Yee Carter

🏦 Over the last few days I have seen former Comptroller Brian Brooks' name mentioned as possible SEC Chair or for another key admin position. When I left Treasury in October 2020 and joined TRM Labs, the OCC, under Brian, was doing some of the most innovative regulatory work of any agency. Specifically, during his tenure, Brian issued several interpretive letters clarifying the authority of national banks and federal savings associations to engage in crypto-related activities. 📝 Interpretive Letter 1170 (July 22, 2020): This letter confirmed that national banks and federal savings associations are authorized to provide cryptocurrency custody services for customers, including holding unique cryptographic keys associated with cryptocurrency. 📝 Interpretive Letter 1172 (September 21, 2020): This letter addressed the authority of national banks and federal savings associations to hold deposits that serve as reserves for certain stablecoins, specifically those backed on a 1:1 basis by a single fiat currency and held in hosted wallets. 📝 Interpretive Letter 1174 (January 4, 2021): This letter concluded that national banks and federal savings associations may use independent node verification networks (distributed ledgers) and stablecoins to facilitate payment activities, representing new means of performing banks’ permissible payment functions. These letters provided regulatory clarity, enabling banks to engage in specific cryptocurrency activities while ensuring compliance with existing laws and regulations. But it was not all crypto. ✔️ The OCC launched the Roundtable for Economic Access and Change (REACh) to promote greater financial inclusion by addressing barriers that prevent underserved populations from accessing financial services. ✔️ The OCC finalized a rule to strengthen and modernize CRA regulations, aiming to increase lending, investment, and services in low- and moderate-income communities. ✔️ Brian signed rules to clarify the “valid when made” doctrine and the “true lender” standard, providing greater certainty regarding permissible interest rates and the identification of the true lender in bank partnerships. ✔️ Proposed and finalized a rule to ensure fair access to banking services, aiming to prevent banks from denying services to lawful businesses without a valid business justification. ✔️ Assessed significant penalties against major banks for various compliance failures, including an $80 million fine against Capital One for a 2019 data breach and a $400 million penalty against Citibank for deficiencies in risk management and internal controls. The barrage of information about potential appointees is overwhelming these days and I do not intend to dive into the discussion and debate. But I thought it would be cool to highlight some of the work I was tracking closely 4 years ago. In fact, in January 2021, I wrote this👇 Hamilton-themed piece on the OCC. Read it here: https://lnkd.in/dRGbj-G6

35

3 Comments

🌪️ I will never forget August 2022. OFAC's sanctions against Tornado Cash set off a discussion of privacy v. security for the digital age. I was deep in the redwoods 🌲 recording with Laura Shin, working with our team at TRM Labs to help our clients comply, and learning new terms like "dusting." Yesterday, the 5th Circuit struck down OFAC’s sanctions on TC, specifically its designation of the protocol’s immutable smart contracts as “property” under the International Emergency Economic Powers Act. For those following crypto regulation, this ruling isn’t just about the law—it’s about how governments can (or can’t) regulate blockchain technology without clear-cut ownership, control, or even a human operator. At the core of the decision is the fact that TC's immutable smart contracts operate autonomously. These contracts, which anonymize cryptocurrency transactions by severing the link between sender and recipient, were made unalterable by their developers in 2020. The court ruled that these contracts don’t meet the IEEPA’s definition of “property” because they can’t be owned, controlled, or excluded from use. The judges rejected OFAC’s arguments that the contracts were services or unilateral agreements, pointing out that there’s no human control or reciprocal interaction—just code running on a decentralized blockchain. This decision essentially says that when it comes to immutable smart contracts, traditional property law concepts don’t apply. So, what does this mean for OFAC and sanctions enforcement? It’s a big deal. While TC still feels like an exception-it is the only truly decentralized service sanctioned by the regulator-OFAC is caught between how to stop North Korea and other threat actors from laundering billions of stolen funds through DeFi services like TC, and, the existing laws like IEEPA that weren’t designed with decentralized, ownerless systems in mind. This decision creates a major gap in the government’s ability to police crypto mixers and other blockchain-based tools. What happens next? This ruling could prompt Congress to act. IEEPA was passed in 1977—long before anyone imagined a world of blockchain and decentralized finance. If lawmakers want agencies like OFAC to have clear authority over decentralized technologies, they’ll need to update the law to address things like immutable smart contracts and autonomous code. In the short term, OFAC might focus its efforts on areas it can still influence, such as wallet providers, exchanges, or other intermediaries that interact with DeFi protocols. Meanwhile, this decision could also be appealed to the Supreme Court, which would set an even broader precedent. However, that could ultimately be decided by the incoming Trump administration. Either way, this ruling highlights the tension between DeFi and the centralized frameworks of government regulation. It’s a wake-up call that the legal system needs to evolve as fast as the technology it’s trying to regulate.

