DECEMBER 2020 | NO. 001 [GIABA Logo]

POLICY ADVISORY

VIRTUAL ASSETS AND VIRTUAL ASSETS SERVICE PROVIDERS (VASPs) - AML/CFT IMPLICATIONS FOR GIABA MEMBER STATES

---

Background

Why this Policy Brief?

The Financial Action Task Force (FATF) amended Recommendation 15 - New Technologies and its interpretative note in 2019 to take into account Virtual Assets and Virtual Assets Service Providers (VASPs).

• All member States who subscribed to the FATF Standards are required to adopt measures to monitor and regulate VA & VASPs

In 2019, the Financial Action Task Force (FATF) amended Recommendation 15 - New Technologies and its interpretative note to give consideration to the emergence of Virtual Assets and Virtual Asset Service Providers (VASPs) as an instrument of asset and financial transaction. These changes were necessitated by the rapid speed of technological advancement in the area especially with regard to financial transactions. The benefits of such technological advancement in relation to financial transactions include convenience, speed, flexibility, and a 24-hour timeframe to conduct transactions locally and globally. However, technological advancement also has provided opportunities for criminals and criminal enterprises to utilise technology platforms to benefit from their crimes.

The revised Recommendation15 now requires countries inter alia to carry out ML/TF risk assessment of activities in relation to virtual assets and/or operations of VASPs and take measures to mitigate risk, to register and/or licence VASPs while taking measures to ensure that criminals or their associates are prevented from holding, or being a beneficial owner of, a significant or controlling interest, or holding a management function in a VASP. Countries are further required to adequately regulate and effectively supervise VASPs for them to be subject to the relevant preventive measures, specifically from Rec. 10 to Rec. 21. Furthermore, the FATF requires countries to sanction VASPs for non-compliance and to provide widest international cooperation in relation to ML/TF, predicate offences investigation involving VASPs and virtual asset activities.

1

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

What is a Virtual Asset?

A virtual asset is a “digital representation of value that can be digitally traded or transferred, and can be used for payment or investment purposes” (FATF, 2019). Virtual assets should also include property, funds, proceeds, other assets or corresponding value. However, they do not include digital representations of fiat currencies, securities and other financial assets that are covered elsewhere in the FATF Recommendations.

Who is a Virtual Asset Service Provider?

The FATF (2019) defines a Virtual Asset Service Provider as any natural or legal person who is not covered elsewhere under the FATF Recommendations, and as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person

1. Exchange between virtual assets and fiat currencies;
2. Exchange between one or more forms of virtual assets;
3. Transfer of virtual assets;
4. Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets; and
5. Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

2

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

The ML/TF Risks Association with Virtual Assets

Although the African continent is yet to see large-scale adoption of virtual assets, Arcane Research describes the continent as “one of, if not the most promising regions for the adoption of cryptocurrencies” (The State of Crypto: Africa, 2020). The report attributed the increasing trend of crypto use in Africa to several factors, including the youthful population, the failing currencies in some African nations, the prevalence of costly payments within the continent, and the limited access to financial service providers such as banks.

Despite its potential to increase financial inclusion and solve long-standing issues such as remittance challenges in Africa, the 2020 Geography of Cryptocurrency Report acknowledged that the risks associated with the misuse of virtual assets and VASPs for money laundering and terrorist financing purposes exist (Chainalysis, 2020), therefore warranting more attention and understanding of the risks.

According to the 12-month review of the implementation of the revised standard on virtual assets and VASPs conducted by the FATF, two main trends have been identified in relation to the ML/TF risks. These include;

1. The risk of continued utilisation of tools and methods to enhance anonymity in conducting transactions; and
2. The risk of utilising VASPs operating in jurisdictions with inadequate AML/CFT regulation as well as the use of more than one VASPs such as local and/or foreign VASPs.

