Almost a year since the Financial Action Task Force (FATF) issued its guidelines on virtual assets, international standards for anti-money laundering continue to develop, with efforts becoming more concerted across national borders and more responsive to industry growth. To explore how the blockchain industry is responding to increasing governance and developments in oversight, we reached out to David Jevans, CEO and co-founder of CipherTrace.
As a serial entrepreneur in crypto, security and fintech, Jevans previously founded the encryption companies Receipt.com and IronKey. He also personally holds 17 U.S. patents, mainly in the areas of cybersecurity and cryptography. Jevans first became involved in cryptocurrencies in 1999. More recently, he has been advising Congress on blockchain security, internet fraud and cybersecurity.
The following Forkast interview with Jevans has been edited and condensed.
As we approach the one-year mark since FATF unveiled its risk-based framework for virtual currencies, how has the industry responded to governance?
With more than 200 countries agreeing to implement FATF mandates, the global anti-money laundering and anti-terrorist financing watchdog wields significant international influence. In June 2019, FATF proposed new guidelines requiring Virtual Asset Service Providers (VASPs) to store and share personal information about senders and receivers of cryptocurrency transactions, including names and account numbers of both parties and the sender’s physical address, national ID number, customer ID number, or birthdate and sometimes even place of birth. Such personal information is generally not expected to be shared and recorded in cryptocurrency transactions, which presents a difficult quandary for VASPs if they are to achieve compliance. The industry has responded positively, however, creating working groups to develop open-source information sharing systems. We have released TRISA (Travel Rule Information Sharing Architecture) as open-source to support VASPs in securely sharing sender and receiver information without compromising privacy.
See related article: How the FATF’s travel rule could push cryptocurrency into the mainstream
What are some of the compliance risks that banks face, and what is the impact on the industry?
A major risk that banks face is not recognizing that Virtual Asset Service Providers are Non-Bank Financial Institutions and failing to identify payments with VASPs. As such, these transactions carry additional money-laundering risks.
Banks must follow all anti-money laundering (AML) regulations and ensure they are abiding by international sanctions, or risk fines and other enforcement actions. The Office of the Comptroller of the Currency (OCC) recently took enforcement action against New York-based bank M.Y. Safra Bank (MYSB) for lack of crypto AML compliance and inadequate vetting of cryptocurrency customers. Though MYSB did not get levied with a fine, the actions they are being required to take will inevitably be expensive. MYSB must appoint a compliance committee within 30 days and train its board and employees on BSA laws within 45 days. Within 90 days, the board will be required to implement an independent BSA audit, monitor and report suspicious activity, and institute an independent party to review past activities. Within 180 days, it will have to hire a BSA officer and sufficient supporting staff.
Enforcement action can also occur against individuals, as it did in the case of Michael LaFontaine, former chief operational risk officer at U.S. Bank. LaFontaine was personally fined $450K for negligence in failing to intercept breaches of the Bank Secrecy Act (BSA).
Banks and other financial institutions are wary of cryptocurrency customers due to the additional challenges posed by the pseudonymous nature of many cryptocurrency transactions. But there is now cutting-edge blockchain forensics technology that can identify criminal activity and non-compliant behaviors on behalf of financial institutions.
How have different governments engaged with crypto?
The introduction of Project Libra sparked an acute interest in digital currencies worldwide. China is moving especially quickly to roll out its central bank digital currency (CBDC), and Sweden and the Bahamas have all launched trials to test their own digital sovereign currencies. If the digital yuan is implemented via the country’s expansive 60-country Belt and Road initiative, it could become an instant global currency. The United States Congress recently proposed a “digital dollar” in a version of the House Stimulus Bill that wasn’t ultimately included in the approved bill; however, the House was onto something with the idea. In the midst of a global pandemic that is spread via physical contact, a digital currency would dramatically reduce exposure to Covid-19 and allow the U.S. government to disperse much-needed value to its citizens faster.
