AML in decentralized finance and traditional finance
The current global scale of money laundering is difficult to assess, with the United Nations estimating that each year 2-5% of global GDP, some $800 billion - $2 trillion, is laundered globally1. With such large quantities of currency at risk, it is vital that authorities across the world actively enforce anti-money laundering (AML) strategies and mechanisms, especially in light of the increased use of cryptocurrency which brings additional challenges for regulators and law enforcement.
This article will explore the ways in which two significant jurisdictions, the United Kingdom (UK), and the United Arab Emirates (UAE), are developing their strategies to combat the changing landscape of AML, both in terms of traditional finance (TradFi) and decentralised finance (DeFi).
What is TradFi?
TradFi refers to all the aspects of the traditional financial system, meaning banking, the stock market, venture capital and hedge funds.
What is DeFi?
DeFi refers to peer-to-peer financial systems primarily using blockchain and cryptocurrencies to allow people, businesses, or other entities to transact directly with each other, removing third parties like banks from the system.
What impact does DeFi have on the UK and UAE’s financial systems from an AML perspective?
The rise of the DeFi industry presents considerable AML challenges. DeFi is particularly vulnerable to hacking, scams, and faulty programming, providing fraudsters with new avenues for money laundering operations. DeFi is constantly evolving and is still in its early years of development, with the current AML regulatory system being crafted with TradFi in mind and not easily transferrable to a DeFi context.
Challenges of DeFi for AML
DeFi’s borderless transactions and anonymity pose significant regulatory challenges. Despite increased regulation on virtual asset service providers, the peer-to-peer nature of DeFi allows criminals to quickly replicate systems applying further regulation with new DeFi services, thereby thwarting AML protections. Hallmarks of DeFi, such as privacy and lack of centralised control, make it difficult to track and trace transactions back to their source, creating a major roadblock for authorities in detecting and preventing money laundering.
What is a typical money laundering operation in the DeFi space?
The use of anonymous transactions on decentralised platforms makes it difficult to trace the origin of funds. It is practically impossible to block user accounts receiving suspicious funds. If a user receives funds owed to an exchange on decentralised platforms (DEXs), the recipient will not know where the funds originated due to the anonymity of the transaction. Should the funds be laundered money, bringing the perpetrator to justice is, therefore, incredibly difficult. This effectively opens the DeFi space for criminals to convert laundered funds into other assets or obscure these proceeds in the blockchain transaction history without alerting law enforcement.
What regulations are in place in the UK for TradFi and DeFi?
Anti-money laundering remains a high priority in the UK, with stringent regulations in place to combat money laundering and terrorist financing. This includes the introduction of the Economic Crime and Corporate Transparency Act of 2023 (ECCTA 2023, the Act), as well as the UK’s continued commitment to the Financial Action Task Force (FATF) membership.
Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023)
ECCTA 2023 received royal assent in October of 2023, with the changes coming into force in late 2023 and throughout 2024 and the remainder scheduled throughout 2025. This legislation marks a significant advancement in the UK's efforts to combat cryptocurrency money laundering, particularly as the new Act provides law enforcement with greater powers to seize and recover crypto assets.
These powers are primarily vested in the National Crime Agency and include new powers for the police to make arrests before seizing cryptocurrency from a suspect. The Act also allows for the destruction of crypto assets if returning them to circulation would not be for the public good. Law enforcement agencies can now seize items that could aid an investigation, such as written passwords or memory sticks.
A key focus of the reform's AML initiatives is to facilitate the exchange of information in specific situations to both prevent and investigate economic crime across both the TradFi and DeFi spaces. This is achieved by exempting firms from civil liability for breaches of confidentiality when sharing information to combat economic crime. We anticipate that this will significantly enhance the flow of information to law enforcement. Furthermore, the reform removes the requirement for a pre-existing suspicious activity report to have been submitted before the National Crime Agency's Financial Intelligence Unit can issue an information order.
Additionally, several amendments were incorporated throughout the Act's journey to royal assent. These include new measures that hold companies accountable if they benefit from the deceitful actions of their employees. This incentivises both TradFi organisations, such as banks, and DeFi organisations, such as decentralised exchanges (DEXs), to ensure their internal AML procedures are particularly rigorous.
FATF and the FCA travel rule
The UK also remains committed to its membership of the FATF. The FATF leads global action to tackle money laundering, terrorist financing, and proliferation financing. It researches how money is laundered and terrorism is funded, promotes global standards to mitigate the risks, and assesses whether countries are taking effective action.
The UK has demonstrated its commitment to the FATF through the implementation of the ‘travel rule’ by the Financial Conduct Authority (FCA). This rule imposes much greater transparency on the DeFi system by requiring virtual asset service providers (VASPs) to share information about a transferor with the VASP of the transferee. Given the anonymised nature of cryptocurrency transactions, tracking money laundering scenarios is extremely difficult. However, by establishing the identity of account holders, transferees, and transferors, and removing the anonymity which was previously afforded, there is now the possibility of spotting potentially illicit transfers.