3

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

Risk arising from the utilisation of tools and methods to enhance anonymity in transactions

Observed Trends:

• The risk of continued utilisation of tools and methods to enhance anonymity in conducting transactions; and
• The risk of utilising VASPs operating in jurisdictions with inadequate AML/CFT regulation as well as the use of more than one VASPs such as local and/or foreign VASPs

The main risk associated with virtual assets is through the use of tools that enhance anonymity in transactions. This can be through the registering of internet domain names through proxies, use of decentralized exchanges and applications and through increase utilisation of mixers, tumblers and emergence of privacy enabling cryptocurrencies known as privacy coins. According to the Royal United Services Institute (RUSI), the use of mixers in virtual currency exchanges pursues the purpose of breaking the chain of traceable cryptocurrency transactions. Enabling this is the sole purpose of cryptocurrency mixers, also known as ‘tumblers’ (RUSI, 2018).

Transactions conducted on blockchains especially those conducted using public ledgers, which are visible to the general public can be traceable. With blockchain analysis, for example, investigators could trace suspected funds on the blockchain and determine which wallets they have gone through (Balaskas and Franqueira, 2018). To increase the level of privacy that users have while transacting in crypto, an emerging form of cryptocurrency is gaining popularity. These are referred to as Privacy-enabling cryptocurrencies, otherwise known as privacy coins. These types of coins differ from other cryptocurrencies in the sense that they provide their users with a degree of transactional privacy, while also providing the benefits of decentralization.

This level of privacy is a course for AML/CFT concern. However, some advocates for the use of privacy coins offer an alternative stance stating that AML/CFT efforts/regulatory actions directed at the VASPs that deal in privacy coins are sufficient to manage the ML/TF risks.

This is presently in accordance with the revised FATF Standards, which do not explicitly apply to peer-to-peer (P2P) transactions without the use of a regulated intermediary such as a VASP.

4

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

Risks associated with inadequate or lack of AML/CFT regulation and supervision of VASPs

What should countries do?

• Conduct risk assessment of virtual assets in relation to ML/TF to adequately understand the risks and put in place measures to mitigate such risks, including legislative measures.

In its revision to Recommendation 15, the FATF states that countries are required to regulate VASPs for AML/CFT purposes, should ensure they are licensed or registered, be subject to effective systems for monitoring and ensuring compliance with the relevant measures called for in the FATF Recommendations (FATF, 2019). The FATF provided an indication that the level of implementation of the revised standards was, for the most part, progressive (FATF, 2020). 24 FATF members and 8 FSRB members claimed to have AML/CFT regimes permitting the establishment of VASPs, while 9 and 4 respectively responded that regulations were either being developed or had been approved. 1 FATF member and 2 FSRB members claimed that VASPs were prohibited and the prohibition was enforced, while 2 FATF members claimed to have regulations being developed or approved to prohibit VASPs. 2 FATF members and 2 FSRB members responded that their approach to VASPs were under consideration (FATF, 2020).

In the GIABA Member States some of the following actions have been taken in relation to the subject matter.

In Nigeria, for example, the approach taken by the Government was to issue a public notice asking the public to exercise caution with regards to investment schemes involving virtual currencies (SEC Nigeria, 2017). Three years later, the Commission issued another statement on the classification and treatment of “digital assets”, wherein it stated that crypto-token or crypto-coin investments would be regulated by the Commission.

However, the statement limits the digital assets under the regulation of the Commission to those that can be classified as ‘securities’ (SEC Nigeria, 2020).

5

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

AML/CFT Implications: Criminals may exploit the vulnerabilities of lack of regulation and supervision of VASPs to launder illicit proceeds and/or utilise VASPs for the purpose of financing terrorism.

In Ghana, the Central Bank also issued a notice in 2018 to banks, specialized deposit-taking institutions and the general public, cautioning that virtual or digital currencies were not licensed under the ‘Payments System Act, 2003’ (Bank of Ghana, 2018). The statement, which acknowledges the potential for blockchain technology to transform the payment system landscape in Ghana and promote financial inclusion, goes further to advise that the public only deal with institutions licensed by the Bank of Ghana. It suggested that the Payment Systems and Services Bill, at the time, would ‘bring the electronic payments space up to date to international standards and be aligned with the evolving electronic payments landscape’.

However, the Payment Systems and Services Act, which was enacted in 2019 (Act 987) does not cover virtual assets.

The general lack of detailed risk assessment and regulation within the sub-region poses ML/TF risk for Member States and creates an environment for VASPs to operate under limited or no AML/CFT oversight, which may likely make it attractive to criminals and criminal organisations.