94

8 Comments

This morning the Treasury Department released corrections to its final rule, Gross Proceeds and Basis Reporting by Brokers and Determination of Amount Realized and Basis for Digital Assets Transactions, which were first made public on June 28 and published in the Federal Register on July 9. Today’s release consists of 17 discreet corrections to that rule. In my review,* only one of these corrections is substantive enough to merit going back and looking to see if that correction changes your view of the final rule, and that correction is this: The fourteenth correction in today’s release changes page 56517 of the Federal Register (the top line of page 133 that you might have saved or printed out on June 28) to take out the second “not” in language that reads, “…a CFC digital asset broker not conducting activities as an MSB was [not] permitted to treat a customer as an exempt foreign person….” The other 16 changes are mostly typographical. A few of them are designed to indicate that Treasury received more than one comment on a particular issue involving the cost of reporting NFTs. This is obviously intended to show that Treasury and the IRS reviewed all relevant comments submitted to them, thus hoping to avoid an Administrative Procedure Act challenge to the final regulations in that regard. If you have any questions, we’re here to help. Taxbit *This is not legal advice. Your mileage may vary. Check with your first-year associate before dropping this into an email to your client. Also, I’m happy to walk that first-year associate through this if you want.

12

2 Comments

Here is another useful example of how the increasing arsenal of AI/ML tools is enabling imposter frauds. Please be aware. https://lnkd.in/gxwtAUdv

23

1 Comment

🚨 The U.S. Securities and Exchange Commission announced its first-ever enforcement actions targeting "pig butchering" scams. The SEC filed charges against five entities and three individuals involved in two scams connected to the platforms NanoBit and CoinW6. Together, these scams defrauded investors out of nearly $3.2 million. The complaints in both cases are in-depth descriptions of scammers luring victims, through romantic overtures, to send cryptocurrency.   In the case of NanoBit, scammers impersonated financial professionals in WhatsApp groups between October 2023 and June 2024, luring victims into investing in what was presented as a legitimate crypto asset trading platform. They falsely claimed that their affiliate, NanobitUS Securities, was an SEC-registered broker, giving the operation an air of legitimacy. Instead, the NanoBit platform was completely fraudulent, with funds being misappropriated and wired to bank accounts in Hong Kong. The defendants are accused of violating antifraud provisions under federal securities laws. The SEC complaint shows, as visualized in the TRM graph below, that the NanoBit funds were transferred to a "transmitter" or aggregation address, which contained crypto likely obtained through other fraudulent activities. These fraudulent activities extended beyond NanoBit, implicating a web of fraudulent transactions that spanned multiple crypto addresses. Similarly, CoinW6 ran a relationship-driven scam, where perpetrators posed as young professionals on LinkedIn and Instagram. Between July 2022 and December 2023, they built romantic relationships with victims through WhatsApp. After establishing trust, they convinced investors to open accounts on a fake CoinW6 trading platform, promising daily returns of up to 3% from crypto asset products such as staking, mining, and yield farming. In reality, these investments were entirely fictitious, with victim funds being siphoned off by the scammers. When victims attempted to withdraw funds, they were met with demands for additional payments or faced blackmail threats regarding compromising romantic communications. It is clear that the US government is taking a whole of government when it comes to attacking the scam epidemic. Earlier this month, the U.S. Department of the Treasury's OFAC sanctioned a network involved in human trafficking for scam centers and we have been seeing activity from the FBI, HSI, USSS, IRS-CI and others in investigating and providing alerts related to scams. A TRM Labs graph in Nanobit and communications between the scammer and victim in the CoinW6 case👇

