Regulatory Concerns Regarding DeFi/NFT Transactions

You can download this article in PDF format

It is oftentimes said that one does not move forward by frequently looking into a rearview mirror.

While true in some instances, in the realm of cryptocurrency and decentralized finance in particular, looking back at the many market shifts, legal regulations, institutional uncertainties and overall learnings of the last two years will help us navigate the concerns associated with participating in a growing cryptocurrency industry in 2022 and beyond.

It is well-established that 2020 was the year where society witnessed the widespread adoption of decentralized finance (DeFi), which preceded the boom of nonfungible tokens (NFTs) in 2021.

But what happens after one transacts on a DeFi network or buys an NFT?

What process must be used to transfer decentralized earnings into a centralized financial institution? Do banks accept decentralized earnings without a detailed transaction history?

If not, what are banks’ standards for filing suspicious activity reports (SARs) with the Financial Crimes Enforcement Network (FinCEN)? These are several of the questions that need to be answered in order to create a more stable and secure cryptocurrency environment.

The Role Of Federal Government Agencies

To better understand the current regulatory regime, it is important to discuss the roles of several federal government agencies. Importantly within this domain, FinCEN is a bureau of the United States Department of the Treasury that collects and analyzes information about financial transactions to combat domestic and international money laundering, terrorist financing, and other financial crimes.[1]

Financial institutions are required to file complete, accurate, and timely SARs in order to provide FinCEN with a method of identifying emergency trends and patterns associated with financial crimes.[2]

The purpose of the SAR is to report known or suspected violations of law or suspicious activity observed by financial institutions subject to the regulations of the Bank Secrecy Act of 1970 (BSA).[3]

Generally, FinCEN may take anywhere between one to two years to investigate “very” suspicious activity.[4] Considering the serious financial implications associated with becoming the subject of a SAR, it is worthwhile to mention that financial institutions have not been transparent about the guidelines or standards used to determine when they will consider filing a SAR.

Instead, they have stated that such determinations are made on a case-by-case basis,[5] ultimately leaving both bank account holders and the public in the dark. For instance, take the individual who sold an expensive NFT on an unregulated marketplace and received payment from a wallet that he or she later found out was attached to an entity in a sanctioned jurisdiction such as Iran or North Korea. How can this individual protect his or her decentralized funds, or more importantly, how will a financial institution treat such individual’s funds?

After a SAR has been filed, law enforcement personnel may use information obtained from a SAR in connection with an official investigation. For example, the DOJ may investigate the origin of certain DeFi earned funds in order to comply with the BSA, which is a law requiring financial institutions in the United States to assist US government agencies in detecting and preventing money laundering.[6]

Specifically, the BSA requires financial institutions to keep records of cash purchases of negotiable instruments, file reports of cash transactions exceeding $10,000, and to report suspicious activity that might signify money laundering, tax evasion, and other criminal activities.[7]

To further this aim, in December of 2020, FinCEN proposed a new anti-money laundering rule aimed at reducing the anonymity allowed by certain cryptocurrency transactions. The Anti-Money Laundering Act of 2020 requires financial institutions like bank unions and money services businesses “to submit reports, keep records, and verify the identity of customers in relation to transactions” related to digital assets held in digital wallets not hosted by a financial institution.[8]

Financial institutions are also required to keep records for any transaction over $3,000 and provide that information to law enforcement upon request.[9]

The transaction amounts of $3,000 and $10,000 correlate with other anti-money laundering reporting requirements placed on financial institutions by the BSA.[10]

The FinCEN Three Cryptocurrency Market Buckets

Moreover, throughout its investigative period, the DOJ may reference FinCEN’s 2019 Digital Asset Guidance, which informs individuals subject to the BSA how FinCEN regulations relating to money services businesses apply to certain business models involving convertible virtual currencies (CVCs).

