Ensuring transparency amid virtual currency tsunami
New anti-money laundering law strengthens ways of monitoring crypto-assets
During the last few years we have witnessed the growing popularity of 'virtual' or 'crypto' currencies. Today, we could even say that their use has become a trend, as many individuals can buy virtual currencies through various platforms and applications by simply using their smartphones, while at the same time watching their favourite TV show.
The procedure is usually simple and swift with very limited identification requirements. The use of virtual currencies, though, conceals the danger of the anonymity or pseudo-anonymity that characterises them. Criminals can take advantage of this anonymity by using crypto currencies to transfer illicit funds into the financial system, achieving their integration in the market and/or the financing of terrorist organisations. To paint the general picture of the scale of such misuse, the crypto currencies and blockchain report, requested by the European Parliament, states that "even though the full scale of misuse of virtual currencies is unknown, its market value has been reported to exceed EUR 7 billion worldwide".
In a world where the competent authorities and the criminals are in a never ending 'cat-and-mouse' game, and during which the authorities are always multiple steps behind the criminals, the European Union has adopted the Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 (the "5th AML Directive") amending the Directives (EU) 2015/849, 2009/138/EC and 2013/36/EU.
The 5th AML Directive's aim is to enhance the transparency of financial transactions not only in the existing framework but also within the spheres of alternative finance and social entrepreneurship. It is hoped that this will be achieved by including as obliged entities a) the "providers engaged in exchange services between virtual currencies and fiat currencies" and b) the "custodial wallet providers". In other words, the 5th AML Directive applies to the service providers that fall under its definitions. As a result, they need to apply customer due diligence procedures in identifying and verifying the identity not only of all new customers but also of existing customers on a risk-sensitive basis. In addition, they are obliged to report suspicious transactions to the competent authority of their member state. In this way, the EU seeks to change the rules of the game by reducing the anonymity hitherto enjoyed by criminals.
Cyprus, in recent times, has become a hub for the rapidly growing forex industry which has come to include crypto currencies along with fiat currencies. Regulators, having concerns over the crypto-assets activities, have been long awaiting the amendment of the local anti-money laundering laws. In connection with the above, on February 23, 2021 the Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, came into force. The law radically amends the Prevention and Suppression of Money Laundering Activities Laws of 2007-2019 and implements the 5th AML Directive. It extends the definition of 'obliged entities' and catches within its ambit the crypto-assets service providers, who are now obliged to apply due diligence procedures every time they undertake a transaction amounting to, or more than, €1,000, irrespective of whether this transaction occurs in a single transaction or in multiple transactions that are interconnected. Given that the threshold provided by the law is quite low, it is apparent that the competent authorities are determined to put under review and scrutiny the majority of the transactions undertaken by the service providers. The question is whether this scrutiny will be sufficient to deter criminal activity.
Crypto-asset businesses will now need to implement adequate measures and procedures to identify their customer and, any ultimate beneficial owner(s), in accordance with the law. The use of technology can be of vital assistance with this demanding exercise, and software can be used "that can automatically background check an organisation to see if its ownership structure has changed, how long it has been established and where the company is registered. Furthermore, robotic and digital process automation (RPA and DPA) can be used to trigger an action such as an email asking banks for financial information such as P&L statements to show source of income, check for originating payments and even discrepancies in costs and profit to check for employees secretly siphoning off funds".
In addition, the 5th AML Directive stipulates that member states shall ensure that the providers of exchange services between virtual currencies and fiat currencies and the custodian wallet providers are registered. Pursuant to the law, such a register will be kept by Cyprus Securities and Exchange Commission (CySEC) and will include a) crypto-assets service providers that provide professional services or activities in the Republic of Cyprus, even if they are already registered in another member state for the services or activities they provide and b) crypto-assets service providers that provide professional services or activities in the Republic of Cyprus, except the persons who provide or carry out services or activities in the Republic of Cyprus that are related to virtual currencies and who have been registered in another member state for the services or activities they provide.
It is important to note that individuals who are not registered can continue to provide or carry out crypto-assets services in the Republic of Cyprus only if they are registered in another member state for the said services.
The crypto-assets service providers will need to submit an application to CySEC, which will review it and decide whether it will be approved or declined. Upon acceptance of their application, crypto-assets service providers will need to pay to CySEC registration and subscription fees. These will be determined by a circular to be issued by CySEC. Furthermore, the law provides that the crypto-assets service providers need to:
- immediately inform CySEC regarding any material amendments to the information required for their registration;
- apply the organisational and operational requirements to be specified in a circular of CySEC; and
- ensure that individuals with a managerial position and the ultimate beneficial owner(s) of the crypto-assets service providers are always capable and honourable, in line with the circular to be issued by CySEC.
It should be noted that the crypto-assets service providers are obliged to comply with the circular of CySEC and failure to do so is considered to be an infringement of the relevant article of the law. Τherefore, it is of paramount importance for the crypto-assets service providers to review and comply with the circular as soon as it has been issued by CySEC.
The circular is keenly awaited, and once issued, it will be extremely interesting to see how CySEC clarifies the following current uncertainties:
- the requirements for the registration of the crypto-assets service providers;
- the reasons for removal from the register and its implications;
- the definition of material amendments on required information;
- the organisational and operational requirements that need to be in place;
- the amount of the subscription fee;
- how the capability and honourability of the individuals with a managerial position and the ultimate beneficial owner(s) can be assessed;
- the obligations of individuals holding managerial positions; and
- the obligations of the ultimate beneficial owner(s).
The 5th AML Directive has undoubtedly filled an extremely important gap in pre-existing legislation by shedding some light on the anonymity enjoyed by criminals using virtual currencies for their illicit activities. Nevertheless, only time will show whether the measures taken by the competent authorities are sufficient, or whether additional actions need to be adopted. To quote the words of Oliver Wendell Holmes Jr, "the life of the law has not been logic; it has been experience".
Originally Published by Cyprus Mail on 30thof April, 2021.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
