To print this article, all you need to do is register or log in to Mondaq.com.
Last month, the United States Department of the Treasury's Office of Foreign Assets Control ("OFAC") imposed sanctions against Russia-based cryptocurrency exchange Suex. This move represents the first time the US has sanctioned a digital currency exchange, signaling a major shift for cryptocurrency exchanges and their potential exposure to liability.
The news is even worse for Suex. Around the same time that OFAC announced the sanctions, cryptocurrency exchange Binance announced that its compliance program had identified issues with Suex, removed the platform from the exchange, and shared information from its investigation with law enforcement. Binance's success may set a new standard for digital asset compliance programs, but time will tell whether it has set a new gold standard or will become the bare minimum.
A haven for bad actors
By way of background, Suex acts as an intermediary between users looking to convert cryptocurrency holdings into fiat cash and larger, more conventional exchanges. To be clear, Suex does not directly guard its clients' holdings; Instead, it uses accounts with larger exchanges to transact on behalf of clients. While these larger exchanges are more liquid and can allow for higher cash payments, they are also subject to higher standards for verification of user identity. An exchange like Suex offers access to greater liquidity and more anonymity in any given transaction by using its own accounts to convert clients' cryptocurrency holdings on the largest exchanges. While this service, known as a nested exchange, may be legitimate, Suex research showed that more than 40% of the exchange's known transaction history was associated with illicit actors, such as ransomware and hackers.
Without access to larger exchanges, platforms like Suex lose access to the liquidity necessary to convert large sums of cryptocurrency for their users. And in the absence of a mechanism for fiat conversion like Suex, users sitting on large sums of cryptocurrencies are severely limited in their ability to discreetly spend their holdings. Therefore, by blacklisting exchanges like Suex, the US Treasury can block future ransomware attacks by limiting attackers' ability to withdraw illegally obtained cryptocurrencies.
Notable policy changes
Some of the big exchanges that enable platforms like Suex have already started preparing for this policy change. Following the news about the sanctions, Binance reported that it had already removed the Suex platform earlier this year. Binance, the world's largest cryptocurrency exchange, cited an internal investigation and safeguard mechanisms that resulted in the removal of Suex accounts even before OFAC's blacklisting.
While Binance did not list any specific parameters used for its internal audit process, it did offer a more in-depth look at the money laundering safeguards on the platform earlier this year. In June, Binance reported removing a $ 500 million ransomware ring called FANCYCAT. In doing so, Binance took credit for leading to the arrest of FANCYCAT members by employing a two-pronged approach. First, Binance claimed that it implemented a "[Anti-Money Laundering] analysis and detection program โ, to identify and eliminate suspicious accounts. In the case of FANCYCAT, the system allegedly detected suspicious behavior and Binance's security team โmapped the entire suspicious network,โ according to a Binance blog post.
After identifying the suspicious network, Binance worked with "private sector chain analytics companies TRM Labs and Crystal (BitFury) to analyze the activity on the chain and gain a better understanding of this group and its attribution." Binance later said that it collaborated with law enforcement agencies to take down the criminal group.
A new industry standard?
Binance's proactive response to Suex's potential use of the platform to facilitate criminal conduct will likely set the industry standard for compliance in this space. At the same time, OFAC sanctions represent only the latest step by the US government to prevent a growing threat of ransomware and cyberattacks. The Treasury reported that in 2020, ransomware payments reached more than $ 400 million, more than four times the level reported in 2019. And while the crypto industry continues to negotiate its compliance and legal exposure standards, the Secretary of the Treasury, Janet L. Yellen, has made clear in a recent press release, the Treasury's intention to prevent any facilitation of malware attacks: โWe will continue to crack down on malicious actors. . .we are committed to using the full range of measures, including sanctions and regulatory tools, to interrupt, deter and prevent ransomware attacks. "
This could spell trouble especially for Binance. Last year, Chainalysis (a blockchain analytics company) published a report showing that 27.5% of the 2.8 billion Bitcoin worth of criminal activity in 2019 ended up on the Binance exchange, representing the biggest recipient of illicit Bitcoin that year. of your compliance program is certainly in response to concerns that you may face liability for facilitating money laundering or evasion of penalties.
Cryptocurrency exchanges in the Treasury's sights
The Treasury's current focus appears to be on exchanges that directly facilitate transactions involving funds acquired through cyberattacks and ransomware (essentially money laundering), an admittedly small group. Chainalysis has reported that a group of just five exchanges received 82% of all ransomware funds in 2020. However, as the Treasury position continues to crystallize, the forecast from Binance and other exchanges taking steps to avoid facilitating the Potential money laundering can only strengthen your position against liability risk.
However, although the official position of the Treasury, at least in recent times, is to ban transactions with blacklisted exchanges such as Suex, it is possible, based on the use of the nested exchange model, that exchanges more Large companies may incur liability if they do not adequately monitor and ensure compliance not only internally, but also with the nested services that their platforms use. The updated guidance makes clear that โOFAC may impose civil penalties for violations of strict liability-based penalties,โ further clarifying the need for companies that facilitate digital asset payments to have strong compliance programs in place.
Originally Published On October 18, 2021
The content of this article is intended to provide general guidance on the subject. The advice of specialists should be sought according to your specific circumstances.
POPULAR ARTICLES ON: US Tech
