Virtual Currencies, Cyber-Payments and

Regulatory Compliance

ACC 5th Annual International ConferenceAbu Dhabi, November 26 , 2013

by Juan Llanos, CAMS

Adult population with NO USE OF formal or semiformal FINANCIAL SERVICES

© 2013 JuanLlanos

2/3 of adults (17 million) | 25% of GNP | 40,000 agents

© 2013 JuanLlanos

M-PESA Swahili for mobile money

© 2013 JuanLlanos

Agenda1. Bitcoin & Math-Based Currencies

What Bitcoin is and why it’s revolutionary

2. Risk Identification & Mitigation

a) Inventory of challenges

b) Mitigating AML risk

c) Customer identification and authentication (de-anonymization)

3. SA Detection via Monitoring and Analysis

Leveraging the blockchain

4. Unsolicited (contrarian) advice

© 2013 JuanLlanos

Agenda1. Bitcoin & Math-Based Currencies

What Bitcoin is and why it’s revolutionary

2. Risk Identification & Mitigation

a) Inventory of challenges

b) Mitigating AML risk

c) Customer identification and authentication (de-anonymization)

3. SA Detection via Monitoring and Analysis

Leveraging the blockchain

4. Unsolicited (contrarian) advice

© 2013 JuanLlanos

Think of Bitcoin as a numbered Swiss bank account living on your smartphone.

[…] retail and online purchases can be made with virtually no transaction fees. It's the ultimate bank debit card, except there's no card –or bank for that matter.

Robert Berry

© 2013 JuanLlanos

Intro Video 2

What is ?

Intro Video 1

© 2013 JuanLlanos

D I G I TA L PAY M E N T S N E T W O R KD I G I TA L M O N E Y

P R O T O C O L

© 2013 JuanLlanos

INSTANTANEOUSSECURE

LOW COSTGLOBAL TRANSFER OF VALUE

D I G I TA L PAY M E N T S N E T W O R K

© 2013 JuanLlanos

D I G I TA L M O N E Y

TRANSACTIONS IN “BITCOINS”DOLLAR VALUE OPEN MARKET

COUNTERFEIT-PROOF “ONLINE CASH”TOTAL CAPPED INFLATION-PROOF

© 2013 JuanLlanos

“bitcoins”

© 2013 JuanLlanos

SCARCE Central Banks can’t inflate themDURABLE they don’t degradePORTABLE can be carried and transmitted electronically or as numbers in your headDIVISIBLE into trillionthsVERIFIABLE through everyone’s block chainEASY TO STORE paper or electronicFUNGIBLE each bitcoin is equalDIFFICULT TO COUNTERFEIT cryptographically impossible

Naval Ravikant

P R O T O C O L

APPLICATIONS BEYOND PAYMENTS SECURE CONTRACTS, ESCROW, TAMPER-PROOF VOTING, NOTARY SERVICES, ETC.

P L AT F O R M F O R I N N O V AT I O N

© 2013 JuanLlanos

© 2013 JuanLlanos

• Contracts can be entered into, verified, and enforced completely electronically, using any third-party that you care to trust, or by the code itself. For free, within minutes, without possibility of forgery or revocation.

• Any competent programmer has an API to cash, payments, escrow, wills, notaries, lotteries, dividends, micropayments, subscriptions, crowdfunding, and more.

• While the traditional banks and credit card companies lock down access to their payments infrastructure to a handful of trusted parties, Bitcoin is open to all.

P L AT F O R M F O R I N N O V AT I O N

Naval Ravikant

ECO-SYSTEM

© 2013 JuanLlanos

K e v i n R o s e

P a u l G r a h a m W i n k l e v o s s T w i n s

A l G o r e N a s s i m N . Ta l e b

A s h t o n K u t c h e r

CENTRALIZED DISTRIBUTED

D I S T R I B U T E D | D E C E N T R A L I Z E D

© 2013 JuanLlanos

PEER

PEERPEER

PEER PEER

PEER

PEER

PEER

PEER

PEER

PEERPEER

PEERPEER

PEER

PEER

PEER

PEER

PEER

PEER

PEER

PEER

PEER

PEER

PEER PEER

PEER

PEER

PEER

PEER

PEER

PEER

PEERNO central authority or fi nancial insti tuti on in control

M AT H - E N F O R C E D T R U S T

PEER PEERPEER

PEER

© 2013 JuanLlanos

Payment + identi ty

© 2013 JuanLlanos

PAY M E N T & I D E N T I T Y S E PA R AT E D

CONSUMER PRIVACY PROTECTEDMERCHANTNO CHARGEBACKS / FRAUD

Payment only

© 2013 JuanLlanos

T R A N S PA R E N C Y

Every transacti on that has ever occurred in the history of the bitcoin economy is publicly viewable in the BLOCK CHAIN.

