Illicit Finance and Other Key Risks of Digital Assets: Keynote at City Week 2023 CFTC Commissioner Christy Goldsmith Romero in London

Source: https://www.cftc.gov/PressRoom/SpeechesTestimony/oparomero8

Highlights:

• "The CFTC will aggressively police fraud in digital asset markets." "
  • We have filed 73 digital assets civil prosecutions for fraud and other illegal acts, about one-third of them during my tenure."
  • "Frauds involving ponzi schemes, rug pulls, fictitious projects, empty promises, and lies about track records of success, devastate victims financially and emotionally."
• "Digital assets pose non-bank financial stability risk."
  • "Digital assets have seen serious disruptions and market stresses, losing two-thirds of value in high profile meltdowns and a loss of market confidence evidenced by extremely fast runs often triggered by social media." "
  • "Many retail customers have either lost their funds or seen them tied up in bankruptcies, particularly when customer assets were commingled with company assets."
  • "Customers of Crypto Exchanges Often Do Not Have Control of their Assets or Bankruptcy Priority"
• "Vertical integration poses significant contagion risk. The extent of contagion risk is unknown when a regulator like the CFTC regulates one company, but has no visibility into, or oversight over, affiliates."
• "To reduce the risk of illicit finance, identity is a foundational challenge. It is essential for governments and the industry to address that which makes crypto so attractive to illicit finance—the allure of anonymity."
• "The digital asset industry should verify digital identity."
• "Governments have a responsibility to reduce the risks that digital assets pose to financial stability."
• "The crypto markets are used to facilitate illicit financing of drugs, human trafficking, ransomware, terrorism, and malicious state sponsored activity posing national security risks."
• "The use of digital assets for illicit finance poses national security and other risks."
  • "Attracted by the allure of anonymity, crypto’s darkest corner facilitates the financing of terrorism, the drug trade, darknet markets, cyber gangs, money launderers, and malicious state sponsored activity."
• "The U.S. Department of Treasury (“Treasury”) recently found that “the most current illicit finance risk in this domain is from [decentralized finance] DeFi services that are not compliant with existing anti-money laundering (“AML”)/countering the financing of terrorism (“CFT”) obligations"
  • "Treasury found that illicit actors, including ransomware gangs, thieves, scammers, and Democratic People’s Republic of Korea cyber actors, are using DeFi services to transfer and launder illicit proceeds, exploiting vulnerabilities in the law enforcement regime as well as the DeFi technology."

TIME OUT! What Treasury actually found:

https://home.treasury.gov/system/files/136/DeFi-Risk-Full-Review.pdf

Moreover, money laundering, proliferation financing, and terrorist financing most commonly occur using fiat currency or other traditional assets as opposed to virtual assets.

That dirty, dirty, dirty fiat!!!! Most common way to money launder and do other bad things?!?

Color me shocked!!! It does take a little bit of the wind out of her argument though, right?

TLDR:

CFTC Commissioner Christy Goldsmith Romero Claims:

• "The use of digital assets for illicit finance poses national security and other risks."
• "The crypto markets are used to facilitate illicit financing of drugs, human trafficking, ransomware, terrorism, and malicious state sponsored activity"
• "Digital assets pose non-bank financial stability risk."
  • "Digital assets have seen serious disruptions and market stresses, losing two-thirds of value in high profile meltdowns and a loss of market confidence evidenced by extremely fast runs often triggered by social media." "
  • "Many retail customers have either lost their funds or seen them tied up in bankruptcies, particularly when customer assets were commingled with company assets."
  • "Customers of Crypto Exchanges Often Do Not Have Control of their Assets or Bankruptcy Priority"
• "Vertical integration poses significant contagion risk. The extent of contagion risk is unknown when a regulator like the CFTC regulates one company, but has no visibility into, or oversight over, affiliates."
• "To reduce the risk of illicit finance, identity is a foundational challenge. It is essential for governments and the industry to address that which makes crypto so attractive to illicit finance—the allure of anonymity."
• "The digital asset industry should verify digital identity."
• The use of digital assets for illicit finance poses national security and other risks."
  • "Attracted by the allure of anonymity, crypto’s darkest corner facilitates the financing of terrorism, the drug trade, darknet markets, cyber gangs, money launderers, and malicious state sponsored activity."
• "The U.S. Department of Treasury (“Treasury”) recently found that “the most current illicit finance risk in this domain is from [decentralized finance] DeFi services that are not compliant with existing anti-money laundering (“AML”)/countering the financing of terrorism (“CFT”) obligations"
  • "Treasury found that illicit actors, including ransomware gangs, thieves, scammers, and Democratic People’s Republic of Korea cyber actors, are using DeFi services to transfer and launder illicit proceeds, exploiting vulnerabilities in the law enforcement regime as well as the DeFi technology."

