CAI0029

Written evidence submitted by RUSI Centre for Financial Crime and Security Studies

This response is submitted by the Centre for Financial Crime and Security Studies (CFCS) at the Royal United Services Institute (RUSI). It represents the views of the research team members who have contributed their expertise as it relates to the wide-ranging themes covered by the inquiry. It does not represent the views of RUSI itself. Further details of our programme and activities can be found at the end of this submission.

Queries about this submission should be forwarded to the CFCS Senior Programme Manager, Alanna Putze.

1.   Summary

For ease, the key points, and recommendations of each section of this submission are laid out below. Further detail is provided in each of the subsequent sections:

1.1  Illicit finance and digital currency

• Crypto-assets have the potential to provide huge benefits to the global financial ecosystem, notably the capability to conduct cross-border transactions in less than an hour. Alongside opportunities for increasing the speed and ease of financial transactions, innovation in the crypto-asset ecosystem can boost the economy by attracting new entrants and investment. Nonetheless, the risk involved in this space cannot be overlooked when considering the role that crypto-assets should play in the UK’s economy going forwards.

• Innovation without regulation will lead to new avenues for criminals to exploit. This abuse is shown repeatedly by hacks carried out by persistent state actors, laundering of funds by organized crime groups, and an abundance of scams relating to crypto-assets. Compliance measures need to consistently adapt to mitigate risks associated with new developments in the crypto-asset ecosystem.

1.2  Central Bank Digital Currencies (CBDCs)

• As far as the alternatives go, a state-backed Central Bank Digital Currency (CBDC, in this case a ‘UK Digital Currency’) is a far more attractive proposition in terms of stability, a store and measure of value, a medium of exchange, or a means of payment, than anything offered by the decentralised world of digital/crypto-assets.  Of course, for those attracted to crypto-assets for other reasons, such as anonymity and operation outside state-based systems, the presence of the state in a digital currency will remain problematic. 
• To-date, the hype surrounding CBDCs has not been matched by reality and a compelling business case.  It is certainly true that the UK’s payment system could benefit from improvements, particularly as relates to providing a ‘whole of system’ overview that would allow for more effective identification of money laundering and fraud; but whether these objectives require the introduction of a new form of payment and/or payment system, or whether the UK needs to simply work more assiduously within the system it already has in place, is far from certain.  As the Economic Affairs Committee of the House of Lords noted earlier this year, CBDCs may be a solution in search of a problem.

1.3  The role of the Government in responding to illicit and emerging finance

• Progress in the UK towards the regulation of crypto-asset businesses for AML purposes has been slow, however this pace does not differ when compared to other jurisdictions. If the UK plans to work towards becoming a hub for the crypto-ecosystem, there needs to be a balance between regulation and innovation. To successfully ensure that this balance is met, there needs to be a direct line of communication between private and public sectors.

2        Illicit Finance and Digital Currency

What opportunities and risks could the use of crypto-assets- including Non-Fungible Tokens- pose for individuals, the economy, and the workings of both the public and private sectors?

General opportunities and risks

2.1  The emergence of crypto-assets in the last 15 years has resulted in substantial changes in the global financial system. The advantages can be significant; the capability to conduct cross-border transactions in less than an hour compares to a 24-hour period with wire transfers between financial institutions. An added benefit is that growth in the crypto-asset ecosystem can boost the economy by bringing in innovation and subsequently new companies.

2.2  Nonetheless, the UK cannot overlook risks associated with crypto-assets. The expansion of this industry may provide economic benefits, but without proper compliance measures in place, emerging avenues can appear for criminals to exploit.

2.3  While the percentage of illicit activity is minimal when looking at the overall crypto transaction activity, appropriate safeguards need to be put in place to restrict heightened abuse.[1] Criminals will continue to exploit gaps in regulation to generate revenue for sanctions evasion, launder proceeds of organised crime, commit large-scale fraud or fund terrorist groups.