Privacy without anonymity pseudonymity

© 2013 JuanLlanos

Agenda1. Bitcoin & Math-Based Currencies

What Bitcoin is and why it’s revolutionary

2. Risk Identification & Mitigation

a) Inventory of challenges

b) Mitigating AML risk

c) Customer identification and authentication (de-anonymization)

3. SA Detection via Monitoring and Analysis

Leveraging the blockchain

4. Unsolicited (contrarian) advice

© 2013 JuanLlanos

“ V i r t u a l c u r r e n c i e s p r o m i s e t o b e n e fi t c o m m e r c e o n

m a n y l e v e l s , f r o m s e r v i n g t h e u n b a n ke d t o n e w fi n a n c i a l p r o d u c t s . I

c h a l l e n g e o u r i n n o v a t o r s : d e v i s e c r e a ti v e s o l u ti o n s t o

p r e v e n t v i r t u a l c u r r e n c y a b u s e .”

F i n C E N D i r e c t o r J e n n i f e r S h a s k y C a l v e r y

© 2013 JuanLlanos

R E G U L AT I O NT R A N S PA R E N C Y/ P R I VA C Y

S P E C U L AT I O NS E C U R I T Y

D I S R U P T I O N O F S TAT U S Q U O

CHALLENGES

© 2013 JuanLlanos

Before March 18, 2013

© 2013 JuanLlanos

The Criminal Precedent that Could Curb Bitcoin ’s Enthusiasm

E-Gold

© 2013 JuanLlanos

• ISSUER OF DIGITAL CURRENCY• a medium of exchange offered over the Internet• Global acceptance without the need for conversion between national

currencies

• USED FOR ONLINE COMMERCE AND FOR FUNDS TRANSFERS BETWEEN INDIVIDUALS

• FOUR PRIMARY STEPS1. Opening a digital currency account2. Converting national currency into “e-gold” to fund the account3. Using “e-gold” to buy a good or service or transfer funds to another person4. Exchanging “e-gold” back into national currency

• PARTIES NEEDED:• Digital currency exchanges• Merchants or individuals that accepted “e-gold”

• ABILITY TO OPERATE ACCOUNTS ANONYMOUSLY• Highly-favored method of payment by operators of “get-rich-quick” scams

• ALL TRANSFERS OF “E-GOLD” WERE IRREVOCABLE AND IRREVERSIBLE

© 2013 JuanLlanos

E-Gold2008-07 Guilty Plea

• Conspiracy To Launder Monetary Instruments (federal)• Conspiracy To Commit The Offense Against The United States (federal)• Operating Of Unlicensed Money Transmitting Business (federal)• Transmitting Money Without A License (District of Columbia)

“ T h e r o o t c a u s e s o f E - G o l d ’s fa i l u r e w e r e d e s i g n fl a w s i n t h e a c c o u n t c r e a ti o n a n d p r o v i s i o n i n g l o g i c t h a t

l e d t o t h e u n fo r t u n a t e c o n s e q u e n c e o f v u l n e ra b i l i t y t o c r i m i n a l a b u s e .

“ We a c k n o w l e d g e t h a t E- G o l d i s i n d e e d a fi n a n c i a l i n s ti t u ti o n o r a g e n c y a s d e fi n e d i n U S l a w a n d s h o u l d

b e r e g u l a t e d a s a fi n a n c i a l i n s ti t u ti o n .”Douglas Jackson, E-Gold Founder

March 18, 2013

© 2013 JuanLlanos

FinCEN Guidance FIN-2013-G001

© 2013 JuanLlanos

FinCEN Guidance FIN-2013-G001• “Interpretive Guidance” not new rule-making • Centralized vs. Decentralized virtual currencies• Virtual Currency Actors:

• USER a person that obtains virtual currency to purchase goods or services.

• EXCHANGER a person engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency.

• ADMINISTRATOR a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency.

FinCEN Guidance FIN-2013-G001

© 2013 JuanLlanos

• “An administrator or exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason is a money transmitter under FinCEN’s regulations […]”

• “Under FinCEN’s regulations, sending “value that substitutes for currency” to another person or to another location constitutes money transmission, unless a limitation to or exemption from the definition applies. This circumstance constitutes transmission to another location, namely from the user’s account at one location (e.g., a user’s real currency account at a bank) to the user’s convertible virtual currency account with the administrator.”

