NPRM: Special measure regarding CVC mixing as a class of transactions of primary money laundering concern (88 FR 72701) (Part 1 of 2)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules 72701
List of Subjects in 30 CFR Part 926 finding that reasonable grounds exist for money laundering concern, the
State regulatory program approval, concluding that one or more classes of Secretary is required to consult with
State-Federal cooperative agreement, transactions within or involving a both the Secretary of State and the
Required program amendments. jurisdiction outside of the United States Attorney General.6 The Secretary is also
is of primary money laundering required to consider such information as
David A. Berry, concern, to require domestic financial the Secretary determines to be relevant,
Regional Director, Unified Regions 5, 7–11. institutions and domestic financial including the following potentially
[FR Doc. 2023–23034 Filed 10–20–23; 8:45 am] agencies to take certain ‘‘special relevant factors:
BILLING CODE 4310–05–P measures.’’ 1 The authority of the • The extent to which such class of
Secretary to administer section 311 and transactions is used to facilitate or
the Bank Secrecy Act (BSA) has been promote money laundering in or
DEPARTMENT OF THE TREASURY delegated to FinCEN.2 through a jurisdiction outside the
The five special measures set out in United States, including any money
Financial Crimes Enforcement Network section 311 are prophylactic safeguards laundering activity by organized
that may be employed to defend the criminal groups, international terrorists,
31 CFR Part 1010 United States financial system from or entities involved in the proliferation
money laundering and terrorist of weapons of mass destruction (WMD)
RIN 1506–AB64 financing risks. The Secretary may or missiles;
Proposal of Special Measure
impose one or more of these special • The extent to which such class of
measures in order to protect the U.S. transactions is used for legitimate
Regarding Convertible Virtual financial system from such threats.
Currency Mixing, as a Class of business purposes in the jurisdiction;
Through special measure one, the and
Transactions of Primary Money Secretary may require domestic • The extent to which such action is
Laundering Concern financial institutions and domestic sufficient to ensure that the purposes of
AGENCY: Financial Crimes Enforcement financial agencies to maintain records, section 311 are fulfilled and to guard
Network (FinCEN), Treasury. file reports, or both, concerning the against international money laundering
ACTION: Notice of proposed rulemaking. aggregate amount of transactions or and other financial crimes.7
individual transactions.3 Through Upon finding that a class of
SUMMARY: FinCEN is issuing a notice of special measures two through four, the transactions is of primary money
proposed rulemaking (NPRM), pursuant Secretary may impose additional laundering concern, the Secretary may
to section 311 of the USA PATRIOT Act, recordkeeping, information collection, require covered financial institutions to
that proposes requiring domestic and reporting requirements on covered take one or more special measures. In
financial institutions and domestic domestic financial institutions and selecting one or more special measures,
financial agencies to implement certain domestic financial agencies.4 Through the Secretary ‘‘shall consult with the
recordkeeping and reporting special measure five, the Secretary may Chairman of the Board of Governors of
requirements relating to transactions prohibit, or impose conditions upon, the the Federal Reserve System, any other
involving convertible virtual currency opening or maintaining in the United appropriate Federal banking agency (as
(CVC) mixing. States of correspondent or payable- defined in section 3 of the Federal
DATES: Written comments on the notice through accounts for or on behalf of a Deposit Insurance Act), the Secretary of
of proposed rulemaking must be foreign banking institution, if the class State, the Securities and Exchange
submitted on or before January 22, 2024. of transactions found to be of primary Commission, the Commodity Futures
ADDRESSES: Comments must be money laundering concern may be Trading Commission, the National
submitted by one of the following conducted through such correspondent Credit Union Administration Board, and
methods: account or payable-through account.5 in the sole discretion of the Secretary,
• Federal E-rulemaking Portal: Before making a finding that such other agencies and interested
https://www.regulations.gov. Follow the reasonable grounds exist for concluding parties as the Secretary may find
instructions for submitting comments. that a class of transactions is of primary appropriate.’’ 8
Refer to Docket Number FINCEN–2023– In addition, the Secretary is required
0016 in the submission.
1 On October 26, 2001, the President signed into
to consider the following factors when
law the Uniting and Strengthening America by selecting special measures:
• Mail: Financial Crimes Enforcement Providing Appropriate Tools Required to Intercept
Network, P.O. Box 39, Vienna, VA and Obstruct Terrorism Act of 2001, Public Law
• Whether similar action has been or
22183. Refer to Docket Number 107–56 (USA PATRIOT Act). Title III of the USA is being taken by other nations or
FINCEN–2023–0016 in the submission. PATRIOT Act amended the anti-money laundering multilateral groups;
(AML) provisions of the Bank Secrecy Act (BSA) to • Whether the imposition of any
Please submit comments by one promote the prevention, detection, and prosecution particular special measure would create
method only, and note that comments of international money laundering and the
financing of terrorism. The BSA, as amended, is the a significant competitive disadvantage,
submitted in responses to this NPRM
popular name for a collection of statutory including any undue cost or burden
will become a matter of public record. authorities that FinCEN administers that is codified associated with compliance, for
FOR FURTHER INFORMATION CONTACT: The at 12 U.S.C. 1829b, 1951–1960 and 31 U.S.C. 5311– financial institutions organized or
FinCEN Regulatory Support Section at 5314, 5316–5336, and includes other authorities
reflected in notes thereto. Regulations licensed in the United States;
1–800–767–2825 or electronically at implementing the BSA appear at 31 CFR Chapter • The extent to which the action or
[email protected].
lotter on DSK11XQN23PROD with PROPOSALS1
X. the timing of the action would have a
SUPPLEMENTARY INFORMATION: 2 Pursuant to Treasury Order 180–01 (Jan. 14,
significant adverse systemic impact on
2020), the authority of the Secretary to administer
I. Statutory Provisions the BSA, including, but not limited to, 31 U.S.C.
the international payment, clearance,
5318A, has been delegated to the Director of and settlement system, or on legitimate
Section 311 of the USA PATRIOT Act FinCEN.
(section 311), codified at 31 U.S.C. 3 31 U.S.C. 5318A(b)(1). 6 31 U.S.C. 5318A(c)(1).
5318A, grants the Secretary of the 4 31 U.S.C. 5318A(b)(2)–(b)(4). 7 31 U.S.C. 5318A(c)(2)(B).
Treasury (Secretary) authority, upon 5 31 U.S.C. 5318A(b)(5). 8 31 U.S.C. 5318A(a)(4)(A).
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00003 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
72702 Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules
business activities involving the Accordingly, because CVC mixing currency and is therefore a type of
particular jurisdiction, institution, class provides foreign illicit actors with ‘‘value that substitutes for currency.’’
of transactions, or type of account; and enhanced anonymity that allows them The label applies to any particular type
• The effect of the action on United to launder their illicit proceeds, FinCEN of CVC, such as ‘‘digital currency,’’
States national security and foreign assesses that transactions involving CVC ‘‘cryptocurrency,’’ ‘‘cryptoasset,’’ and
policy.9 mixing within or involving a ‘‘digital asset.’’ 16 17
jurisdiction outside the United States The public nature of most CVC
II. Summary of NPRM are of primary money laundering blockchains,18 which provide a
Convertible Virtual Currency (CVC) concern, and, having undertaken the permanent, recorded history of all
mixing entails the facilitation of CVC 10 necessary consultations, also finds that previous transactions, make it possible
transactions in a manner that obfuscates imposing additional recordkeeping and to know someone’s entire financial
the source, destination, or amount reporting requirements would assist in history on the blockchain. Anonymity
involved in one or more transactions.11 mitigating the risks posed by such enhancing tools, including ‘‘mixers,’’
Because CVC mixing is intended to transactions. Such reporting will assist are used to avoid this. To provide
make CVC transactions untraceable and law enforcement with identifying the enhanced anonymity, CVC mixers
anonymous, CVC mixing is ripe for perpetrators behind illicit transactions provide a service—CVC mixing—that is
abuse by, and frequently used by, illicit and preventing, investigating, and intended to obfuscate transactional
foreign actors that threaten the national prosecuting illegal activity, as well as information, allowing users to obscure
security of the United States and the rendering such transactions—through their connection to the CVC.
U.S. financial system. By obscuring the increased transparency—less attractive There are a number of ways to
connection between the CVC wallet and useful to illicit actors. This NPRM conduct CVC mixing transactions—one
addresses used to receive illicit CVC (1) sets forth FinCEN’s finding that of the most common of which is the use
proceeds and the CVC wallet addresses transactions involving CVC mixing of CVC mixers. CVC mixers can
from which illicit CVC is transferred to within or involving jurisdictions outside accomplish this through a variety of
CVC-to-fiat 12 currency exchangers, the United States are a class of mechanisms, including: pooling or
other CVC users, or CVC exchanges, transactions that are of primary money aggregating CVC from multiple
CVC mixing transactions can play a laundering concern; and (2) proposes, individuals, wallets, or accounts into a
central role in facilitating the laundering under special measure one, requiring single transaction or transactions;
of CVC derived from a variety of illicit covered financial institutions to splitting an amount into multiple
activity. implement certain recordkeeping and amounts and transmitting the CVC as a
Indeed, CVC mixing transactions are reporting requirements on transactions series of smaller independent
frequently used by criminals and state that covered financial institutions know, transactions; or leveraging code to
actors to facilitate a range of illicit suspect, or have reason to suspect coordinate, manage, or manipulate the
activity, including, but not limited to, involve CVC mixing within or involving structure of the transaction; among other
money laundering, sanctions evasion jurisdictions outside the United States. methods. Through such mechanisms,
and WMD proliferation by the CVC mixers can functionally simulate a
III. Background customer depositing funds from an
Democratic People’s Republic of Korea
(DPRK or North Korea), Russian- Although the United States supports anonymous account into a financial
associated ransomware attacks,13 and innovation and advances in digital and institution’s omnibus account and
illicit darknet markets. Further, a recent distributed ledger technology for withdrawing funds into a separate
assessment by FinCEN determined that financial services, it must also consider anonymous account.19 For example, a
the percentage of CVC transactions the substantial implications that such
16 See, e.g., FinCEN, FIN–2019–G001, Application
processed by CVC mixers that originated technology has for national security and
of FinCEN’s Regulations to Certain Business Models
from likely illicit sources is mitigate the attendant risks for Involving Convertible Virtual Currencies, May 9,
increasing.14 CVC mixing often involves consumers, businesses, national 2019, available at https://www.fincen.gov/sites/
foreign jurisdictions because persons security, and the integrity of the broader default/files/2019-05/FinCEN%20Guidance
U.S. financial system.15 CVC can be %20CVC%20FINAL%20508.pdf (FinCEN 2019 CVC
who facilitate or engage in CVC mixing Guidance).