Full Speech:

Tomorrow is reportedly the 12th anniversary of the day that Satoshi Nakamoto, the creator of Bitcoin and blockchain, sent his final message to developers.[1] It has long been speculated that he left disillusioned after PC-World published that Bitcoin could be used for payments to WikiLeaks after it was blacklisted by banks. He walked away the day after messaging, “It would have been nice to get this attention in any other context. WikiLeaks has kicked the hornet’s nest, and the swarm is headed towards us.”[2]I wonder what Satoshi thinks of the entire industry that has grown from his vision, about this past tumultuous year for that industry, and the use of Bitcoin for illicit finance. A hornet’s nest has been kicked indeed.Satoshi’s vision for a peer-to-peer network without a trusted third party inspired a global financial services ecosystem of intermediaries, platforms, projects, and markets. However, most digital assets today are transacted on centralized “exchanges,” that act as “trusted” third parties, differing from Satoshi’s vision. Retail and institutional participation in digital asset markets exploded in recent years to a $3 trillion valuation, in part because investors trusted in those exchanges. Trust was eroded with high-profile meltdowns and contagion, leaving investors with nearly $2 trillion in losses,[3] and the industry in a crisis of trust.[4]As a U.S. regulator in law enforcement for 21 years combatting money laundering, fraud and other crime, I will talk first about the most serious risk in digital asset markets—the use of crypto for illicit finance. I will also talk about the risk of cyber hacks, fraud, and financial stability. I will share my views about how to manage these risks, while promoting market integrity and protecting customers.The crypto markets are used to facilitate illicit financing of drugs, human trafficking, ransomware, terrorism, and malicious state sponsored activity posing national security risks.The use of digital assets for illicit finance poses national security and other risks. Attracted by the allure of anonymity, crypto’s darkest corner facilitates the financing of terrorism, the drug trade, darknet markets, cyber gangs, money launderers, and malicious state sponsored activity.[5]In 2020, the U.S. Department of Justice (“DOJ”) dismantled three terrorist financing campaigns of Hamas, al-Qaeda, and ISIS, seizing 300 cryptocurrency accounts. One of these terrorist groups boasted that Bitcoin donations were untraceable and would be used for violent causes. DOJ has shut down darknet marketplaces, like Silk Road and Hydra. DOJ also shut down Hydra’s largest counterparty, the crypto exchange Bitzlato, which Treasury has identified as a primary money laundering concern in connection with Russian illicit financing.[6]Cryptocurrency is used to finance cybercrime and is demanded for ransomware payments. The victims of cyber attacks can be individuals, companies, hospitals, schools, governments, the financial sector, transportation, critical infrastructure like the Colonial Pipeline, and supply chains like JBS, the world’s largest meat supplier. There have been significant cyber hacks sponsored by Russia, including related to the U.S. 2016 election, French elections in 2017, the 2018 Olympic games, and Ukraine.U.S. authorities worked with authorities from many nations to take down Hydra and Genesis Market, who sold account access credentials stolen from 1.5 million compromised computers.[7] And in January, DOJ shut down Hive, one of the largest ransomware groups.The U.S. Department of Treasury (“Treasury”) recently found that “the most current illicit finance risk in this domain is from [decentralized finance] DeFi services that are not compliant with existing anti-money laundering (“AML”)/countering the financing of terrorism (“CFT”) obligations.[8] Treasury found that illicit actors, including ransomware gangs, thieves, scammers, and Democratic People’s Republic of Korea cyber actors, are using DeFi services to transfer and launder illicit proceeds, exploiting vulnerabilities in the law enforcement regime as well as the DeFi technology.[9]Digital asset technologies pose a significant risk of customer loss through cybercrime.Last year was a record-setting year for crypto cybercrime with more than $3.8 billion stolen. The criminals are sophisticated, relentless, and often state actors. DeFi’s open source code and public blockchain make it vulnerable to cyber hacks, as seen by the fact that 82% of the hacks involved DeFi.[10]Exchanges also face cyber risks. FTX CEO John Ray recently reported that FTX “grossly deprioritized and ignored cybersecurity controls” and “lacked a reasonable ability to prevent, detect, respond to, or recover from a significant cybersecurity incident, including” a $432 million breach in November.[11]Private key management is essential. In the Ronin Bridge hack, the largest hack ever, the hackers were able to access the private keys to steal $600 million in crypto.Fortifying cross-chain bridges that permit users to migrate crypto assets across different blockchains is critical. Almost two-thirds of hacks affecting DeFi protocols came via breaches on cross-chain bridges.[12] Binance was hacked over a cross-chain bridge in October.