InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
NYDFS adds enhancements for detecting virtual currency fraud
On February 21, NYDFS Superintendent Adrienne A. Harris announced enhancements to the Department’s ability to detect fraud in the virtual currency industry. The new enhancements will improve NYDFS’s ability to combat financial crime and detect illegal activity among state-regulated entities engaged in virtual currency activity through new insider trading and market manipulation risk monitoring tools. Specifically, the enhancements will strengthen NYDFS’s virtual currency supervision and aid the Department in detecting potential insider trading, market manipulation, and front-running activity associated with regulated entities’ and applicants’ exposure or potential exposure to listed virtual currency wallet addresses. The announcement builds upon recently issued guidance related to the use of blockchain analytics tools, the issuance of U.S. dollar-backed stablecoins, and custodial guidance on crypto insolvency, as well as guidance for addressing measures for preventing market manipulation. (Covered by InfoBytes here, here, here, and here.)
NYDFS gives custodial guidance on crypto insolvency
On January 23, NYDFS reiterated expectations for sound custody and disclosure practices for entities that are licensed or chartered to custody or temporarily hold, store, or maintain virtual currency assets on behalf of customers (virtual currency entities or “VCEs”). NYDFS explained that under the state’s virtual currency regulation (23 NYCRR Part 200), VCEs operating under the BitLicense and Limited Purpose Trust Charter are required to, among other things, “hold virtual currency in a manner that protects customer assets; maintain comprehensive books and records; properly disclose the material terms and conditions associated with their products and services, including custody services; and refrain from making any false, misleading or deceptive representations or omissions in their marketing materials.”
The regulatory guidance on insolvency clarifies standards and practices intended to ensure that VCEs are providing high levels of customer protection with respect to licensed asset custody. Specifically, the guidance addresses customer protection concerns regarding:
- The segregation of and separate accounting for customer virtual currency. VCEs “should separately account for, and segregate a customer’s virtual currency from, the corporate assets of the VCE Custodian and its affiliated entities, both on-chain and on the VCE Custodian’s internal ledger accounts.”
- VCEs limited interest in and use of customer virtual currency. VCEs that take possession of a customer’s assets should do so “only for the limited purpose of carrying out custody and safekeeping services” and must not “establish a debtor-creditor relationship with the customer.”
- Sub-custody arrangements. VCEs may choose, after conducting appropriate due diligence, to safekeep a customer’s virtual currency through a third-party sub-custody arrangement provided the arrangement is consistent with regulatory guidance and approved by NYDFS.
- Customer disclosures. VCEs are “expected to clearly disclose to each customer the general terms and conditions associated with its products, services and activities, including how the VCE Custodian segregates and accounts for the virtual currency held in custody, as well as the customer's retained property interest in the virtual currency.” Additionally, a customer agreement should be transparent about the parties’ intentions to enter into a custodial relationship as opposed to a debtor-creditor relationship.
FinCEN prohibits engagement with virtual currency exchange connected to Russian finance
On January 18, the Financial Crimes Enforcement Network (FinCEN) issued its first order pursuant to section 9714(a) of the Combating Russian Money Laundering Act to identify a Hong Kong-registered global virtual currency exchange operating outside of the U.S. as a “primary money laundering concern” in connection with Russian illicit finance. FinCEN announced that the virtual currency exchange offers exchange and peer-to-peer services and “plays a critical role in laundering Convertible Virtual Currency (CVC) by facilitating illicit transactions for ransomware actors operating in Russia.” A FinCEN investigation revealed that the virtual currency exchange facilitated deposits and funds transfers to Russia-affiliated ransomware groups or affiliates, as well as transactions with Russia-connected darknet markets, one of which is currently sanctioned and subject to enforcement actions that have shuttered its operations. The investigation also found that the virtual currency exchange failed to meaningfully implement steps to identify and disrupt the illicit use and abuse of its services, and lacked adequate policies, procedures, or internal controls to combat money laundering and illicit finance.
Recognizing that the virtual currency exchange “poses a global threat by allowing Russian cybercriminals and ransomware actors to launder the proceeds of their theft,” FinCEN acting Director Himamauli Das emphasized that “[a]s criminals and criminal facilitators evolve, so too does our ability to disrupt these networks.” He warned that FinCEN will continue to leverage the full range of its authorities to prohibit these institutions from gaining access to and using the U.S. financial system to support Russian illicit finance. Effective February 1, covered financial institutions are prohibited from engaging in the transmittal of funds from or to the virtual currency exchange, or from or to any account or CVC address administered by or on behalf of the virtual currency exchange. Frequently asked questions on the action are available here.
