Published in Law360 on February 7, 2023. © Copyright 2023, Portfolio Media, Inc., publisher of Law360. Reprinted here with permission.
The Dec. 14, 2022, introduction of the Digital Asset Anti-Money Laundering Act[1] by Sens. Elizabeth Warren, D-Mass., and Roger Marshall, R-Kan., marks the end of a tumultuous year in the cryptocurrency industry that saw a massive contraction in market cap and criminal and civil charges levied against the CEO of one of the world's largest cryptocurrency exchange platforms.[2]
If passed, the act would dramatically change how the federal government regulates cryptocurrency entities by recategorizing certain cryptocurrency firms as money services businesses, thereby broadening the reach of anti-money laundering statutes like the Bank Secrecy Act and regulations like the know-your-customer requirements.[3]
Further, it would ban the use of anonymity-enhancing technologies in cryptocurrency transactions.[4] While cryptocurrency exchanges are already regulated under the current scheme, the vast majority of cryptocurrency industry participants, such as wallet providers and miners, have to this point evaded federal regulation. The act seeks to bring the entire industry under the federal regulatory umbrella.
The act also would require the Financial Crimes Enforcement Network of the U.S. Department of the Treasury to adopt a proposed rule that would amend existing know-your-customer requirements by placing greater record-keeping and recording responsibilities on money services businesses whose customers transact with certain cryptocurrency entities.[5]
FinCEN had previously proposed a rule that would, among other things, amend the Bank Secrecy Act's definition for monetary instruments to include cryptocurrency and require banks and money services businesses to file reports for cryptocurrency transactions valued at $10,000 or higher. This proposed rule has not yet been adopted but would be if the act becomes law.
These proposed changes to the existing federal scheme for the cryptocurrency industry would likely impose significant costs on cryptocurrency entities to create or update anti-money laundering and know-your-customer programs.[6]
Firms failing to do so would run the risk of financial liability, as FinCEN can assess massive civil money penalties on firms that fail to comply with Bank Secrecy Act and know-your-customer requirements.[7] Additionally, FinCEN proceedings can run parallel to and assist criminal investigations, which could create dual civil-criminal liability for violating firms.[8]
Although the act fails to provide guidance on whether cryptocurrency is a commodity or a security,[9] and therefore does not clarify whether cryptocurrency would be subject to regulation[10] by either the Commodity Futures Trading Commission or the U.S. Securities and Exchange Commission, or both, it hedges future resolution of this distinction by imposing identical requirements on both agencies[11] and demonstrates that Congress is intent on reining in an industry predicated, at least in part, on unregulated transactions.
Whether the act passes into law remains to be seen. However, it is likely that further regulation in this industry is on the horizon, and companies in the cryptocurrency space should take note of the act and at a minimum view it as a harbinger of what is to come as they assess whether they need to create or update an anti-money laundering compliance program.
The Current Anti-Money Laundering Regulatory Scheme and Cryptocurrency
Congress imposes record-keeping and reporting requirements on financial institutions through the Bank Secrecy Act and its corresponding know-your-customer requirements to prevent illicit money laundering.[12]
The requirements apply to financial institutions as defined by the regulations.[13] A money services business is one such financial institution under the regulations.[14]
As such, a money services business is required to verify customer identification, file currency transaction reports, keep certain records and respond to law enforcement requests.[15] Cryptocurrency exchanges like Binance already are registered as money services businesses with FinCEN under the current scheme.[16]
FinCEN, which is a bureau within the Department of the Treasury that has the authority to enforce compliance with the Bank Secrecy Act and know-your-customer requirements,[17] can impose civil money penalties on firms that violate these anti-money laundering statutes and regulations[18] and help support criminal investigations by the U.S. Department of Justice.[19]
The danger of FinCEN civil money penalties is not to be overlooked — such penalties can run into the tens of millions. For example, FinCEN recently assessed a roughly $29 million penalty on another cryptocurrency exchange, Bittrex, for failing to develop an effective anti-money laundering program.[20]
FinCEN also has the authority to augment the anti-money laundering regime by promulgating rules.[21] FinCEN issued a notice of proposed rulemaking concerning the cryptocurrency industry on Dec. 23, 2020.[22]
The proposed rule, which has not yet been finalized, would not only define cryptocurrency as a "monetary instrument" under the Bank Secrecy Act and require banks and money services businesses to file reports for cryptocurrency transactions valued at $10,000 or higher, but also would reach those persons and entities that store their cryptocurrency in so-called unhosted wallets.[23]
Specifically, the new FinCEN rule would require banks and money services businesses to keep records and verify the identity of their hosted wallet customers when such customers engage in transactions greater than $3,000 with unhosted wallet-holders.[24]
If adopted, this proposed FinCEN rule would therefore significantly expand the universe of regulated cryptocurrency transactions by regulating peer-to-peer transactions and the decentralized applications that facilitate these transactions. By the terms of the act, this FinCEN proposed rule would be adopted if the act becomes law.