67

6 Comments

🚨 Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) used sanctions to target the human trafficking networks related to forced labor in online scam centers. Specifically, OFAC sanctioned Cambodian businessman Ly Yong Phat, his companies and O‑Smach Resort for their role in the pig butchering scourge that has devastated countless victims of scams and human trafficking. It often goes unrealized, but the frontline scammers in cryptocurrency-related frauds are themselves victims of human trafficking, including forced labor, and are subjected to physical and mental abuse. According to TRM Labs, scams and frauds totaled about USD 12.5 billion last year, accounting for approximately a third of all crypto-related crime last year. Pig butchering alone accounted for about USD 4.4 billion in 2023. For more than two years, according to Treasury, O-Smach Resort has been investigated by police and publicly reported on for serious human rights abuse. Victims reported being lured to O-Smach Resort with false employment opportunities, having their phones and passports confiscated upon arrival, and being forced to work scam operations. People who called for help reported being beaten, abused with electric shocks, made to pay a hefty ransom, or threatened with being sold to other online scam gangs. There have been two reports of victims jumping to their death from buildings within O‑Smach Resort. For much more read our breaking news blogpost in the comments 👇 and thank you to OFAC for taking this important action.

59

3 Comments

🕵️‍♀️ Today the U.S. Department of the Treasury's OFAC sanctioned five individuals and one entity associated with the Intellexa Consortium for their role in developing, operating, and distributing commercial spyware technology that presents a significant threat to the national security of the United States. The Intellexa Consortium, according to Treasury, is a complex international web of decentralized companies that built and commercialized a comprehensive suite of highly invasive spyware products, primarily marketed under the brand-name “Predator.” Predator spyware, which is sold as a licensing model 👇 like typical SAAS, can be used to gain access to data stored and transmitted from the target’s device, such as a cellphone, through one-click and zero-click attacks that require no user interaction for the spyware to infect the device. Successful Predator spyware attacks can provide the spyware’s operators with access to sensitive information on the victim’s device, including photos, geolocation data, personal messages, and microphone records. As a part of the growing commercial spyware industry, the Intellexa Consortium maintains operations around the world, and its clients include state-sponsored actors and governments. Past targets of the Intellexa Consortium’s spyware products include government officials, journalists, policy experts, and opposition politicians. These designations complement concerted U.S. government actions against commercial spyware vendors, including previous sanctions against individuals and entities associated with the Intellexa Consortium; the Department of Commerce’s addition of commercial spyware vendors to the Entity List; and the Department of State’s visa ban policy targeting those who misuse or profit from the misuse of commercial spyware, subsequently exercised on thirteen individuals.   “The United States will not tolerate the reckless propagation of disruptive technologies that threatens our national security and undermines the privacy and civil liberties of our citizens,” said Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley T. Smith. “We will continue to hold accountable those that seek to enable the proliferation of exploitative technologies, while also encouraging the responsible development of technologies that align with international standards.”

14

1 Comment

Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated three Chinese individuals, Yunhe Wang, Jingping Liu, and Yanni Zheng, for their activities associated with the malicious botnet tied to the residential proxy service known as 911 S5. OFAC also sanctioned three Thailand-based entities. In addition to the individuals and entities designated, OFAC also added 45 cryptocurrency addresses associated with Yunhe Wang.   The 911 S5 botnet was a malicious service that compromised victim computers and allowed cybercriminals to proxy their internet connections through these compromised computers. Once a cybercriminal had disguised their digital tracks through the 911 S5 botnet, their cybercrimes appeared to trace back to the victim’s computer instead of their own. The 911 S5 botnet compromised approximately 19 million IP addresses and facilitated the submission of tens of thousands of fraudulent applications related to the Coronavirus Aid, Relief, and Economic Security Act programs by its users, resulting in the loss of billions of dollars to the U.S. government. The 911 S5 service enabled users to commit widespread cyber-enabled fraud using compromised victim computers that were associated to residential IP addresses. The IP addresses compromised by the 911 S5 service were also linked to a series of bomb threats made throughout the United States in July 2022. According to OFAC, today’s action was taken in partnership with the Federal Bureau of Investigation (FBI), the Defense Criminal Investigative Service, U.S. Department of Commerce’s Office of Export Enforcement, as well as partners in Singapore and Thailand.

