Share the article
twitter-iconcopy-link-iconprint-icon
share-icon
Western EuropeJanuary 29 2020

EU steps up AML fight with 5MLD

With money launderers utilising evermore sophisticated techniques – largely through cryptocurrencies – jurisdictions around the world are looking to respond. James King assesses the potential effectiveness of the EU's 5MLD.
Share the article
twitter-iconcopy-link-iconprint-icon
share-icon
AML fight

When a Franco-Belgian terror cell brought devastation to the heart of Europe by attacking Paris in November 2015 and Brussels in March 2016, the two countries’ security agencies were caught off guard. For one, both operations were highly sophisticated and well resourced. But they were also financed in a way that evaded the attention of law enforcement. In the case of the assault on Paris, the French finance ministry’s intelligence unit, Tracfin, estimated the total cost of the deadly assault at no more than €30,000. Much of this was splintered into smaller sums deployed on anonymous, prepaid cards. 

The financing mechanisms behind these attacks offer one example of an escalating arms race between financial regulators on the one hand and terrorist networks, criminals and money launderers on the other. And it is unfolding against a backdrop of an increasingly complex global financial system.

Today, for instance, the website of a prominent Palestinian militant group invites users to provide financial support through a Bitcoin QR code. Every time a visitor reaches the page, a unique Bitcoin donation address is generated. This makes it nearly impossible for security agencies to track related payments, as each visit to the website creates a new address on the blockchain ledger underpinning it. 

Fifth time lucky? 

With a growing constellation of cryptocurrencies offering terrorists, criminals and money launderers new opportunities to achieve their goals, alongside creative adaptations to traditional financing methods, global regulators are racing to enhance their anti-money laundering (AML) and countering the financing of terrorism frameworks. In the EU, the latest response has arrived in the form of the Fifth Money Laundering Directive (5MLD). 

Enacted by the European Parliament in July 2018 and implemented by member states on January 10, 2020, the directive is the latest salvo from the European authorities in this perpetual struggle.

“5MLD came out only a year after its predecessor, 4MLD. It was an instinctive response to events such as the cryptocurrency boom, the Bataclan attack and money-laundering scandals linked to shell companies. What the European Parliament came up with was a specific response to these trends,” says Charles Delingpole, chief executive of ComplyAdvantage, a London-based regulation technology company. 

The introduction of 5MLD covers new regulations and due diligence procedures for cryptocurrencies and crypto exchanges, prepaid cards, the use of high-value goods including art and precious metals, enhanced ultimate beneficial ownership rules and dealings with individuals from high-risk third countries, among a number of other changes. Through these mechanisms, it also diminishes the anonymity of users in the realm of digital payments. Accordingly, its impact on the EU’s financial landscape, and for its cryptocurrency sector in particular, will be far reaching. 

“Under 5MLD, the EU’s AML regime has been extended to include cryptocurrency exchanges and digital wallet providers. It has also clarified areas around customer due diligence by offering more consistency across the continent,” says Stephen Smith, a partner in Eversheds Sutherland’s financial services disputes and investigations group. 

Future unknown 

These changes can not only be traced back to events that hit Europe’s news cycle in the preceding years but also to a wider understanding that new and unforeseen risks are likely to emerge in the crypto sector moving forward.

“It is widely perceived that cryptocurrency has been used by money launderers. So by bringing it under the scope of AML regulations it firstly makes it harder for criminals to abuse that system, while also driving clarification and a better understanding of the crypto sector by regulators,” says Mr Smith. 

In Europol’s October 2019 Internet Organised Crime Threat Assessment, the organisation notes that “the currency of dark web enterprises remains virtual”, with more than $1bn spent on the dark web in the year to the report’s publication. While Bitcoin remains the dominant cryptocurrency, criminals looking for greater privacy were increasingly migrating to alternative currencies. The report also highlights the needs for European regulators to remain vigilant to cryptocurrency conversion and cashout opportunities – essentially, the bridges to fiat currency conversion. 

“Cryptocurrency is a whole new front in the war against financial crime. In effect, crypto is the perfect vehicle for laundering money. There is a legitimate use case but the most likely user is someone laundering the proceeds of crime who is likely to co-mingle legal with illegal funds,” says Mr Delingpole. 

Visibility drive 

Before 5MLD, various dimensions of the crypto asset sector in Europe were unregulated. Under the new regime, cryptocurrencies and crypto exchanges are regarded as ‘obliged entities’ with a requirement to perform customer due diligence procedures, as well as file suspicious activity reports. As such, the new directive addresses many of the regulatory and supervisory blind spots that existed under the fourth directive, despite the fact that some larger and more established crypto asset businesses were already self-regulating to a high standard. 

“[The regulators] wanted to enhance the visibility of the [crypto] market and to ensure that, on the crypto side of things, the customers can be identified. What the new regulation does is regulate the cryptocurrency to fiat currency bridge, to ensure that everyone on the crypto side is identified,” says Simon Lelieveldt, a regulatory and compliance consultant who used to work for the Dutch Bankers Association and De Nederlandsche Bank. 

