FATF Turns 30, Part 2: Addressing the rise of Crypto, VASPs and technology

This is the second in a series of articles assessing the evolution of the FATF since its inception in 1989.  It focuses on how the FATF is addressing the rise of innovation in finance, particularly the crypto and virtual assets industry, and discusses emerging technology and initiatives, such as digital identity, to tackle anti-money laundering and countering the financing of terrorism (AML/CFT).

The first article looked at how the FATF’s mandate has changes in the past 30 years under the guidance of the G7 and G20.

The Fifth Industrial Revolution

The Fifth Industrial Revolution –a term for the increasingly close collaboration between man and machine – is changing the payments landscape.  This has required a shift in how the Financial Action Task Force (FATF) and the industry approach (AML/CFT).

While this evolution in finance and technology is creating new opportunities, particularly with regards to financial inclusion and sustainable development, it is also opening new pathways for criminals to exploit.  For example, crypto intelligence company CyperTrace said recently that in the first half of 2019, more than $4.26 billion was stolen from cryptocurrency exchanges, investors, and users, all of which will be laundered at some point in time.  If the trend continues, this will double Europol’s 2018 estimate of $5.5 billion being laundered through cryptocurrencies.

At the same time, firms have increasingly been using regulatory technology (regtech) to comply with AML requirements.  The RegTech industry is estimated to be worth $5 billion and growing.

The FATF has evolved to address new threats presented by such technology, for example, by amending its 40 Recommendations, and by working with industry.  This led to the issuance of the first global standard on virtual assets.

FATF’s Response to the Rise of Virtual Assets

In October 2018, FATF updated its 40 Recommendations to bring “Virtual Assets Service Providers” (VASPs) into scope as an entity type that needs to adopt AML/CFT measures.  The FATF defines VASPs as a natural or legal person that exchanges, transfers or engages in financial services, and/or the safekeeping or administration of virtual assets.

In April 2019, the FATF engaged in lively dialogue with the crypto community on the proposed “travel rule,” which proved very controversial in the crypto community given the lack of available technology to transfer required information at the time. Essentially, the FATF calls for VASPs to send their customers’ information to other corresponding VASPs when a transfer of value between firms occurs, including:

• (i) originator’s name (i.e., the sending customer);
• (ii) originator’s account number where such an account is used to process the transaction (e.g., the Virtual Assets (VA) wallet);
• (iii) originator’s physical (geographical) address, or national identity number, or customer identification number (i.e., not a transaction number) that uniquely identifies the originator to the ordering institution, or date and place of birth;
• (iv) beneficiary’s name; and
• (v) beneficiary account number where such an account is used to process the transaction (e.g., the VA wallet).

The FATF also issued a Guidance for a risk-based approach for VASPs.  In the guidance, the FATF recommends that member countries enforce the new standards by using various technological tools, such as “web-scraping” and “open-source information,” to pinpoint unregistered or unlicensed entities engaging in virtual currency businesses.

It also placed emphasis on information sharing between the public and private sector.  This includes sharing of typologies on how criminals misuse VASPs to engage in money laundering or terrorist financing activities, a form of targeted unclassified intelligence. The FATF also signalled the importance of cross-border information sharing between the private sector, countries, and VASPs to promote transparency and flag suspicious transactions.

Bringing VASPs into the regulatory framework not only helps to address the risk of VASPs being used to launder the proceeds of crime, but also goes some way to support financial institutions in reconsidering their risk appetite towards the industry.  While looking to on-board this client type, however, financial institutions should aim to understand the systems and controls implemented by actors operating in this nascent industry.

Shortly after it issued its updated standards for VASPs, the FATF made itself available during the Virtual Assets 20 (V20), a side event held during the Osaka G20 Summit, to meet with industry leaders in the virtual assets community.  During the event, discussions were held to establish how the virtual assets industry could develop a technological solution to allow for the transfer of originator and beneficiary information. This included the creation of a standardised data set and conversations around what type of technology layer could be used.

Given the various types of decentralised protocols and networks used for different assets, this will require VASPs to continue to work together to develop, at minimum, a common set of standards to allow for the same information to be captured and shared about assets transferred on different blockchains.  The VASPs and crypto assets community could look to existing Organisation for Economic Cooperation and Development (OECD) Common Reporting Standards and information-sharing requirements to use as a model or link into the current international reporting standards but add their own technology layer. The FATF is scheduled to review the progress of implementation by the industry in June 2020.