2.4  The government has stated its aim for the UK to be a hub for crypto investment. If this is to be the objective, there needs to be a clear and robust regulatory regime that is effectively enforced. This will provide consumers and investors with confidence and restrict malign actors from abusing regulatory gaps.

2.5  We have set out below areas of financial crime risks that our work has identified in relation to crypto-assets. It is critical that policy makers, regulators and the private sector understand these risks and put in place appropriate steps to mitigate them.

Obfuscation of crypto and digital asset ownership and flows

2.6  A main benefit of crypto-assets that operate on a public blockchain is the capability to trace transactions. This transparency allows for illicit funds to be tracked and, in some cases, recovered.[2] There are, however, services that obfuscate the source and onward flow of crypto-assets, known as mixers and tumblers. While there may be legitimate uses for these services, they can make investigations difficult for law enforcement when determining the recipient of funds.

2.7  Services that integrate mixing protocols such as CoinJoin, which bundles crypto-asset transactions, aid in reducing transparency and consequently attract illicit activity. With the use of these applications, law enforcement cannot connect ingoing funds with the outgoing value with full accuracy via blockchain analytic tools and can lead to a crypto-asset business accepting funds tied to illicit activity.

2.8  Smaller crypto-asset businesses with limited or no compliance measures can set up accounts at exchanges with more services available. These nested crypto and digital asset businesses take advantage of these services to conduct transactions on behalf of their own customers, creating financial crime risks similar to those in correspondent banking, an accepted high-risk area of banking. It is therefore critical that AML controls at higher liquidity exchanges are identifying correspondent relationships and conducting due diligence on nested businesses, to avoid fronting for illicit activity.

2.9  Recommendation: Regulators, law enforcement and the private sector must ensure that they are aware of the latest techniques used by criminals to obscure the flows of crypto-assets.

Non-Fungible Tokens (NFTs)

2.10          The use of NFTs provides benefits to artists, as the creators earn royalties for subsequent sales of the asset. Nonetheless, factors that add to consumer risk persist, such as wash trading and fraud. If NFTs connected to illicit activity are sold and the funds are sent to a crypto-asset business to be converted to fiat currency, the crypto-asset business may assume that the digital asset sold is legitimate.

2.11          At the same time, new threats within the NFT ecosystem continue to emerge, such as the use of NFTs to raise funds. In 2022, the Russian Imperial Movement listed an NFT on a popular marketplace to raise funds for Russian fighters in Ukraine.[3] Law enforcement should monitor this development closely to preclude other designated terrorist entities from raising funds through the sale of NFTs. Given the demonstrable attraction of far-right extremists to NFTs as a means of disseminating propaganda, non-designated far-right groups should also be monitored for NFT usage for fundraising.

2.12          Recommendation: Regulators need to understand the emerging trends within the crypto and digital asset space and associated risks. Consistent training of regulators on these new avenues can aid in combatting financial crime.

Crypto mining

2.13          Cryptocurrency mining is the process of verifying transactions on the blockchain. In return, the miners carrying out this validation process receive a generated ‘block’ reward that consists of new crypto-assets, along with the fees associated with each transaction. There is evidence of criminal activity within the crypto mining space. Two cases exist of law enforcement seizing bitcoin mining facilities used by criminal networks to launder funds in Spain and Brazil.  Criminals can use illicit funds to pay for crypto mining machines and energy costs to sustain the activity. After successfully validating transactions through mining, they receive newly minted crypto-assets that are not tied to previous transactions. They can then move the clean funds across borders and potential convert funds at a crypto-asset firm without detection.

2.14          There is also a risk of sanctioned countries mining prominent forms of crypto-assets at crypto mining facilities. These countries take advantage of their natural energy resources to power mining, which in return, provides newly minted crypto-assets that are not tied to previous transactions. Identification of this activity is limited and most likely would not be flagged by public and private sectors conducting due diligence.

2.15          Recommendation: The UK’s National Risk Assessment process for money laundering, terrorist financing and proliferation financing needs to account for emerging services within the crypto mining space. Linking crypto mining to illicit activity cannot occur solely by blockchain analytic tools, and therefore, other indicators for this activity need to be identified.