Concurrently, the DOJ announced that the founder and majority owner of the virtual currency exchange was arrested for his alleged involvement in the transmission of illicit funds. Charged with conducting an unlicensed money transmitting business and processing more than $700 million of illicit funds, the DOJ said the individual allegedly “knowingly allowed [the virtual currency exchange] to become a perceived safe haven for funds used for and resulting from a variety of criminal activities,” and was aware that the virtual currency exchange’s accounts “were rife with illicit activity and that many of its users were registered under others’ identities.” While the virtual currency exchange claimed it did not accept users from the U.S., it allegedly conducted substantial business with U.S.-based customers and advised users that they could transfer funds from U.S. financial institutions.
Deputy Secretary of the Treasury Wally Adeyemo issued a statement following the announcement, noting that the action “is a unique step that has only been taken a handful of times in Treasury’s history for some of the most egregious money laundering cases, and is the first of its kind specifically under new authorities to combat Russian illicit finance.” He reiterated that the action “sends a clear message that we are prepared to take action against any financial institution—including virtual asset service providers—with lax controls against money laundering, terrorist financing, or other illicit finance.”
Crypto platform reaches $100 million settlement to resolve alleged compliance failures
On January 4, NYDFS issued a consent order against a cryptocurrency trading platform for engaging in alleged violations of New York virtual currency, anti-money laundering, transaction monitoring, and cybersecurity regulations. According to the consent order, in 2020, NYDFS found significant deficiencies across the respondent’s compliance program, including its Know-Your Customer/Customer Due Diligence (KYC/CDD) procedures, Transaction Monitoring System (TMS), OFAC screening program, and AML risk assessments. As a result of these findings, the respondent agreed to improve its BSA/AML and OFAC compliance programs, including engaging an independent consultant to develop a remediation plan and improve its compliance program.
In 2021, NYDFS launched an investigation to determine whether the respondent’s compliance deficiencies had resulted in any legal violations. The investigation found “substantial lapses in [the respondent’s] KYC/CDD program, its TMS, and in its AML and OFAC sanctions controls systems, as well as issues concerning [the respondent’s] retention of books and records, and with respect to meeting certain of its reporting obligations to the Department.” NYDFS noted that in late 2020 and 2021, the respondent took steps to remediate the issues identified by the Department and the independent consultant; however, substantial weaknesses remained, and its compliance system was inadequate to handle the growing volume of the respondent’s business.
Under the terms of the consent order, the respondent must pay a $50 million civil penalty to NYDFS and invest $50 million in its compliance program. Additionally, an independent third party will continue to work with the respondent for another year, which may be extended at the Department’s sole discretion. NYDFS noted that the respondent has already taken steps to build a more effective and robust compliance program under the supervision of NYDFS and the NYDFS-appointed independent monitor. According to the respondent’s press release, the company “has taken substantial measures to address these historical shortcomings” and “remains committed to being a leader and role model in the crypto space, including partnering with regulators when it comes to compliance and other areas.”
NYDFS reminds institutions to seek prior approval before engaging in virtual currency activities
On December 15, NYDFS released virtual currency guidance for regulated banking institutions and licensed branches and agencies of foreign banking organizations. NYDFS reminded covered institutions that they must seek prior approval at least 90 days before engaging in any new or significantly different virtual currency-related activity. The agency noted that this requirement also applies in situations where any portion of the activity will be handled by a third party. The guidance outlines the process institutions should observe for seeking prior approval and summarizes the following categories of information that the agency will consider when assessing proposals: business plan, risk management, corporate governance and oversight, consumer protection, financials, and legal and regulatory analysis. The guidance includes a supplemental checklist of initial documents and required information.
NYDFS reiterated that prior approvals “to engage in virtual currency-related activity does not constitute general consent for that institution to engage in other types of virtual currency-related activity, nor does it authorize other Covered Institutions to undertake that same activity.” Institutions already engaging in virtual-currency related activities should immediately notify NYDFS, if they have not already done so. The guidance, which is not intended to limit the scope or applicability of any law or regulation, is effective as of its release date and applies to all regulated institutions for all virtual currency-related activities.
