Risk Associated with New Payment Products and Services

Risk Associated with New Payment Products and Services The internet, new payment platforms, and electronic money (e-money) have changed the way people conduct business and transact with one another, as well as how consumers buy products and services. Small corner shops that were limited to servicing local consumers can now have a broader, global reach with an online business as well. Digital payment platforms have altered how consumers and the regulatory environment view merchants and funds transmission. The lower cost of technology; globally interdependent society; increasingly highly skilled, engineering-based workforce; and entrepreneurial drive have all contributed to the evolution of new payment products and services that expand the boundaries of how and where money is used. Generally, the risk posed by these new payment systems is relative to the functionality of the services and their funding mechanisms. Prepaid Cards, Mobile Payments, and Internet-Based Payment Services Alternative payment methods, including prepaid cards, digital wallets, and emoney continue to rise in popularity in the increasingly digital, fast-moving world. In October 2006, FATF first published a report that examined the ways in which money can be laundered through the exploitation of new payment methods, such as prepaid cards, internet payment systems, mobile payments, and digital precious metals. The report found that, although there is a legitimate market demand for these payment methods, money laundering and terrorist financing vulnerabilities exist. In addition, cross-border providers of new payment methods can pose more risk than providers strictly operating within a specific country. The report recommended continued vigilance to further assess the effect of evolving technologies on cross-border and domestic regulatory frameworks. Since 2006, FATF has published additional guidance on new payment methods, typologies, and the risk-based approach. Prepaid cards Prepaid cards have the same characteristics that make cash attractive to criminals: They are portable, valuable, exchangeable, and anonymous. Typically, prepaid products require the consumer to pay in advance for future purchases of goods and services. Each payment is subtracted from the balance of the card or product until the total amount is spent. Prepaid cards can be categorized as either open loop or closed loop. Openloop prepaid cards, many of which are network branded by American Express, Visa, or MasterCard, can be purchased and loaded with money by one person and used like regular debit cards by the same person or another person to make purchases or ATM withdrawals anywhere in the world. Closed-loop prepaid products are of limited use for a specific purpose or service, such as with a certain merchant or retailer, whether online or at a physical location. A prepaid card can be either nonreloadable, which means it is purchased for a fixed amount that cannot be reloaded as the funds are depleted, or reloadable, which permits adding funds on the card to replace what was previously spent. Although there are many different types of prepaid cards that are used in a variety of ways, the cards typically operate in the same way as a debit card and ultimately rely on access to an account. There might be an account for each card that is issued or, alternatively, a pooled account that holds the prepaid funds for all cards issued. The cards can be issued by, and accounts can be held at, a depository institution or a nonbank organization; pooled accounts are normally held by the issuer at a bank. According to the FATF reports on this topic, the potential risk factors commonly associated with prepaid cards are: • Anonymous cardholders • Anonymous funding • Anonymous access to funds • High value limits and no limits on the number of cards individuals can acquire • Global access to cash through ATMs • Offshore card issuers that might not observe laws in all jurisdictions • Use as substitute for bulk-cash smuggling Following multiple high-profile money laundering and terrorist financing cases involving prepaid cards, including the 2015 Paris attacks, the European Union took steps to reduce the limits on prepaid cards under the Fourth Anti-Money Laundering Directive, which went into effect in 2017, and again in the Fifth Anti-Money Laundering Directive, which went into effect in 2020. According to the Fifth Directive, the monthly transaction limit and maximum amount that can be stored on prepaid cards not subject to due diligence is €150. Online transactions associated with such cards have similarly been limited to €50. Restrictions have also been placed on the use of prepaid cards that originate from outside of the European Union. The combined deployment of limits and geographic restrictions have helped to mitigate some of the greatest risk factors commonly associated with prepaid cards. Electronic money According to the JMLSG’s sectoral guidance on preventing money laundering and combating terrorist financing, e-money is “a prepaid means of payment that can be used to make payments to multiple persons, where the persons are distinct legal or natural entities.” E-money products can be card-based, app-based, or online account-based. They can be issued by financial organizations, building societies, and specialist e-money institutions. Examples of e-money include prepaid cards that can be used to pay for goods at a range of retailers and virtual purses that can be used to pay for goods and services online. All UK e-money institutions are regulated by the FCA and governed under the Electronic Money Regulations (2011), which require compliance with all AML/CFT and sanctions requirements. In