The risk of crypto and digital assets in relation to terrorist financing and proliferation financing

2.16          In a recent study[4] on the impacts of new technologies (including crypto-assets) on terrorism financing risks in Europe, the Centre for Financial Crime and Security Studies found that crypto-assets were noticeably absent from the financing of most operational terrorist activity between 2015 and 2021. Crowdfunding donations in crypto-assets was more common for organisational financing purposes, oftentimes in combination with traditional terrorism financing methods such as money-service businesses and hawala transfers.

2.17          This study also finds that policymaking on the regulation of crypto assets in the EU has been overly dependent on assumed levels of risk of crypto-assets for terrorism financing abuse, with rhetoric emphasising the vulnerability of crypto assets overall without clarifying within which subsectors of the industry the greatest risk lies. The UK should continue to establish regulation in-line with evidencable risks.

2.18          Proliferation financing by state actors within the crypto-asset ecosystem is more prominent than terrorist financing. In particular, North Korea has focused on hacking to generate revenue. In April 2022, a North Korean hacking group stole approximately $540 million worth of crypto-assets from the Ronin cross-chain bridge.[5] A subsequent cross—bridge exploit occurred, reportedly carried out in a similar manner to the Ronin Bridge exploit.[6] This occurrence could either be tied to North Korea or alternatively represent a false flag operation.

2.19          Recommendation: The UK should continue to establish regulation in-line with evidencable risks. While there is evidence of crypto asset activity in relation to proliferation financing, there is less evidence to date of its use for terrorist financing however that may change in future.

3        CBDCs

What opportunities and risks would the introduction of a Bank of England Digital Currency bring?

3.1  In January 2022, the House of Lords Economic Affairs Committee published an extensive report considering the ‘far-reaching consequences [of CBDCs] for households, businesses, and the monetary system for decades to come’, noting that a UK CBDC ‘may pose significant risks depending on how it is designed. These risks include state surveillance of people’s spending choices, financial instability as people convert bank deposits to CBDC during periods of economic stress, an increase in central bank power without sufficient scrutiny, and the creation of a centralised point of failure that would be a target for hostile nation state or criminal actors.’  In sum, the Committee believed, CBDCs are perhaps a solution in search of a problem.

3.2  It should be noted that a member of staff from RUSI gave evidence to this House of Lords Committee and that the subsequent report was launched by way of a public event, led by Lord King, hosted by RUSI.  (A recording can be found here).

3.3  Key to considering this question is to first determine what improvements are required of the UK’s payment system, as it relates to retail, business and wholesale use?  And once these improvements have been identified, determining to what extent a digital currency – in one form or another – represents the best form of amelioration.

3.4  Such considerations are outside of the scope of the CFCS at RUSI, however CBDCs do present financial crime and security related concerns (and opportunities) that should be addressed as part of any wider assessment of the potential adoption of a UK CBDC.

• First, can the introduction of a UK CBDC be used to ‘bake’ anti-financial crime measures into the UK’s financial system as a matter of course?  A key challenge in the UK is the lack of information sharing between those in the public and private sectors charged with combatting financial crime, and the absence of a unified picture of financial flows in the UK.  This means that each stakeholder in the UK’s financial system has to rely on the small slice that is visible to them in order to determine suspicious activity.  Would a centralised overview – with the necessary privacy protections – enhance the ability of supervisors and law enforcement to identify illicit financial activity?  And in particular, would the introduction of a UK digital currency make a meaningful impact on the national fraud epidemic?  This should be one of the key litmus tests applied to the value of such an innovation.
• Second, could a UK CBDC be used to achieve more effective UK sanctions implementation?  The UK’s track record on identifying financial sanctions evasion is weak.  Again, assuming the appropriate safeguards on privacy are in place, could a UK CBDC support a more effective sanctions evasion monitoring effort?
• Lastly, in an era where the threat from hostile state activity has increased markedly, to what extent does the further digitisation of the UK’s national payments system present a risk to national security?  We are well aware of the chaos that occurs when ATM/credit card point-of-sale systems go down – what are the risks to which the UK is exposing itself if it introduces a UK digital currency (noting that there are different formats in which such an innovation could be introduced)?

