Two recent criminal enforcement actions against individual cryptocurrency exchanges, including one offering to do business with a small-level marijuana business in California, indicate that federal agencies are using anti-money laundering laws as a vehicle for oversight over transactions involving cryptocurrency and proceeds from the sale of cannabis.
Two weeks ago, the Department of Justice (DOJ) charged a California resident, Morgan Rockcoons, with violating the money laundering provisions of the Bank Secrecy Act (BSA) for trading $9,200 in Bitcoin to an undercover officer in exchange for $14,500 represented to be proceeds of marijuana sales. Similar to a criminal complaint recently brought against a Michigan resident, the DOJ also charged Rockcoons with violating the BSA for failing to register as a cryptocurrency exchange — a type of Money Services Business (MSB) — with the Financial Crimes Enforcement Network (FinCEN), and for failing to conduct “know your customer” (KYC) due diligence and other anti-money laundering (AML) procedures required of MSBs and other financial institutions, like banks and casinos.
Anyone subject to the requirements of the BSA, including cryptocurrency exchanges, marijuana-related businesses, or those who do business with cryptocurrency businesses or marijuana-related businesses, should take note of these enforcement actions.
Background: Cryptocurrency & bank secrecy act basics
Cryptocurrencies, such as bitcoin, are digital currencies that are not issued by any central authority, but rather are generated and recorded on a decentralized “peer to peer” network. Cryptocurrency can be purchased from a cryptocurrency exchange such as Coinbase or Kraken. Cryptocurrency exchanges typically accept payments of “Fiat Currency” (currency that derives its value from government regulation or law) for a corresponding amount of digital currency based on the prevailing exchange rate. The exchange, often for a commission, will attempt to broker the purchase with another user on the exchange that is trying to sell cryptocurrency. For liquidity purposes, exchanges may also buy cryptocurrency themselves.
Most cryptocurrency exchanges require registrants to reveal their identity, while other exchanges do not require users to reveal personal details when registering. Little to no personally identifiable information about the payer or payee is transmitted in a cryptocurrency transaction. Only the cryptocurrency addresses of the parties (sometimes referred to as the party’s “key,” of which there are public and private “keys”) — which by themselves do not reveal any identifying information — are needed for the transaction.
Some exchanges, like Coinbase, allow users to trade cryptocurrency for government-issued currency, for a fee, by linking their accounts with a credit/debit card or bank account. Users then simply choose how many cryptocurrencies they would like to withdraw from their account, choose their currency of choice and execute the exchange. After the bank processes the transaction, users can simply withdraw the money via an automated teller machine (ATM), by using debit or credit cards or even directly from a bank teller. Some financial institutions—after verifying customer’s identity pursuant to KYC policies—also issue prepaid debit cards that are funded via bitcoin or other cryptocurrencies.
Cryptocurrency exchanges are subject to AML regulations because they are considered money transmitters and are treated as financial institutions under the BSA. Specifically, federal regulations require cryptocurrency exchanges to register with FinCEN as an MSB and—as required of other financial institutions such as banks and casinos —to develop and maintain an effective AML program.
The BSA requires financial institutions to establish adequate internal controls to mitigate the risk that customers will use their facilities to launder money. In turn, FinCEN regulations require financial institutions to identify the source of customers’ funds, use a risk-based approach to identify patrons using illicit funds and conduct customer due diligence to identify high-risk customers.
In 2014, FinCEN issued guidance that allows financial institutions to provide services to marijuana-related businesses without facing prosecution for violating the BSA, provided that the institution follows a detailed list of guidelines, including conducting enhanced due diligence and filing a Suspicious Activity Report. FinCEN is now reviewing its guidance to see if there is a conflict between what it allows and the new DOJ position, discussed below, that gives federal prosecutors discretion to prosecute marijuana crimes, including under the BSA, even in states where marijuana is legal.
Cryptocurrency exchangers recently indicted for violating the Bank Secrecy Act
In February 2018, the DOJ indicted California resident Morgan Rockcoons for federal money laundering violations for selling $9,208 in Bitcoin to an undercover agent from DHS for $14,500 in U.S. currency. The agent posed as a manufacturer/distributor of hash oil, and represented that the $14,500 were proceeds from hash oil sales. California state law allows for the sale and use of cannabis, including marijuana extracts like hash oil, for medical and recreational purposes. However, like cannabis, distribution of hash oil is illegal under federal law and is considered a Schedule 1 Controlled Substance under the Controlled Substances Act (CSA).