transactions are often located abroad, used for legitimate and innovative 17 FinCEN notes that CVC or ‘‘virtual currency’’
including notable recent CVC mixing purposes. However, it is not without its by itself does not meet the definition of a
activity involving DPRK-affiliated threat risks and, in particular, the use of CVC ‘‘currency’’ under 31 CFR 1010.100(m).
to anonymize illicit activity undermines Additionally, potential characterization of CVC as
actors, Russian ransomware actors, and currency, securities, commodities, or derivatives for
buyers and sellers on Russian darknet the legitimate and innovative uses of the purposes of any other legal regime, such as the
markets. CVC. Federal securities laws or the Commodity Exchange
Act, is outside the scope of this proposed rule.
A. CVC Mixing and Its Mechanisms However, as described in the FinCEN 2019 CVC
9 31 U.S.C. 5318A(a)(4)(B).
The term ‘‘virtual currency’’ refers to Guidance, if assets that other regulatory frameworks
10 For the purposes of this NPRM, the term ‘‘CVC’’
defined as commodities, securities, or futures
is defined as a medium of exchange that either has a medium of exchange that can operate contracts were to be specifically issued or later
an equivalent value as currency or acts as a like currency but does not have all the repurposed to serve as a currency substitute, then
substitute for currency, but lacks legal tender status. attributes of ‘‘real,’’ or fiat, currency. the asset itself could be a type of value that
Although Bitcoin has legal tender status in at least substitutes for currency and be defined as CVC for
two jurisdictions, the term ‘‘CVC’’ includes Bitcoin. CVC is a type of virtual currency that
the purposes of this proposed rule, in addition to
11 A more detailed definition of this term is either has an equivalent value as being subject to other applicable regulatory
lotter on DSK11XQN23PROD with PROPOSALS1
provided in Section IX of this NPRM. currency or acts as a substitute for frameworks.
12 Fiat currency refers to traditional currency 18 Blockchain refers to a type of distributed ledger
such as the U.S. dollar. 15 White House, Executive Order on Ensuring technology (DLT) that cryptographically signs
13 Notwithstanding the use of ‘‘attack’’ as a legal transactions that are grouped into blocks. For more
Responsible Development of Digital Assets Fact
term of art in certain settings, FinCEN here and Sheet, Mar. 9, 2022, available at https:// information on blockchain, see National Institute of
throughout intends only the colloquial meaning of www.whitehouse.gov/briefing-room/statements- Science and Technology, Blockchain, available at
the term. releases/2022/03/09/fact-sheet-president-biden-to- https://www.nist.gov/blockchain.
14 A more detailed examination of analysis is sign-executive-order-on-ensuring-responsible- 19 See U.S. Department of the Treasury
below in Section IV.A.3 of this NPRM. innovation-in-digital-assets/. (Treasury), DeFi Risk Assessment, Apr. 2023, at p.
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00004 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules 72703
criminal actor could take the illicit ‘‘peel chain’’—in a series of unnatural frameworks,22 threatening the
proceeds of their crime, send the CVC transactions that have the purpose or effectiveness of rules which require
to a CVC mixer, and then on to an effect of obfuscating the source and financial institutions to, among other
account they hold at a virtual asset destination of funds by volumetrically things, know the identity of their
service provider (VASP). At this point, increasing the number of involved customers and report suspicious activity
the VASP would take custody of the transactions, thereby decreasing the to FinCEN.
illicitly sourced CVC, thereby allowing probability of determining both Over the past few years, Treasury has
illicit funds to enter their omnibus intended persons for each unique monitored, and expressed concern with,
account, all while being unaware of the transaction. the increasing use of CVC mixing by
origin of the illicit CVC. The critical e. Exchanging between types of CVC, illicit actors, including North Korea-
challenge is that CVC mixing services or other digital assets: This method affiliated cyber threat actors,
rarely, if ever, provide to regulators or involves exchanges between two or ransomware actors, and darknet
law enforcement the resulting more types of CVC or other digital market 23 participants, to transfer and
transactional chain or information assets—colloquially referred to as launder their illicit proceeds. In
collected as part of the transaction. ‘‘chain hopping’’—to facilitate particular, the DPRK—already under
CVC mixing does not, however, transaction obfuscation by converting pressure from robust United States,
wholly rely on the use of CVC mixers. one CVC into a different CVC at least European Union, United Kingdom, and
There are certain methods that CVC once before moving the funds to another United Nations sanctions—relies upon
users—and CVC mixers—often employ service or platform thereby decreasing CVC mixing to launder the proceeds of
in an effort to obfuscate their the probability of determining both cyber heists in order to finance the
transactions. These methods include: intended persons for each unique DPRK’s WMD program.24 The Axie
a. Pooling or aggregating CVC from transaction.20 Infinity Ronin Bridge (Axie Infinity)
multiple persons, wallets, addresses, or f. Facilitating user-initiated delays in heist—committed in March 2022, worth
accounts: This method involves transactional activity: This method almost $620 million and carried out by
combining CVC from two or more involves the use of software, programs, the DPRK-controlled Lazarus Group—
persons into a single wallet or smart or other technology that remains, for instance, the largest cyber
contract and, by pooling or aggregating programmatically carry out pre- heist to date,25 and made high profile
that CVC, obfuscating the identity of determined timed-delay of transactions use of at least two mixers to launder the
both parties to the transaction by by delaying the output of a transaction proceeds of the theft—Blender.io and
decreasing the probability of in order to make that transaction appear Tornado Cash.26
determining both intended persons for to be unrelated to transactional input,
each unique transaction. thereby decreasing the probability of 22 See Treasury April 2023 Defi Risk Assessment,
b. Splitting CVC for transmittal and determining both intended persons for at pp. 3–4, 28.
23 ‘‘Darknet’’ is a term used to refer to networks
transmitting the CVC through a series of each unique transaction.
that are only accessible through the use of specific
independent transactions: This method B. Use of CVC Mixing by Illicit Foreign software or network configurations. Darknet content
involves splitting a single transaction Actors is not indexed by web search engines, and is often
from sender to receiver into multiple, accessed via anonymized, encrypted systems like
smaller transactions, in a manner Illicit actors use enhanced anonymity the software The Onion Router (TOR). Darknet
on the blockchain to avoid detection by markets are online markets only accessible with the
similar to structuring, to make use of software like TOR, and because they are not
transactions blend in with other, authorities as they launder their illicit indexed, can only be found if the domain name and
unrelated transactions on the proceeds. By obfuscating identity and URL are already known to the user. As a result of
blockchain occurring at the same time preventing the attribution of ownership the inherent anonymity of the darknet
of CVC,21 CVC mixing allows illicit infrastructure, darknets facilitate criminal activity
so as to not stand out, thereby because of the difficulty involved for law
decreasing the probability of actors, such as cyber threat actors enforcement in identifying users, infrastructure,
determining both intended persons for carrying out ransomware attacks or and even domains associated with the sale of illicit
each unique transaction. cyber heists, to launder their CVC and goods and services. FinCEN’s August 2021 publicly
convert it into fiat currency, minimizing available assessment of a civil money penalty
c. Using programmatic or algorithmic against an exchange noted that darknet
code to coordinate, manage, or the risk of being detected by involved marketplaces actively promote CVC mixers as the
manipulate the structure of a financial institutions, including VASPs, primary method for obfuscating CVC transactions.
transaction: This method involves the or relevant authorities. Because wallet 24 United Nations, UN Panel of Experts Letter, S/
use of software that coordinates two or addresses are pseudonymous and CVC 2023/171, Mar. 7, 2023, at p. 4, available at https://
documents-dds-ny.un.org/doc/UNDOC/GEN/N23/
more persons’ transactions together in mixing severs the connection between 037/94/PDF/N2303794.pdf?OpenElement (UN
order to obfuscate the individual unique the identity of users sending and March 2023 Experts Letter); see Wall Street Journal,
transactions by providing multiple receiving CVC, illicit actors are able to North Korea Suspected of Plundering Crypto to
potential outputs from a coordinated exploit vulnerabilities in anti-money Fund Weapons Programs, July 1, 2022, available at
https://www.wsj.com/articles/north-korea-
input, decreasing the probability of laundering and countering the financing suspected-of-plundering-crypto-to-fund-weapons-
determining both intended persons for of terrorism (AML/CFT) regulatory programs-11656667802.
each unique transaction. 25 Office of Foreign Assets Control (OFAC), U.S.
