Uncertainty Looms for Digital Currency Providers and Regulators
Since the indictment of digital currency provider Liberty Reserve, new questions have been raised about what, if anything, that prosecution may portend for a growing population of digital currency providers and the law enforcement and regulatory communities. In May 2013, Liberty Reserve was indicted for conspiracy to commit money laundering, conspiracy to operate an unlicensed money transmitting business and operation of an unlicensed money transmitting business.1 The indictment has been characterized as the largest money laundering prosecution in history and an "important step towards reining in the Wild West of illicit Internet banking."2 Specifically, Liberty Reserve is alleged to have processed 55 million transactions and laundered $6 billion in criminal proceeds since 2006.3 In addition to criminal charges, a civil forfeiture complaint and restraining order were filed against 35 domain names associated with pre-approved third-party exchangers recommended by Liberty Reserve on its website.4
Simultaneous with the federal indictment, the Financial Crimes Enforcement Network (FinCEN) announced the designation of Liberty Reserve as a "financial institution of primary money laundering concern" under the Patriot Act.5 The coordinated action evidences a policy of pursuing rogue digital currencies through orchestrated criminal, civil and regulatory means. It may also signal an increase in the level of scrutiny applied to financial institutions providing services to the digital currency industry.
In its simplest form, digital currency is an electronic currency that exists on the Internet and is characterized by the absence of a centralized bank.6 A digital currency administrator like Liberty Reserve operates by allowing users to open accounts on its website. In contrast to a legitimate financial institution, the user's identifying information is not verified, which serves to provide the first layer of anonymity to the account holder. In addition, digital currency users cannot fund their accounts by direct transfers of money or credit card payments. Rather, the user can make deposits or withdrawals into the account only through a third-party exchanger.
The exchangers buy and sell digital currency from the administrator in bulk. This allows the exchanger to transact with a particular user, receiving payments and in turn issuing credit to the user's account for a processing fee. Once the credit of digital currency is in the user's account, the user can directly transact with other users for goods and services, or transfer funds without the exchange of goods by way of an exchanger on either side of the transfer. The end result is that the transactions and transfers happen with complete anonymity and without the paper trail that would have been created through the traditional banking system.7
A series of important milestones predated the Liberty Reserve indictment and provide meaningful insight to the future of increased regulatory enforcement. In 2007, the first digital currency provider was indicted for operating an unlicensed money services business (MSB). In United States v. e-gold, the government indicted the digital currency provider, a primary exchanger and individual operators of both. The defendants challenged the indictment on the grounds that they did not meet the definition of an MSB because they never engaged in the physical transfer of currency.8 Although the district court rejected the argument and the defendants later pleaded guilty, the case highlighted the reality that the statutes and regulatory framework at that time were ambiguous in terms of the application to digital currencies. As a result, digital currencies were able to hide behind the vagueness, and operate free from any restrictions at all.
In July 2011, FinCEN published a final rule substantially revising the definition of a money transmitter.9 Specifically, the definition was expanded to apply to the "acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means."10 In addition, the definition was revised to include entities doing business as a transmitter, "whether or not on a regular basis or as an organized or licensed business concern, wholly or in substantial part in the United States…."11 The new MSB rule was thus drafted with some foresight and in recognition of the fact that payment processors were evolving and moving towards technology-based methods to service customers. Notwithstanding the obvious implications of the new MSB rule, FinCEN did not issue specific guidance on the application of BSA regulations to digital currencies until March 2013. Two months before the Liberty Reserve indictment was announced, FinCEN issued Guidance affirmatively stating that an "administrator or exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason is a money transmitter…."12
The Liberty Reserve case remains pending and it remains to be seen whether the regulatory changes and guidance issued since United States v. e-gold will be enough to stave off anticipated challenges to the indictment of a digital currency provider largely operating online and beyond U.S. borders. The allegations in the indictment make clear, however, that the basis for jurisdiction is grounded in the number of users in the United States and the transfer of funds through at least one correspondent bank in New York. The indictment alleges that Liberty Reserve touted itself as serving millions around the world including the United States, but at no time registered with the U.S. Department of Treasury (FinCEN).13 The indictment also details the founding of Liberty Reserve in a manner to evade U.S. law enforcement and regulators by incorporating in Costa Rica, and using exchangers primarily in Malaysia, Russia, Nigeria and Vietnam.14 The indictment further alleges that an estimated 200,000 users were located in the United States;15 however, there are no specific allegations that users in the United States engaged in the criminal acts listed as predicates for the money laundering conspiracy.
With respect to the conspiracy to operate an unlicensed money transmitting business, the indictment specifically references the newly broadened definition of MSBs as applying to foreign-based businesses.16 The single overt act listed is a wire transfer in November 2011 from a bank in Costa Rica to an account in Cyprus, through a correspondent bank account in New York.17 In sum, the allegations in the indictment are based in large part on activity occurring outside the United States. The prosecution is seemingly indicative of how aggressively the Department of Justice will pursue illicit digital currencies, and the extent to which the United States is cooperating with the global law enforcement community and vice versa.
In coordination with the prosecution, FinCEN designated Liberty Reserve as a "primary money laundering concern" under §311 of the Patriot Act, marking the first use of the special measure in relation to a digital currency.18 The action essentially triggers AML-compliance requirements under the BSA for domestic financial institutions, to include extensive record-keeping and prohibitions on the maintenance and opening of correspondent accounts for use by the designated concern.19
This concerted action suggests that the focus going forward may well expand beyond the digital currencies themselves, to domestic financial institutions that deal, even indirectly, with administrators or exchangers of digital currency. The requirement that banks apply heightened scrutiny to third-party payment processors is not a new concept. Third-party payment processors are generally viewed as non-bank entities in the business of processing financial transactions for clients that do not have a relationship with the processor's bank. Regulators have repeatedly warned of the increased potential for money laundering occasioned by third-party processors and specifically MSBs.20