3.5  In sum, in line with the conclusion of the recent House of Lords Economic Affairs Committee report, the case for a significant change in the UK’s payment system has yet to be made.  Improvements are certainly warranted, but whether these developments are best served by the introduction of a UK digital currency, remains to be proven.

4        Crypto-asset Regulation

Are the Government and regulators suitably equipped to grasp the opportunities presented by crypto-assets, whilst at the same time mitigating against the risks?

1         

2         

3         

4         

4.1  The balance between regulation and innovation when it comes to crypto-assets is a topic that jurisdictions are grappling with. Progress towards the regulation of crypto-asset firms for AML purposes in the UK has been slow, as noted by the Treasury Select Committee[7] and evidenced by the fact that the FCA has only authorised a small fraction of the overall number of businesses that applied.[8] The UK is not, however, an outlier in terms of the speed of crypto regulation compared to other countries.[9]

4.2  Given the cross-border nature of crypto-assets, coordinated efforts between global regulators are required. Currently, there is limited implementation of AML regulations relating to crypto on an international scale. In 2021, the Financial Action Task Force (FATF) published the Second 12-Month Review of Revised FATF Standards on Virtual Assets and Virtual Asset Service Providers. This review notes that 70 of the 128 jurisdictions self-assessed had yet to implement revised standards into their national law.[10]  

4.3  Securing longer-term funding for training financial intelligence units (FIUs) in British Overseas Territories will aid in risk mitigation. FIUs need to understand how to analyse crypto-related suspicious transaction reports, subsequently successfully prosecute crypto-related crimes and seize related crypto assets. At the same time, training needs to include a focus on the procedure for recovering these assets, as the speed and ease of these transactions can become a drawback when trying to obtain custody of the funds.

4.4  It is unclear as to whether the FCA have the resources to be able to successfully bring crypto and digital assets within their regulatory perimeter. Charles Randall, the outgoing Chair of the FCA, has highlighted that it is not clear how the FCA will pay for the “very significant cost” of oversight of the crypto industry.[11] Some firms who have undergone the FCA’s authorization process have complained about the high staff turnover at the FCA and the lack of knowledge.[12]

4.5  It is also essential that regulators and supervisors of the Designated Non-Financial Businesses and Professions sectors (DNFBP is a term used by the Financial Action Task Force including lawyers, accounts, real estate agents, trust/company service providers, etc) understand how their sectors interact with crypto and digital assets. The UK’s National Risk Assessment of Money Laundering and Terrorist Financing 2020 notes accountancy and legal services providers are increasingly asked to accept payment in crypto and digital assets.[13]  Training of associated risks in this space is critical, as a key factor for efficient enforcement is ensuring that red flags are effectively identified and reported.

4.6  While it is likely a ‘fantasy’[14] to expect that policy and regulation will move as fast as the crypto industry, it is, however, essential that the UK regulators are provided with the resources that they need to carry out an effective oversight function. This includes access to relevant technology, training on new and emerging risks and additional staff resources who are experienced and knowledgeable about the industry.

4.7  It would also be beneficial to establish a formalized method for sharing crypto-asset financial crime typologies between crypto-asset businesses and law enforcement. This process can occur through the establishment of a permanent working group in the Joint Money Laundering Intelligence Taskforce (JMLIT). Through a direct line of information sharing, these crypto-asset businesses can effectively identify illicit activity and effectively file suspicious transaction reports.

About the CFCS

Since its formation in 2014, RUSI’s Centre for Financial Crime and Security Studies (CFCS) has focused on matters at the intersection of finance and security in support of policy makers and operational agencies in the UK and in a range of countries across the globe, as well as undertaking extensive engagement with multilateral bodies charged with developing policy and operational responses to financial crime, such as the Financial Action Task Force (FATF), its regional bodies (FSRBs) and the UN Security Council.

September 2022

8