20 FinCEN, Financial Trend Analysis, Treasury issues First Ever Sanctions on Virtual
d. Creating and using single-use
Ransomware Trends in Bank Secrecy Act Data Currency Mixer, Targets DPRK Cyber Threats, May
wallets, addresses, or accounts and Between January 2021 and June 2021, Oct. 15, 2021, 6, 2022, available at https://home.treasury.gov/
sending CVC through these wallets, at p. 13, available at https://www.fincen.gov/sites/ news/press-releases/jy0768 (U.S. Treasury May
lotter on DSK11XQN23PROD with PROPOSALS1
addresses, or accounts in a series of default/files/2021-10/Financial%20 2022 Press Release); see Elliptic, North Korea’s
transactions: This method involves the Trend%20Analysis_ Lazarus Group Identified as Exploiters Behind $540
Ransomware%20508%20FINAL.pdf (FinCEN Million Ronin Bridge Heist, Apr. 14, 2022, available
use of single-use wallets, addresses, or October 2021 FTA). at https://www.elliptic.co/blog/540-million-stolen-
accounts—colloquially known as a 21 Users employ digital wallets to hold their CVC. from-the-ronin-defi-bridge.
These wallets appear on the blockchain as a string 26 OFAC, Treasury Designates DPRK Weapons
19, available at https://home.treasury.gov/system/ of alphanumeric characters, but can be created Representative, Nov. 8, 2022, available at https://
files/136/DeFi-Risk-Full-Review.pdf (Treasury April using software at will, and are not directly tied to home.treasury.gov/news/press-releases/jy1087 (U.S.
2023 Defi Risk Assessment). any individual person’s identity. Treasury November 2022 Press Release).
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00005 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
72704 Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules
CVC mixing is also commonly used to IV. Finding That Transactions That steps to avoid the discovery of where
obfuscate the source of CVC obtained Involve CVC Mixing Within or they and their users are located. CVC
through other illicit activities, such as Involving a Jurisdiction Outside the mixers commonly obscure their
ransomware attacks and the use and United States Are a Class of locations, including (1) employing The
operation of darknet markets. For Transactions of Primary Money Onion Router (TOR) to conceal the
example, between January 2021 and Laundering Concern location of their servers; 30 (2) failing to
June 2021, the top 10 most common register as a business in any jurisdiction;
Pursuant to 31 U.S.C. 5318A(a)(1),
ransomware variants reported in and (3) failing to maintain any activity
FinCEN finds that reasonable grounds
suspicious activity report (SAR) data, logs. Based on public and non-public
exist for concluding that transactions
information, FinCEN assesses that CVC
including several Russian-affiliated involving CVC mixing within or
mixing activity often occurs within or
variants, sent approximately $35.2 involving a jurisdiction outside the
involves numerous jurisdictions outside
million to CVC mixers and $252 million United States are a class of transactions
the United States and, indeed,
to darknet markets.27 Indeed, darknet that is of primary money laundering
throughout the world. The U.S.
marketplaces actively promote CVC concern. In making this finding, FinCEN
Department of Justice (DOJ) and open
mixers as the primary method for considered the following statutory
source reporting identified an increase
obfuscating related transactions, and, factors: (1) the extent to which the class in the use of CVC in terror finance,
indeed, multiple CVC mixers of transactions is used to facilitate or including by Hamas and the Islamic
historically interacted with Hydra, the promote money laundering in or State of Iraq and Syria (ISIS), and the
former Russian darknet market that through a jurisdiction outside of the use of CVC mixers to obfuscate source
accounted for approximately 80 percent United States, including money of funds to protect the identity of their
of all darknet market CVC transactions laundering activity with connections to donors.31 In addition, FinCEN has
in 2021 before being shut down by international terrorism, organized crime, identified the use of CVC mixing
and proliferation of WMDs and missiles; services as a prevalent money
United States and German law
(2) the extent to which a class of laundering typology for the top 10
enforcement.28 Because darknet
transactions is used for legitimate ransomware strains identified in BSA
marketplaces are fundamentally illicit business purposes; and (3) the extent to
in nature, FinCEN assesses that illicit data from January 2021 to June 2021,
which action by FinCEN would guard and, notably, open source analysis of
actors using darknet markets to against international money laundering
purchase or sell illicit goods favor the CVC payments indicates that up to 74
and other financial crimes. percent of ransomware activity is
ability to reduce the odds of being
A. The Extent to Which the Class of associated with Russia.32
identified and leverage CVC mixing to
Transactions Is Used To Facilitate or The global nature of the problem is
enhance anonymity to that end. further demonstrated by the fact that no
Similarly, ransomware actors also prefer Promote Money Laundering in or
Through a Jurisdiction Outside the CVC mixers are currently registered
an opportunity to successfully launder with FinCEN. CVC mixers are required
their illicit funds by using CVC mixing United States, Including Any Money
Laundering Activity by Organized to register with FinCEN if they do
to enhance anonymity. business as money transmitters wholly
Criminal Groups, International
The multiple U.S. Government Terrorists, or Entities Involved in the or in substantial part within the United
actions against CVC mixers, often in Proliferation of WMD and Missiles States.33 To the extent foreign CVC
coordination with international mixers are operating beyond United
FinCEN assesses that foreign CVC States jurisdiction, they are not subject
partners, demonstrate that CVC mixing
mixing transactions are used to facilitate to U.S. regulations that require financial
provides illicit actors with enhanced
or promote money laundering in or institutions to, among other things,
anonymity in CVC transactions, through jurisdictions outside the United
allowing them to more easily launder know the identity of their customers
States, including by organized criminal and report suspicious activity to
their illicit proceeds in CVC.29 groups, international terrorists, or FinCEN. Nevertheless, FinCEN assesses
entities involved in the proliferation of that other forms of CVC mixing, that do
27 See FinCEN October 2021 FTA, at p. 17.
WMD and missiles. FinCEN based this not involve the use of CVC mixers, do
28 U.S. Department of Justice (DOJ), Justice
assessment on information available to occur within the United States.
Department Investigation Leads To Shutdown Of
Largest Online Darknet Marketplace, Apr. 5, 2022, the agency, including both public and Recent U.S. and foreign enforcement
available at https://www.justice.gov/usao-ndca/pr/ non-public reporting, and after thorough actions also reflect CVC mixing
justice-department-investigation-leads-shutdown- consideration of each of the following transactions within or involving
largest-online-darknet-marketplace. factors: (1) that transactions involving numerous foreign jurisdictions,
29 FinCEN, First Bitcoin ‘‘Mixer’’ Penalized by
FinCEN for Violating Anti-Money Laundering Laws,
CVC mixing often occur within, or including DPRK, Russia, Luxembourg,
Oct. 19, 2020, available at https://www.fincen.gov/ involve, jurisdictions outside of the
news/news-releases/first-bitcoin-mixer-penalized- United States; (2) that CVC mixing is 30 See DOJ March 2023 Press Release.
fincen-violating-anti-money-laundering-laws (First used to launder proceeds of large-scale 31 DOJ, Four Defendants Charged with Conspiring
Bitcoin ‘‘Mixer’’ Penalized by FinCEN, October 19, to Provide Cryptocurrency to ISIS, Dec. 14, 2022,
CVC theft and heists, and support the available at https://www.justice.gov/usao-edny/pr/
2020); DOJ, Ohio Resident charged operating
darknet based bitcoin mixer laundered over 300 proliferation of WMD, in particular, by four-defendants-charged-conspiring-provide-
million, Feb. 13, 2020, available at https:// the DPRK; and (3) that CVC mixing is cryptocurrency-isis; TRM Labs, Terrorist Financing
www.justice.gov/opa/pr/ohio-resident-charged- similarly used by ransomware actors Six Crypto Related Trends to Watch in 2022, Feb.
operating-darknet-based-bitcoin-mixer-which- 16, 2023, available at https://www.trmlabs.com/
lotter on DSK11XQN23PROD with PROPOSALS1
and darknet markets to launder illicit post/terrorist-financing-six-crypto-related-trends-to-
laundered-over-300-million; DOJ, Justice
Department Investigation leads to takedown of proceeds. watch-in-2023.
Darknet cryptocurrency mixer processed over $3 32 Chainalysis, Russian Cybercriminals Drive
billion of unlawful transactions, Mar. 15, 2023,
1. CVC Mixing Transactions Often Significant Ransomware and Cryptocurrency-based
available at https://www.justice.gov/opa/pr/justice- Occur Within or Involve Jurisdictions Money Laundering Activity, Feb. 14, 2022, available
department-investigation-leads-takedown-darknet- Outside the United States at https://www.chainalysis.com/blog/2022-crypto-
cryptocurrency-mixer-processed-over-3 (DOJ March crime-report-preview-russia-ransomware-money-
2023 Press Release); U.S. Treasury November 2022 CVC mixers conduct business with laundering/.
Press Release. opaque operational structures and take 33 31 CFR 1010.100(ff).
