On October 19, 2023, the U.S. Department of the Treasury's ("Treasury") Financial Crimes Enforcement Network (FinCEN) announced a Notice of Proposed Rulemaking (NPRM) that would implement new recordkeeping and reporting requirements on domestic financial institutions and domestic financial agencies, related to transactions that they know, suspect, or have reason to suspect involve convertible virtual currency (CVC) mixing within or involving a non-U.S. jurisdiction.
FinCEN issued the NPRM pursuant to Section 311 of the USA PATRIOT Act, which provides the Secretary of the Treasury (the "Secretary") the authority to require domestic financial institutions and domestic financial agencies to take "special measures" where the Secretary finds reasonable grounds to conclude that a class of transactions, institution, account, or foreign jurisdiction is of "primary money laundering concern." The NPRM identifies international CVC mixing as a class of transactions of primary money laundering concern, highlighting the use of CVC mixing services by illicit actors including cyber criminals and terrorist groups. According to FinCEN's press release, the NPRM represents FinCEN's first use of Section 311 to target a class of transactions.
Requirements Contained in the Proposed Rule
The proposed rule defines "CVC mixer" as any person, group, service, code, tool, or function that facilitates CVC mixing. "CVC mixing" is defined as the facilitation of CVC transactions in a manner that obfuscates the source, destination, or amount involved in one or more transactions, regardless of the type of protocol or service used, such as: (1) pooling or aggregating CVC from multiple persons, wallets, addresses, or accounts; (2) using programmatic or algorithmic code to coordinate, manage, or manipulate the structure of a transaction; (3) splitting CVC for transmittal and transmitting the CVC through a series of independent transactions; (4) creating and using single-use wallets, addresses, or accounts, and sending CVC through such wallets, addresses, or accounts through a series of independent transactions; (5) exchanging between types of CVC or other digital assets; or (6) facilitating user-initiated delays in transactional activity.
The definition of CVC mixing excludes "the use of internal protocols or processes to execute transactions by banks, broker-dealers, or money services businesses, including virtual asset service providers that would otherwise constitute CVC mixing, provided that these financial institutions preserve records of the source and destination of CVC transactions when using such internal protocols and processes; and provide such records to regulators and law enforcement, where required by law."
The proposed rule would require financial institutions to report information regarding transactions involving CVC mixing in or involving a non-U.S. jurisdiction and the customer associated with any such transaction, including:
- Amount of any CVC transferred, in both CVC and its U.S. dollar equivalent when the transaction was initiated;
- CVC type;
- CVC mixer used, if known;
- CVC wallet address associated with the mixer;
- CVC wallet address associated with the customer;
- Transaction hash;
- Date of transaction;
- IP address and time stamps associated with the transaction;
- Narrative description of the activity observed by the financial institution, including summary of investigative steps taken;
- Customer's full name;
- Customer's date of birth;
- Customer's address;
- Email address associated with any and all accounts from which or to which the CVC was transferred; and
- Unique identifying number for the customer (Taxpayer Identification Number, meaning an Employer Identification Number or Social Security Number, or the foreign equivalent).
The proposed rule would require the foregoing information to be reported to FinCEN within 30 days of initial detection of a reportable transaction.
Significantly, the NPRM indicates FinCEN's expectation that both direct exposure and indirect exposure to CVC mixing involving a non-U.S. jurisdiction would trigger the reporting requirement under the proposed rule. For example, if CVC were sent from a mixer to an intermediate wallet and then to a covered financial institution, the rule's reporting obligation would be triggered; and the same would be true if CVC were sent from a covered financial institution to an intermediary wallet and then to a CVC mixer. But transactions that are only indirectly related to CVC – such as a transfer of the fiat currency proceeds from an exchange of CVC that was previously processed through a CVC mixer – would fall outside the scope of the proposed rule.
Implications of the Proposed Rule
Should the rule be adopted as proposed, covered financial institutions will need to ensure that they collect the above-listed reportable information, or prevent transactions involving CVC mixers. Many financial institutions may already collect some or all of the required information, but others would need to adjust their data collection and retention practices. Some financial institutions may simply decline to engage in transactions involving CVC mixers.
Whether for the purpose of ensuring compliance with the rule's reporting obligation or for the purpose of declining transactions involving CVC mixers, covered financial institutions may also need to enhance their transaction surveillance frameworks to identify direct and indirect exposure to non-U.S. CVC mixing, if the proposed rule is adopted. According to the NPRM, "FinCEN would expect covered financial institutions to employ a risk-based approach" to compliance with the proposed rule, "including by using the variously available free and paid blockchain analytic tools commonly available."
Another key issue is likely to be which platforms qualify as a CVC mixer. The definition in the proposed rule is quite broad and could capture a wide range of platforms that are not typically considered mixers. For example, exchanging between types of CVC or other digital assets would capture an array of decentralized protocols, many of which would not fall into the exemption for virtual asset service providers because they are not licensed or registered as such. Additionally, if financial institutions (which include most digital asset custodial exchanges and platforms, among many other digital asset business models) decline to deal with CVC mixers to ease their compliance burden, that could have a significant impact on the liquidity and, potentially, viability of those CVC mixers.
The Treasury has shown an increased interest in addressing sanctions and money laundering-related concerns arising from CVC mixing over the past two years. In 2022, the Treasury's Office of Foreign Assets Control (OFAC) designated virtual currency mixers Blender.io and Tornado Cash as Specially Designated Nationals (SDNs) (see Steptoe's blog post on the designation of Tornado Cash for more information).
Comment Period and Topics
In addition to inviting comments on all aspects of the proposed rule, the NPRM posits a number of specific matters for commenters to address, including, for example:
- What impact would this proposed rule have on legitimate activity conducted by persons in the course of conducting financial transactions?
- Does the proposed definition of CVC mixing adequately capture the activity of concern? If not, please provide suggested revisions to the proposed definition that would better capture such activity. Where possible, please provide information or examples to illustrate how the recommended revisions would improve upon the definition as proposed.
- Does the proposed exception to the definition of CVC mixing adequately account for legitimate activity conducted by VASPs and other financial institutions?
The comment period for the NPRM closes on January 21, 2024.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