the UK, this means all e-money institutions are subject to the Money Laundering Regulations 2017. The guidance identifies several risk factors inherent in e-money for money laundering and terrorist financing, including: • High transaction or purse limits • The ability of a customer to hold numerous purses or cards • E-money issuers using complex business models (e.g., “white-label” products and outsourcing, particularly to overseas jurisdictions), resulting in a complex AML/CFT control environment • Certain merchant activity with high-risk businesses, such as gambling, which allows for the movement of higher amounts of funds • Funding with unverified persons, whether customers or third parties • Funding with cash that leaves no electronic trail to the source of funds, as well as the ability for cash withdrawal • Funding with other e-money that lacks verified persons and/or source of funds • Non-face-to-face transactional activity • Features that increase the functionality of the card in terms of how to execute transactions, such as person-to-person, business-to-person, business-to-business, and person-to-business transactions The guidance lists specific controls that e-money institutions should consider implementing in order to effectively mitigate the above risks, in addition to meeting standard AML/CFT obligations, including: • Conducting robust oversight of outsourced functions • Placing limits on storage values, transactions, and turnover • Implementing transaction monitoring systems that are able to detect money laundering patterns and deviations from normal transaction patterns • Implementing systems to detect individuals holding multiple purses, accounts, and cards, including across multiple e-money issuers • Utilizing geolocation, device-related information, and IP addresses to identify discrepancies in customer activity from the information provided at onboarding (e.g., an individual onboarding in the United Kingdom, but only transacting from their device in Russia) • Cooperating with merchants that accept e-money to better detect suspicious activity • Instituting geographic restrictions on the use and function of e-money products, such as limiting use to the UK, EU, or other comparable jurisdictions with strong AML/CFT supervision CDD is another important control that can help mitigate the risks associated with e-money. As noted above, there are some limits under which CDD is not required for prepaid card and e-money products. Outside of this, standard due diligence measures typically apply to e-money, although there are some circumstances in which simplified due diligence may be applied when the situation is sufficiently low-risk. When an e-money organization applies simplified due diligence, additional checks should still be considered to help mitigate fraud risk by establishing who controls a funding instrument. For example, some e-money issuers use a “micro-deposit,” or a small charge on a customer’s funding account, to help confirm the customer has access to the funding account and is not defrauding another individual. E-money organizations are often just one party in a larger, more complex scheme that includes other banks, merchants, payment schemes, and payment processors. In these set-ups, e-money issuers must be satisfied that the due diligence measures being performed on the involved merchants align with sectoral guidance. One concern with e-money is that it is offered predominantly in a non-faceto-face context. However, as noted in the FATF guidance paper Digital Identity, non-face-to-face onboarding can be just as robust, if not more so, as face-to-face onboarding when the appropriate systems and controls are in place to verify identities using reliable, independent sources. The risks of payment services and e-money are also assessed by the United Kingdom’s National Risk Assessment. In 2017 and 2020, the money laundering and terrorist financing risk level associated with payment services and emoney was “medium.” The assessment noted certain typologies associated with e-money, such as the movement of illicit funds in and out of Eastern Europe, although it also noted the development of new controls. For example, “Strong Customer Authentication” adds extra layers of security checks to electronic payments to reduce the risk of fraud. The assessment concluded that the sector would continue to be monitored closely, given its novelty and likelihood to evolve. Virtual Currency Virtual currency (VC) is a medium of exchange, unit of account, and/or a store of value that operates in the digital space without legal tender status. VCs are distinguished from “fiat currency,” or “real currency,” which refers to government-issued currency that is typically accepted as the medium of exchange. Although a simplification, VCs often fall into two categories: centralized and decentralized. Centralized VCs have a centralized repository and a single administrator. They can be issued by a central government (e.g., the Bahamian Sand Dollar, the first fully launched central bank digital currency) or a non-government administrator (e.g., Facebook’s Diem). Decentralized VCs (e.g., Bitcoin) have no repositories or administrators, but they work as a peer-to-peer media of exchange without the need for an intermediary. According to FATF, VCs can also be distinguished between convertible VCs (e.g., Bitcoin, Ethereum, and Ripple), which have an equivalent value and can be exchanged in real currency, and non-convertible VCs (e.g., Reddit Coins and World of Warcraft Gold), which are intended to be specific to a particular domain. VCs allow value to be transmitted anywhere in the world without the requirement of a centralized bank or institutional authority. In 2009, the Bitcoin