The Financial Action Task Force (FATF) has applied its anti-money laundering (AML) and counter-financing of terrorism (CFT) standards to virtual assets and virtual asset service providers (VASP) since 2019. The intergovernmental body has noted that virtual assets have “the potential to radically change the financial landscape” but that regulators must also become familiar with a “new vocabulary” in order to effectively address the criminal threats that the technology brings.
Regulatory Progress
The FATF has issued periodic updates and guidance on how its standards should be applied to virtual assets and VASPs, with a heavy focus on Recommendation 16, also known as the ‘Travel Rule’. Recommendation 16 requires private sector institutions to trace both the originators and recipients of funds when they are sent across borders, and maintain suitable records of those transactions.
In practice the Travel Rule requires firms to implement suitable Know Your Customer (KYC) measures, including capturing names, addresses, and account numbers in order to establish the identity of customers and counterparties. In the context of virtual assets, service providers must ensure they collect this information despite the anonymity challenges associated with cryptocurrency transactions.
As of 2022, the FATF noted that the vast majority of jurisdictions had not passed the relevant laws necessary to implement the Travel Rule for virtual assets. A 2022 FATF report revealed that, since June 2021, of 98 responding jurisdictions only 29 had passed virtual asset Travel Rule legislation and only 11 had implemented any enforcement or supervisory measures. The report suggests that the level of Travel Rule implementation amongst non-reporting FATF jurisdictions is likely to be slower than reporting jurisdictions.
The FATF found that the delay in the implementation of the Travel Rule in some jurisdictions was a result of undeveloped or in-progress virtual asset regulatory regimes, or a lack of domestic expertise in Travel Rule compliance.
Travel Rule Implementation
Both the FATF’s research and open source reports suggest that the private sector has led in the implementation of the Travel Rule, often going beyond requirements for the public sector. Private sector VASPs are taking advantage of novel technological solutions to achieve Travel Rule compliance, with a focus on interoperability with other AML/CFT solutions, and the need to scale with global solutions implemented by counterparts.
Despite the private sector progress, the FATF has highlighted a number of challenges affecting Travel Rule implementation. These include:
Some Travel Rule compliance solutions are only compatible with certain types of virtual assets.
Some VASPs, along with counterparties or third-party service providers, require approval over Travel Rule compliance solutions.
A lack of consensus over which solution (or solutions) will meet FATF and local compliance obligations.
A lack of shared and clear information about VASP Travel Rule obligations from official sources.
The FATF has acknowledged that many VASPs are still in the very early stages of Travel Rule implementation. In order to accelerate that process, the FATF has emphasised the need to engage with jurisdictional authorities and the private sector, and encourage the further development of solutions “that are global, interoperable, and can accommodate for nuances across national requirements.”
Emerging Issues and Risks
The need for VASPs to implement the Travel Rule has grown more urgent as a result of developments on the cryptocurrency landscape. The FATF has set out some of the key emerging risks and market developments:
Decentralised finance
FATF research suggests that decentralised finance (DeFi) markets have grown significantly from 2021-22, with increasing use of stablecoins and cross-chain bridge software. The FATF has stated that it will continue to monitor DeFi developments to ensure that AML/CFT standards remain relevant.
Non-fungible tokens
Like DeFi markets, use of non-fungible tokens (NFT) has also increased, along with opportunities for criminals to use them to launder money. The FATF notes that the increase in active wallets trading in NFTs and disparities in the way NFTs are defined across jurisdictions has created new AML/CFT risks.
Peer-to-peer payments
The FATF has noted that peer-to-peer (P2P) payments of virtual assets potentially fall outside the scope of the AML/CFT recommendations – and will continue to monitor emerging risks.
Stablecoins
As stablecoin liquidity increases, so do the potential risks to consumers. The FATF has stated that it will “continue to facilitate discussion between jurisdictions and other standard setting bodies” on VASP regulation implementation issues as they relate to stablecoins.
Sanctions evasion
The FATF has recognised the potential for the anonymity of virtual assets to aid attempts at sanctions evasion – although liquidity limitations have prevented this happening on a large scale. With that in mind, the FATF has noted that the Travel Rule is vital in helping VASPs identify counterparties involved in transactions.