[13]It’s also important to secure third party services, such as customer interfaces. Man-in-the-middle hacks exploit third party vulnerabilities, as seen in the $120 million Badger DAO hack.Fraud has become a hallmark of digital asset markets, the human toll of which may be overlooked.The hype and buzz around digital assets have attracted opportunists and criminals. The CFTC will aggressively police fraud in digital asset markets. We have filed 73 digital assets civil prosecutions for fraud and other illegal acts, about one-third of them during my tenure.[14] This, combined with my two decades of combatting fraud, give me insight into the human toll of crypto fraud—the victims. Frauds involving ponzi schemes, rug pulls, fictitious projects, empty promises, and lies about track records of success, devastate victims financially and emotionally.Perhaps the worst victimization comes from scammers who prey on loneliness in romance scams and the newly emerged “pig-butchering” scam, where scammers “fatten up” victims by tricking them into believing they are in a romantic relationship, and then “butcher” them into investing in a fraudulent crypto scheme on a fake website that looks like a legitimate crypto offering or trading platform.[15]In 2022, frauds reported to the FBI involving cryptocurrency, including pig butchering, represented the highest of any category of investment scams. Losses from these scams have increased 183% since 2021, with $2.57 billion in losses in 2022.[16]Digital assets pose non-bank financial stability risk.Satoshi’s vision for a peer-to-peer network to transfer value without a trusted third party and outside of the traditional financial system (“Trad Fi”) is by design a shadow banking system. Much like other non-bank activity, regulators do not have visibility into risks of digital asset activity. I came to the CFTC from Treasury where for the last decade I served as the Special Inspector General over the Troubled Asset Relief Program (“SIGTARP”), in law enforcement and other work to strengthen financial stability after the 2008 financial crisis.Within three months of joining the CFTC, starting in June 2022, I began warning of financial stability risks in crypto markets that echoed the 2008 crisis.[17] This included run risk, contagion risk, hidden exposures in opaque, complex products, and underlying assets that were not the high quality represented. I also said that because the Bitcoin (and other non-securities) markets were not regulated, regulators could not see the extent of the risk. Additionally, I warned of risks novel to crypto, such as conflicts of interests as many companies use multiple affiliates to serve as exchanges, brokers, clearing agencies, and other functions (known as vertical integration). And I warned that customer assets were commingled with company assets, and of heightened cyber risk.All of these risks were then publicly exposed. Digital assets have seen serious disruptions and market stresses, losing two-thirds of value in high profile meltdowns and a loss of market confidence evidenced by extremely fast runs often triggered by social media. Many retail customers have either lost their funds or seen them tied up in bankruptcies, particularly when customer assets were commingled with company assets.Today I want to highlight two specific areas that contribute to financial stability risk: first, the fact that customers of crypto exchanges often do not have control of their assets or bankruptcy priority, and second, conflicts of interest including vertical integration.Customers of Crypto Exchanges Often Do Not Have Control of their Assets or Bankruptcy PriorityBecause crypto exchanges are often structured similar to traditional exchanges and perform similar functions, they present similar financial stability risks, but they are often outside of the regulatory perimeter or unwilling to step into it. Exchanges operate “off chain” maintaining customer trades in an internal, centralized account ledger, like traditional exchanges. The exchange also maintains possession and control of the customers’ funds and crypto.Customers may not realize that their transaction is not on the blockchain and that they do not have keys or other control over what they would consider to be their assets. Disclosures are inadequate in both content and delivery to be effective in informing customers of their rights and risks. Customers have been held to contractual language that most have never read, much less negotiated. They often scroll through electronic disclosures without reading them and click to accept. Courts are upholding these “click-wrap agreements” as seen in the Celsius bankruptcy, where the court found that customer deposits were owned by the exchange, not the customers.[18] This is further complicated when, as seen with FTX, customer assets are commingled with exchange assets.[19]Conflicts of Interest Including Vertical IntegrationFTX’s actions with its affiliates laid bare the risk of undisclosed and unmitigated conflicts of interest—a risk that I warned about in October, a few weeks before FTX’s collapse saying:[20]Crypto-related companies may serve multiple functions that are separated into different entities in traditional finance. An exchange may also be a market maker, clearinghouse, lender, and/or custodian. These conflicts present significant risk that in a regulated environment would be disclosed and resolved. In an unregulated environment, the full extent of these conflicts may not be disclosed or resolved, which could lead to cascading losses and contagion risk.[21]Treasury Secretary Janet Yellen recently said that Treasury is “working to address risks associated with vertical integration of crypto-trading platforms and lack of visibility into the operations of subsidiaries and other entities across these businesses.”