or processes need to be adjusted or developed accordingly (for instance, through a regulatory change management program).
A key theme highlighted by the above is the importance of assessing and understanding one’s risk exposures and developing a tailored financial crimes compliance program that leverages automated reporting capabilities, applies effective regulatory change management processes, and regularly includes a review of staffing sufficiency based on new procedural demands.
[1] “FinCEN Proposes New Regulation to Enhance Transparency in Convertible Virtual Currency Mixing and Combat Terrorist Financing,” FinCEN News Release, 19 October 2023, https://www.fincen.gov/news/news-releases/fincen-proposes-new-regulation-enhance-transparency-convertible-virtual-currency.
[2] Ibid.
[3] Proposal of Special Measure Regarding Convertible Virtual Currency Mixing, as a Class of Transactions of Primary Money Laundering Concern, FinCEN, 23 October 2023, https://www.federalregister.gov/documents/2023/10/23/2023-23449/proposal-of-special-measure-regarding-convertible-virtual-currency-mixing-as-a-class-of-transactions.
[4] “U.S. Treasury Issues First-Ever Sanctions on a Virtual Currency Mixer, Targets DPRK Cyber Threats,” U.S. Department of the Treasury, 6 May 2022, https://home.treasury.gov/news/press-releases/jy0768.
[5] National Money Laundering Risk Assessment, U.S. Department of the Treasury, 1 March 2022, https://home.treasury.gov/system/files/136/2022-National-Money-Laundering-Risk-Assessment.pdf.
[6] “U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash,” U.S. Department of the Treasury, 8 August 2022, https://home.treasury.gov/news/press-releases/jy0916. Additionally, Tornado Cash was simultaneously delisted and redesignated by OFAC in November 2022.
[7] “Justice Department Investigation Leads to Takedown of Darknet Cryptocurrency Mixer that Processed Over $3 Billion of Unlawful Transactions,” U.S. Department of Treasury, 15 March 2023, https://www.justice.gov/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3.
[8] “FinCEN Proposes New Regulation,” FinCEN News Release.
[9] “Fact Sheet: Overview of Section 311 of the USA PATRIOT Act,” U.S. Department of the Treasury, 10 February 2011, https://home.treasury.gov/news/press-releases/tg1056.
[10] Ibid.
[11] Ibid.
[12] “Proposal of Special Measure Regarding Convertible Virtual Currency Mixing,” Section VI.A.5, Definition of Covered Transaction.
[13] Ibid., Section VI.A.2, Definition of CVC Mixing.
[14] Ibid., Section VI.B.1, Information to Be Reported.
[15] Ibid., Section VI.B.2, Filing Procedures.
[16] “FinCEN Guidance and Mixers: Your Questions Answered,” Elliptic Webinar, 24 October 2023, https://www.elliptic.co/webinars-events/october-fincen-guidance-your-questions-answered.