ecosystem was developed as a cryptographic protocol to transfer value through a peer-to-peer network without reliance on a centralized banking structure. Since then, other coins, such as Ethereum, Dogecoin, and Litecoin, have become popular, and new coins are regularly being developed. Coins are units of value transfer that are established as a virtual currency. Much like any financial instrument, a coin derives its value from what another party is willing to trade for that item. For most coins, there is a value that is expressed in fiat currency that is based upon economic and market forces. Coins can be expressed as an equivalent value in each locale’s specific currency. One of the most significant concerns with regard to VCs and financial crime is the potential for anonymity. Some coins, such as Bitcoin, can be tracked through a public ledger. However, depending on the regulatory status of the exchanges and wallet providers involved, it can be difficult to identify who is behind a specific wallet address, where the funds originated, and the destination of the funds in the “fiat” space. Additionally, some coins, such as Monero, ensure all users are anonymous, making it very difficult to trace funds. FinCEN was one of the first FIUs to offer interpretative guidance on VCs and to clarify their regulatory status. FinCEN categorized participants in the ecosystem into three segments: • A User is a person who obtains VC to purchase goods or services. • An Exchanger is a person engaged as a business in the exchange of VC for real currency, funds, or other virtual currency. • An Administrator is a person engaged as a business in issuing VC and who has the authority to redeem such virtual currency. The guidance states that Administrators or Exchangers of VC are, unless exempted, MSBs engaging in money transmission. As such, they must comply with the registration, reporting, recordkeeping, and other regulations applicable to money transmitters, such as maintaining a compliant AML program. In a typical transaction scenario, a User has an established virtual wallet or an account with an Exchanger to conduct a transaction. The User acquires VC from the Exchanger, which allows the User to transfer funds in and out of that account. FinCEN consolidated and clarified its position by providing guidance for certain business models that involve convertible VCs. This guidance expanded how regulations would apply in different scenarios, including those involving different types of VC wallet providers, VC kiosks (often called “Crypto ATMs”), and decentralized (distribution) applications (“DApps”). DApps are software programs using distributed ledger technology that are not controlled by a single, identifiable administrator. At a global level, FATF amended its Recommendations to explicitly require virtual asset service providers (VASPs)—providers of VCs—to be regulated for AML/CFT purpose as part of Recommendation 15. An interpretative note adopted on Recommendation 15 clarified how to consider other FATF Recommendations in the context of VCs and VASPs, including the application of a risk-based approach, supervision, and monitoring to VASPs, the implementation of AML/CFT controls within VASPs, and international cooperation on VC and VASP-related activity. This included expanding Recommendation 16 regarding the exchange of identifying information between originators and beneficiaries, to cover VC transactions. This is commonly referred to as the “travel rule.” FATF has since undertaken multiple reviews to assess the implementation of the revised FATF Recommendations. The Second 12-Month Review of the Revised FATF Standards, released in July 2021, noted that significant progress had been made globally in implementing the revised Recommendations, but that more work was still needed. Of 128 jurisdictions assessed in 2021, 70 (55%) had yet to implement the revised Recommendations into national law. Implementation of the travel rule was highlighted as being particularly difficult due to the absence of proper investment in the necessary technological solutions to facilitate full global compliance. FATF published a list of red flag indicators to assist regulated organizations in identifying suspicious activity involving VCs. The report noted that the most common misuse of VCs was connected to sales of illicit substances, particularly through activity on the “dark web.” The second most common misuse was related to fraud, scams, ransomware, and extortion. The use of VCs to help layer and disguise the true origin of proceeds from professional money laundering networks is also becoming more common. FATF updated its guidance for organizations working to design a risk-based approach to the treatment of VCs and VASPs that discourages blanket “derisking” of virtual asset-related activity. The guidance provides additional risk indicators to consider in a VC context, particularly concerning the risks of peer-to-peer VC exchanges, as well as more information on the implementation of the FATF Recommendations, including the travel rule. The guidance also addresses how FATF standards apply to VCs tied to a specific fiat currency or commodity, otherwise known as stable coins. This followed an FATF Report to the Group of Twenty (G20) on the same subject. The guidance also clarifies when FATF standards might need to be applied to “decentralized finance,” or “DeFi,” products and services. Use of virtual currency (Case example: Methods of money laundering) In the early days of cryptocurrency exchanges, criminals operated in what was described as the “weak spot” of financial services. Criminal exchanges and operators were able to conduct a wide range of criminal activity, often with little enforcement action, due to