More recently, at the October 2019 Plenary, the FATF said it is it actively monitoring the rise of emerging assets, such as stablecoins, and that these new virtual assets would be subjected to FATF standards.  Stablecoins are a type of virtual asset designed to minimise the volatility of cryptocurrencies by pegging them to more stable assets or baskets of assets, such as fiat money or exchanged-traded commodities.

This followed the announcement by Facebook that it would issue the Libra stablecoin on its platform, making it available to its 2 billion users worldwide.  If there were to be mass adoption, this could have systemic implications for financial stability.  In addition to the initiatives on stablecoins and other emerging assets, the FATF also announced another strategic initiative on “understanding and leveraging the use of digital identity.”

Digital identity and the use of new technologies to tackle AML/CFT

Under the new Chinese Presidency, the FATF agreed to continue its work to mitigate emerging threats while exploring opportunities offered by new technologies to target these risks more effectively. Speaking at the HSBC Annual Lecture on Financial Crime, Xiangmin Liu, the FATF’s president, explicitly stated that new technologies can be used to combat financial crime.  He flagged the use of machine-learning tools to identify financial crimes or using big-data techniques to keep track of beneficial owners of companies. Liu said none of the existing technologies are universal and some are used only by a few countries. Thus, there are still major gaps in using existing technologies to tackle financial crimes on an international basis.

“[T]he rapid pace of innovation in digital identity has reached an inflection point,” Liu said, with solutions becoming commercially available at scale. Technologies cited as being more widely used include smart phone technology, biometrics (including fingerprints and behavioural biometrics), artificial intelligence/machine learning, and distributed ledger technology. Liu said reliable digital ID could “improve the trustworthiness, security, privacy, convenience and efficiency of identifying individuals in the financial sector.”

During its October 2019 Plenary, the FATF issued draft guidance on digital identity which highlighted digital payment are growing at approximately 12.7% per year, and are projected to reach 726 billion transactions annually by 2020: nearly 2 billion transactions per day.  By 2022, the FATF said, approximately 60% of global GDP will be digitalised.

This significant increase in digital transaction, combined with the rising popularity of cryptocurrencies and non-face-to-face onboarding, heightens the challenge of digital customer identification.  In the draft guidance, the FATF examines how digital ID systems can meet FATF’s customer due diligence requirements and assist governments and financial institutions to “apply a risk-based approach to use digital ID systems.”  It said that distributed ledgers technology – a digital system that records transactions of assets in multiple places at the same time and does not require central data store or administration functionality – can be used in digital ID systems to better pinpoint financial crimes more accurately.

There are a number of benefits associated with digital identity, such as effective authentication, improved accuracy and reduced resource waste.  And despite low adoption, the digital identity market is set to reach $12.8 billion by 2024.  It is clear that the FATF has made digital identity a priority to manage risks of adoption while promoting the opportunities offered by new technologies as the market grows.

Continued G20 Support for FATF

The FATF has been swift to respond to the rapid rise in popularity of VASPs and the new and innovative avenues created to engage in finance.  It has done so through a combination of political will, and working in public-private partnership, to a fixed timeline.

The FATF’s guidance on the “travel rule” is vitally important to tackle financial crime. Although there was initial uproar in the crypto and virtual assets community, it was reminiscent of when financial institutions had to develop a solution to share originator and beneficiary information following the 9/11 terrorist attacks to allow for quick responses by law enforcement.

The FATF’s new strategic initiatives on emerging assets, specifically stablecoin and digital identity, have come at a time when the world is contending with the regulatory and legal challenges of Facebook’s Libra.  The FATF’s position and standards on emerging assets will help determine the viability of Libra and, by extension, the adoption of stablecoins in the financial systems.

The G7 and the G20’s continued support of the FATF’s initiatives and standards shows that the countries which make up a combined global GDP of 80% recognise how vital it is to have a body which sets standards to target the profits of those committing some of the most heinous crimes around the world. There seems little doubt that the G20 will continue to endorse the FATF’s work on stablecoins and digital identity, amongst other initiatives, at the G20 Summit to be held on 21-22 November 2020 in Riyadh, Saudi Arabia.

Originally published on Thomson Reuters Accelus