Enter to open, tab to navigate, enter to select
US Treasury Releases DeFi Illicit Finance Risk Assessment
Practical Law Legal Update w-039-1202 (Approx. 6 pages)
US Treasury Releases DeFi Illicit Finance Risk Assessment
by Practical Law Finance
| Published on 13 Apr 2023 • USA (National/Federal) |
The US Treasury Department published its first assessment of decentralized finance (DeFi) illicit finance risk, including recommendations for enhancing anti-money laundering and countering the financing of terrorism (AML/CFT) protocols on DeFi platforms, as well as a request for public input.
On April 6, 2023, the US Treasury Department published its first illicit finance risk assessment on decentralized finance (DeFi), which furthers the work outlined in Biden Executive Order 14067 on ensuring the responsible development of digital assets (see Legal Update, President Biden Signs Comprehensive Executive Order on Digital Assets Including Exploration of US CBDC) and builds on prior Treasury risk assessments on money laundering, terrorist financing, and national proliferation financing (see Legal Update, White House Issues Framework for Regulation of Digital Assets, Treasury Issues Crypto Reports and Request for Comment).
The DeFi assessment addresses:
- How illicit actors are abusing DeFi services. According to the assessment, cybercriminals, ransomware attackers, thieves, scammers, and countries such as Democratic People’s Republic of Korea (DPRK) are using DeFi services to transfer and launder illicit proceeds.
- Vulnerabilities unique to DeFi services. These vulnerabilities include noncompliance of many DeFi services with anti-money laundering and countering the financing of terrorism (AML/CFT) obligations.
After providing a DeFi market overview, the assessment notes the following about DeFi as an element of the virtual asset ecosystem:
- DeFi had a total value locked (TVL) of $39.77 billion as of December 19, 2022, according to DefiLlama, the largest aggregator for DeFi. TVL represents the aggregate amount of assets currently deposited in DeFi protocols.
- DeFi includes the following categories of services:
- decentralized exchanges (DEXs), which are disintermediated platforms that facilitate the trading of virtual assets. Per DefiLlama, there are 649 separate DEXs with a combined $15.85 billion in reported TVL operating as of December 19, 2022;
- lending and borrowing services, which allow holders of virtual assets to earn a fixed or variable return on virtual assets by depositing them in a pool that simultaneously allows other participants to borrow those assets for other financial activity. Per DefiLlama, DeFi lending and borrowing platforms have TVL of $10.85 billion across 197 services as of December 19, 2022;
- decentralized mixers, which obfuscate the source, destination, or amount involved in virtual asset transactions;
- aggregators, which query a range of DeFi services to collate the best terms for a trade or other activity for users;
- cross-chain bridges, which facilitate network interoperability by allowing users to exchange virtual assets or information across blockchains;
- liquid staking, under which the platform accepts and stakes virtual assets for users and typically issues a “liquid staking derivative” virtual asset in exchange for the staked virtual asset; and
- algorithmic stablecoins, which maintain a stable value via protocols that provide for the increase or decrease of the supply of the stablecoin in response to changes in demand.
The assessment identified the following illicit finance threats related to DeFi:
- Money laundering. According to the assessment, ransomware actors, thieves, fraudsters and scammers, and drug traffickers use DeFi services to transfer and launder illicit proceeds. Examples cited in the assessment include:
- Silk Road wire fraud. On November 4, 2022, James Zhong pled guilty to committing wire fraud to unlawfully obtain Bitcoin valued at approximately $3 billion at the time of its seizure in 2021 from Silk Road, an online "darknet market"; and
- Mango Markets manipulation. In January 2023, the CFTC filed a civil enforcement action charging Avraham Eisenberg with a scheme to unlawfully obtain over $110 million in digital assets from Mango Markets, a purported decentralized digital asset exchange, through a price inflation scheme (see Legal Update, US Attorney's Office and CFTC File Charges in Scheme to Manipulate Token Prices on Decentralized Digital Asset Exchange).
- Proliferation finance. According to the assessment, in response to sanctions from the US and United Nations, the DPRK committed illicit activities designed to generate revenue for its unlawful weapons of mass destruction (WMD) and ballistic missile programs. An example cited in the assessment is:
- Tornado Cash money laundering. In November 2022, OFAC redesignated Tornado Cash under E.O. 13722 and E.O. 13694, as amended, for its role in enabling malicious cyber activities that support the DPRK’s WMD program. (see Legal Updates, Updated: OFAC Issues Sanctions Against Virtual Currency Mixer Tornado Cash and Updated: OFAC Issues FAQs Clarifying Sanctions Against Virtual Currency Mixer Tornado Cash).
The DeFi assessment will be used to identify and address gaps in the US AML/CFT regulatory, supervisory, and enforcement procedures for DeFi. The recommended actions are:
- Strengthening US AML/CFT regulatory supervision to increase compliance by virtual asset firms with Bank Secrecy Act (BSA) obligations (see Practice Notes, Bank Secrecy Act: Compliance Issues and US Anti-Money Laundering and Trade Sanctions Rules for Financial Institutions).
- Assess possible enhancements to the US AML/CFT DeFi regulatory regime, including closing identified gaps in the BSA that allow certain DeFi services to fall outside the scope of the BSA’s definition of financial institutions.
- Continue research and private sector engagement to support understanding of developments in DeFi.
- Continue collaborating with foreign partners bilaterally and multilaterally to close gaps in implementation of the international standards with regards to virtual assets and virtual asset service providers (VASPs). For example, the assessment notes that the US will press the Financial Action Task Force (FATF) for immediate implementation of FATF standards and advocate for FATF members to continue to monitor developments in DeFi (see Legal Update, FATF Targeted Update on Implementation of Standards on Virtual Assets and Virtual Asset Service Providers: June 2022).
- Advocate for real time analytics, monitoring, and rigorous testing of code to more efficiently identify vulnerabilities and respond to indicators of suspicious activity, and share information with virtual asset firms and the public about potential threats and mitigation measures that firms can take to improve defenses.
- Promote responsible innovation of mitigation measures.
The DeFi assessment qualified its findings by noting that:
- Most money laundering, terrorist financing, and proliferation financing as measured by volume and value of transactions occurs in fiat currency.
- DeFi is just one element of the virtual asset ecosystem.
The DeFi assessment includes a request for input from the public to inform next steps, including responses to the following questions (note no feedback deadline has been provided):
- What factors should be considered to determine whether a DeFi service is a financial institution under the BSA?
- How can the US government encourage the adoption of measures to mitigate illicit finance risks?
- The assessment finds that non-compliance by covered DeFi services with AML/CFT obligations may be partially attributable to a lack of understanding of how AML/CFT regulations apply to DeFi services. Are there additional recommendations for ways to clarify and remind DeFi services that fall under the BSA financial institution definition of their existing AML/CFT regulatory obligations?
- How can the US AML/CFT regulatory framework effectively mitigate the risks of DeFi services that currently fall outside of the BSA financial institution definition?
- How should AML/CFT obligations vary based on the different types of services offered by DeFi platforms?