Ransomware
The criminal use of virtual assets is often linked to ransomware money laundering, with criminals using non-compliant VASPs to transform illegal proceeds. In addition to implementing the Travel Rule, the FATF has highlighted opportunities to use blockchain analytics technology to trace ransomware-related money laundering.
VASP Compliance: Next Steps
The FATF has urged member states and jurisdictions to “lead by example” in order to promote the implementation of the Travel Rule by encouraging VASPs to share knowledge and good practices. In particular, the FATF has highlighted the importance of technological solutions in achieving Travel Rule compliance and especially in cross-border compliance. Similarly, the FATF suggests that the private sector should work to “facilitate interoperability across Travel Rule technological solutions”.
In order to comply with the Travel Rule, and adapt to the changing landscape of virtual asset regulations, VASPs and other obligated entities must implement suitable risk management solutions to analyse vast amounts of customer and transaction data. Ripjar’s Labyrinth platform is designed with that requirement in mind, integrating advanced screening software and machine learning systems capable of capturing data in real time from across the world – and ensuring that your organisation is informed as soon as its risk exposure changes.
To learn how Ripjar can help you comply with the FATF’s virtual assets guidance, contact us today.
On 1 July 2022, T. Raja Kumar became the first Singaporean president of the Financial Action Task Force (FATF), succeeding the outgoing German Presidency of Dr Marcus Pleyer. President Kumar brings a depth of experience to his role at the head of the inter-governmental anti-money laundering authority, including senior leadership roles in Singapore’s police force and Ministry of Home Affairs. Kumar described his new position as “an honour and a privilege” and stated that the FATF Singapore Presidency would “focus on enhancing the effectiveness of anti-money laundering and counter-terrorist financing measures across FATF member jurisdictions and the wider Global Network”.
Reinforcing FATF partnerships with FATF-stye regional bodies (FSRB)
Given the important role that the FATF plays in setting global anti-money laundering (AML) and counter-financing of terrorism (CFT) policy and regulations, it is important that banks and financial institutions become familiar with the FATF’s objectives under the Singapore Presidency.
With that in mind, we’re taking a closer look at the key points of interest raised in the FATF’s recently published Objectives for 2022-2024.
Cyber-Enabled Crime
The FATF Singapore Presidency recognised that cyber-enabled crime (cybercrime) has dominated the financial compliance landscape since 2020 – and will only continue to increase in sophistication. If authorities do not implement strategies to address the threat, the Singapore Presidency notes that more criminal organisations will engage in cybercrime, and pose a growing threat to global financial stability.
Given that threat, and the potential for criminals to take advantage of new technologies to perpetrate sophisticated crimes, the Singapore Presidency will introduce a new initiative focusing on money laundering and terrorism financing strategies that are linked to cyber-enabled crimes such as frauds and scams. The initiative will:
Seek to understand the challenges associated with cybercrime AML/CFT.
Analyse the types of money laundering techniques used in relation to cybercrime.
Identity appropriate tools to fight cybercrime, including data analytics and industry partnerships.
Highlight best practices to help FATF members learn how to fight cybercrime-related money laundering and terrorism financing.
Global AML Measures
The FATF Singapore Presidency has announced that “increasing the effectiveness of AML/CFT measures” will be a key focus of its role. It has committed to continuing and completing the FATF’s existing work plans which include a review of FATF standards to ensure that they remain relevant and up to date, and undertaking groundwork for the fifth round of FATF mutual evaluations. In more detail, the work plans will include:
Virtual assets: The FATF will monitor the new money lanudering and terrorism financing risks relating to virtual assets and virtual asset service providers (VASP). The work will include the implementation of best practices and mitigation measures, and efforts to ensure that countries are able to apply FATF recommendations to virtual assets.
Beneficial ownership: The FATF will oversee the completion of new guidance on amendments to FATF recommendations on beneficial ownership information for trusts and other legal arrangements.
Data analytics: The FATF will promote the adoption of data analytics by financial authorities by “sharing and focusing on” case studies.
Risk awareness: The FATF will continue to raise awareness of money laundering and terrorism financing risks associated with environmental crime, the illegal wildlife trade, and grand and systemic corruption.