• “To the extent that the convertible virtual currency is generally understood as a substitute for real currencies, transmitting the convertible virtual currency at the direction and for the benefit of the user constitutes money transmission on the part of the exchanger.”

• “[…] a person that creates units of convertible virtual currency and sells those units to another person for real currency or its equivalent is engaged in transmission to another location and is a money transmitter. In addition, a person is an exchanger and a money transmitter if the person accepts such de-centralized convertible virtual currency from one person and transmits it to another person as part of the acceptance and transfer of currency, funds, or other value that substitutes for currency.”

© 2013 JuanLlanos

FinCEN Guidance FIN-2013-G001• Currency definitions:

• REAL CURRENCY the coin and paper money of the United States or of any other country that [i] is designated as legal tender and that [ii] circulates and [iii] is customarily used and accepted as a medium of exchange in the country of issuance.

• VIRTUAL CURRENCY medium of exchange that operates like currency in some environments, but does not have all the attributes of real currency; no legal tender status in any jurisdiction.

• CONVERTIBLE VIRTUAL CURRENCY either has an equivalent value in real currency, or acts as a substitute for real currency.

© 2013 JuanLlanos

FinCEN Guidance FIN-2013-G001• PROBLEM #1 ALL USERS? How does the law apply if one

obtains bitcoins not to purchase goods or services? Reasons:1. speculation that the price of bitcoins will go up 2. simply because one trusts a virtual currency’s stability more than that of a

particular “real currency” (think of Argentina or Zimbabwe), or 3. because one wants to make a remittance to a family member overseas.

• PROBLEM #2 MINERS?• If mine and buy goods users• If mine and sell bitcoins money transmitters. Why?

• Not transmitting bitcoins from one party to another (only 2 parties to the transaction)

• No consumer to protect and no potential for money laundering

• PROBLEM #3 NEW LAW IN THE GUIDANCE?• Definitions of “virtual currency” and “convertible virtual currency” only in

this guidance.

After March 18, 2013

© 2013 JuanLlanos

The End of Bitcoin as We Know It

© 2013 JuanLlanos

Liberty Reserve• alternative digital payment network• “Closed look” centralized virtual currency (LR

dollars)• shut down and its management indicted and

arrested in May 2013.• “the largest money laundering case in U.S.

history”• a convenient tool for foreign currency brokers,

as it allowed them to bypass local legislation and avoid exchange rate fluctuations

• “a shadowy netherworld of cyber-finance”• its realm of anonymity made it a popular hub

for fraudsters, hackers and traffickers

© 2013 JuanLlanos

Liberty Reserve Indictment[x] ANONYMITY product has to dissuade the bad element, never attract it.

• “deliberately attracting, and maintaining a customer base of criminals by making financial activity on LR anonymous and untraceable.”

• “designed so that criminals could effect financial transactions under multiple layers of anonymity and thereby avoid apprehension by law enforcement.”

[y] COMPLIANCE product and operations cannot be in violation of any applicable laws and regulations (the “form” or “paper” side of compliance).

• “was not registered as a money transmitting business with FinCEN”• “operated an unlicensed money transmitting business.”

[z] SUBSTANCE what is written in their policy must actually be implemented. Businesses must be run with integrity, responsibility and control.

• “intentionally creating, structuring, and operating LR as a criminal business venture, one designed to help criminals conduct illegal transactions and launder the proceeds of their crimes.”

• “lying to anti-money laundering authorities in Costa Rica, pretending to shut down LR after learning the company was being investigated by US law enforcement (only to continue operating the business through a set of shell companies)”

• “created a system to feign compliance with anti-money laundering procedures, […] including a ‘fake’ portal that was manipulated to hide data that LR did not want regulators to see.”

Money transmittersand their agents are perceived as

HIGH RISK of• ABUSE TO CONSUMER• MONEY LAUNDERING• TERRORIST FINANCING

Money transmission = highly regulated industry

© 2013 JuanLlanos

Money Transmitter Regulation (US)

© 2013 JuanLlanos

Focus AML/BSA + State Compliance

Main Risk Areas Main Statutes and RegsAnti-Money Laundering BSA, USA PATRIOT Act, Money

Laundering Acts

Anti-Terrorism Financing (CFT) USA PATRIOT Act, OFACPrivacy and Information

SecurityGramm-Leach-Bliley

Safety and soundness State (via licensing)Consumer protection State (via licensing) + Dodd-Frank /

Regulation E (CFPB)

Operational Customer (Sender & Recipient)

Foreign Counterparty

Agent (B&M, online)

MT Risks

Money Transmitter Risk Fronts

© 2013 JuanLlanos

© 2013 JuanLlanos

RISKS MITIGATORS Complicity with agent or foreign

counterparty

Complicity with recipient (or sender)

‘Drip-irrigation’ transfer of illicit funds (O2M recipients, M2O recipient, M2M recipients)

Intra-company structuring

Inter-company structuring (‘smurfing’)

Terrorist financing

Customer acceptance, monitoring and termination protocols

Transaction & behavior monitoring

Lower identity verification thresholds at origin and destination

For cards, maximum loadable amounts, expiration date, and limited number of recipients.