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00006 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules 72705
the Netherlands, and Vietnam. Office of scale CVC theft and heists by both state attempt to obscure the origins of its ill-
Foreign Assets Control (OFAC) actions and non-state sponsored actors. gotten CVCs while converting them into
in 2022, for instance, highlighted the Whether heists are carried out by state fiat currency.46 In the same year, there
links between the DPRK and CVC or non-state actors, the need for CVC was a notable increase in large scale
mixers Blender.io 34 and Tornado mixing is the same—illicit CVC must be heists carried out by, or in support of,
Cash 35—through their respective laundered, and CVC mixing provides the DPRK, with associated use of CVC
involvement in the Axie Infinity heist 36 the enhanced anonymity to separate mixing and CVC mixers. OFAC
in March 2022 and Tornado Cash’s illicitly obtained CVC from the sanctioned two CVC mixers, Blender.io
involvement in the Harmony Horizon underlying illicit activity. and Tornado Cash, used to launder
Bridge (Harmony) heist 37 in June Non-state-affiliated actors commonly illicit proceeds of the March 2022 Axie
2022.38 The coordinated international use CVC mixing services to launder Infinity heist and the June 2022
takedown of ChipMixer, a darknet CVC their proceeds from large scale heists. Harmony heist, both of which were
‘‘mixing’’ service operated by The proceeds from the heists that carried out by North Korea’s Lazarus
Vietnamese national Minh Quôc targeted a CVC exchanger 40 and cross- Group.47 48 In addition, DOJ has
Nguyên in Hanoi, Vietnam, by the DOJ chain bridge Nomad 41 were, for determined that ChipMixer processed
and the German Federal Criminal Police instances, laundered using the Tornado over $700 million in Bitcoin associated
(Bundeskriminalamt or BKA) on March Cash CVC mixer. with wallet addresses identified as
15, 2023, and shutdown of Bestmixer.io In addition to the use of CVC mixing containing stolen CVC, including CVC
and associated seizure of servers located by non-state-affiliated actors, FinCEN related to the Axie Infinity and the
in the Netherlands and Luxembourg by assesses that, based on public and non- Harmony heists.49 The Federal Bureau
the Dutch Fiscal Information and public reporting, DPRK state-sponsored of Investigation (FBI) has also
Investigation Service (FIOD), in close or -affiliated cyber threat actors are determined that North Korean cyber
cooperation with Europol and responsible for a substantial portion of actors laundered over $60 million worth
Luxembourg authorities on May 22, illicit or stolen CVC funds sent to CVC of Ethereum stolen during the Harmony
2019,39 similarly demonstrate the mixers,42 and that the DPRK utilized heist through RAILGUN, a United
international character of CVC mixing CVC mixing to launder proceeds in an Kingdom-based CVC mixer.50 51 52
transactions—spanning jurisdictions attempt to obfuscate its connection to Importantly, DPRK-sponsored and
across Europe and Asia. those funds. The DPRK uses the mixed -affiliated actors’ desire to rely on CVC
proceeds of these thefts to support its mixing appears unlikely to abate. Most
2. CVC Mixing Is Used To Launder WMD program.43 44 A publicly available recently, in August 2023 the FBI
Proceeds of Large-Scale CVC Theft and analysis in February 2021 determined attributed the June 2023 Atomic Wallet
Heists that individuals acting for or on behalf heist to the Lazarus Group, and open-
FinCEN assesses that CVC mixing is of the North Korean government source reporting indicates that the
used to launder the proceeds of large- laundered more than 65 percent of Lazarus Group used specific services
stolen CVC through CVC mixers—an including Sinbad, a CVC mixer, to
34 See U.S. Treasury May 2022 Press Release.
increase from 42 percent in 2020 and 21 launder the stolen CVC.53 54
35 See U.S. Treasury November 2022 Press
percent in 2019.45 Further, publicly In brief, non-state actors and,
Release.
36 Federal Bureau of Investigation (FBI), FBI
available analysis in February 2022 significantly, DPRK state-sponsored or
Statement of Attribution of Malicious Cyber Activity assessed that the DPRK is a systematic -affiliated cyber threat actors have
Posed by the Democratic People’s Republic of money launderer and that its use of
Korea, Apr. 14, 2022, available at https:// multiple CVC mixers is a calculated 46 Chainalysis, The 2022 Crypto Crime Report,
www.fbi.gov/news/pressrel/press-releases/fbi- Feb. 2022, available at https://go.chainalysis.com/
statement-on-attribution-of-malicious-cyber- 40 CoinDesk, Crypto.com’s Stolen Ether Being 2022-crypto-crime-report.html (The 2022 Crypto
activity-posed-by-the-democratic-peoples-republic- Crime Report); see Chainalysis, North Korean
of-korea. Mixed Through Tornado Cash (Updated May 11,
2023), available at https://www.coindesk.com/ Hackers Have Prolific Year as Their Unlaundered
37 FBI, FBI Confirms Lazarus Group, APT 38
business/2022/01/18/cryptocoms-stolen-ether- Cryptocurrency Holdings Reach All-time High, Jan.
Cyber Actors Responsible for Harmony’s Horizon 13, 2022, available at https://blog.chainalysis.com/
Bridge Currency Theft, Jan. 23, 2023, available at being-laundered-via-tornado-cash/; see Halborn,
Explained: the Crypto.com Hack (January 2022), reports/north-korean-hackers-have-prolific-year-as-
https://www.fbi.gov/news/press-releases/fbi- their-total-unlaundered-cryptocurrency-holdings-
confirms-lazarus-group-cyber-actors-responsible- Jan. 24, 2022, available at https://halborn.com/
explained-the-crypto-com-hack-january-2022/ reach-all-time-high/.
for-harmonys-horizon-bridge-currency-theft (FBI 47 See U.S. Treasury May 2022 Press Release.
January 23, 2023 Press Release). (accessed Nov. 15, 2022).
48 See U.S. Treasury November 2022 Press
41 See U.S. Treasury November 2022 Press
38 See Dutch Fiscal Information and Investigation
Release; Reuters, U.S. crypto firm Nomad hit by Release.
Service, Arrest of suspected developer of Tornado 49 See DOJ March 2023 Press Release.
Cash, Aug. 12, 2022, available at https:// $190 million theft, Aug. 3, 2022, available at
https://www.reuters.com/technology/us-crypto-firm- 50 According to open-source reporting, RAILGUN
www.fiod.nl/arrest-of-suspected-developer-of-
tornado-cash/; DOJ, Tornado Cash Founders nomad-hit-by-190-million-theft-2022-08-02/. is headquartered in London, England.
42 See Chainalysis, The Crypto Crime Report 51 FinCEN assesses that RAILGUN falls under the
Charged with Money Laundering and Sanctions
Violations, Aug. 23, 2023, available at https:// 2023, available at https://go.chainalysis.com/2023- umbrella of CVC mixing, as defined by this NPRM,
www.justice.gov/usao-sdny/pr/tornado-cash- crypto-crime-report.html (The 2023 Crypto Crime because it uses its privacy protocol to manipulate
founders-charged-money-laundering-and-sanctions- Report). the structure of the transaction to appear as being
violations; OFAC, Treasury Designates Roman 43 See U.S. Treasury November 2022 Press sent from the RAILGUN contract address, thus
Semenov, Co-Founder of Sanctioned Virtual Release; see also FinCEN, Imposition of Special obscuring the true originator.
Measure Against North Korea as a Jurisdiction of 52 See FBI January 23, 2023 Press Release.
Currency Mixer Tornado Cash,Aug. 23, 2023,
available at https://home.treasury.gov/news/press- Primary Money Laundering Concern, 81 FR 78715, 53 FBI, FBI Identifies Cryptocurrency Funds
releases/jy1702; OFAC, Sanctions List Search, Aug. Nov. 9, 2016, available at https://www.fincen.gov/ Stolen by DPRK, Aug. 22, 2023, available at https://
24, 2023, available at https://sanctionssearch. sites/default/files/shared/2016-27049.pdf (FinCEN www.fbi.gov/news/press-releases/fbi-identifies-
lotter on DSK11XQN23PROD with PROPOSALS1
ofac.treas.gov/Details.aspx?id=44718. 2016 Imposition of Special Measure Against North cryptocurrency-funds-stolen-by-dprk.
39 The European Union Agency for Law Korea). 54 Elliptic, North Korea’s Lazarus Group likely
44 See UN March 2023 Experts Letter, at p. 4.
Enforcement Cooperation (Europol), Multi-million responsible for $35 Million Atomic Crypto Theft,
euro cryptocurrency laundering service Bestmixer.io 45 Chainalysis, Crypto Money Laundering: Four June 6, 2023, available at https://hub.elliptic.co/
taken down, May 22, 2019, available at https:// Exchange Deposit Addresses Received Over $1 analysis/north-korea-s-lazarus-group-likely-
www.europol.europa.eu/media-press/newsroom/ Billion in Illicit Funds in 2022, Jan. 26, 2023, responsible-for-35-million-atomic-crypto-theft/
news/multi-million-euro-cryptocurrency- available at https://blog.chainalysis.com/reports/ #:∼:text=Elliptic’s%20analysis%20suggests
laundering-service-bestmixerio-taken-down; DOJ crypto-money-laundering-2022/. (Crypto Money %20that%20North,with%20five%20million
March 2023 Press Release. Laundering: Four Exchange). %20users%20worldwide.