Strategic Review outcomes: Following the FATF Strategic Review in April 2022, the Singapore Presidency will work to implement the relevant outcomes. This effort will include updating training materials and making sure that financial experts are available to conduct effective mutual evaluations and reviews based on these new areas of assessment focus.
In continuing the FATF’s work plans, the Singapore Presidency will also focus on strengthening a culture within the FATF that identifies best practices quickly and that drives AML/CFT effectiveness by sharing knowledge.
Additional AML/CFT Priorities
In addition to the key cyber-enabled crime initiative and the implementation of ongoing FATF work plans, the Singapore Presidency has committed to a number of additional operational initiatives.
Asset Recovery
The FATF Singapore Presidency has indicated that it will help countries enhance asset recovery related to financial crimes – and in particular from “fraud, scams, and ransomware”. The FATF will conduct an assessment of current asset recovery networks in order to develop strong operational systems and to encourage “substantive changes” in the way that countries approach the asset recovery process. The effort will include increased collaboration between the FATF, FSRBs and asset recovery networks, and cooperation with strategic partners such as the UN, the IMF and INTERPOL. The FATF will convene a Global Roundtable with law enforcement agencies, regulators and investigators in order to focus on actionable changes.
FSRB Partnerships
Building on the work of the German Presidency, the FATF Singapore Presidency will seek to closely partner with FSRBs in order to strengthen the FATF’s Global Network in the fight against money laundering and the financing of terrorism. The Singapore Presidency will aim to focus on the specific needs of FSRBs, their current levels of expertise, and the next round of mutual evaluations.
FATF Compliance
The FATF Singapore Presidency’s priorities indicate a growing focus on the risk of cybercrime, and a need for banks and financial service providers to respond to the sophistication of criminal money laundering methodologies. With that in mind, organisations should seek to implement a risk management solution capable of capturing a broad range of risk data in a constantly-changing regulatory environment, and do so with a global perspective by incorporating information from foreign sources.
Ripjar’s Labyrinth Screening solution is designed to meet that requirement, integrating cutting-edge compliance technology and machine learning tools. Labyrinth includes next generation adverse media screening enabling clients to match customer names against a spectrum of foreign language news stories and stay informed of changes to risk profiles – before that news is confirmed by domestic outlets or even official sources.
The HKMA compiles the report following the recommendation of the Financial Action Task Force (FATF) that jurisdictions identify the financial crime risks that they face and deploy suitable risk mitigation measures. Hong Kong is home to some of the world’s largest banks and financial institutions and holds total assets worth around HK$26.4 trillion. Since the city has developed its status as international finance, trade, and transportation hub, the ML/TF report is an important feature of Hong Kong’s anti-money laundering (AML) and counter-financing of terrorism (CFT) framework. The HKMA points out that, while the city’s “longstanding strengths” bring advantages, they also attract criminals that seek to abuse and exploit the financial system.
The first version of the ML/TF report was released in 2018 while the second version was completed in 2021: the 2021 report reflects the ways in which the financial landscape has “continued to evolve” in relation to new threats and influences and, in particular, to new technologies. In his introduction to the 2021 report, Hong Kong’s financial secretary, Paul MP Chan, outlined the new risks facing the city’s banks and financial service providers, including those posed by virtual assets – along with the “robust and effective” responses the regulator has implemented in order to deal with them.
Hong Kong Money Laundering Predicate Offences
The ML/TF report examined the criminal detail behind Hong Kong’s money laundering activity from 2016 to 2020. As part of that examination, the report broke down the Hong Kong authorities’ money laundering investigations by the type of predicate offence involved – that is, the illegal activity that generated the funds that criminals needed to launder.
According to the report, between 2016 and 2020, 9197 money laundering investigations were initiated in Hong Kong for the following predicate offences:
72.6% for fraud related crimes
19.2% for no identified predicate offences
1.4% for drug related crimes
1.2% for corruption
1.2% for tax crimes
0.93% for robbery, burglary, theft, and blackmail
0.8% for goods smuggling (eg, illegal wildlife trading)
0.4% for seriously gambling offences
0.3% for loansharking
0.2% for vice
0.04% for human smuggling and trafficking
1.3% for crimes not listed above
When compared to 2018, the 2021 report suggests that Hong Kong’s money laundering threat landscape has not changed significantly in terms of methodology. While there was an increase in the number of money laundering investigations, that change is likely a result of the increased amount of online transactions caused by Covid-19 restrictions and the influx of new financial services provided by virtual banks.