Digital Asset Anti-Money Laundering Act and Its Implications
As summarized above, the recently proposed act would bolster FinCEN's role in regulating cryptocurrency while also bringing more facets of the cryptocurrency industry under federal anti-money laundering regulatory scrutiny.
In fact, a closer look at the act reveals that the increased role of FinCEN is specifically contemplated by the bill. Indeed, the very first sentence of the act "require[s] the Financial Crimes Enforcement Network to issue guidance on digital assets."[25]
The act further directs FinCEN to adopt a rule categorizing the following entities as money services businesses: custodial and unhosted wallet providers, cryptocurrency miners, validators "or other nodes who may act to validate or secure third-party transactions," independent network participants, and "other validators with control over network protocols."[26] FinCEN would also be required to adopt its Dec. 23, 2020, proposed rule described above.[27]
Additionally, the act directs the Treasury Department to adopt a rule banning financial institutions from using so-called mixers, or anonymity-enhancing technologies, and from handling cryptocurrency that passed through a mixer.[28]
Cryptocurrency mixers collect together cryptocurrency deposits by many users and blend or stir the source funds together and then withdraw the funds to new wallet addresses under the control of each user that are different from the original wallet addresses that contained the deposits.
This process obscures the public origin and destination of cryptocurrency and attempts to anonymize the identity of the original holder. Mixers have already been the focus of federal regulators: FinCEN assessed a $60 million civil money penalty in 2020 on a cryptocurrency mixing firm that facilitated purchases of illegal drugs and permitted bitcoin laundering.[29]
It has been, to this point, unclear which federal agency should be the primary regulator of the cryptocurrency industry. Both the CFTC and the SEC have taken a role in regulating certain cryptocurrencies — with some cryptocurrencies classified as commodities,[30] and thus subject to CFTC regulation, while other cryptocurrencies have been classified as securities, and thus subject to SEC regulation.
The proposed act seems to intentionally do little to clear up this ambiguity. It does not purport to curtail or enlarge the CFTC or the SEC's jurisdiction to regulate cryptocurrency.[31] It only imposes identical monitoring requirements on both the CFTC and the SEC to create programs that monitor compliance with anti-money laundering regulations.[32]
Further demonstration of this agnostic approach to the cryptocurrency regulatory powers of the CFTC and SEC is the act's inclusion that each agency monitor entities "[already] regulated" by the respective commissions.[33]
Passage of the act would certainly impose significant compliance responsibilities and costs on large segments of the cryptocurrency industry. The cryptocurrency wallet market in the U.S. has an estimated value of $2 billion.[34] The U.S. constitutes 38% of global bitcoin mining,[35] an industry that yields over $12 million per day.[36]
Large firms that operate mining services and unhosted wallets would be exposed to the high costs of compliance with anti-money laundering regulations. To illustrate, LexisNexis issued a report in September 2022, estimating that North American firms spent $56.7 billion from May 2021 to May 2022 to comply with anti-money laundering statutes and regulations.[37]
Even firms that were previously regulated under the existing federal scheme, such as cryptocurrency exchanges, would see increased compliance costs because of the act's requirement that FinCEN adopt its rulemaking on record-keeping and reporting for unhosted wallet transactions.
A prohibition of mixer or otherwise anonymity-enhancing technology use would also greatly impact the cryptocurrency industry and potentially exclude billions of dollars in cryptocurrency from the U.S. market.
Chainalysis published a report estimating that mixing services received roughly $4.5 billion during the first two quarters of 2022.[38] And while a large portion of this funding came from illicit sources, not all cryptocurrency fed through mixers originate from illicit sources; centralized exchanges use mixers as well.[39]
Prohibiting financial institutions from handling mixed cryptocurrency could decrease money laundering, but it would radically change an industry inextricably tied to decentralized transactions and privacy among transacting parties.[40]
The act's failure to elevate either the CFTC or the SEC as the main regulatory authority for cryptocurrency may signal that Congress is interested in regulating as many aspects of the industry as is practicable, or it may be tacit recognition of the fact that whether cryptocurrency is a commodity or a security is a complicated issue that is not yet ripe for resolution.