Implications on AML/CFT Regimes of Member States

As part of the global network, GIABA Member states cannot afford to remain shy or silent on the issue of virtual assets and VASPs. Criminals may exploit the vulnerabilities of lack of regulation and supervision of VASPs to launder illicit proceeds and or utilise VASPs for the purpose of financing terrorism. The FATF has carried out important work in relation to virtual assets and VASPs. Some of them include, revising and amending Recommendation 15 and its interpretative note, production of a report on virtual assets red flag indicators for ML/TF, developing a guidance document on investigating virtual assets (confidential report), producing another guidance for a risk based approach to virtual assets and VASPs, carrying out a 12 month review of the revised standard on virtual assets and VASPs and producing a report to the G-20 Finance Ministers and Central Bank Governors on “so-called stablecoins”, which may have components of virtual assets and digital assets. Based on the work carried out thus far by the FATF, it is an indication that the issue of virtual assets and VASPs is a priority for the global standard setter. Therefore, it is important for the regional FSRB, GIABA to consider this as a priority albeit the conditions in the region may be different from other FATF member jurisdictions. Nevertheless, the GIABA region is still an integral part of the global network and should commence review and assessment of virtual assets in respective Member States.

6

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

Where are we? Most GIABA Member States are yet conduct risk assessment of virtual assets in relation to ML/TF and/or to pass legislations to address the the FATF requirements.

• The use of cryptocurrencies, like other forms of virtual assets, is for the most part, not under any AML/CFT supervision in GIABA member States.

The amendment of Recommendation 15 has implications in terms of Mutual Evaluation of Member States of GIABA. It is noteworthy that some elements of Recommendation 15 are considered in the assessment of effectiveness, in particular immediate outcomes (IOs) 3, 4, 6, 7, 8,10, 11. In addition, Member States that are assessed or to be assessed after June 2019 will be subject to the new amendments. Member States that have already been assessed under the previous requirement may be required to provide updates during the follow-up process on actions taken in relation to the new amendments of R.15.

Conclusions

According to the revised FATF standard on new technologies, countries are firstly required to conduct risk assessment of virtual assets in relation to ML/TF. This is aimed at having adequate understanding of risks and as a result of the risk assessed and identified, countries may be able to put in place measures to mitigate such risks, including legislative measures. However, majority of GIABA Member States are yet to conduct risk assessment of virtual assets in relation to ML/TF and/or to pass legislations to address this provision. As such, the use of cryptocurrencies, like other forms of virtual assets, is for the most part, not under any AML/CFT supervision in GIABA member States.

7

---

DECEMBER 2020 | NO. 001 [GIABA Logo]

What should you do?

• Take measures to mitigate the ML/TF risks arising from VA and VASPs.
• Ensure that VASPs are registered and/or licensed and be subject to adequate regulation and effective supervision for AML/CFT;
• Implement an effective sanctions regime for non-compliance of AML/CFT requirements by VASPs.

Recommendations For GIABA Member States

1. Identify, assess and understand the risk posed by virtual assets in our respective jurisdictions;
2. Take measures to mitigate the ML/TF risks arising from virtual assets and VASPs as identified in the risk assessment process;
3. Develop new legislation or amend existing legislation to take into consideration the new requirements;
4. Provide guidance/checklist for the registration and/or licensing of VASPs. These should include entry control mechanisms and supervisory guidance to subject VASPs to adequate regulation and effective supervision for AML/CFT;
5. Implement an effective sanctions regime for non-compliance of AML/CFT requirements by VASPs through legislative and other supervisory mechanisms;
6. Provide cooperation in relation to the investigation of ML/TF and predicate offences investigation involving virtual assets;
7. Set up national monitoring mechanisms for VAs and VASPs, including where possible, the participation of relevant private sector operators/experts, to assist competent authorities to effectively mitigate the ML/TF risks associated with the sector.

For Regional Authorities

• GIABA should conduct an assessment on the status of implementation of the revised recommendation 15 by Member States; and;
• GIABA should provide capacity building programs for AML/CFT stakeholders in the region on virtual assets, including supervision, investigative techniques and risk mitigating measures.;

Member States are hereby urged to share this Policy Brief with their National Competent Authorities and other relevant stakeholders in order to take relevant action

8