limited primary and secondary legislation and regulation. Law enforcement also had limited capability to investigate and prosecute offenders. In 2017, a ground-breaking US-led investigation into criminal users of BTC-e, a cryptocurrency trading platform, discovered that users were allowed to: • Operate with high levels of anonymity, as user identification and verification details were not consistently required • Obscure and anonymize transactions • Openly discuss criminality on the BTC-e user chat • Obtain advice from BTC-e on how to access illegally obtained money from drug sales In December 2020, Paris courts sentenced Alexander Vinnik, founder of BTCe, to five years in prison on money laundering charges. Currently there exists a much wider understanding of the high risks presented by the use of cryptocurrency. This understanding has resulted in an array of global, cross-sector cooperation and regulation to prevent and prosecute the misuse of cryptocurrencies. BTC-e was one of the first cryptocurrency exchanges and one of the world’s largest and most widely used digital currency exchanges. In 2017 US authorities seized BTC-e, along with 38% of the users’ funds. Vinnik fled to Greece, where the authorities arrested him following US indictments for laundering US$4 billion worth of bitcoin (BTC). Vinnik was linked to corrupt politicians, ransomware scams, identity theft schemes, and narcotics distribution rings. Greek authorities eventually extradited Vinnik to France in January 2020. Vinnik was found guilty by French authorities of money laundering as part of an organized crime group and sentence to 5 years in prison. The activities in cryptocurrency laundering are often similar to those found in mainstream financial services. One difference is that the ultimate beneficiaries of cryptocurrency laundering need to convert their criminal cryptocurrency funds into criminal fiat funds to make them more widely usable, as part of the integration phase of money laundering. Cryptocurrency laundering has prompted global regulators to ensure that local AML/CFT laws are updated and applicable to cryptocurrency service providers. The challenge with tracking virtual currencies is that they are identifiable only through a user’s exchange account or cryptocurrency wallet address. In addition, the transactions are executed within seconds across exchanges and jurisdictions, and often from cryptocurrency to fiat currency. FATF has identified cryptocurrency red flags. Individuals and organizations interacting with cryptocurrencies must understand the risks and red flags and incorporate them into their risk assessments. Key takeaways • Cryptocurrency exchanges can allow users to operate with high levels of anonymity and be used to obscure and anonymize transactions. • Virtual currencies are challenging to track because they are identifiable only through a user’s exchange account or cryptocurrency wallet address. • Cryptocurrency transactions are executed within seconds across exchanges and jurisdictions, and often from cryptocurrency to fiat currency. The rapid changes introduced by cryptocurrencies require a consistent global approach in terms of law and regulation. • Individuals and organizations interacting with cryptocurrencies must understand the risks and red flags and incorporate them into their risk assessment. Virtual currency (Case example: Dark web) In September 2020, the US Department of Justice announced the results of an international law enforcement operation targeting drug criminals who operated on the darknet. Operation DisrupTor’s actions in the US and Europe resulted in the arrest of 179 darknet drug traffickers and other criminals who engaged in tens of thousands of transactions involving illicit goods on both sides of the Atlantic. The operation also resulted in the seizure of over US$6.5 million in cash and virtual currency, mainly Bitcoin, 500 kilograms of drugs worldwide, and 63 firearms. An unprecedented, coordinated international effort to disrupt opioid trafficking on the darknet, Operation DisrupTor, was jointly conducted by the US Joint Criminal Opioid and Darknet Enforcement (JCODE) and Europol. The operation identified numerous darknet vendor accounts through which criminals had been selling illicit goods on darknet market sites. A common criminal pattern consisted of finding buyers on the dark web, accepting cryptocurrency as prepayment, and shipping drugs to customers’ addresses through regular mail and other shipping services. One criminal group operating in the US city of Los Angeles completed more than 18,000 individual drug sales on several darknet sites. The group was also supplying other darknet vendors and street drug dealers. The darknet offers its users anonymity, and cryptocurrencies, which are often the preferred method of payment on darknet sites, provide an additional way to veil transactions. According to the FBI, many drug users have grown more comfortable logging onto their computers and buying narcotics in a few minutes from their home than going to a street corner. The darknet and its associated use of cryptocurrencies provides a large and expanding marketplace that crosses national borders to enable illicit activity. However, in an environment in which law enforcement action is identifying darknet operators and their activities, darknet users are increasingly searching for other ways to communicate, such as encrypted chat networks. Key takeaways • Cryptocurrency is the preferred payment method for purchasing illicit goods on the darknet. • Law enforcement is increasingly capable of countering encryption and identifying anonymous data sources and transactions. • Criminals will always search for new avenues of communication to avoid detection.