[22] Vertical integration poses significant contagion risk. The extent of contagion risk is unknown when a regulator like the CFTC regulates one company, but has no visibility into, or oversight over, affiliates.Managing digital asset riskGiven that digital assets are already of significant size in the global financial system, it is imperative that these serious risks are managed. The stakes are too high. Market integrity, national security, and financial stability are non-negotiable. The private sector and governments both have a role to play in reducing these risks and in protecting customers.Managing National Security Risk and Illicit Finance Risk:To reduce the risk of illicit finance, identity is a foundational challenge. It is essential for governments and the industry to address that which makes crypto so attractive to illicit finance—the allure of anonymity. While the public blockchain can provide some traceability and transparency, the use of mixers and technology designed to enhance anonymity presents substantial risk. Treasury recently sanctioned two mixers, Blender and Tornado Cash. Treasury said that Tornado Cash was used to launder $7 billion, including millions stolen by the Lazarus Group, a North Korea state-sponsored hacking group that engaged in cyber hacks to support illegal nuclear and ballistic missile programs.[23]Law abiding customers do not want their funds mixed with North Korea cybergangs or terrorist organizations. Legally compliant crypto companies should not use these mixers.It is possible for all crypto companies to distance themselves from mixers and anonymity-enhanced technology, while still appropriately providing financial privacy for customers. Financial privacy is different from anonymity. TradFi provides financial privacy while verifying identity, as part of KYC (know your customer), AML, and CFT controls. The digital asset industry should verify digital identity. There are existing technologies to provide digital identity, and more being developed, which was the subject of a recent meeting of the CFTC’s Technology Advisory Committee that I sponsor.[24] Exchanges as well as those offering DeFi services should verify digital identity. More often than not, DeFi services are not fully decentralized but instead maintain central parties who could verify identity, and may be held accountable to do so. Congress is also considering new laws on addressing anonymity and digital identity.[25]The U.S. government will continue to prioritize preventing crypto’s use for illicit finance. DOJ continues to shut down crypto’s path of illicit finance. The CFTC will continue to be aggressive in enforcing the law. The CFTC brought two enforcement actions against crypto exchanges, BitMEX and Binance, alleging that they undertook activities with customers in the U.S. that required CFTC registration and that they did not follow AML controls. For example, BitMEX took no steps to verify its customers’ identities, allowing individual customers to trade simply by providing an email address.[26] The CFTC brought its action in parallel with the criminal indictment of four BitMEX executives.[27] Treasury has shown its willingness to sanction mixers. A couple of weeks ago, Treasury issued a report on the use of DeFi for illicit finance recommending strengthening U.S. AML/CFT supervision and, when relevant, enforcement of crypto activities, including DeFi services.[28]Managing Financial Stability Risks: Governments have a responsibility to reduce the risks that digital assets pose to financial stability. This is still a sizeable market of around $1 trillion,[29] with a lot of participating retail investors. I advocate for a same risk, same regulatory outcome approach, with the same market guardrails and customers protections (including banning commingling of customer assets and customer priority in bankruptcy) that have proven to promote financial stability. In the U.S., Congress should consider closing the regulatory gap in the Bitcoin and other non-securities spot markets.[30] Congress should also consider reducing the risks of conflicts of interest, including those raised by vertical integration. This could include requiring firms to disclose and resolve conflicts of interest, and providing regulators greater visibility and oversight tools related to affiliates.Eliminating Cyber Vulnerabilities: Cyber experts on the Committee that I sponsor agree that it will not be sufficient to manage cyber vulnerabilities; instead, the industry must eliminate those vulnerabilities. The stakes are too high, with hacks used to fund weapons and other illegal activity, and customers without recourse when their assets are stolen in a hack. It will not be sufficient to assume that smart contracts work without fail or that there are no vulnerabilities. The industry should strengthen cybersecurity, including through code audits, fortifying cross-chain bridges, strengthening private key management, and shoring up vulnerabilities of third party services.ConclusionThese are global risks with implications far more dire than Satoshi could have conceived when he talked about the hornet’s nest. Because digital assets cross borders, countering these global risks will require both private sector commitment and international government cooperation and coordination. We are stronger working together. We can leave no safe passage for illicit finance, cyber criminals, fraudsters or those who risk the stability of our global financial system.