While the typologies of predicate offence remained broadly unchanged, the HKMA noted that criminals were increasingly “taking advantage of the online platform” in order to commit fraud – a trend partly motivated by pandemic-related factors and the emergence of new technologies such as virtual assets. The HKMA noticed other changes in criminal behaviour emerging from the pandemic, including the increase in drugs transported into Hong Kong via air and sea – as a result of land-based travel restrictions.
Banking Challenges
The 2021 report focuses on the specific money laundering threats against Hong Kong’s banking system, emphasising the sector’s increasing reliance on digital payment channels and remote customer onboarding as risk factors. With that in mind, major money laundering threats to Hong Kong’s banking sector in 2021 included
Online fraud (and fraud related to Covid)
Corruption and tax crimes
Remote onboarding (virtual banks and conventional using online)
Mule accounts
Payment systems new payment methods
Virtual Assets
The report notes that the rapid increase in the use of virtual assets (VA), such as cryptocurrencies, poses ‘significant ML/TF risks to the international financial system’ – and to Hong Kong, which is described as having ‘significant VA activities’. The threat posed by VA is predominantly a result of their anonymity and decentralisation of cryptocurrency transactions, and lack of safeguarding compared to fiat currencies. Data suggests that the number of financial crimes involving VA has increased in Hong Kong, with 739 cases reported in the first 8 months of 2021, compared to 494 in the entirety of 2020.
The report found that the money laundering risks associated with VA in Hong Kong primarily affect trading platforms or cryptocurrency exchanges, which allow international money launderers to access services anonymously or use mules to conduct transactions on their behalf. Similarly, criminals are able to conceal the source of the funds they use on exchanges by using anonymous wallets – further complicating subsequent efforts by law enforcement during ML investigations.
The report also cited crypto ATMS, ICOs, and peer-to-peer trading platforms as potential ML vulnerabilities but noted that the risk they posed in Hong Kong was limited.
Addressing Hong Kong’s Money Laundering Challenges
In response to the ML/TF threats set out in the report, the HKMA emphasised the need for banks to take a risk-based approach to AML/CFT. The risk-based approach requires banks and financial institutions to assess their customers individually to determine the level of risk they present, and then deploy an appropriate AML/CFT response.
With that process in mind, the HKMA has issued numerous guides and advisories to financial institutions in the city and made AML/CFT resources available, such as the Anti-Money Laundering and Counter-Financing of Terrorism Guideline, which was updatesd in 2018. In response to the increasing complexity of the financial landscape, the HKMA has focused heavily on virtual banks and other fintech service providers – including taking steps to ensure that these entities establish ‘robust ML/TF risk management controls and comprehensive independent assessments of their AML/CFT systems’. Hong Kong’s Securities & Futures Commission introduced a licensing regime in 2019 to manage the growth of the city’s VA trading platforms. The licensing criteria includes requirements to implement a range of ML/TF compliance controls, including know your customer (KYC), cybersecurity, and risk management measures. Similarly, Hong Kong’s government has introduced a proposal for a licensing regime for all virtual asset service providers (VASP): the regime will include a ‘fit and proper test’ that will require VASPs to appoint AML/CFT officers responsible for ensuring regulatory compliance.
Implement Next Generation Risk Management
Achieving compliance with Hong Kong’s AML/CFT regulations requires banks, financial institutions, and VASPs to collect and analyse vast amounts of customer and transaction data in an increasingly complex and challenging regulatory landscape. Ripjar’s next generation Labyrinth risk management solution has been developed with that capability in mind, integrating cutting edge compliance technology and real time data screening to ensure your business stays ahead of criminal trends, and is able to adapt to incoming regulations.