The FinCEN Guidance provides three separate cryptocurrency market buckets: (1) users; (2) exchangers; and (3) administrators.[11]

A user is a person that obtains virtual currency to purchase goods or services,[12] whereas an exchanger is a person engaged as a business in the exchange of real currency, funds, or other virtual currency.[13]

Lastly, an administrator is a person engaged as a business in issuing a virtual currency and who has the authority to redeem such virtual currency with the intent to inject it into the stream of commerce to use as a medium of exchange.[14]

Understanding the distinctions between the three cryptocurrency market buckets is important because an individual classified as a “user” is not a money services business under FinCEN’s regulations and thus is not subject to FinCEN’s registration, reporting, and recordkeeping regulations.[15]

Within these categories, it is common for DeFi clients to be classified as exchangers since they are normally exchanging virtual currency for real currency rather than obtaining virtual currency to buy goods or services.

There is a mistaken majority view that if individuals trade on their own account then they are to be classified as users. However, there is case law suggesting that such individuals are still to be regarded as money transmitters,[16] and several prominent white-collar criminal defense attorneys have been unable to uphold legal arguments stating otherwise.

Moreover, financial institutions, including crypto-friendly ones, have been unable to confirm at the pre-deposit stage that they would not report DeFi earned funds to FinCEN. In fact, several financial institutions will not even allow clients to speak with their internal compliance departments before making a deposit.

This is problematic as bank account holders are left with the difficult decision of whether or not to transfer their decentralized earned funds into traditional financial institutions without clear guidance as to whether such institutions will protect their funds from becoming the subject of a SAR.

Summary

While DeFi is a relatively new and unregulated system that offers investors the opportunity to transact without the use of intermediaries, it is important to remember that we still function within a centralized system that demands transparency and accountability from both investors and institutions alike.

Therefore, DeFi users need to take into account that transacting within a decentralized sphere also requires them to responsibly vet who they are transacting with and validate the legitimacy of such transactions to comply with current federal laws if and when they choose to move funds from a decentralized realm to a centralized one.

This is not to say that traditional institutions should not be held to the same standard. Considering that equal access to financial opportunities, blockchain transparency, and individual autonomy lie at the heart of the cryptocurrency movement, traditional institutions’ argument that DeFi platforms are a dangerous and murky “wild west” is a paradox when such institutions themselves are unwilling, or unable, to provide uniform standards to guide and protect bank customers who are exploring within the DeFi sphere.

Overall, it is unarguable that the cryptocurrency industry would benefit from certain regulatory boundaries, however, to survive in a growing decentralized economy, it is also important for traditional financial institutions to practice what they preach and become more transparent regarding their standards, guidelines, and regulatory policies as the paradigm shift away from centrally controlled power (i.e., banks, governments, and corporations) and toward individual users has already begun.

[1] What We Do, FinCEN.gov, https://www.fincen.gov/what-we-do  (last visited Jan 1, 2022).

[2] Guidance on Preparing A Complete & Sufficient Suspicious Activity Report Narrative, FinCEN.gov, https://www.fincen.gov/sites/default/files/shared/sarnarrcompletguidfinal_112003.pdf .

[3] Id.

[4] “Very” suspicious activity could involve transactions or financial associations between an individual and sanctioned areas such as North Korea or Iran.

[5] Craig E. Johnson, To file or not to file, that is the question, WIPFLI (Dec. 17, 2019), https://www.wipfli.com/insights/articles/fi-how-to-decide-if-sar-filing-is-needed.

[6] Bank Secrecy Act (BSA), Office of the Comptroller of the Currency, https://www.occ.treas.gov/topics/supervision-and-examination/bsa/index-bsa.html.

[7] FinCEN’s Mandate From Congress, FinCEN.org, https://www.fincen.gov/resources/fincens-mandate-congress.

[8] Aaron Nicodemus, FinCEN proposes BSA reporting rule for cryptocurrency transactions, Compliance Week (Dec. 21, 2020 4:11 PM), https://www.complianceweek.com/regulatory-policy/fincen-proposes-bsa-reporting-rule-for-cryptocurrency-transactions/29864.article.

[9] Id.

[10] Id.

[11] Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies, FinCEN.org, https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering.

[12] Id.

[13] Id.

[14] Id.

[15] Id.

[16] Cryptocompliance 101: How to Know If Your Cryptocurrency Business Is An MSB In The Eyes Of Regulators, BitAML (Oct. 29, 2018), https://bitaml.com/2018/10/29/cryptocurrency-msb/.