NYDFS proposes virtual currency firms to pay supervision fees
Recently, NYDFS announced it is seeking public comment on a proposed rule establishing how certain licensed virtual currency businesses would be assessed for the costs of their supervision and examination. According to NYDFS, the proposed regulation establishes a provision in the state budget granting NYDFS new authority to collect supervisory costs from virtual currency businesses that are licensed pursuant to the Financial Services Law, and will permit NYDFS “to continue adding top talent to its virtual currency regulatory team.” The proposed regulation states that it will apply only to licensed persons engaged in virtual currency business activity and that the fees will only cover the costs and expenses associated with NYDFS's oversight of each licensee. Specifically, the draft regulation states that a licensee's total annual assessment fee will be the “sum of its supervisory component and its regulatory component” and that each licensee will be billed five times per fiscal year. According to the regulation, there will be four quarterly fees, each approximately 25 percent of the anticipated annual amount, and a final fee based on the actual total operating cost for the fiscal year. Comments on the proposed regulation are due March 20.
DFPI revokes crypto lending company's license; issues notice to suspend a different crypto lending company
On December 19 , the California Department of Financial Protection and Innovation (DFPI) announced that it has moved to revoke a cryptocurrency lender’s license. According to DFPI revoking the license "is the result of the department’s examination, which found that the New Jersey-based finance lender failed to perform adequate underwriting when making loans and failed to consider borrowers’ ability to repay these loans, in violation of California’s financing laws and regulations." DFPI previously announced on November 18 an order suspending a cryptocurrency lender’s California license for 30 days pending DFPI’s investigation. The suspension follows the DFPI’s notice to suspend issued on November 11, which was prompted by the cryprocurrency lender's November 10 announcement that it would limit platform activity, including pausing client withdrawals. DFPI noted that the cryptocurrency lender confirmed its “significant exposure to [a crypto asset platform]” and affiliated entities. DFPI further noted that the cryptocurrency lender expected “that the recovery of the obligations owed to us by [the crypto company] will be delayed as [the crypto company] works through the bankruptcy process.” According to the cryptocurrency lender, withdrawals would continue to be paused. DFPI also noted that in February 2022, the respondent was ordered to desist and refrain from offering or selling unqualified, non-exempt securities in the form of its interest accounts in California.
Later, DFPI issued an order suspending a different cryptocurrency lender’s license license for 30 days pending DFPI’s investigation into the respondent’s recent announcement to limit its platform activity, including pausing client withdrawals. The respondent had sent a communication to customers signed by the CEO, stating: “I am sorry to report that the collapse of [the cryptocurrency lender that was issued a notice to suspend from DFPI on November 10] has impacted our business. Until we are able to determine the extent of this impact with specific details that we feel confident are factually accurate, we have paused deposits and withdrawals on [its own platform] effective immediately.” DFPI also noted that it is “investigating the extent to which [the cryptocurrency lender] has been affected by the bankruptcy of [the cryptocurrency lender that was issued a notice to suspend from the DFPI on November 10] and related companies.”
OFAC updates FAQs related to sanctioned virtual currency “mixer”
On November 8, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) published one new and three amended cyber-related FAQs related to sanctions issued in August against a virtual currency mixer accused of allegedly laundering more than $7 billion. As previously covered by InfoBytes, OFAC claimed the company “repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis.” Newly added FAQ 1095 clarifies that a designated “person” under Executive Order 13722 or 13694 is a “partnership, association, joint venture, corporation, group, subgroup, or other organization.” Amended FAQs 1076, 1078, and 1079 (i) explain how persons can complete transactions or withdraw virtual currency without violating U.S. sanctions regulations; (ii) clarify whether OFAC reporting obligations apply to “dusting” transactions (wherein “certain U.S. persons may have received unsolicited and nominal amounts of virtual currency or other virtual assets from [the sanctioned company’s] smart contracts”; and (iii) outline prohibitions resulting from the sanctions.
OFAC, FinCEN take action against virtual currency exchange
On October 11, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC), together with the Financial Crimes Enforcement Network (FinCEN), announced two settlements for more than $24 million and $29 million, respectively, with a Washington state-based virtual currency exchange. According to OFAC’s announcement, this is the agency’s largest virtual currency enforcement action to date, and represent the first parallel actions taken by FinCEN and OFAC in this space.
OFAC settlement. OFAC’s web notice stated that between March 28, 2014 and December 31, 2017, the exchange operated 1,730 accounts that processed 116,421 virtual currency-related transactions totaling roughly $263,451,600.13, in apparent violation of OFAC sanctions against Cuba, Ukraine, Iran, Sudan, and Syria. Specifically, due to alleged deficiencies in the exchange’s sanctions compliance procedures, the exchange failed to prevent persons located in the sanctioned jurisdictions from using its platform to engage in more than $263,000,000 worth of virtual currency-related transactions. OFAC claimed that while the IP addresses and physical address information collected on each customer at onboarding should have given the exchange reason to know that the persons were located in jurisdictions subject to sanctions, the exchange did not “screen customers or transactions for a nexus to sanctioned jurisdictions.” Rather, the exchange only screened transactions for hits against lists including OFAC’s List of Specially Designated Nationals and Blocked Persons. In arriving at the settlement amount of $24,280,829.20, OFAC considered various aggravating factors, including that the exchange did not exercise due caution or care for its sanctions compliance obligations and conveyed economic benefit to persons located in jurisdictions subject to OFAC sanctions, thus causing harm to the integrity of multiple sanctions programs. OFAC also considered various mitigating factors, including that the exchange provided substantial cooperation throughout the investigation, most of the transactions were for a relatively small amount and represented a small percentage when compared to the exchange’s annual volume of transactions, and the exchange has undertaken remedial measures intended to minimize the risk of recurrence of similar conduct.