On 30 June 2022, the European Union reached a provisional agreement on a landmark regulatory framework for the cryptocurrency industry, featuring new EU crypto regulations. The framework, known as Markets in Crypto Assets (MiCA), will regulate unbacked crypto-assets and stablecoins along with the cryptocurrency exchanges and wallets in which those assets are held, and will introduce a range of new compliance requirements for service providers. MiCA follows the introduction of the Transfer of Funds Regulation (TFR) which passed on 29 June and which focuses on anti-money laundering (AML) and counter-financing of terrorism (CFT) protections for cryptocurrency service providers.
Expected to come into effect in 2024, MiCA and the TFR are intended to create a harmonised regulatory regime for cryptocurrency service providers in all EU member states. These new EU crypto regulations are legislatively intertwined, with aspects of the TFR only applicable via MiCA.
Understanding the EU’s Crypto Regulations
What is MiCA?
Markets in Crypto Assets represents the EU’s first attempt at implementing a comprehensive regulatory regime for digital assets, ensuring a high level of consumer protection, market integrity, and financial stability across the industry. The proposed regulation was passed following a series of high profile stablecoin collapses, including the TerraUSD crash that saw over $200 billion wiped off the crypto market in a single day. Under MiCA, the following rules will come into effect:
Issuers of stablecoins will be required to build up and maintain a sufficient liquid reserve to ensure redemption requests from holders can be honoured, even in the event of a mass withdrawal.
Crypto-asset service providers will be required to obtain authorisation from a national authority in order to operate.
The European Banking Authority (EBA) will create and maintain a public register of crypto-asset service providers that are found to be non-compliant with the regulations.
What is the TFR?
The Transfer of Funds Regulation is intended to address the anonymity risks that are associated with cryptocurrency transactions and that criminals frequently exploit to launder money and fund terrorist activities. The regulation reflects Financial Action Task Force (FATF) Recommendation 16, known as the ‘Travel Rule’, which requires financial service providers to trace cross-border transfers of funds as part of their Know Your Customer (KYC) process. Under the Transfer of Funds Regulations, the following rules are in effect:
Cryptocurrency exchanges are required to obtain the personal data of all parties involved in crypto asset transfers. The requirement applies regardless of the size of the transfer.
The personal data collection requirement also applies to transactions involving unhosted wallets that are not managed by crypto exchanges when those transactions exceed €1,000.
Before assets can be released to a beneficiary, service providers must screen to ensure that the beneficiary is not designated on any sanctions lists or subject to other restrictive measures.
Cryptocurrency exchanges must provide the personal data that they collect to authorities when requested.
TFR rules will not apply to cryptocurrency transactions conducted directly between private wallets – only those that involve an exchange platform. Prior to the introduction of the TFR, cryptocurrency transactions were subject to the FATF Travel Rule but only in cases where funds were equal to or greater than $3,000.
MEP Assita Kanko emphasised the compliance benefits of the TFR in addressing money laundering, terorrism financing and other serious financial crimes: “Today, we have taken a big step to address these problems. It will be much harder to misuse crypto-assets and innocent traders and investors will be better protected. The extended travel rule will make that world safer”.
5AMLD set out a legal definition of cryptocurrency and applied existing AML/CFT regulations to crypto assets and exchanges. The directive also required crypto service providers to register with their domestic financial authorities.
5AMLD gave national financial intelligence units (FIU) the authority to obtain the personal details of cryptocurrency holders from service providers.
6AMLD introduced 22 new predicate offences – requiring crypto service providers to expand the scope of their AML/CFT screening and monitoring.
6AMLD also extended criminal liability for money laundering offences to senior management figures – meaning that crypto service providers must ensure their leadership retains oversight of AML/CFT controls.
While the UK is likely to align closely with the new EU crypto regulations, there are indications that it may diverge from its continental counterpart, or even introduce more stringent cryptocurrency compliance measures in the future. In January 2022, for example, the UK Treasury strengthened financial advertising regulations in order to bring cryptocurrencies into line with other types of financial promotion. In April 2022, the UK government announced that it would be bringing stablecoins into the scope of AML/CFT regulations. As part of the government’s ambition to make the UK a global hub for crypto-asset technology, it also announced that it would be introducing a financial market infrastructure sandbox to help crypto firms innovate within the UK’s regulatory environment.
To discover how Ripjar can help you comply with the EU’s crypto AML regulations, contact us today.