36

🔥 Moments ago U.S. Department of the Treasury OFAC issued a very rare fine - that of an individual. Expect DoJ charges to follow. Fines of individuals compose less than ONE PERCENT of all OFAC fines, but are a step in the right direction in holding individual accountability. Here we don't have Iranian proliferators or North Korean hackers, but instead hotel business and old school sanctions evasion. Props to OFAC for detailing the scheme - full details in document - link in comments. I'll also link the previous individual fines below (individual in Turkey, named; and U.S. individual - not named - who fell in love and bought jewels for a sanctioned narco-trafficanta). But details on this caper below: 💸 $1,104,408 penalty 🛂 Natural U.S. person #️⃣ 75 OFAC violations (approximately $561,802) 📅 Between 2019 and 2022 U.S. Person-1 (USP1) knowingly financed the purchase, renovation, and operation of a hotel in Iran, using proceeds from property sales in Iran and funds transferred from the U.S. DESPITE being aware of sanctions USP1 used accounts at sanctioned entities (Bank Melli Iran and Bank Keshavarzi Iran) and relied on a Canadian MSB employing an informal value transfer system to circumvent U.S. financial restrictions. OFAC found the violations egregious, noting USP1's willful and reckless disregard for sanctions, continued use of concealed methods, and lack of cooperation during the investigation. Aggravating factors included direct financial support to sanctioned Iranian institutions and a substantial investment in Iran. Mitigating factors included U.S. Person-1's lack of sanctions expertise and financial condition, which justified a reduced penalty (i.e. OFAC is taking them to cleaners, but any more would result in bankruptcy). The violations included unauthorized investments, financial transfers, and ownership transfers of Iranian property. USP1's efforts to obscure activities, such as using business accounts and altering transaction details, highlighted deliberate evasion of U.S. sanctions.

103

17 Comments

Today the Federal Trade Commission issued a consumer alert on romance induced crypto-related scams. The engaging and well written alert by Colleen Tressler of the Division of Consumer and Business Education explains: "No one thinks their online love interest is going to scam them, but scammers are good at what they do. They establish an emotional connection with you so you’re more likely to believe that they’re an expert in cryptocurrency investing, for example. But that online love interest is a scammer. People have lost tens of thousands ― sometimes millions — of dollars to romance scammers." Here is the full consumer alert 👇 Kudos to the FTC for including helpful red flags 🚩 It all starts with someone contacting you — seemingly at random — on social media. But they’ve done their homework, checking out your profile and other information on the platform. That helps them say the right things to build a relationship…and before you know it, your new friend is talking money. They want to help you invest your money in the crypto markets, or they say they can teach you how to do it. You might think they have your financial well-being in mind, but they don’t. They only care about their own financial well-being. No matter what they say, if someone you meet online says they want to help you invest in cryptocurrency, it’s an investment scam. Know this: 🚩 Scammers promise big profits. They might say they’ve made money this way before and that you will too, but it’s a lie. No one can guarantee profits in any investment. 🚩 Scammers say there’s no risk. But all investments have risks, including investments in the crypto markets. 🚩 Scammers say they can help you learn to invest. They’ll say they can teach you investment tricks, but they’re really leading you to a scam investment opportunity. You will lose the money you “invest.” 🚩 Scammers tell you how to send the money. Scammers want your money quickly, so they’ll steer you to gift cards, payment apps like Apple Pay, CashApp, PayPal, and Zelle, money wiring companies, or even crypto. But only scammers insist you send money this way.    📢 If you think someone you met on social media is a scammer, cut off contact. Tell the social media platform, and then tell the FTC at ReportFraud.ftc.gov. They even included this social media savvy language! "Share this post in your socials to alert your followers of this scam." 👏