Either way, the dual monitoring requirements levied by the act on both the CFTC and SEC[41] demonstrate an intent to employ both regulatory bodies in the fight against money laundering.
Conclusion
The Digital Asset Anti-Money Laundering Act is a bipartisan piece of legislation that on its face appears to be aimed at preventing the perpetration of illegal activity through cryptocurrency transactions.
The introduction of the act caps a year in which the SEC and a separate group of bipartisan senators proposed new methods of regulating cryptocurrency under existing federal financial enforcement statutes, and in which cryptocurrency prosecutions and civil suits have been making headlines and causing shockwaves in the entire cryptocurrency industry.
While it is unclear whether the act will pass into law, individuals and companies operating in the cryptocurrency space should be mindful of the proposed changes the act would bring.
It seems likely that Congress, the CFTC and the SEC will continue to seek further regulation of the entire industry, and that some aspect of that regulation will focus on anti-money laundering. Those entities that are operating in the cryptocurrency space would do well to evaluate their anti-money laundering protocols and consult with experienced counsel to be prepared for the likely changes in the regulatory landscape.
[1] Press Release, Senator Elizabeth Warren, Warren, Marshall Introduce Bipartisan Legislation to Crack Down on Cryptocurrency Money Laundering, Financing of Terrorists and Rogue Nations (Dec. 14, 2022), https://www.warren.senate.gov/newsroom/press-releases/warren-marshall-introduce-bipartisan-legislation-to-crack-down-on-cryptocurrency-money-laundering-financing-of-terrorists-and-rogue-nations.
[2] Jay Dubow, et al., Prosecutors and Regulators Announce Criminal Charges and Civil Enforcement Actions Against Sam Bankman-Fried Following FTX Collapse, Troutman Pepper (Dec. 16, 2022), https://www.troutman.com/insights/prosecutors-and-regulators-announce-criminal-charges-and-civil-enforcement-actions-against-sam-bankman-fried-following-ftx-collapse.html.
[3] S. _____, 117th Cong. § 3(a) (2022).
[4] S. _____, 117th Cong. § 3(d)(1) (2022).
[5] S. _____, 117th Cong. § 3(b) (2022).
[6] True Cost of Financial Crime Compliance Study Global Report, LexisNexis, https://risk.lexisnexis.com/global/en/insights-resources/research/true-cost-of-financial-crime-compliance-study-global-report (last visited Dec. 27, 2022) (noting $274.1 billion in global anti-money laundering compliance spending and $49.9 billion in North American anti-money laundering compliance spending).
[7] In the matter of Larry Dean Harmon, Assessment of Civil Money Penalty Number 20202, Financial Crimes Enforcement Network, December 19, 2020, at 7 (assessing a $60 million civil money penalty).
[8] Press Release, Dep’t of Just., Ohio Resident Pleads Guilty to Operating Darknet-Based Bitcoin ‘Mixer’ That Laundered Over $300 Million (Aug. 18, 2021) (on file with author).
[9] Jay Dubow, et al., SEC Scores Victory in Ongoing Effort to Classify Cryptocurrencies as Securities, Troutman Pepper (Nov. 17, 2022), https://www.troutman.com/insights/sec-scores-victory-in-ongoing-effort-to-classify-cryptocurrencies-as-securities.html.
[10] Senators Debbie Stabenow (D-MI), John Boozman (R-AR), Cory Booker (D-NJ), and John Thune (R-SD) proposed the Digital Commodities Consumer Protection Act of 2022 on August 3, 2022, which would expand the Commodity Futures Trading Commission’s jurisdictional reach to regulate cryptocurrencies that qualify as “digital commodities.” SEC Chairman Gary Gensler has publicly stated that many of the cryptocurrency tokens currently traded on popular exchanges likely meet the definition of “securities,” which would implicate the SEC’s regulatory authority. Congress’s two proposed bills and the SEC’s public comments demonstrate that Washington is intent on regulating the cryptocurrency industry.
[11] Compare S. _____, 177th Cong. § 4(b) (2022) with S. _____, 117th Cong. § 4(c) (2022).
[12] Bank Secrecy Act, Off. of the Comptroller of the Currency, https://www.occ.treas.gov/topics/supervision-and-examination/bsa/index-bsa.html (last visited Dec. 27, 2022).
[13] 31 C.F.R. § 1010.100(t).
[14] 31 C.F.R. § 1010.100(t)(3).
