Treasury Risk Assessment Highlights Decentralized Crypto Companies Have Anti-Money Laundering and Sanctions Compliance Obligations

[ad_1]

Earlier this month, the US Department of the Treasury (Treasury) released its Decentralized Finance Illicit Funding Risk Assessment (Assessment). This assessment, part of a broader regulatory review of entities that operate in the decentralized finance (DeFi) space (see explanation below), focuses on illicit finance risks associated with virtual assets.

While the assessment explains how bad actors take advantage of weak spots in anti-money laundering (AML) and other regulatory regimes around the world, we want to highlight the findings of the assessments that DeFi firms do not often fail to meet their obligations to deal with the sanctions and risks of money laundering. As we’ve highlighted over the past year, financial institutions of all kinds, from traditional banks and brokerages to new crypto and web3 companies, are facing increased regulatory scrutiny (for example, see past alerts of Wilson Sonsini on Coinbase, TornadoCash and Kraken). This assessment is a reminder, especially to DeFi financial institutions, that regulators will continue to crack down on AML breaches.

The first-of-its-kind risk assessment alleges that DeFi service providers often fail to have strong AML compliance programs in place. This, according to the assessment, can make DeFi services vulnerable to exploitation by illicit actors. To curb the use of DeFi services for criminal purposes, the Treasury assessment recommends that the U.S. government strengthen anti-money laundering regulatory oversight, consider potential improvements to the existing regulatory regime, and better engage with the private sector to keep abreast of the latest developments in the field. DeFi ecosystem.

Enough to ?

Although there is no universally accepted definition of DeFi services, the term is generally used to describe virtual currency protocols and services that offer some form of automated peer-to-peer exchange transactions. These transactions are often executed using smart contracts or computer code. DeFi companies can operate, at least to some extent, without the support of a central company, group or individual, although the Treasury clarifies that the extent to which a purported Defi service is actually decentralized is a matter of facts and circumstances. Examples include cryptocurrency exchanges and decentralized liquidity platforms, where lenders and borrowers are incentivized to rely on a particular service.

Decentralization may not mean no regulatory control

The treasury assessment clarifies that the mere fact that a virtual currency business claims to be decentralized does not necessarily mean that the business would not be considered a financial institution under the Bank Secrecy Act, the legislative basis of the AML regulations. Likewise, the statement that a service is decentralized cannot be used to abdicate responsibility for compliance with sanctions programs administered by the Office of Foreign Assets Control (OFAC).

The assessment notes that when entities whose operations are subject to regulation (e.g. money transfer companies) fail to register with regulators or fail to meet their money laundering, malicious actors are more likely to take advantage of their services to profit from their criminal activity or circumvent law enforcement.

We’ve said it before and we’ll say it again: increasing trend in enforcement

The valuation is part of a larger trend: regulators are increasingly concerned about the illicit use of crypto assets and will aggressively scrutinize crypto asset businesses. Even companies with some degree of decentralization are not exempt from this scrutiny.

We’ve already discussed, for example, how crypto asset exchange Coinbase and its $50 million settlement with the New York Department of Financial Services after it failed to track, monitor and report suspicious activities that may have, and in some cases have resulted in, illicit activity. Additionally, decentralized crypto asset mixer TornadoCash was penalized by OFAC in August 2022 because, according to OFAC, TornadoCash’s weak AML program allowed users to launder more than $7 billion. On the same day, a senior BitMEX employee was found guilty of violating AML regulations issued under the Bank Secrecy Act, demonstrating that individuals, not just crypto-asset companies themselves, can be held responsible for these violations. Crypto asset exchanges Kraken and Bittrex both settled with federal regulators in 2022 over alleged sanctions and anti-money laundering violations.

The Treasury assessment separately notes that the Commodity Futures Trading Commission even filed a lawsuit against a Decentralized Autonomous Organization (DAO) for non-compliance with KYC/AML requirements. The U.S. District Court for the Northern District of California ruled that the DAO could be sued as an unincorporated association under applicable law, demonstrating how decentralization does not render crypto services to the application test. Regulators are unlikely to take their eyes off DeFi crypto asset firms anytime soon, making proper compliance programs more important than ever.

My company works in DeFi: what should I do?

First and foremost, companies operating in the DeFi space must perform an analysis to determine whether they need to register with federal (and/or state) regulatory bodies (e.g., FinCEN). Much like in the TV series The Office, when character Michael Scott discovered that declaring bankruptcy required a little more legwork than making that declaration in a public place (even out loud), DeFi companies (and their employees) don’t. should not assume that simply telling partners and customers that they are decentralized will protect them from their regulatory liabilities.

Additionally, maintaining an effective anti-money laundering and sanctions compliance program is essential to avoid missteps that could expose DeFi businesses to significant penalties. DeFi companies that do not have such compliance programs in place need to consider whether they are required to have one, what it should include, and how it should be funded.

Finally, Treasury’s assessment includes an acknowledgment that the government is behind in understanding DeFi, and Treasury recommends further engagement with the industry to catch up. This engagement can take the form of public comments and research opportunities. DeFi companies should pay close attention to these opportunities to ensure they help shape governments’ understanding of this evolving and innovative space.

If you have any questions about the valuation or how we can help your DeFi business, please contact any member of Wilson Sonsini’s national security and/or fintech and financial services practices.

[ad_2]