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00007 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
72706 Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules
repeatedly used, and continue to use, Force (FATF) identified this connection, the CVC mixer Helix, to obfuscate CVC
CVC mixing to launder illicit proceeds noting in 2022 the ongoing and growing transactions on the site.65 66
from large-scale CVC theft and heists. threat of criminal misuse of CVC for the As these examples demonstrate, illicit
receipt and laundering of illicit actors of all types conducting illicit
3. CVC Mixing Is Used by Ransomware cyber activity, including ransomware
proceeds from ransomware attacks,
and Darknet Markets expressing particular concern that attacks and transactions on darknet
CVC mixing services that obfuscate ransomware cybercriminals are markets, frequently seek out services
blockchain trails are attractive for increasingly using CVC mixers to that mask their illicit transactions and
cybercriminals looking to launder illegal launder their illicit proceeds.59 favor the enhanced anonymity provided
proceeds from malicious cyber-enabled Similarly, between January and June by CVC mixing. Furthermore, FinCEN
activities, including ransomware 2021, FinCEN observed the use of CVC assesses that the percentage of mixing
attacks.55 FinCEN assesses that threat mixing services (as reflected in BSA activity attributed to illicit activity is
actors avoiding reusing wallets, using reporting of suspicious activity) with increasing. According to publicly
CVC mixing services, and ‘‘chain the top 10 ransomware strains identified available analysis reported in January
hopping’’ have been prevalent as sending approximately $35.2 million 2023, the total amount of CVC sent to
associated money laundering to CVC mixers. During this same time CVC mixers fell significantly, likely due
typologies.56 Open-source analysis in period FinCEN also observed ‘‘chain to OFAC designation of two CVC
July 2022 reported that nearly 10 hopping’’ by ransomware actors to mixers, Blender.io and Tornado Cash.
percent of all CVC sent from addresses obfuscate the orgin of their proceeds as However, the analysis noted the CVC
tied to illicit activity were sent to CVC well as that ransomware actors layered that was sent to CVC mixers in 2022 was
mixers, while no other service type funds through multiple wallet addresses more likely to come from illicit sources
exceeded a 0.3 percent CVC mixer and avoided reusing wallet addresses than in previous years—24 percent of
sending share.57 FinCEN’s analysis of for each attack. The most prevalent the $7.8 billion 67 processed by mixers
the top 10 CVC mixers by volume per ransomware variants observed by in 2022 versus 10 percent of the $11.5
commercially available data determined FinCEN between January and June 2021 billion processed by mixers in 2021.68
that approximately 33 percent of all were Russia-affiliated REvil/Sodinokibi, This shift constitutes a 62.78 percent
deposits as of August 2022 were and Conti,60 and Russian-speaking increase in the illicit value flowing
attributed to high risk sources, with 13 DarkSide, Avaddon, and Phobos.61 62 through CVC mixers, year over year.69
percent of all deposits coming from The relationship between CVC mixing
B. The Extent to Which the Class of
known illicit activities.58 More and illicit activities is likewise
Transactions Is Used for Legitimate
significantly, only a portion of the prevalent in transactions involving
Business Purposes
activity in the CVC ecosystem with darknet markets. CVC mixing services
exposure to CVC mixing is captured by often deliberately operate opaquely and FinCEN recognizes that there are
BSA reporting. As a result, FinCEN advertise their services as a way to pay legitimate reasons why responsible
assesses that high-risk deposits into anonymously for illicit items such as actors might want to conduct financial
CVC mixers are likely underreported, illegal narcotics, firearms, and child transactions in a secure and private
and the percent of CVC tied to illicit sexual abuse material.63 According to manner given the amount of information
activity is likely higher. DOJ, the mixer Bitcoin Fog—the longest available on public blockchains.
The relationship between CVC mixing running Bitcoin money laundering FinCEN also recognizes that, in addition
and malicious cyber-enabled and other service on the darknet—laundered CVC to illicit purposes, CVC mixing may be
criminal activities is evident through from darknet marketplaces tied to illegal used for legitimate purposes, such as
the reliance of ransomware actors on narcotics, computer fraud and abuse privacy enhancement for those who live
CVC mixing. The Financial Action Task activities, and identity theft.64 under repressive regimes or wish to
Additionally, according to the conduct licit transactions
55 Europol, One of the darkweb’s largest
Government Accountability Office and anonymously.70 Still, CVC mixing
cryptocurrency laundromats washed out, Mar. 15, DOJ, the dismantled darknet market presents an acute money laundering risk
2023, available at https://www.europol.europa.eu/ because it shields information from
media-press/newsroom/news/one-of-darkwebs- Alphabay allegedly not only sold and
largest-cryptocurrency-laundromats-washed-out. purchased various illegal drugs, illicit
65 United States Government Accountability
56 See FinCEN October 2021 FTA. FinCEN goods, and services with CVC, but also
examined ransomware-related SARs filed between Office, VIRTUAL CURRENCIES Additional
allegedly provided mixing services, via Information Could Improve Federal Agency Efforts
January 1, 2021, and June 30, 2021, to determine
trends. The full data set consisted of 635 SARs to Counter Human and Drug Trafficking, Dec. 2021,
59 FATF, Targeted Update On Implementation Of p. 29, available at https://www.gao.gov/assets/gao-
reporting $590 million in suspicious activity. From
this data, FinCEN identified the top 10 most The FATF Standards On Virtual Assets And Virtual 22-105462.pdf.
common ransomware variants and analyzed their Asset Service Providers, June 2022, p. 24, available 66 DOJ, Ohio Resident Pleads Guilty to Operating
indicators of compromise through commercially at https://www.fatf-gafi.org/media/fatf/documents/ Darknet-Based Bitcoin ‘Mixer’ That Laundered Over
available analytics tools. USD figures cited in this recommendations/Targeted-Update- $300 Million, Aug. 18, 2021, available at https://
analysis are based on the value of BTC when the Implementation-FATFStandards-VirtualAssets- www.justice.gov/opa/pr/ohio-resident-pleads-guilty-
transactions occurred. VASPs.pdf. operating-darknet-based-bitcoin-mixer-laundered-
60 See U.S. Treasury May 2022 Press Release. over-300-million.
57 Chainalysis, Crypto Mixer Usage Reaches All-
time Highs in 2022 With Nation State Actors and OFAC identified Conti and Sodinokibi as Russian- 67 See The 2023 Crypto Crime Report, p. 46.
Cybercriminals Contributing Significant Volume, linked malign ransomware groups in their 68 See Crypto Money Laundering: Four Exchange.
July 14, 2022, available at https:// designation of Blender.io on May 6, 2022. 69 Although this analysis assessed only CVC sent
61 Id.
blog.chainalysis.com/reports/cryptocurrency- to CVC mixers without considering other forms of
lotter on DSK11XQN23PROD with PROPOSALS1
62 See FinCEN October 2021 FTA.
mixers/. CVC mixing (as identified by this NPRM), its
58 In August 2022, FinCEN analyzed 10 mixers, 63 See First Bitcoin ‘‘Mixer’’ Penalized by findings are nevertheless instructive.
finding that these services processed more than $20 FinCEN, October 19, 2020. 70 Chainalysis, Crypto Mixers and AML
billion in total volume between January 2011 and 64 DOJ, Individual Arrested and Charged with Compliance, August 23, 2022, available at https://
August 2022. The majority of this total occurred Operating Notorious Darknet Cryptocurrency blog.chainalysis.com/reports/crypto-mixers/; see
between January 2021 and August 2022. FinCEN ‘Mixer’, Apr. 28, 2021, available at https:// Elliptic, What are Bitcoin Mixers & Are They
assessed what sources constituted high risk and www.justice.gov/opa/pr/individual-arrested-and- Compliant With AML Standards?, May 7, 2018,
illicit activites based on commercial source charged-operating-notorious-darknet- available at https://elliptic.co/blog/bitcoin-mixers-
attributions of entities. cryptocurrency-mixer. assessing-risk-bitcoin-transactions.
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00008 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules 72707
responsible third parties, such as V. Proposed Enhanced Recordkeeping the information necessary to more
financial institutions and law and Reporting by Covered Financial effectively understand, investigate, and
enforcement. Institutions Where a Covered Financial hold illicit actors accountable.
FinCEN is concerned that CVC mixing Institution Knows, Suspects, or Has Collectively, the outcomes of the
makes CVC flows untraceable by law Reason To Suspect a Transaction proposed recordkeeping and reporting
enforcement and makes potentially Involves CVC Mixing Within or requirement—discouraging the use of
suspicious transactions unreportable by Involving a Jurisdiction Outside the CVC mixing by illicit actors and closing
responsible financial institutions— United States the information gap in service of
thereby fostering illicit activity as Having found that transactions increased investigation of those illicit
described elsewhere in this document. involving CVC mixing within or actors who continue to make use of CVC
More importantly, FinCEN assesses that involving a jurisdiction outside the mixing—will aid in the protection of the
the percentage of CVC mixing activity United States are a class of transactions U.S. financial system.
FinCEN has determined that
attributed to illicit activity is increasing. that are of primary money laundering
imposition of special measure one
At the same time, because of the lack of concern, FinCEN proposes imposing
would most appropriately collect
available transactional information, recordkeeping and reporting obligations necessary information while limiting
FinCEN cannot fully assess the extent to on covered financial institutions under the burden placed on covered financial
which, or quantity thereof, CVC mixing special measure one. Such institutions and users of CVC mixing.
activity is attributed to legitimate recordkeeping and reporting obligations As set out further below in Section V.B.,
business purposes. would require covered financial FinCEN believes that the existing risk-
Thus, the legitimate applications of institutions to report certain information based approach to AML/CFT
CVC mixing must be carefully weighed when they know, suspect, or have compliance used by covered financial
against the exposure of the U.S. reason to suspect a CVC transaction institutions already largely encompasses
financial system to ongoing illicit use of involves the use of CVC mixing within the information FinCEN is requesting.
CVC mixing. Given the substantial risks or involving a jurisdiction outside the Despite this ready availability of
posed by CVC mixing, the fact that CVC United States. information, covered financial
mixing can be used for some legitimate FinCEN believes that this special institutions do not, and often need not,
business purposes does not alter measure is the best available tool to universally report that information to
FinCEN’s conclusion that this class of mitigate the risks posed by CVC mixing. FinCEN at present. The proposed
transactions is of primary money It would appropriately collect reporting requirement would address
laundering concern. information, which will discourage the this reporting gap.
use of CVC mixing by illicit actors, and FinCEN considered the other special
C. The Extent to Which Action by is necessary to better understand the measures available under section 311.
FinCEN Would Guard Against illicit finance risk posed by CVC mixing As discussed further in Section V.E.