Count One of the indictment charged Rockcoons with violating a BSA provision that forbids individuals from conducting a monetary transfer while knowing that the transaction is designed in whole or in part to disguise the proceeds of unlawful activity (e.g. proceeds from the sale of marijuana in violation of the CSA). Count Two of the indictment charged Rockcoons with violating a separate BSA provision that forbids a person from operating an unlicensed money transmitting business, and for failing to fulfill FinCEN regulations requiring MSBs to establish an AML program and fulfill KYC responsibilities.
After the indictment of Rockcoons, several cryptocurrency exchangers said that they had witnessed a substantial amount of what they believed were undercover agents attempting to conduct transactions on the exchanges.
The Rockcoons indictment was at least the second in the past six months in which federal law enforcement charged an individual for laundering money through cryptocurrencies where there is an overlap with the sale of drugs. In October 2017, the DOJ filed a criminal complaint against a Michigan resident, Bradley Stetkiw, for failing to register as an MSB with FinCEN when selling and brokering nearly a hundred thousand dollars in bitcoin through a cryptocurrency exchange. The complaint alleged that Stetkiw exchanged bitcoin without registering as an MSB, and also that Stetkiw sent about $300 in bitcoin to a website that was known to sell illegal drugs. The complaint also alleged that Stetkiw violated the BSA by failing to establish an effective AML program pursuant to FinCEN’s regulations for registered MSBs, in particular by failing to verify the identity of one of the individuals involved in the transaction (actually, an undercover DHS agent) during bitcoin transactions greater than $3,000 as required by FinCEN regulations.
Federal Government’s Potential Crackdown on Cryptocurrency and Cannabis Proceeds: Implications for Financial Institutions
Anyone subject to the BSA—including cryptocurrency exchanges, banks, and casinos—should take note of charges against Rockcoons and Stetkiw because they signal that federal agencies are developing a twin enforcement focus on cryptocurrency transfers and marijuana-related business proceeds, even in states where marijuana sales are legal, and even where the dollar amounts are relatively small. Indeed, a number of federal regulators are focused on cryptocurrency—the U.S. Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) have already this year issued guidance on cryptocurrency.
Both indictments strongly suggest that entities subject to the BSA should handle dealings in cryptocurrency with caution. Financial institutions that provide banking services to virtual currency exchanges should consider developing “crypto compliance policies” to mitigate the specific AML risks posed by virtual currency. The Association of Certified Anti-Money Laundering Compliance Specialists (ACAMS) recommends that financial institutions conduct a risk assessment of the virtual currency exchanges by evaluating the purpose of the account and the types of products and services offered by the exchanger, confirming that the exchanger is registered with FinCEN and state authorities, when required, and assessing the exchanger’s compliance with BSA regulations (e.g. existence of a written BSA/AML program and a designated BSA officer). Indeed, federal regulators will expect financial institutions to fulfill KYC obligations in dealing with cryptocurrency exchanges. For this reason, ACAMs also suggests that financial institutions consider conducting enhanced due diligence into the nature of a cryptocurrency exchange by, for example, determining whether: (i) the exchange is an established business with an operating history, (ii) the exchange is acting as an agent, (iii) the exchange provides services to foreign nationals, and (iv) the exchange’s customers conduct transactions in high dollar amounts.
Federal law enforcement’s crackdown on individual cryptocurrency exchanges for money laundering violations should serve as a warning to financial institutions that the U.S. government has not let up on its commitment to strictly enforce the BSA, including for failing to conduct adequate KYC and for accepting proceeds of cannabis sales, even where such sales are legal under state law. Indeed, the charges against Rockcoons and Stetkiw may indicate that federal law enforcement is shifting toward more aggressive enforcement against marijuana-related businesses through the application of the BSA. This enforcement interest is consistent with Attorney General Jeff Sessions’ decision in January 2018 to rescind the “Cole Memo,” which had narrowed the focus of federal prosecutors in terms of pursuing marijuana crimes in states where the sale of marijuana had been legalized. Sessions’ announcement returned to federal prosecutors the discretion to prosecute marijuana offenses to the full extent of the law, including under the BSA; it appears at least some prosecutors are exercising that discretion to charge individuals involved in certain cryptocurrency transactions.