Overview

Convertible virtual currency ("CVC") mixing is in the crosshairs of U.S. national security policy. On October 19, 2023, the Financial Crimes Enforcement Network (“FinCEN”) of the U.S. Department of the Treasury (“Treasury”) issued a notice of proposed rulemaking ("NPRM") designating CVC mixing – within or involving the United States – as a class of transactions of primary money laundering concern. If finalized, the proposed rule will impose additional obligations on covered financial institutions, which include domestic banks, U.S. branches and agencies of foreign banks, broker-dealers, money services businesses ("MSBs"), and virtual asset service providers. The move follows continued reports of criminals, state-affiliated cyber actors, the Palestinian terrorist organization Hamas, and other terrorist groups using CVC transactions, including CVC mixing, to evade sanctions, launder proceeds, and engage in terrorist and other criminal acts.

The NPRM represents the first-ever invocation of Section 311 of the USA PATRIOT Act (“Patriot Act”) to designate an entire class of transactions rather than a specific person or jurisdiction. Section 311 authorizes the Secretary of the Treasury to order financial institutions to take certain special measures to combat money laundering. The proposed rule would require financial institutions to adopt one such special measure – enhanced recordkeeping and reporting – although it gives the Treasury greater authority over CVCs, including to prevent entry into domestic markets, further demonstrating the Treasury’s heightened concern that CVC mixing helps to launder criminal proceeds and threatens U.S. national security.

Congress and the Biden administration have both signaled a greater willingness to reign in abuses of CVCs. Earlier in October 2023, more than 100 lawmakers pressured the administration to formulate a strategy to “meaningfully curtail illicit crypto activity” to protect U.S. and allied national security. A day after FinCEN announced the proposed rule, it issued an alert urging financial institutions to monitor and report suspicious activity by Hamas, which uses CVC to fund its operations. In January 2023, FinCEN invoked separate statutory authority to identify the CVC exchange Bitzlato Limited as a primary money laundering concern in connection with Russian illicit finance. In August 2022, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned CVC mixer Tornado Cash, alleging that it had been used to launder more than $7 billion in CVC. OFAC had designated CVC mixer Blender.io as a Specially Designated National earlier in 2022 for its role in assisting North Korean cyber hacking organization Lazarus Group funnel $20.5 million from a CVC heist.

Key Components of the NPRM

Covered Transactions and CVC Mixing: Transactions covered by the NPRM are those that a financial institution “knows, suspects, or has reason to suspect” involve CVC mixing in a jurisdiction within or involving the United States. Because many CVCs are exchanged on public blockchains, which record CVC transactions and their parties, illegal actors often attempt to anonymize their transactions through CVC mixing. Under the proposed rule, CVC mixing is defined to comprise several practices, including:

1. Pooling CVCs from multiple persons, wallets, or other holdings into a single transaction to obfuscate the identity of the parties to the transaction in question;
2. Conversely, splitting an amount of CVC into multiple transactions, some of which could be legitimate, to avoid suspicion;
3. Using software to coordinate multiple persons’ transactions to hide a particular transaction amidst the increase volume;
4. Engaging in “peel chain” transactions, by which a small amount of CVC is repeatedly transmitted from a person’s holdings in a series of low-value transfers to evade value-based checks for anti-money laundering ("AML") compliance and tax reporting;
5. “Chain hopping” CVC from one blockchain to another, often facilitated by a cross-chain bridge, a type of software enabling the transfer of CVC between blockchain networks; and
6. Injecting artificial delays in CVC transactions to make them appear to be unrelated.

Reporting and Recordkeeping Requirements: By designating international CVC mixing as a class of transactions of primary money laundering concern, FinCEN would mandate financial institutions to collect and report certain information to it regarding covered transactions. This first special measure under the Patriot Act generally requires financial institutions to maintain records, file reports, or both, concerning the aggregate amount of transactions, or concerning individual transactions. Required information may also include: (1) the identity and address of the participants in a transaction or relationship, including the identity of the originator of any funds transfer; (2) the legal capacity in which a participant in any transaction is acting; (3) the identity of the beneficial owner of the funds involved in any transaction; and (4) a description of the transaction.

Specifically, the NPRM would require financial institutions to collect information concerning both the particular covered CVC mixing transaction and the customers associated with it. Regarding the transaction, financial institutions would be required to record the amount of any CVC transferred and its U.S. dollar equivalent as of the time the transaction was initiated. In addition, information about the type of CVC transferred, the identity of the CVC mixer used (if known), and the CVC wallet address of the CVC mixer and customers would be required to be collected. Financial institutions must also collect the transaction hash, date, IP addresses and associated time stamps, and a narrative description of the transaction. Regarding the customers, financial institutions would be obligated to collect the customers’ full name, date of birth, address and email address, and unique identifying number. Financial institutions would be required to report to FinCEN within 30 calendar days of their initial detection of a covered transaction.

Key Exclusions and Qualifications: Notably, the NPRM excludes “internal protocols or processes to execute transactions by banks, broker-dealers, or money services businesses,” so long as such persons preserve records of the source and destination of the internal CVC transaction. Because the NPRM applies only to transactions in CVC, it exempts from its recordkeeping any reporting obligations for “indirect” transactions, such as payment by a financial institution in fiat currency on behalf of a CVC exchange purchasing previously mixed CVC for its customer. FinCEN also clarified that financial institutions are only required to collect and report information that is in their possession, and they do not have to reach out to the transaction parties to collect it. The NPRM notes, however, that financial institutions remain independently obligated to file suspicious activity reports, even if doing so results in duplicative reporting.

Conclusion

FinCEN’s proposed inclusion of an entire category of CVC transactions under the Patriot Act could herald a significant step that alters the contours of the global financial landscape. At the same time, financial institutions with developed AML and counter-terrorism financing programs may find, upon a reevaluation of their existing policies and procedures, that they are already collecting much of the information required to be gathered under the NPRM. Regardless, the NPRM further underscores the ratcheting scrutiny by the U.S. government on novel financial activities to deter money laundering and protect national security.

Domestic businesses and other persons involved with cryptocurrency platforms that permit users to exchange CVC across borders should review their current practices to understand their potential obligations and risks if FinCEN’s proposed rule is adopted. The comment period for the NPRM is open for 90 days, with written comments due to FinCEN before January 22, 2024.