International Money Laundering and and investigate those who seek to use below, it determined that none of them
Other Financial Crimes CVC mixing for illicit ends. At the same would appropriately balance the
time, this special measure will interests in permitting secure and
Given the threats posed to U.S. minimize the burden upon financial
national security and the U.S. financial private financial transactions while
institutions and those who seek to use addressing the risks posed by CVC
system by obfuscation of illicit proceed mixing for legitimate purposes. The
flows through CVC mixing, FinCEN mixing, or were otherwise ill-suited to
reporting obligations under this special CVC-related transactions, and thus
believes that imposing recordkeeping measure apply to covered financial
and reporting requirements under incapable of collecting information
institutions that directly engage with necessary to add transparency to them.
special measure one would guard CVC transactions, such as exchangers, Moreover, FinCEN also considered the
against international money laundering and do not encompass indirect fiat appropriate scope of the proposed
and other financial crimes by increasing transactions by covered U.S. financial recordkeeping and reporting
transparency in these transactions, and institutions, such as a bank sending requirements, and determined that the
thus render them less attractive to illicit funds on behalf of a CVC exchanger that proposed approach would best capture
actors while also providing additional is acting on behalf of a customer necessary information and mitigate risks
information to support law enforcement purchasing CVC previously processed associated with CVC mixing and
investigations. through a CVC mixer. facilitate investigations of illicit actors,
This additional transparancy would As proposed by FinCEN, special while preserving legitimate actors’
serve two purposes. First, it would measure one would require ability to continue conducting secure
enable investigations by law recordkeeping and reporting of and private financial transactions.
enforcement and regulators to support biographical and transactional In proposing this special measure,
money laundering investigations, information related to transactions FinCEN consulted with the Chairman of
including cases against North Korean involving CVC mixing, increasing the Board of Governors of the Federal
and Russian cybercriminals that pose a transparency and thereby rendering the Reserve System, the Office of the
threat to U.S national security and the use of CVC mixing services by illicit Comptroller of the Currency, the
U.S. financial system. Second, it would actors less attractive. Furthermore, the Secretary of State, certain staff of the
highlight the risks and deter illicit information generated by this special Securities and Exchange Commission,
actors’ use of CVC mixing services, measure would support investigations the Commodity Futures Trading
lotter on DSK11XQN23PROD with PROPOSALS1
including by foreign state-sponsored or into illicit activities by actors who make Commission, the National Credit Union
-affiliated cyber actors’ laundering use of CVC mixing to launder their ill- Administration Board, the Federal
proceeds of CVC theft to facilitate WMD gotten CVC by law enforcement. At Deposit Insurance Corporation, and the
proliferation, ransomware attackers’ present, there is no similar or equivalent Attorney General. These consultations
laundering of ransoms, and obfuscation mechanism possessed by law involved obtaining interagency views on
of transactions associated with the use enforcement to readily collect such the imposition of the proposed
of illicit darknet markets. information, depriving investigators of recordkeeping and reporting
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00009 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
72708 Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules
requirements and the effect that such a activities. These efforts are generally not C. The Extent to Which the Action or the
recordkeeping and reporting as expansive as FinCEN’s proposed rule Timing of the Action Would Have a
requirements would have on the would be. However, FinCEN’s Significant Adverse Systemic Impact on
domestic and international financial identification of CVC mixing as a class the International Payment, Clearance,
system. of transactions of primary laundering and Settlement System, or on Legitimate
Below is a discussion of the relevant concern and proposed special measure Business Activities Involving CVC
statutory factors FinCEN considered in may support efforts of other countries Transactions
proposing these recordkeeping and by clearly outlining the illicit finance FinCEN assesses that imposition of
reporting requirements. the proposed special measure would
risks associated with CVC mixing and
A. Whether Similar Action Has Been or demonstrating means of enhancing have minimal impact upon the
Is Being Taken by Other Nations or transparency as well as mitigating these international payment, clearance, and
Multilateral Groups risks. settlement system, or on legitimate
FinCEN is not aware of any other business activities involving CVC
B. Whether the Imposition of Any transactions. As noted in the February
nation or multilateral group that has Particular Special Measure Would
imposed, or is currently imposing, 16, 2022, Financial Stability Board’s
Create a Significant Competitive Assessment of Risks to Financial
similar recordkeeping and reporting
requirements relating to transactions Disadvantage, Including Any Undue Stability, direct connections between
involving CVC mixing. However, having Cost or Burden Associated With CVC and systemically important
likewise identified the significant Compliance, for Financial Institutions financial institutions and core financial
money laundering threat that CVC Organized or Licensed in the United markets are limited at present.73
mixing poses, numerous other nations States Volatility and disruptions in the CVC
and certain multilateral groups have ecosystem have been contained within
While FinCEN assesses that the the CVC markets and have not
issued public statements regarding the
recordkeeping and reporting significantly spilled over to financial
risks presented by CVC mixing, called
for appropriate regulation, and/or taken requirements proposed in this NPRM markets and infrastructures.
action against specific CVC mixers. will place some cost and burden on
D. The Effect of the Proposed Action on
Several countries—such as Australia, domestic financial institutions, these
United States National Security and
Canada, and Seychelles—and burdens are neither undue nor
Foreign Policy
multilateral groups, such as FATF and inappropriate in view of the threat
posed by the obfuscation of illicit As described above, CVC mixers are
Europol, have identified CVC mixing as
activity enabled by CVC mixing. The used by DPRK-affiliated and Russia-
a risk indicator for money laundering or
existing risk-based approach to AML/ affiliated threat actors, among others, to
terrorist financing and have found that
CFT compliance used by covered facilitate illicit activities ranging from
CVC mixing can make it more difficult
financial institutions already largely WMD proliferation to ransomware
for law enforcement to trace and
attacks affecting victims in both the
attribute transactions, complicating encompasses the information FinCEN is
United States and around the world,
investigations.71 Japan requires requesting. While the information is
and whose interests are adversarial to
information from VASPs on their available to covered financial
the national security interests of the
exposure to CVC mixing services to institutions, at present it is not United States. Imposing recordkeeping
assess their risk exposure and assign universally reported to FinCEN. That is and reporting requirements on
risk ratings.72 Moreover, as discussed to say, FinCEN assesses that covered transactions that involve CVC mixing
above, numerous countries have financial institutions already possess will enhance financial intelligence on
investigated and prosecuted individual customer information and can identify the identity of illicit users who rely
CVC mixers and associated persons when their customers engage in a upon mixers to obfuscate their identities
engaged in or facilitating illicit covered transaction. This proposed rule and sources of CVC, as well as provide
71 See AUSTRAC, Preventing the Criminal Abuse
would compel covered financial insight into those CVC mixers that
of Digital Currencies Financial Crime Guide, Apr. institutions to attribute a covered facilitate such illicit activity. Such a
2022, pp. 1, 15–17, available at https:// transaction to the involved customer(s) rule would therefore best serve the
www.austrac.gov.au/sites/default/files/2022-04/ and report this information to FinCEN. national security interests of the United
AUSTRAC_FCG_
PreventingCriminalAbuseOfDigitalCurrencies_
Accordingly, the collection of the States and support efforts to protect the
FINAL.pdf; Government of Canada, Updated information in question would not United States financial system from
Assessment of Inherent Risks of Money Laundering create any undue costs or burdens on illicit finance threats.
and Terrorist Financing in Canada, Mar. 2023, covered financial institutions. Covered
available at https://www.canada.ca/en/department- E. Consideration of Alternative Special
finance/programs/financial-sector-policy/updated- domestic financial institutions may Measures
assessment-inherent-risks-money-laundering- need to modify or replace the current
terrorist-financing-canada.html; Republic of In assessing the appropriate special
systems in place used to detect other
Seychelles, ML/TF Overall National Risk measure to impose, FinCEN considered
Assessment for VA & VASPs, July 2022, pp. 32, 43, types of illicit activity in virtual
alternatives to imposing recordkeeping
available at https://www.cbs.sc/Downloads/ currency transactions, such as sanctions and reporting requirements under
publications/aml/ReportSeychellesONRAML- compliance systems, to detect
TFofVAandVASP-26.08.2022.pdf; Europol, Seizing special measure one. However, FinCEN
the Opportunity: 5 Recommendations For Crypto-
transactions involving CVC mixing. believes that recordkeeping and
lotter on DSK11XQN23PROD with PROPOSALS1
Assets Related Crime And Money Laundering Such burdens are commensurate with reporting requirements under special
(2022), p. 6, available at https:// established AML/CFT protocols. measure one would most effectively
www.europol.europa.eu/cms/sites/default/files/
documents/2022_Recommendations_Joint_ safeguard the U.S. financial system from
Working_Group_on_Criminal_Finances_and_
Cryptocurrencies_.pdf; FATF, Updated Guidance 73 Financial Stability Board, Assessment of Risks
for a Risk-Based Approach, Oct. 2021. to Financial Stability from Crypto-assets, Feb. 16,
72 See FATF, Updated Guidance for a Risk-Based 2022, at p. 5, available at https://www.fsb.org/wp-
Approach, Oct. 2021, at p. 94. content/uploads/P160222.pdf.