Given the reality of the rapid digitization of the global economy, a transition to digital currencies is inevitable. That said, the countries that move with expedience on implementation will have a leg-up on establishing economic influence. China has long desired to unseat the U.S. dollar as the default international reserve currency; swift implementation of a more efficient, easier-to-transact digital yuan could enable China to finally achieve that aim, unless the United States and other global powers take immediate action.
Why is cracking down on bad actors so important, and is doing so integral to legitimizing cryptocurrency?
From Silk Road to ongoing bitcoin ransom schemes, the crypto community has experienced a PR problem. VASPs and other financial institutions dealing with cryptocurrencies need to implement strong measures to ensure compliance, security and privacy in order to alter the perception that cryptocurrency is somehow criminal. In actuality, it is easier to track criminals using pseudonymous cryptocurrency networks like Bitcoin than it is to track anonymous cash transactions. That said, bitcoin is increasingly becoming the preferred currency of criminals. This is partly due to the disappearing options for offloading cash and simultaneous increasing options for paying with bitcoin. There are nearly 4,000 bitcoin ATMs in the United States alone, for example. If VASPs institute appropriate AML compliance measures, suspicious activities can be identified early and bad actors ferreted out.
There are compelling arguments for both sides of the debate on whether regulatory authorities should be more heavy-handed and issue more comprehensive guidelines with oversight of distributed ledger technologies. How do you think regulatory agencies should act going forward? How do you think they will act?
Regulators should make informed decisions based on data and balance fostering innovations with consumer safety concerns.
It is the job of regulatory authorities to protect people from illicit activities, terrorist financing fraud and investment scams, but by coming down too forcefully regulators could create an environment that is unfriendly to entrepreneurs and lose crypto businesses to nations seen to have more crypto-friendly regulatory regimes, such as Bermuda or Malta. This is called regulatory arbitrage. It’s worth noting, however, that even these so-called crypto hot spots must ensure any entity operating under their jurisdictions is abiding by international sanctions and AML requirements.
Ultimately, regulatory agencies need to walk the fine line between enforcing compliance with AML standards without violating the privacy right of individuals and corporations. It may not be practical to apply the same regulations on cryptocurrency companies as traditional financial institutions. Moreover, it may not even be necessary to implement all of the regulatory controls given the capability of advanced blockchain analytics products.
In what ways could blockchain play a role in the current coronavirus crisis? For example, processing medical insurance claims, tracking medical supplies or even vaccine research?
Beyond introducing digital sovereign currencies to reduce in-person contact in value transactions, governments could use blockchain technology to track sensitive information pertaining to the spread of the coronavirus without revealing personally identifying information. For example, it’s important for governments to know how many cases of Covid-19 exist in a given area in order to make decisions about PPE (personal protection equipment) allocations, but they don’t need to know who has the virus nor have access to patients’ entire health histories. This information should be accessible to health care providers, however, who need this type of data to make informed treatment decisions. Secure and efficient data sharing is one of the main advantages of blockchain technology, which could be deployed to develop such systems.
IMF chief Kristalina Georgieva has declared a global recession that rivals or even exceeds the magnitude of the 2009 financial crisis. How do you expect this to impact the blockchain space, and what steps can we take to ameliorate its effects?
Blockchain companies are by no means immune to the economic impacts of the coronavirus crisis. That said, many blockchain companies are ahead of the curve by already having remote work processes in place. For our part, we were fortunate to already have virtual work systems in place with multiple cloud providers for redundancy and two-factor authentication to ensure security. Despite the additional strain of remote work and fewer venture capital investments coming from overseas, I’m confident that the companies with resilient operational systems will find a way to get through this period of uncertainty.
Though no one wishes for hard times, global challenges like the coronavirus pandemic can reveal holes in our existing systems that can lead to lasting change. The very idea of Bitcoin, for example, emerged from the 2009 financial crisis — an innovation that led to the plethora of blockchain-powered systems and platforms to serve industries as wide-ranging as healthcare, entertainment, finance and governance.
We at CipherTrace believe that this recession, and the Covid-19 crisis, will accelerate the use of blockchain to build central bank digital currencies in the coming years. Every country will issue one within 10 years.