FinCEN settlement. According to FinCEN’s press release, an investigation found that from February 2014 through December 2018, the exchange failed to maintain an effective AML program, resulting in its inability to appropriately address risks associated with its products and services, including anonymity-enhanced cryptocurrencies. The exchange also failed to effectively monitor transactions on its trading platform, and relied “on as few as two employees with minimal anti-money laundering training and experience to manually review all of the transactions for suspicious activity, which at times were over 20,000 per day.” FinCEN claimed that the exchange conducted more than 116,000 transactions valued at over $260 million with persons located in jurisdictions subject to OFAC sanctions, including those operating in Iran, Cuba, Sudan, Syria, and the Crimea region of Ukraine, and failed to file suspicious activity reports (SARs) between February 2014 and May 2017. The exchange also “failed to file SARs on a significant number of transactions involving sanctioned jurisdictions, including the processing of over 200 transactions that involved $140,000 worth of virtual assets—nearly 100 times larger than the average withdrawal or deposit on the Bittrex platform—and 22 transactions involving over $1 million worth of virtual assets,” FinCEN said in its announcement. Under the terms of the consent order, the exchange—which admitted to willfully violating the Bank Secrecy Act (BSA) and its implementing regulations—will pay a $29,280,829.20 civil money penalty. FinCEN stated it will credit the $24,280,829.20 the exchange has agreed to pay for the OFAC violations.
During remarks delivered at the Association of Certified Anti-Money Laundering Specialists, Under Secretary for Terrorism and Financial Intelligence Brian Nelson discussed, among other topics, Treasury’s efforts to counter illicit finance. Nelson highlighted the aforementioned settlements, stressing that failing to comply with BSA/AML requirements and SARs filing obligations “are not something that companies focused on growth can simply put off to a later day.” He also emphasized that Treasury will continue to strengthen ties with interagency partners and international counterparts to identify and pursue potential violations.
SEC opens crypto assets office
On September 8, SEC Chair Gary Gensler issued remarks before the Practising Law Institute to discuss cryptocurrency tokens and corresponding SEC regulation. During his remarks, Gensler stated his view that the “vast majority” of cryptocurrency tokens on the market are securities that are subject to SEC regulation. As a result, investors in cryptocurrencies “deserve disclosure to help them sort between the investments that they think will flourish and those that they think will flounder,” and that the law requires such protections. Gensler, also addressed stablecoins, which he also concluded raised significant policy issues. Gensler pointed out that depending on their attributes, stablecoins “may be shares of a money market fund or another kind of security,” and therefore require registration and deserve investor protections. Finally, addressing crypto intermediaries, Gensler noted that they are either engaging “in the business of effecting transactions in crypto security tokens for the account of others, which makes them brokers, or engage in the business of buying and selling crypto security tokens for their own account, which makes them dealers.” He warned that because crypto intermediaries often commingle other functions with a market, investors are inherently exposed to conflicts of interest and risks. To address this, Gensler noted that he encouraged SEC staff to collaborate “with intermediaries to ensure they register each of their functions—exchange, broker-dealer, custodial functions, and the like—which could result in disaggregating their functions into separate legal entities to mitigate conflicts of interest and enhance investor protection.” Gensler noted that legislation should be crafted in a way that maintains the SEC’s oversight of crypto security tokens, and added that these kind of assets make up most of the digital assets that are currently traded.
The same week, the SEC announced it is establishing an Office of Crypto Assets and an Office of Industrial Applications and Services to the Division of Corporation Finance’s Disclosure Review Program (DRP), which “has long had offices to review company filings by issuers.” According to the SEC, the offices will join the seven existing offices that provide focused review of issuer filings to continue the SEC’s efforts in promoting capital formation and protecting investors. The Office of Crypto Assets will permit “the DRP to better focus its resources and expertise to address the unique and evolving filing review issues related to crypto assets.”