On Oct. 23, 2023, FinCEN published an NPRM that identifies international CVC mixing as “a class of transactions of primary money laundering concern,” and finds that imposing additional recordkeeping and reporting requirements on “covered financial institutions” would help mitigate the risks such transactions pose. The NPRM’s proposed reporting requirements would be in addition to any obligation to file Suspicious Activity Reports (SARs). FinCEN has invited comments on all aspects of the NPRM, including several questions posed. Comments will be accepted through Jan. 22, 2024.

Background

Section 311 of the USA PATRIOT Act (Section 311) grants the Secretary of the Treasury or her delegee (here, the Director of FinCEN) the authority to require domestic financial institutions and agencies to take “special measures” to defend the U.S. financial system from money laundering and terrorist financing risks, upon a finding that reasonable grounds exist for concluding that one or more classes of transactions within or involving a jurisdiction outside the United States is of primary money laundering concern.[1] 

The NPRM sets forth: (1) FinCEN’s finding that transactions involving CVC mixing within or involving jurisdictions outside the United States are a class of transactions that are of primary money laundering concern; and (2) FinCEN’s proposed rule requiring covered financial institutions to implement certain recordkeeping and reporting requirements on transactions that they know, suspect, or have reason to suspect involve CVC mixing within or involving jurisdictions outside the United States.

CVC and CVC Mixing 

In line with previously published FinCEN guidance, the NPRM provides that the term “virtual currency” refers to a medium of exchange that can operate like currency but does not have all the attributes of “real” (i.e., fiat) currency. The NPRM proposes to define the term “convertible virtual currency” as a medium of exchange that either (1) has an equivalent value as currency; or (2) acts as a substitute for currency but lacks legal tender status.[2]

The public nature of most CVC blockchains provides a permanent, recorded history of all previous transactions, potentially allowing an individual’s entire financial history to be traced on the blockchain. Anonymity-enhancing tools, including “mixers,” are designed to obscure transactional information, allowing users to conceal their connection to the CVC and obscure the source of CVC obtained. 

Use of CVC Mixing by Illicit Foreign Actors

The NPRM sets forth FinCEN’s findings that foreign CVC-mixing transactions are used to facilitate or promote money laundering in or through jurisdictions outside the United States, including by organized criminal groups, international terrorists, or entities involved in the proliferation of weapons of mass destruction and missiles. As such, the NPRM seeks to impose recordkeeping and reporting requirements on covered financial institutions to increase transparency in these transactions.

Covered Financial Institutions and Covered Transactions Under the NPRM

FinCEN proposes to require “covered financial institutions” to report certain information concerning the use of CVC mixing, relying on existing regulations to define the scope of entities and transactions covered by the NPRM:

• The term “covered financial institution” encompasses those financial institutions defined in 31 C.F.R. § 1010.100(t), including, among others, banks, money services businesses, broker-dealers, futures commission merchants and introducing brokers, and mutual funds.

• The term “covered transaction” means a “transaction” as defined in 31 C.F.R. § 1010.100(bbb)(1) (including a purchase, sale, loan, pledge, transfer, delivery, disposition), in CVC, that is carried out “by, through, or to the covered financial institution,” and “that the covered financial institution knows, suspects, or has reason to suspect involves CVC mixing within or involving a jurisdiction outside the United States.”

• The term “CVC mixing” means the facilitation of CVC transactions in a manner that obfuscates the source, destination, or amount involved in one or more transactions, regardless of the type of protocol or service used (examples include pooling or aggregating CVC from multiple persons, wallets, addresses, or accounts, using programmatic or algorithmic code to coordinate, manage, or manipulate the structure of a transaction, and splitting CVC for transmittal and transmitting it through a series of independent transactions). The definition exempts the use of internal protocols or processes to execute transactions by banks, broker-dealers, or money services businesses that would otherwise constitute CVC mixing, provided that these financial institutions preserve records of the source and destination of CVC and provide such records to regulators and law enforcement, where required by law.

Proposed Reporting and Recordkeeping Requirements

FinCEN proposes to require covered financial institutions to report the following information regarding “covered transactions”:

• the amount of any CVC transferred, in both CVC and its U.S. dollar equivalent, when the transaction was initiated;

• the type of CVC used in the covered transaction;

• the CVC mixer[3] used, if known;

• the CVC wallet address associated with the mixer;

• the CVC wallet address associated with the customer;

• the transaction hash;

• the date of the transaction;

• the IP addresses and time stamps associated with the covered transaction; and

• a description of the activity observed by the covered financial institution.

Additionally, the NPRM would require covered financial institutions to collect and report information about the customer associated with the covered transaction, which includes the customer’s:

• full name, as it appears in the customer’s proof of identification and related documents, such as a passport or driver’s license;

• date of birth;

• address;

• email address associated with any and all accounts from which or to which the CVC was transferred; and

• unique identifying number, such as the customer’s Taxpayer Identification Number (TIN) or, if the individual does not have one, a foreign equivalent, or in the case of entities, the entity’s TIN, or if the entity does not have one, a foreign equivalent or a foreign registration number.

Covered financial institutions would be required to report covered transactions to FinCEN within 30 calendar days of initial detection. The NPRM does not require that covered financial institutions perform a lookback to identify covered transactions that occurred prior to the issuance of a final rule. The NPRM would require covered financial institutions to maintain records, for a period of five years after filing a report, documenting its compliance with the recordkeeping and reporting requirements of the NPRM. 

Takeaways

Entities that fall within the definition of a covered financial institution should closely monitor developments and assess the potential impact on their compliance operations. Additionally, individuals and entities not classified as financial institutions but involved in CVC transactions could experience indirect consequences resulting from the implementation of the NPRM and should closely monitor developments as well.

[1] See Pub. L. No 107-56, § 311, 115 Stat. 272, 402 (2001) (codified at 31 U.S.C. § 5318A).

[2] The NPRM provides that although Bitcoin has legal tender status in at least two jurisdictions, the term CVC includes Bitcoin for the purposes of the NPRM.

[3] The term “CVC mixer” is defined as any person, group, service, code, tool, or function that facilitates CVC mixing.