36

2 Comments

High Stakes, Low AML Oversight: Sweepstakes Casinos and Other Wagering Models Most important read of the week on this topic by Sean Topchi…excerpts below but entire piece is worth your time. “[A]nother critical area that poses a threat to the US financial system: the risk of money laundering or other illicit activity. Without AML laws, sweepstakes casinos can become conduits for money laundering activities. The dual-currency system and the ability to exchange virtual currency for real money makes it easier for illicit funds to be laundered through these platforms.” “Unlicensed Money Transmitters: If sweepstakes casinos and similar platforms are deemed to be operating as unlicensed money transmitters, they could be subject to federal prosecution.” The article contains a proposed blueprint for regulatory actions and rulemaking.

17

🚨 Big News: Today, TRM Labs announced that we are the first blockchain intelligence company to achieve FedRAMP Moderate authorization. FedRAMP is a U.S. federal government-wide initiative that promotes the adoption of secure cloud services across the federal government through a standardized approach to security assessment, authorization, and continuous monitoring. TRM Labs received FedRAMP Moderate authorization after demonstrating adherence to stringent performance, security, and compliance standards. Now, TRM’s public sector customers can access mission-critical blockchain intelligence in a secure cloud environment while ensuring that TRM’s blockchain intelligence platform has undergone rigorous testing and complies with stringent standards for data security, integrity, and monitoring. As we all work together to build a safer financial system, getting our law enforcement and national security customers our data in a secure and compliant way is essential to enabling that mission.

248

22 Comments

I often post about how law enforcement uses TRM Labs to track and trace illicit proceeds and build investigations - think the cool graphs. However, there are other use cases. Regulators use TRM for decisions related to licensing and ongoing supervision of #cryptocurrency businesses and financial institutions engaging with #crypto. In our latest guide, “Elevating Ongoing AML Supervision: How to leverage blockchain intelligence in processing VASP reporting and alerts,” we take a deep-dive into how regulators can use blockchain intelligence to gain a more comprehensive view of a VASP’s risk exposure and make data-driven decisions—specifically in the monitoring stage of the regulatory lifecycle. 📕 The guide includes: ☑️ An overview of the role blockchain intelligence plays in anti-money laundering (AML) supervision ☑️ Examples of the types of information regulators might request from the VASPs they oversee ☑️ Guidance for reviewing alerts and evaluating risk ☑️ Detailed examples of event-driven reporting scenarios (and how to use blockchain intelligence tools like TRM to resolve them) This is a must read for regulators in the space. I'm talking to you Financial Conduct Authority, Financial Action Task Force (FATF), Financial Crimes Enforcement Network, US Treasury, Monetary Authority of Singapore (MAS), Hong Kong Monetary Authority (HKMA), U.S. Commodity Futures Trading Commission, U.S. Securities and Exchange Commission, Abu Dhabi Global Market (ADGM), Virtual Assets Regulatory Authority [VARA], Financial Services Agency, Japan (JFSA, 金融庁), Cayman Islands Monetary Authority, European Securities and Markets Authority (ESMA), Australian Securities and Investments Commission (ASIC), Hong Kong Monetary Authority (HKMA), Swiss Financial Market Supervisory Authority FINMA, Securities Commission of The Bahamas (SCB), Autorité des marchés financiers (AMF) – France, Financial Supervisory Authority (BaFin), Central Bank of Ireland; New York State Department of Financial Services, and so many others! 📕 Read it here: https://lnkd.in/etqpm45W While you are at it, here are a few other pieces of content for regulators! 📕 Common Market Manipulation Typologies in Crypto and How to Spot Them: https://lnkd.in/ebmkuQ5p 📕 Enhancing Virtual Asset Licensing and Supervision with Blockchain Intelligence: https://lnkd.in/eS_Fwpx6 Great ☕️ coffee reads this morning for all my regulator friends out there! Enjoy.

