On October 19, 2023, The US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) released a Notice of Proposed Rulemaking (NPRM) taking aim at convertible virtual currency (CVC) mixing transactions, utilizing for the first time its power under the Patriot Act to implement a “special measure” for financial institutions for matters related to a “primary money laundering concern” (Proposed Rule). The Proposed Rule, if implemented, will require certain financial institutions to implement recordkeeping and reporting procedures for transactions that involve CVC mixing.

CVC is a type of virtual currency that has an equivalent value to, or acts as a substitute for, fiat currency. Since transactions made using CVC occur on a blockchain, a permanent record of the transactions are recorded. Mixing services—also often referred to as crypto currency “tumblers”—provide additional anonymity for individuals transacting with CVC by bundling CVC from multiple individuals into one or a few transactions, or otherwise structuring CVC transactions to obfuscate the identities of the transacting parties, the amounts of the transactions, or the CVC’s ultimate destination.

While the anonymity that CVC mixing provides is a selling point for many individuals looking to use CVC for legitimate purposes, CVC mixing provides an opportunity for users to engage in any number of illicit activities, not least of which includes international money laundering and threat financing. Illicit actors can use CVC mixing to obscure the source, amount, and destination of CVC derived from illicit activities, such as dark net transactions and ransomware attacks. The NPRM states, “CVC mixing is ripe for abuse by, and frequently used by, illicit foreign actors that threaten the national security of the United States and the US financial system.” FinCEN cites examples including the “Axie Infinity Ronin Bridge” heist, which utilized at least two mixers—Blender.io and Tornado Cash—to launder nearly $620 million in funds stolen by the Lazarus Group, a cyber-threat actor affiliated with the Democratic People’s Republic of Korea.

Based on its analysis, FinCEN concluded CVC mixing is a primary money laundering concern, and utilized its authority under the Patriot Act for the first time to propose recordkeeping and reporting requirements for transactions involving CVC mixing. Under the Proposed Rule, if a covered financial institution “knows, suspects, or has reason to suspect” a transaction involves CVC mixing, it must report to FinCEN, among other things: (1) the amount of the CVC transferred and US dollar equivalent; (2) the CVC type; (3) the CVC mixer, if known; (4) the CVC wallet associated with the customer; (5) the IP address and time stamp associated with the transaction; (6) the date of the transaction; and (7) a narrative of the activity observed.

In addition, the financial institution must retain and report information regarding the customers involved with the CVC mixing transaction, including the customer’s full name, date of birth, address, email, and unique identifying number. Covered financial institutions must maintain any records documenting their compliance with the rules, if implemented. However, the NPRM defines covered transactions under the Proposed Rule as transactions “in CVC,” meaning only those financial institutions directly engaging in CVC transactions are required to comply. Institutions only indirectly related to CVC transactions, i.e. that are multiple steps removed from the mixing transaction, would not need to comply. The NPRM provided as an example businesses sending previously mixed and converted fiat funds to a person’s bank account.

***

The NPRM marks FinCEN’s latest efforts towards what appears to be part of a broader national security strategy involving cryptocurrency. Mixers and mixer transactions came under increased scrutiny last year. In May of 2022, OFAC sanctioned Blender.io for its involvement with the Lazarus Group and laundering the proceeds of the Axie Infinity heist. In August of 2022, OFAC sanctioned CVC mixer Tornado Cash for its use in laundering more than $7 billion in illicitly obtained CVC since 2019. Notably, FinCEN referenced both Blender.io and Tornado Cash’s role in money laundering in its reasoning for publishing the NPRM.

The NPRM requests public comment in a number of areas, including the impact of the Proposed Rule on legitimate activity conducted via CVC mixing transactions, whether other methods may be used to identify illicit activity, and whether the impact on the privacy interests of legitimate consumers outweighs the benefits of Proposed Rule. Notably, while FinCEN asserts that “[i]n light of the existing compliance practices of covered financial institutions, FinCEN expects that complying with this proposed rule should not add a significant additional burden[,]” it nonetheless invites comment on the potential compliance burdens of the Proposed Rule.

The comment period for the NPRM will close on January 22, 2024. Stakeholders in virtual currency industries, particularly those which involve CVCs that would be required to report CVC mixing transactions under the Proposed Rule, should consider commenting on the NPRM by the deadline. In addition, businesses should remain apprised of any further regulatory action involving CVC mixers.

________

If you have any questions about this Legal Alert, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.