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00010 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules 72709
the illicit finance risks posed by CVC VI. Section-by-Section Analysis of dealers, or money services businesses,
mixing. Proposed Regulations including VASPs, that would otherwise
In particular, none of the other special The goal of this proposed rule is to constitute CVC mixing, provided that
measures available under section 311 implement an effective and efficient these financial institutions preserve
would appropriately balance the reporting regime to combat and deter records of the source and destination of
interests in permitting secure and money laundering associated with CVC CVC transactions when using such
private financial transactions while mixing and increase transparency in a internal protocols and processes, and
addressing the risks posed by CVC sector of the United States virtual provide such records to regulators and
mixing or would be suited to CVC- currency ecosystem with identified law enforcement, where required by
related transactions. For instance, illicit finance risks. law. This exemption is designed to
FinCEN considered special measure avoid capturing transactions with
two, which is designed to obtain A. Definitions known VASPs that use these internal
beneficial ownership information 1. Definition of Convertible Virtual protocols or processes as part of their
relating to accounts opened in the Currency business purpose and that are
United States by certain foreign persons positioned to appropriately respond to
or their agents. However, FinCEN The term ‘‘convertible virtual inquiries by law enforcement and other
determined that such a special measure currency’’ or CVC, means a medium of relevant authorities. However, if the
would fail to collect key information of exchange that either has an equivalent covered financial institution is unsure if
interest relating to CVC transactions that value as currency, or acts as a substitute these processes are used as part of a
involve CVC mixing such as the identity for currency, but lacks legal tender business purpose, they should collect
of the participants and beneficial status.74 Although Bitcoin has legal the recordkeeping and reporting
owners of the CVC involved. FinCEN tender status in at least two information.
also considered special measures three jurisdictions, the term CVC includes FinCEN is seeking to address the
through five, which are focused upon Bitcoin for the purposes of this primary money laundering concern
transactions conducted through proposed rule. posed by CVC mixing. The proposed
payable-through accounts and 2. Definition of CVC Mixing definition of CVC mixing is designed to
correspondent banking relationships capture methodologies used by illicit
and determined that these are less The term ‘‘CVC mixing’’ means the
actors to break the traceability of their
relevant in the context of CVC facilitation of CVC transactions in a
illicit proceeds and create a mechanism
transactions, including those that manner that obfuscates the source,
on which which covered businesses
involve CVC mixing, as CVC destination, or amount involved in one
would be required to report when they
transactions are conducted outside of or more transactions, regardless of the
observe CVC mixing transactions. The
the traditional banking system. type of protocol or service used, such as:
exception to the definition is crafted to
(1) pooling or aggregating CVC from
More broadly, FinCEN also avoid imposing undue burden on
multiple persons, wallets, addresses, or
considered the appropriate scope of the covered businesses, provided they are
accounts; (2) using programmatic or
proposed recordkeeping and reporting also taking appropriate steps to ensure
algorithmic code to coordinate, manage,
requirements. Of note, FinCEN information is being retained as
or manipulate the structure of a
considered issuing a rule pursuant to prescribed by law.
transaction; (3) splitting CVC for
section 311 that would have been
transmittal and transmitting the CVC 3. Definition of CVC Mixer
narrowly scoped to address terror
through a series of independent
finance involving Hamas and ISIS and/ The term ‘‘CVC mixer’’ means any
transactions; (4) creating and using
or North Korea-sponsored and -affiliated person, group, service, code, tool, or
single-use wallets, addresses, or
actors. However, FinCEN determined function that facilitates CVC mixing.
accounts, and sending CVC through
that such a narrow approach would be FinCEN acknowledges this definition is
such wallets, addresses, or accounts
insufficient to address the relevant risks relatively broad; however, given the
through a series of independent
detailed elsewhere in this action. Given nature of CVC mixing, FinCEN deems
transactions; (5) exchanging between
the nature and use of CVC mixing, the breadth of this definition to be
types of CVC or other digital assets; or
covered financial institutions would necessary.
(6) facilitating user-initiated delays in
typically have insufficient information
transactional activity. 4. Definition of Covered Financial
to determine whether the CVC
This definition excepts the use of Institution
transaction was initiated North Korean-
internal protocols or processes to
affiliated actors. FinCEN believes this The proposed rule defines ‘‘covered
execute transactions by banks, broker-
would be true of any similarly narrow financial institution’’ as the term is
approach, regardless of the actors 74 As noted in note 17, FinCEN notes that CVC defined 31 CFR 1010.100(t), which in
involved. Therefore, FinCEN has or ‘‘virtual currency’’ by itself does not meet the general includes the following:
determined that additional definition of a ‘‘currency’’ under 31 CFR
• A bank (except bank credit card
recordkeeping and reporting 1010.100(m). Additionally, the potential
characterization of CVC as currency, securities, systems);
requirements set forth in this proposed
rule would best mitigate the risks
commodities, or derivatives for the purposes of any • A broker or dealer in securities;
other legal regime, such as the Federal securities
associated with CVC mixing, deter illicit laws or the Commodity Exchange Act, is outside the • A money services business, as
actors, facilitate law enforcement scope of this proposed rule. However, as described defined in 31 CFR 1010.100 (ff). This
lotter on DSK11XQN23PROD with PROPOSALS1
in the FinCEN 2019 CVC Guidance, if assets that would include VASPs and other persons
investigations into illicit activity, and other regulatory frameworks defined as
adequately protect the U.S. financial commodities, securities, or futures contracts were to
that provide money transmission
system from the illicit financial risk be specifically issued or later repurposed to serve services, which ‘‘. . . means the
posed by CVC transactions that involve as a currency substitute, then the asset itself could acceptance of . . . value that substitutes
be a type of value that substitutes for currency and for currency from one person and the
CVC mixing, while preserving legitimate be defined as CVC for the purposes of this proposed
actors’ ability to conduct secure and rule, in addition to being subject to other applicable
transmission of . . . value that
private financial transactions. regulatory frameworks. substitutes for currency to another
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00011 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
72710 Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules
location or person by any means previously processed through a CVC mixing because, at present, covered
. . .’’; 75 mixer from the CVC exchanger’s bank financial institutions do not regularly
• A telegraph company; account to the bank account of the report when their customers send or
• A casino; customer selling CVC. receive CVC in transactions with indicia
• A card club; It is critical that all financial of CVC mixing. Reporting that links
• A person subject to supervision by institutions, including those with customers to the CVC mixing
any state or Federal bank supervisory visibility into CVC flows, such as CVC transactions will aid law enforcement
authority; exchangers—generally considered and national security investigations of
• A futures commission merchant or money services businesses (MSBs) illicit activity involving CVC. The
an introducing broker-commodities; and under the Bank Secrecy Act—identify following addresses the types of
• A mutual fund. and quickly report suspicious activity, information the rulemaking proposes to
5. Definition of Covered Transaction and conduct appropriate risk-based collect.
customer due diligence or, where
The term ‘‘covered transaction’’ (i) Reportable Information Regarding the
required, enhanced due diligence. For
means a transaction as defined in 31 Covered Transaction
example, in appropriately conducting a
CFR 1010.100(bbb)(1) in CVC by,
review to identify suspicious activity In connection with all covered
through, or to the covered financial
associated with potential sanctions transactions, FinCEN proposes to collect
institution that the covered financial
evasion and to comply with existing the following information:
institution knows, suspects, or has
FinCEN 311s on Iran and DPRK, • The amount of any CVC
reason to suspect involves CVC mixing
financial institutions must know if transferred, in both CVC and its U.S.
within or involving a jurisdiction
transactions originate from or are dollar equivalent when the transaction
outside the United States. The reference
destined to prohibited jurisdictions, was initiated: The amount of CVC
to FinCEN’s definition of ‘‘transaction’’
such as Iran 77 or DPRK.78 Indeed, transferred would aid in performing
means that a covered transaction
FinCEN can, and has, assessed civil analysis using a risk-based approach.
includes the following: a purchase, sale,
monetary penalties on covered financial The proposed rule would require the
loan, pledge, gift, transfer, delivery, or
institutions that have failed to conduct amount in CVC and U.S. dollar
other disposition, and with respect to a
such due diligence, including, recently, equivalent when the transaction was
financial institution includes a deposit,
in enforcement actions against Bittrex 79 initiated to account for volatile CVC
withdrawal, transfer between accounts,
and BitMex.80 In light of the existing prices and aid in consistent monitoring
exchange of currency, loan, extension of
compliance practices of covered and risk management purposes.
credit, purchase or sale of any stock,
financial institutions, FinCEN expects • CVC type: The proposed rule would
bond, certificate of deposit, or other
that complying with this proposed rule require reporting of the type of CVC
monetary instrument, security, contract
should not add a significant additional used in a covered transaction. The type
of sale of a commodity for future
burden. FinCEN invites public comment of CVC used would allow for trend
delivery, option on any contract of sale
on this assessment.
of a commodity for future delivery, analysis of preferred usage of different
option on a commodity, purchase or B. Reporting and Recordkeeping types of CVC, as well as ensure the
redemption of any money order, Requirements correct blockchain analysis can be done
payment or order for any money given each CVC exists on different
1. Information To Be Reported
remittance or transfer, purchase or blockchains. Taken together with the
redemption of casino chips or tokens, or Although FinCEN recognizes much of amount of any CVC transferred, this
other gaming instruments or any other the information that would be collected information would inform trend
payment, transfer, or delivery by, under this proposed rule is already analysis and allow for an improved
through, or to a financial institution, by provided to the most frequent reporters understand of laundering typologies.
whatever means effected. To this end, in the CVC ecosystem, imposing • The CVC mixer used, if known: The
FinCEN would expect covered financial additional recordkeeping and reporting proposed rule would require reporting
institutions to employ a risk-based requirements is necessary to address the of the CVC mixer used in the covered
approach to compliance of this money laundering threat posed by CVC transaction. That information would
proposed rule, and more broadly, the assist in understanding trends of mixing
77 See FinCEN, Imposition of Fifth Special
Bank Secrecy Act, including by using activity as well as aid in understanding
Measure against the Islamic Republic of Iran as a
the variously available free and paid Juridiction of Primary Money Laundering Concern, the quantity of CVC mixers in the CVC
blockchain analytic tools commonly 84 FR 59302, Nov. 4, 2019, available at https:// ecosystem.
available.76 www.fincen.gov/sites/default/files/shared/2019- • CVC wallet address associated with
The limitation to transactions ‘‘in 23697.pdf.
