FinCEN Proposes New Regulation To Enhance Transparency In Convertible Virtual Currency Mixing And Combat Terrorist

Summary of What Has Happened and What Is Yet to Come

On 19 October 2023, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) announced a Notice of Proposed Rule Making (NPRM), pursuant to section 311 of the USA PATRIOT Act, that “identifies international convertible virtual currency mixing (CVC mixing) as a class of transactions of primary money laundering concern.” This action represents the first time in history that FinCEN has designated an entire class of transactions as being of primary money laundering concern.[1]

The NPRM cites the “risks posed by the extensive use of CVC mixing services by a variety of illicit actors throughout the world and proposes a rule to increase transparency around CVC mixing to combat its use by malicious actors including Hamas, Palestinian Islamic Jihad, and the Democratic People’s Republic of Korea (DPRK).”[2] To that end, the proposal would require covered financial institutions to report information about a transaction when they know, suspect, or have reason to suspect it involves mixing.[3]

Implementation of the proposed special measure is yet to come. The NPRM details proposed steps that FinCEN seeks to take to mitigate the illicit financing risk associated with CVC mixers; however, the proposal is subject to a comment period (ending on 22 January 2024), with plans to take stakeholder feedback into consideration prior to implementation.

Virtual asset service providers (VASPs), particularly those regulated in the United States, should closely examine their risk appetite, risk exposure, and transaction monitoring processes in light of FinCEN’s determination that transactions with CVC mixers—as a class—are of primary money laundering concern. In addition, U.S.-regulated entities should assess both their exposure to CVC mixers and the operational impact of the proposed reporting obligations in preparation for the possibility that binding reporting requirements will go into effect in Q1 2024.

What the Alert Covers

This Policy Alert discusses (1) the rationale behind FinCEN’s NPRM on CVC mixers; (2) the background and context around the NPRM; (3) the detail and requirements of the proposal; (4) industry response to the proposed rule; and (5) key implications and considerations for relevant stakeholders, including regulated crypto firms.

Background and Context

The proposed rule on CVC mixers does not come as a surprise to the industry. The U.S. Department of the Treasury and U.S. law enforcement are clearly focused on the way cryptocurrency and related services such as CVC mixers have been exploited by criminals and sanctioned entities for illicit financing activities in recent years:

• On 6 May 2020, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated CVC mixer Blender.io under its cyber sanctions program, noting that Blender.io provided mixing services used by the DPRK to launder millions of dollars from the Axie Infinity hack.[4]
• In March 2022, the U.S. Department of the Treasury released its National Money Laundering Risk Assessment (NMLRA) highlighting the increased use by criminals of anonymity-enhancing technologies, including CVC mixers, to help obfuscate the movement or origin of funds.[5]
• On 8 August 2022, OFAC also designated Tornado Cash, a CVC mixer, for obfuscating the movement of more than $455 million stolen in March 2022 by the Lazarus Group.[6]
• On 15 March 2023, the U.S. Department of Justice (DOJ) announced a coordinated international takedown of ChipMixer, a darknet cryptocurrency “mixing” service responsible for laundering more than $3 billion worth of cryptocurrency between 2017 and February 2023, in furtherance of, among other activities, ransomware, darknet market, fraud, cryptocurrency heists, and other hacking schemes.[7]

The fact that this notice marks FinCEN’s first-ever designation of an entire class of transactions indicates to the industry and the world writ large that FinCEN views transactions with mixers as representing significant inherent financial crimes risk, prompting action for impacted entities. As FinCEN Director Andrea Gacki stated:

CVC mixing offers a critical service that allows players in the ransomware ecosystem, rogue state actors, and other criminals to fund their unlawful activities and obfuscate the flow of ill-gotten gains. […] This is FinCEN’s first ever use of the Section 311 authority to target a class of transactions of primary money laundering concern, and, just as with our efforts in the traditional financial system, Treasury will work to identify and root out the illicit use and abuse of the CVC ecosystem.[8]