Redundant identity verification procedures at destination

POS training

OFAC screening

Eventually, intercompany transaction monitoring by highly-professional and secure clearing house. This is the only possible antidote against ‘smurfing’.

Customer Risks and Mitigators

© 2013 JuanLlanos

* AML Program Elements (Section 352 of the USA PATRIOT Act)

1. A designated compliance officer + professional team 2. Written policies and procedures + operational controls:

• Licensing, renewal and reporting procedures (S)• Registration, record-keeping and report-filing procedures (F)• KY (Know Your…) Subprograms: Acceptance, monitoring, correction and

termination• KY…Customer• KY…Agent• KY…Foreign Counterparty• KY…Employee• KY…Vendor

• Monitoring, analysis and investigating procedures• OFAC compliance program• Response to official information requests• Privacy and information security protection protocols

3. An on-going training program • Risk & Compliance Committee

4. An independent compliance auditing function

Corporate Safeguards*

© 2013 JuanLlanos

Key Elements of a BSA/AML Program• State Compliance: Licensing, renewal and reporting

procedures // Consumer protection disclosures, etc.• Federal Compliance: Registration, record-keeping and report-

filing procedures (F)• KY (Know Your…) Subprograms: Acceptance, monitoring,

correction and termination (Life-Cycle Management)• KY…Customer• KY…Agent• KY…Foreign Correspondent or Counterparty• KY…Employee• KY…Vendor

• SA Detection: Monitoring, analysis and investigating procedures

• Information Sharing: Response to information requests• OFAC Compliance Program• Privacy and information security protection protocols (GLBA)

© 2013 JuanLlanos

Product Safeguards• Anonymous identification• No value limits• Anonymous funding• No transaction records• Wide geographical use• No usage limits

Cash features

Anything we do to

counter these

will mitigate the

risk of our

product!

© 2013 JuanLlanos

Customer Identification

© 2013 JuanLlanos

Non-Face to Face Card not present standards

NON-DOCUMENTARY Independently verifying the customer’s identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source• contacting a customer• checking references or obtaining a financial statement

DOCUMENTARY Review an unexpired government-issued form of identification from most customers. • evidence of a customer’s nationality or residence • photograph or similar safeguard• form a reasonable belief that of the true identity of the customer. • E.g.: driver’s license (U.S.) or passport.

Authentication StrengthMultifactor authentication:

• Something the user knows (e.g., password, PIN)• Something the user has (e.g., ATM card, smart card)• Something the user is (e.g., biometric feature)

Authentication methods:• Shared secrets• Tokens (smart card, one-time password generating

device)• Biometrics (fingerprint, face, voice, keystroke

recognition) • Out-of-band authentication• Internet protocol address (IPA) location and geo-location• Mutual identification

Source: FFIEC

© 2013 JuanLlanos

Agenda1. Bitcoin & Math-Based Currencies

What Bitcoin is and why it’s revolutionary

2. Risk Identification & Mitigation

a) Inventory of challenges

b) Mitigating AML risk

c) Customer identification and authentication (de-anonymization)

3. SA Detection via Monitoring and Analysis

Leveraging the blockchain

4. Unsolicited (contrarian) advice

© 2013 JuanLlanos

“What customers do speaks so loudly that

I cannot hear what they’re saying.”

(Paraphrasing Ralph Waldo Emerson)

Customer identification vs. customer knowledge

B E H AV I O R A L A N A LY T I C S © 2013 JuanLlanos

© 2013 Juan Llanos

Machine Learning (AI) MethodsSUPERVISED LEARNING: relies on two labeled classes (good vs. bad)

Goal Detect known suspicious patterns1. Training set:

a. Select dataset with clean and dirty cases.b. Classification algorithm to discriminate between the two

classes (finds the rules or conditions)c. Probabilities of class 1 and class 2 assignment

2. Run discrimination method on all future purchases.

UNSUPERVISED LEARNING: no class labelsGoal Detect anomalies

3. Takes recent purchase history and summarize in descriptive statistics.

4. Measure whether selected variables exceed a certain threshold. (deviations from the norm)

5. Sounds alarm and records a high score.© 2013 JuanLlanos

• Structuring (Many-to-one)• High amounts • High frequency• Use of multiple locations • Use of multiple identities• Use of untrusted device• Values just below threshold• Immediate withdrawals

Known Suspicious Behaviors

© 2013 JuanLlanos

Sample Entity Pair Concentration

Analysis

© 2013 JuanLlanos

Sample Geographical Concentration (“heat”) Map

© 2013 JuanLlanos

• The entire history of Bitcoin transactions is publicly available.