78 See FinCEN 2016 Imposition of Special
the mixer: The proposed rule would
CVC’’ means that the reporting Measure Against North Korea. require reporting of the CVC wallet
obligations under this special measure 79 See FinCEN, FinCEN Announces $29 million address of the CVC mixer, if one is used,
apply to covered financial institutions Enforcement Action Against Virtual Asset Service to aid in understanding of addresses
that directly engage with CVC Provider Bittrex for Willful Violations of the Bank associated with each CVC mixer. This
transactions, such as a CVC exchange. It Secrecy Act, Oct. 11, 2022, available at https://
www.fincen.gov/news/news-releases/fincen- information would assist with
also means that covered transactions do announces-29-million-enforcement-action-against- understanding the size, scale, and
not include transactions that are only virtual-asset-service. methodologies of CVC mixers by
indirectly related to CVC, such as when 80 See FinCEN, FinCEN Announces $100 Million
facilitating aggregate analysis of
lotter on DSK11XQN23PROD with PROPOSALS1
a CVC exchanger sends the non-CVC Enforcement Action Against Unregistered Futures
Commission Merchant BitMEX for Willful
transactional data of CVC mixers.
proceeds of a sale of CVC that was Violations of the Bank Secrecy Act, Aug. 10, 2021, • CVC wallet address associated with
available at https://www.fincen.gov/news/news- the customer: The proposed rule would
75 31 CFR 1010.100(ff)(5)(A).
releases/fincen-announces-100-million- require reporting of the CVC wallet
76 FinCEN is not, at this time, proposing that enforcement-action-against-unregistered-
covered financial instutitons would be required to futures#:∼:text=Despite%20BitMEX’s%20public
address of the customer to assist in the
perform a lookback to identify covered transactions %20representation%20that,trading%20platform investigation of the covered transaction,
that occurred prior to issuance of a final rule. %20and%20circumvent%20internet. including blockchain analysis to
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00012 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules 72711
determine if the wallet is associated of the full date of birth of the covered counterparty to collect additional
with illicit activities. financial institution’s customer, as it information on the CVC mixing
• Transaction hash: The proposed appears in the customers onboarding transaction.
rule would require reporting of the file.
transaction hash, which will allow an • Address: The proposed rule would 3. Recordkeeping Requirements
investigation of the specific transaction require reporting of the most Pursuant to the proposed rule,
and assist in the identification of appropriate address (residential or covered financial institutions would be
specific wallet addresses involved in the business) of the customer engaged in a required to maintain any records
transaction(s), as well as more specific covered transaction. Specifically, if the documenting compliance with the
transactional meta data such as the date customer is a business, the business requirements of this regulation.
and time the transaction was completed. address would be reported, and, if the
VII. Request for Comments
• Date of transaction: The proposed customer is an individual, the
rule would require reporting of the date residential address would be reported. FinCEN invites comments on all
of transaction, which would assist in • Email Address associated with any aspects of the proposed rule, including
enforcing the proposed regulation, as and all accounts from which or to which the following specific matters:
well as assist in corroborating other the CVC was transferred: The proposed
A. CVC Mixing as a Class of
reported information. rule would require email address(es)
Transactions of Primary Money
• IP addresses and time stamps used by a customer involved in a
Laundering Concern
associated with the covered transaction: covered transaction and known to the
The proposed rule would require covered institution. 1. What impact would this proposed
reporting of the IP address to obtain • Unique identifying number: For rule have on legitimate activity
geographical information related to the individuals, the proposed rule requires conducted by persons in the course of
covered transaction, which would assist reporting of customers’ Internal conducting financial transactions?
trend analysis of patterns of covered Revenue Service (IRS) Taxpayer 2. What impact would the proposed
transactions by geographic location. Identification Number (TIN) or, if the rule have on blockchain privacy or
• Narrative: The proposed rule would individual does not have one, a foreign pseudonymity, noting that filings
require a description of activity equivalent. If the customer has neither reported to FinCEN are not publicly
observed by the covered financial a TIN nor a foreign equivalent, the releasable and the similarities of this
institution, including a summary of proposed rule would require reporting proposal to the recordkeeping and
investigative steps taken, provide of a non-expired United States or reporting requirements of transactions
additional context of the behavior, or foreign passport number or other using the traditional financial system,
other such information the covered government-issued photo identification such as with wire or Automated
financial institution believes would aid number, such as a driver’s license. For Clearing House (ACH) transactions?
follow on investigations of the activity. entities, the proposed rule would 3. Does the impact on privacy and
As the covered financial institution require reporting of the entity’s IRS TIN legitimate applications identified in
would have insight into the normal or, if the entity does not have one, a Section IV.B potentially outweigh the
pattern of its customers’ transactions, foreign equivalent or a foreign risks posed by illicit activity facilitated
this narrative would assist with registration number. TINs and other by CVC mixing?
understanding if there is an unique identifying numbers provide law 4. What challenges are anticipated
uncharacteristic change in pattern of enforcement with the most efficient with respect to identifying the foreign
behavior. means to identify individuals nexus of a CVC mixing transaction?
Importantly, under the proposed rule, potentially involved in illicit activity. 5. Are there any other methods that
covered financial institutions would covered financial institutions can use to
2. Filing Procedures
continue to have an obligation to file a be able to readily determine if covered
SAR when warranted, regardless of The proposed regulation would transactions stemming from non-mixer
whether the covered financial require a covered financial institution to CVC mixing have a foreign nexus?
institutions also filed a report required collect, maintain records of, and report 6. Are there sufficient tools available,
under the proposed rule. to FinCEN within 30 calendar days of either free or paid, that would aid
initial detection of a covered covered financial instutitions to
(ii) Reportable Information Regarding transaction, in the manner that FinCEN determine if covered transactions
the Customer Associated With the may prescribe, certain information occurred outside the United States?
Covered Transaction regarding covered transactions that 7. Are there any other methods that
In respect of customers associated involve CVC mixing. This includes covered financial institutions can use to
with covered transactions, FinCEN certain information the covered be able to readily determine if covered
proposes to collect the following financial institution shall provide with transactions stemming from non-mixer
information: respect to each covered transaction CVC mixing have a foreign nexus?
• Customer’s full name: The which is examined in detail below. This 8. Has FinCEN appropriately weighed
proposed rule would require reporting proposed reportable information is the legitimate and illicit activities
of the full name of the covered financial similar to the information already associated with the use of CVC mixing?
institution’s customer, as it appears in collected by financial institutions to What other factors should be
the customer’s proof of identification comply with their AML/CFT considered?
obligations; however, at present covered
lotter on DSK11XQN23PROD with PROPOSALS1
and related documents, such as passport
businesses would not necessarily report B. Definitions
or driver’s license or non-driver
identification card, used by the such information. Notably, the proposed 1. Please provide suggested revisions
customer when they validated their regulation only requires a covered to the proposed definitions that would
identity with the covered financial financial institution to report better tailor the intended recordkeeping
institution. information in its possession, and thus and reporting obligations to the
• Customer’s date of birth: The does not require a covered institution to objectives and uses described in this
proposed rule would require reporting reach out to the transactional proposal. Where possible, please
VerDate Sep<11>2014 16:17 Oct 20, 2023 Jkt 262001 PO 00000 Frm 00013 Fmt 4702 Sfmt 4702 E:\FR\FM\23OCP1.SGM 23OCP1
72712 Federal Register / Vol. 88, No. 203 / Monday, October 23, 2023 / Proposed Rules
provide information or examples to 7. In cases where the customer of a 7. Are the due diligence requirements
illustrate how the recommended covered financial institution is a legal appropriately scoped in this proposed
revisions improve upon the definitions entity, should the implementation of rule?
as proposed. special measure one also require the 8. What impact will this proposal
2. Does the proposed definition of beneficial ownership of that legal entity have on augmenting law enforcement’s
CVC mixing adequately capture the be reported, in addition to the other ability to track and trace CVC derived
activity of concern? If not, please proposed reporting requirements? from cyber heists, ransomware, or
provide suggested revisions to the E. Burden and Other Impacts of This similar illicit activity to aid the return
proposed definition that would better Proposed Rule of victim’s CVC?
capture such activity. Where possible, 9. Are there any international efforts
please provide information or examples 1. Does FinCEN accurately account for to address illicit finance risks stemming
to illustrate how the recommended the burden and impact of this proposed
from mixing not addressed in the
revisions would improve upon the rule when a covered financial
NPRM?
definition as proposed. institution knows, suspects, or has
reason to suspect a transaction involves 10. What effect would the proposed
3. Does the proposed exception to the rule have on international efforts to
definition of CVC mixing adequately CVC mixing?
2. Is there a less burdensome way of address the illicit use of CVC mixing?
account for legitimate activity 11. Are there specific examples of
collecting information regarding the
conducted by VASPs and other financial ‘‘covered transactions’’ or sample
details of a CVC transaction, which the
institutions? If not, please provide scenarios that FinCEN could have
BSA’s AML/CFT objectives require
suggested revisions to the proposed provided to assist financial institutions
financial institutions to collect,
definition that would better capture and other affected parties in further
including know-your-customer and
such activity. Where possible, please understanding the intended
customer due diligence?
provide information or examples to 3. Would the adoption of