45

☘️ Moments ago, TRM Labs announced that Chainabuse - our scam reporting platform - is now the official reporting partner for Operation Shamrock. Looking forward to even more closely collaborating with friend Erin West to root out scams and fraud. Operation Shamrock is a collaborative effort that provides law enforcement and industry partners with education and resources to help them more successfully fortify defenses against, and disrupt, scams and other illicit activity in order to protect and support victims. With this partnership, Chainabuse’s reporting platform will have an even broader reach — serving as a centralized, public forum where victims can report pig butchering and other scams, and support ongoing investigations of crypto-related fraud. Since Chainabuse was established in 2022, users of the platform have reported over 700,000 incidents of scams. Operation Shamrock’s support for law enforcement will similarly be amplified with this partnership — by empowering investigators with streamlined access to consolidated victim reports and data for network analysis, ultimately enabling investigators to triage reports faster, investigate cases more thoroughly, and identify linked reports more efficiently. As Erin explained, “Our partnership with Chainabuse is a game-changer in fraud prevention. By consolidating victim reports and linking cases, we can identify and target large-scale fraud networks. Together, we can educate, seize, and disrupt.” This collaboration between Operation Shamrock and Chainabuse exemplifies the power of industry and law enforcement working together to safeguard the crypto community — ensuring that victims no longer face these incidents alone, but instead join a proactive community that aims to protect, educate, and establish transparency in the digital asset ecosystem. 📑 For more information on reporting scams or accessing victim resources, visit Chainabuse at www.chainabuse. com.

135

12 Comments

Great reporting by Sheila Chiang for CNBC on TRM Labs' recent report on 2024 hacks. According to the report, hackers more than doubled their cryptocurrency spoils in the first half of 2024 compared with a year ago stealing crypto valued at $1.38 billion between Jan. 1 and June 24, more than double the $657 million during the same period a year ago. Like last year, a handful of large attacks drove the increase in plundered crypto, with the top five hacks accounting for 70% of the amount stolen in the first half of the year. Private key and seed phrase compromises remain a top attack vector in 2024, alongside smart contract exploits and flash loan attacks.  For example, in May, DMM Bitcoin, a Japanese cryptocurrency exchange, suffered the largest attack so far in 2024. It resulted in the theft of over 4,500 BTC, valued at over USD 300 million at the time. While the exact cause of the attack remains unknown, potential vectors include stolen private keys or address poisoning—a tactic wherein attackers send tiny amounts of cryptocurrency to a victim’s wallet to create fake transaction histories, potentially confusing users into sending funds to the wrong address in future transactions. 💡 Some thoughts . . . In 2023 hacks were down considerably from 2022 - with about $750 million stolen in 2023 compared to closer to $900 million in 2022. It is important to note that 2022 remains a record year for hacks in large part due to North Korea's theft of $625 million from the Ronin Bridge which is part of the play to earn game Axie Infinity. So why are we seeing a spike in activity in the first part of 2024? While we have not seen any fundamental changes in the security of the cryptocurrency ecosystem, we have seen a significant increase in the value of various tokens - from bitcoin to ETH and Solana - compared to the same time last year. This essentially means that North Korea and other cybercriminals can steal more value in a single exploit and are more motivated to attack crypto services. The bottom line is that DPRK and other illicit actors are opportunistic and will use any opportunity to steal more funds. Thought it might be helpful to provide an overview of the types of hacks 👇 TRM Labs will continue to provide updates on what we are seeing out there. 📑 Full CNBC piece here: https://lnkd.in/eytcyadd

13

🚨 Just hours ago, the U.S. Department of Justice announced that an indictment was unsealed in the Central District of California charging two Chinese nationals for their roles in a scheme to launder proceeds from cryptocurrency investment scams. According to DOJ, Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and a resident of China, Cambodia, and the United Arab Emirates, was arrested on April 12 and Yicheng Zhang, 38, a Chinese national and resident of Temple City, California, was arrested yesterday in Los Angeles. According to the indictment, Li, Zhang, and other conspirators allegedly managed an international syndicate that laundered proceeds of “pig butchering," in which victims of the schemes were fraudulently induced into transferring millions of dollars to U.S. bank accounts opened in the names of dozens of shell companies whose sole apparent purpose was to facilitate the laundering of fraud proceeds. A network of money launderers then facilitated the transfer of those funds to other domestic and international bank accounts and cryptocurrency platforms in a manner designed to conceal the source, nature, ownership, and control of the funds. The fraud scheme, according to the indictment, involved more than $73 million laundered through U.S. financial institutions to bank accounts in The Bahamas, and converted to the virtual asset USDT, or Tether. A cryptocurrency wallet involved in the scheme received more than $341 million in virtual assets. The case, which is being prosecuted by the United States Attorney's Office for the Central District of CA and DOJ's NCET, is being investigated by the U.S. Secret Service. In 2023, the Secret Service recovered more than $1.1 billion in financial fraud including illicit proceeds associated with pig butchering and other crypto-related scams.