Accordingly, 5MLD represents a first step in what is likely to be a longer term journey of the regulation of cryptocurrency in Europe. Similar efforts are either under way or have been implemented in key jurisdictions around the world. Nevertheless, the challenges linked to the regulation of the crypto sector are numerous. This is due not only to issues of complexity but, in Europe, to the nature of the regulatory structure and marketplace. 

A fragmented landscape

“The nature of 5MLD is that it is minimum harmonisation. That means you can have local flavours and member states can throw in extra rules if they wish. In Europe, on the AML side, it is a somewhat fragmented landscape,” says Mr Lelieveldt. 

This degree of latitude for regulators at the local level is a product of the EU’s directive structure, which mandates that member states achieve an outcome without dictating the path to reaching that objective. As a result, depending on the jurisdiction, there will be differences in application from one market to the next. For crypto asset businesses, this difficulty is likely to be compounded by other issues, including the varying degrees of expertise and know-how from one country’s regulator to the next. 

“What’s interesting is that, in the UK, the focus has been on making sure that the relevant entities fall under 5MLD. In Germany, they have interpreted the directive as a basis for creating a new licensing regime for [crypto] custodians, which is far more onerous than what is happening in the UK,” says James Burnie, head of blockchain and crypto assets at Eversheds Sutherland. 

As Mr Burnie notes, one outcome of this difference has been that many custodians have tried to secure a licence in Germany, only to be put off by the high costs involved. As such, regulators must be careful not to implement the scope of 5MLD without constructing an anti-competitive regime. But if Germany’s more onerous interpretation of the directive proves appealing to European lawmakers, it has the potential to become the norm moving forward.

“If the [EU authorities] see the German licensing regime working well, you might see licensing regimes become a requirement in future updates to the money laundering regime. So it could well be that Germany has forced the hand of the rest of Europe,” says Mr Smith of Eversheds Sutherland. 

Compliance challenges 

From the perspective of crypto sector businesses, Europe’s changing regulatory landscape will pose something of a compliance challenge. For some, a more regulated marketplace will require a cultural shift in their operations in order to adopt a compliance-focused mindset. In addition, it will lead to heavy cost increases as personnel and technology are deployed to meet 5MLD requirements, as well as the subsequent iterations of the EU’s AML framework. 

“Some crypto companies have simply shut down, rather than meet the compliance standards set out by 5MLD. It is far too onerous for many smaller players to remain active because the cost of compliance is so high,” says Mr Delingpole.

Simplecoin, a cryptocurrency mining pool, as well as Chopcoin, a Bitcoin gaming platform, have both closed their operations in response to the introduction of 5MLD. A note published on Simplecoin’s website, and widely reported on through online media sources, detailed the management’s privacy concerns relating to the AML requirements of the directive. Elsewhere, a number of specialist media reports in late January 2019 linked KyberSwap, the second largest non-custodial cryptocurrency exchange by market share, with a move to the British Virgin Islands from Malta in response to 5MLD.

“The journey will be easier for firms with strong AML and know-your-customer controls. But we are seeing some companies close as a result of these AML requirements and we may see some firms merge to achieve economies of scale,” says Malcolm Wright, chief compliance officer at Diginex. 

But as Mr Wright notes, any enterprises eyeing a move to a less regulated jurisdiction in response to 5MLD may only deliver a brief reprieve. “5MLD does not go as far as 2019’s Financial Action Task Force [FATF] recommendations to countries on how to regulate cryptocurrency firms,” he says. “It is expected that countries should implement regulations to FATF standards within the next 18 months, so moving to a less stringent jurisdiction may only provide temporary relief.”

No more anonymity 

Beyond the implications for Europe’s cryptocurrency sector, 5MLD is delivering profound changes to other aspects of the region’s financial landscape. For some, this is primarily linked to questions around the anonymity of payments. The directive has, for instance, lowered the monthly transaction limit on prepaid cards from €250 to €150. The same limit exists for the total value that can be stored on a prepaid card. In addition, the limit for an online transaction using a card has been set to €50. 

“If you look at it not from a supervisory perspective but from a societal perspective, this is where we started to decide that the only means of payment that will remain anonymous is cash. We have removed anonymity from the digital domain,” says Mr Lelieveldt. 

5MLD also prevents credit and financial institutions from holding anonymous safe-deposit boxes, while customer due diligence procedures must be executed on clients already in possession of these facilities. “[The regulators] have basically closed the door on all the relevant mechanisms where people can still deal with their money in a private way. That’s the very fundamental element that is hidden in 5MLD,” says Mr Lelieveldt. 

Issues of data privacy and the anonymity of individuals will remain a central tension in the fight against money laundering and terrorist financing. For regulatory and law enforcement agencies, it is difficult terrain to navigate. Critics of the current AML framework point to regulatory ‘land grabs’ in the aftermath of terrorist attacks or money laundering scandals. But having the right regulations in place will be essential if state authorities are to have any hope of minimising the threats they face. 

For now, however, regulators will need to focus on the immediate challenges presented by the increasing complexity of the global economic and financial system. “What we have today is a regime that is decades old and which was designed in terms of a basic economy. But the economy has changed very significantly in that time. It will be interesting to see, as 5MLD develops, whether the regime is suitable for mitigating money laundering risk in the crypto space or if it is just going to become an element of window dressing,” says Mr Smith. 

Was this article helpful?

Thank you for your feedback!