Recent enforcement actions in the UK
The focus and success of the regulations can be seen in recent enforcement actions taken by authorities in the UK; albeit focussed on TradFi, this is likely to be indicative of a general tightening up and is intended to translate to DeFi, where possible. Notably, the FCA fined Santander £107.7 million in December 2022 for repeated anti-money laundering failings, citing ‘poor management’ and the creation of ‘a prolonged and severe risk of money laundering.’ Similarly, the Solicitors Regulation Authority has increased its scrutiny of AML within law firms, as evidenced by the issuance of a £100,000 fine to Ashfords LLP for money laundering compliance failures reported by the firm itself.
The position in the UAE
The UAE has been proactive in addressing the risks associated with cryptocurrency money laundering, particularly in the context of its rapidly growing financial sector and the increasing adoption of cryptocurrencies. Recognising the potential for cryptocurrencies to be used in illicit activities due to their anonymous and decentralised nature, the UAE has through a series of legislative and regulatory measures taken significant steps to enhance its AML framework and ensure the integrity of its financial system.
Federal legislation
The UAE has implemented a comprehensive legal framework to combat money laundering and terrorist financing, addressing risks that arise from both TradFi and DeFi. One of the cornerstone pieces of legislation in this regard is the Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combatting the Financing of Terrorism. This law provides a comprehensive framework for AML efforts in the UAE, including specific provisions related to virtual assets and cryptocurrencies. The law mandates that all financial institutions and designated non-financial businesses and professions (DNFBPs) implement robust AML measures, including customer due diligence, transaction monitoring, and reporting of suspicious activities. The law also extends these requirements to virtual asset service providers (VASPS), ensuring that entities dealing in cryptocurrencies are subject to the same stringent AML obligations as traditional financial institutions.
DIFC and the DFSA
The Dubai International Financial Centre is a major financial centre and free zone, where a significant portion of the UAE’s TradFi and DeFi are established. Regulatory oversight within the DIFC is provided by the Dubai Financial Services Authority (DFSA), an independent regulator responsible for ensuring the integrity and transparency of financial operations within the centre. In 2021, the DFSA issued its "Regulation of Crypto Asset Activities in the DIFC" framework, which sets out detailed requirements for the operation of crypto asset businesses within the DIFC. This framework includes stringent AML and counter-terrorism financing measures, such as mandatory registration and licensing of VASPs, comprehensive customer due diligence procedures, and regular audits and inspections to ensure compliance.
Regulatory bodies and enforcement
The UAE’s AML and counter-terrorism financing (CTF) regime is supervised and enforced by various financial services regulators, including the UAE's Central Bank, Securities and Commodities Authority, DFSA and the Financial Services Regulatory Authority, which is the regulator in the UAE’s second financial free zone the Abu Dhabi Global Market. In addition, the UAE has established a specialist unit to oversee and enforce AML compliance, the Financial Intelligence Unit (FIU). The FIU plays a crucial role in monitoring and analysing financial transactions, including those involving cryptocurrencies, to detect and prevent money laundering activities. The FIU collaborates closely with international counterparts and leverages advanced technologies to enhance its surveillance capabilities, ensuring that the UAE remains at the forefront of global AML efforts.
FATF
The UAE's commitment to combating cryptocurrency money laundering is also evident in its active participation in international AML initiatives. The country is a member of the Financial Action Task Force (FATF) and has aligned its AML regulations with FATF recommendations. In 2020, the UAE underwent a mutual evaluation by the FATF, which assessed the effectiveness of its AML and CTF measures. The UAE has since been working diligently to address the recommendations from the evaluation, further strengthening its regulatory framework and enhancing its capacity to combat money laundering in the cryptocurrency space.
Cultural and Compliance Initiatives
Furthermore, the UAE has focused on raising awareness and providing training to financial institutions and stakeholders to ensure effective implementation of AML controls. The government has launched initiatives to promote a culture of compliance and encourage the adoption of best practices in AML.
What next?
Increased supervision of organisations and financial transactions, as well as international collaboration, remain vital in preventing money laundering. The UK and UAE appears to be making progress in this regard. However, given that the DeFi market operates without intermediaries and with anonymity at its core, regulatory systems must adapt their approach when building a regulatory framework.
Regulating a decentralised system is likely to require more ingenuity than the ECCTA 2023 and the UAE’s patchwork of AML legislation currently offers. Imposing liability on organisations that fail to prevent fraud will undoubtedly impact the TradFi system more than the DeFi system, where there may be no organisation to hold liable and in circumstances where a self-regulating DeFi system may itself attract criminal enterprises to “regulate”.
The international regulatory community must, therefore, continue to collaborate with key players in the DeFi system in order to develop adequate and DeFi specific AML measures which can be incorporated into the system itself. Some may say that this goes against the grain and the spirit of the DeFi system, but without such intervention and with AML tightening up in the TradFi system, DeFi could simply become a money launderers playground.
Our expertise
With offices in many of the world’s major financial centres, including London, Paris, Geneva, Zurich, Dubai, Hong Kong and Singapore, we are ideally placed to work with you to prevent, resolve and assist with financial crime disputes and investigations as they arise, whatever the law, language, rules, industry sector, or subject matter of that dispute may be. Our dedicated multicultural and multilingual specialists conduct proceedings under both common law and civil systems and regularly act in fraud-related proceedings.
Whether you are an individual or a business, our strategically focused specialists will work alongside you through every aspect of any proceedings. Please contact the author or your usual Charles Russell Speechly LLP contact if you would like to get in touch.