182

15 Comments

#AFC #AI #UseCases #ACAMS ANALYSIS: GenAI has 'huge potential' to help combat financial crime, but first principle must be 'do no harm' to customers -ACAMS panel Published 01-Oct-2024 by Brett Wolf, Regulatory Intelligence Despite the potential of generative artificial intelligence (GenAI) for anti-financial crime efforts, banks and financial institutions should adopt it gradually and use a centralized approach, experts told an anti-money laundering (AML) conference in Las Vegas. "The use of [GenAI] has huge potential for industry, but also some huge pitfalls," said Craig Timm, senior director of AML with the Association of Certified Anti-Money Laundering Specialists (ACAMS), in his opening remarks when moderating a panel at his organization's event last week. "This strikes me as an area where the financial crime team doesn't want to get out ahead, frankly shouldn't get out ahead," Timm said. "This is a bigger enterprise-wide question about your approach and there are some key foundational things that as a business you want to have in place before you start to tinker around with doing any of this." James Candelmo, chief Bank Secrecy Act and AML sanctions officer with PNC Bank, said he agreed with Timm's suggested cautionary approach. "I think that where we start [to use GenAI] is in a safe place," Candelmo said. "I steal shamelessly from the hypocritic oath — 'do no harm.'" "I always talk about saving lives and what we hope to do. [But] there are people who entrust their financial lives to us, to safeguard their money, to protect their privacy, and also to be fair to their neighbors, and we have to ensure that whatever we do in this incredibly innovative space does no harm." Timm interjected, saying that "there are probably 25% to a one-third" of banks that "are beyond just the thinking and starting to do some things [with GenAI], and I think they walked, hopefully, through that safe space and are now to a point where they're starting to evolve." COMPLETE ARTICLE ATTACHED BELOW: I thought this was one of the best panels I have attended addressing the intersection of anti-financial crime and GenAI. The specificity in terms of potential use cases was enlightening, as were the warnings about moving too quickly, or risking rogue investigators using public LLMs. Rabihah Butler Lashvinder Kaur

30

6 Comments

There is a lot of discussion out there about bad crypto policy, but here is an example of what I think reflects good crypto policy: I have been researching federal seizures and forfeitures of crypto assets and found reports reflecting that the DOJ seized somewhere between $912 and $1.1 billion in crypto assets in FY23 alone. And perhaps more importantly, these numbers come from at least 55 different cases out of offices spread all across the country. A lot of attention has been given to notable multi-billion dollar seizures from earlier years (e.g. Bitfinex and Silk Road hacks) but, in my opinion, the numbers from FY23 reflect a more healthy trend in terms of expanded capabilities and capacity across the DOJ. Ultimately, these numbers illustrate the impact of prioritizing: (1) broad education efforts of investigators and prosecutors, (2) equipping staff with the tools and data that allow for efficiently understanding the movement of crypto funds, and (3) coordination with important private sector players that can assist in quickly seizing assets when the opportunity arises. In other words, the results are emblematic of what most would consider good policy decisions. That said, I think both those inside and outside the government would admit that more is possible here in terms of thwarting illicit activity involving digital assets. To that end, it will be interesting to follow trends in seizures and forfeitures as reporting comes out for FY24 and analyzing areas for additional investment and capacity building within the DOJ, FBI, DEA, etc. Here are a couple of the documents I looked at for the numbers above: 1. FY23 DOJ Annual Financial Report: https://lnkd.in/enyKMCdN 2. FY23 Seized Property Inventory > $1m: https://lnkd.in/ezhaDK5G

46

1 Comment