[15] 31 C.F.R. § 1022.210(d)(i).
[16] Licenses, Binance, https://support.binance.us/hc/en-us/articles/360050532193-Licenses (last visited Dec. 27, 2022).
[17] 31 C.F.R. § 1010.810(a). See also 31 U.S.C. § 5321(a); 31 U.S.C. § 5321(d); Treasury Order 180-01 (July 1, 2014).
[18] 31 C.F.R. § 1010.810(d).
[19] 31 U.S.C. § 310(b)(2)(C)(ii).
[20] In the matter of Bittrex, Inc., Assessment of Civil Money Penalty Number 2022-3, Financial Crimes Enforcement Network, October 11, 2022, at 4, 15.
[21] 31 U.S.C. § 310(b)(2)(J).
[22] 85 Fed. Reg. 83840 (proposed Dec. 23, 2020).
[23] “Hosted” wallets are cryptocurrency wallets housed in banks and registered money services businesses. “Unhosted” wallets are cryptocurrency wallets that are not linked to a bank or money services business and are instead operated by whichever individual holds the wallet’s private “key.” “Unhosted” wallet holders engage in peer-to-peer transactions, while “hosted” wallet holders engage in transactions that involve a regulated financial intermediary like a bank or money services business.
[24] 85 Fed. Reg. 83840, 83848 (proposed Dec. 23, 2020).
[25] S. _____, 117th Cong. (2022).
[26] S. _____, 117th Cong. § 3(a) (2022).
[27] S. _____, 117th Cong. § 3(b) (2022).
[28] S. _____, 117th Cong. § 3(d) (2022).
[29] In the matter of Larry Dean Harmon, Assessment of Civil Money Penalty Number 20202, Financial Crimes Enforcement Network, December 19, 2020, at 5, 7.
[30] Ethan Ostroff, et al., Bipartisan Responsible Innovation Act Limits Howey Test; Suggests Non-Depository Institutions May Issue Payment Stablecoins, Troutman Pepper (June 6, 2022), https://www.troutman.com/insights/bipartisan-responsible-innovation-act-limits-howey-test-suggests-non-depository-institutions-may-issue-payment-stablecoins.html.
[31] See S. _____, 117th Cong. (2022).
[32] Compare S. _____, 177th Cong. § 4(b) (2022) with S. _____, 117th Cong. § 4(c) (2022).
[33] S. _____, 177th Cong. § 4(b) (2022); S. _____, 117th Cong. § 4(c) (2022).
[34] Crypto Wallet Market Size, Share, & Trends Analysis Report by Wallet Type (Hot Wallet, Cold Wallet), by Operating System (Android, iOS, Others), by Application, by End Use (Individual, Commercial), by Region, and Segment Forecasts, 2022-2030, Grand View Rsch., https://www.grandviewresearch.com/industry-analysis/crypto-wallet-market-report (last visited Dec. 28, 2022).
[35] Press Release, White House, FACT SHEET: Climate and Energy Implications of Crypto-Assets in the United States (Sept. 8, 2022) (on file with author).
[36] Bitcoin Miners Revenue Per Day, YCharts, https://ycharts.com/indicators/bitcoin_miners_revenue_per_day (last visited Dec. 28, 2022).
[37] LexisNexis Risk Solutions Report Reveals the Yearly Cost of Financial Crime Compliance Reaching $56.7 Billion, a 13.6% Increase for Financial Institution in the United States and Canada Combined, LexisNexis Risk Sols. (Sept. 29, 2022), https://www.prnewswire.com/news-releases/lexisnexis-risk-solutions-report-reveals-the-yearly-cost-of-financial-crime-compliance-reaching-56-7-billion-a-13-6-increase-for-financial-institutions-in-the-united-states-and-canada-combined-301633828.html.
[38] Crypto Mixer Usage Reaches All-time Highs in 2022, with Nation State Actors and Cybercriminals Contributing Significant Volume, Chainalysis (July 14, 2022), https://blog.chainalysis.com/reports/crypto-mixer-criminal-volume-2022/.
[39] Id.
[40] See Emily Mason, U.S. Attack on Crypto Mixers Threatens Collateral Damage to Privacy, Forbes (Aug. 10, 2022), https://www.forbes.com/sites/emilymason/2022/08/10/us-attack-on-crypto-mixers-threatens-collateral-damage-to-privacy/?sh=1216fe695629.
[41] S. _____, 177th Cong. § 4(b) (2022); S. _____, 117th Cong. § 4(c) (2022).