• “Using an appropriate network representation, it is possible to associate many public-keys with each other, and with external identifying information.”

• “Large centralized services such as the exchanges and wallet services are capable of identifying and tracking considerable portions of user activity.”

An Analysis of Anonymity in the Bitcoin System - Bitcoin is Not Anonymous

by Fergal Reid and Martin Harrigan (2011)

Link: http://anonymity-in-bitcoin.blogspot.com/2011/07/bitcoin-is-not-anonymous.html

© 2013 JuanLlanos

• The victim woke up on the morning of 13/06/2011 to find a large portion of his Bitcoins sent to1KPTdMb6p7H3YCwsyFqrEmKGmsHqe1Q3jg.

• The alleged theft occurred on 13/06/2011 at 16:52:23 UTC shortly after somebody broke into the victim's Slush pool account and changed the payout address to 15iUDqk6nLmav3B1xUHPQivDpfMruVsu9f.

• The Bitcoins rightfully belong to1J18yk7D353z3gRVcdbS7PV5Q8h5w6oWWG.© 2013 JuanLlanos

© 2013 JuanLlanos

Bitcoin

Anonymous

Untraceable

“Invisible to law enforcement and the taxman”

© 2013 JuanLlanos

Myths

© 2013 JuanLlanos

Resources• Bitcoin Educational Resources:

http://www.forbes.com/sites/jonmatonis/2013/05/13/6-new-bitcoin-educational-resources/

• Bitcoin Education Project (Udemy): https://www.udemy.com/bitcoin-or-how-i-learned-to-stop-worrying-and-love-crypto/

• Bitcoin Primer for Policymakers: http://mercatus.org/sites/default/files/Brito_BitcoinPrimer_embargoed.pdf

• Bitcoin Wiki: https://en.bitcoin.it/wiki/Main_Page

• Cato Unbound-The Private Digital Economy: http://www.cato-unbound.org/issues/july-2013/private-digital-economy

• CoinDesk: http://www.coindesk.com/

• Contrarian Compliance: http://contrariancompliance.com/

• Let’s Talk Bitcoin: http://letstalkbitcoin.com/

• Khan Academy Bitcoin Series: https://www.khanacademy.org/economics-finance-domain/core-finance/money-and-banking/bitcoin/v/bitcoin-what-is-it

• We Use Coins: https://www.weusecoins.com/en/

Agenda1. Bitcoin & Math-Based Currencies

What Bitcoin is and why it’s revolutionary

2. Risk Identification & Mitigation

a) Inventory of challenges

b) Mitigating AML risk

c) Customer identification and authentication (de-anonymization)

3. SA Detection via Monitoring and Analysis

Leveraging the blockchain

4. Unsolicited (contrarian) advice

© 2013 JuanLlanos

• Prevention trumps damage control• Risk MGT Both reducing downside and

increasing upside• Simplicity and common sense• Train for behavior change, not theoretical

knowledge• Form-substance continuum substance• Letter-spirit continuum focus on spirit

(underlying purpose and values) facilitates• Operational synergies (leveraging tech)• Compliance without compromising performance• Flexibility and sustainability

© 2013 JuanLlanos

What i f…?

© 2013 JuanLlanos

Adult population with NO USE OF formal or semiformal FINANCIAL SERVICES

© 2013 JuanLlanos

BRAZILCUBA

CYPRUSVENEZUELAZIMBABWE

Etc., Etc…© 2013 JuanLlanos

© 2013 JuanLlanos

Underground Economy

© 2013 JuanLlanos

“If you haven't heard of BITCOIN, drop what you're

doing and go research it, for it is THE MOST

IMPORTANT PROJECT ON THE PLANET.”

Erik Voorhees

© 2013 Juan Llanos

Juan LlanosEVP & Compliance OfficerUnidos Financial Services, Inc.275 Seventh Ave. - 20th FloorNew York, NY 10001Direct: (646) 485-2264Mobile: (646) 201-6217Email: jllanos@unidosfinancial.com

LinkedIn: www.linkedin.com/in/juanllanosTwitter: @JuanLlanosBlog: contrariancompliance.com

Thank you!