As a reminder, Section 311 of the USA PATRIOT Act “grants the Secretary of the Treasury the authority, upon finding that reasonable grounds exist for concluding that a foreign jurisdiction, institution, class of transaction, or type of account is of ‘primary money laundering concern,’ to require domestic financial institutions and financial agencies to take certain ‘special measures’ against the entity of primary money laundering concern.”[9] The following special measures can be imposed individually, jointly, in any combination and in any sequence:

• Recordkeeping and reporting certain transactions (Note: this was the special measure chosen pursuant to the CVC Mixers NPRM);
• Collection of information relating to beneficial ownership;
• Collection of information relating to certain payable-through accounts;
• Collection of information relating to certain correspondent accounts; and
• Prohibition or conditions on the opening or maintaining of correspondent or payable-through accounts.[10]

When the Department of the Treasury issues a finding of primary money laundering concern, it is effective immediately. U.S. financial institutions should be alert to such findings and take them into account as part of their overall risk management programs.[11] Treasury typically issues an NPRM explaining which special measure(s) it proposes and requests comments from the public on the details included within the NPRM. Following the comment period and review of the comments received, FinCEN has three main options:

1. Proceed with a final rule;
2. Withdraw the finding and proposed rule; or
3. Keep the matter open for further review.

It is also important to note that Section 311 actions are different from OFAC designations, which trigger asset freezing obligations for U.S. persons and prohibit virtually all dealings with the designated persons. By contrast, Section 311 actions can impose a wide range of compliance obligations and do not necessarily require obliged entities to discontinue all dealings with target entities, jurisdictions, or classes of transactions.

Detailed Overview

In its 19 October NPRM publication on CVC mixers, FinCEN clarified that it plans to apply the first special measure, “recordkeeping and reporting certain transactions,” to “certain transactions,” defined in this case as any “transaction in CVC by, through, or to the covered financial institution that the covered financial institution knows, suspects, or has reason to suspect involves CVC mixing within or involving a jurisdiction outside the United States.”[12]

FinCEN defines CVC mixing as:

The facilitation of CVC transactions in a manner that obfuscates the source, destination, or amount involved in one or more transactions, regardless of the type of protocol or service used, such as: (1) pooling or aggregating CVC from multiple persons, wallets, addresses, or accounts; (2) using programmatic or algorithmic code to coordinate, manage, or manipulate the structure of a transaction; (3) splitting CVC for transmittal and transmitting the CVC through a series of independent transactions; (4) creating and using single-use wallets, addresses, or accounts, and sending CVC through such wallets, addresses, or accounts through a series of independent transactions; (5) exchanging between types of CVC or other digital assets; or (6) facilitating user-initiated delays in transactional activity.[13]

Though quite broad, it should be noted that the above six examples are just that—examples—and are not meant to constitute an exhaustive list. Notably, the key element of the definition focuses on obfuscation or concealing of the source, destination, and/or amount of funds involved in a transaction; however, based on K2 Integrity’s conversations with industry participants, some VASPs may challenge the examples provided in FinCEN’s definition through the NPRM process.

Regarding the specific reporting requirements under special measure one, FinCEN proposes both transaction-related reporting obligations and customer-related reporting obligations:[14]

Transaction Reportable Information

1. Amount of any CVC transferred, in both CVC and its U.S. dollar equivalent when the transaction was initiated
2. CVC type
3. CVC mixer used, if known
4. CVC wallet address associated with the mixer
5. CVC wallet address associated with the customer
6. Transaction hash
7. Date of transaction
8. IP addresses and time stamps associated with the covered transaction
9. Narrative

Customer Reportable Information

1. Customer’s full name
2. Customer’s date of birth
3. Address
4. Email address associated with any and all accounts from which or to which the CVC was transferred
5. Unique identifying number

The proposed regulation would require covered financial institutions to “collect, maintain records of, and report to FinCEN within 30 calendar days of initial detection of a covered transaction, in the manner that FinCEN may prescribe, certain information regarding covered transactions that involve CVC mixing.”[15] Notably, this requirement would apply in addition to any suspicious activity reporting requirements observed by covered institutions. Of further note, it is telling that FinCEN selected the reporting special measure, suggesting that information collection…