Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
The Future of Regulating Crypto
33 Plays2 months ago
Join The Future of Financial Crime Podcast as we delve into the world of crypto regulation with Kane Baguley, SOCnet’s Illicit Finance Policy Lead based in Latvia. Earlier this year, Kane explored the current landscape of regulating cryptocurrencies, focusing on Virtual Assets Service Providers (VASPs). Join us as we explore the challenges and potential solutions in navigating this complex and ever-changing space.
The Future of the Financial Crime Podcast is a production of Arctic Intelligence, an award-winning Regulatory Technology (RegTech) business that transforms financial crime risk assessments to help protect your business.
Recommended
Transcript
Introduction to The Future of Financial Crime
00:00:03
Speaker
This is the Future of Financial Crime, a production of Arctic Intelligence, a podcast takes a global perspective on financial crime compliance. religious one, recently a preacher saw in his own kind of coin linked to Christianity and used that to actually con inspiration. So you get people
Guest Introduction: Kane Bagley
00:00:19
Speaker
talking in all these different groups, but using the same version of some of these scams. Welcome to the Future of Financial Crime. My name is Kwame Slusher and I am your host on the podcast. And we have a special guest with us today. We have Kane Bagley, sock net illicit finance lead. Welcome to the podcast, Kane. Hi, Kwame. Thank you very much for having me.
00:00:37
Speaker
Kane's going to help us sort of gaze into the crystal ball and try to figure out what are some of the future financial crime threats and hopefully help us sort of develop a few ways of mitigating these challenges. But we're going to start easy. Tell us about yourself and your role.
Role in Global Illicit Finance Strategies
00:00:52
Speaker
Yeah, thank you. Yeah, definitely start easy. Okay. You mentioned illicit finance policy lead for Socknet. I'll start with Socknet. Fairly new idea within the UK. Started around five years ago. So effectively the yeah UK for many years has had lots of overseas offices from our National Crime Agency or HMRC, our Home Office International and and various other teams. But it was recognized about five years ago that a lot of the issues we have with illicit finance, with serious organized crime,
00:01:17
Speaker
a lot of those problems we can't arrest our ways out of. so Effectively, we need to look at some kind of slightly wider solutions. So my role and my colleagues' roles are to look at the policy, the strategy, the programmatic activity we can carry out in strategic jurisdictions around the world that have the greatest impact in reducing illicit finance and economic crime.
00:01:34
Speaker
So effectively, I'm based here in Riga, Latvia. I have quite
Regulatory Challenges in Crypto
00:01:37
Speaker
a wide portfolio working across the Baltics, Malta, Cyprus, and also doing a little bit of work in Georgia, Moldova. And in the future, our focus has started to change now towards Ukraine and helping helping them.
00:01:49
Speaker
So as you can imagine, lots of those countries have different regulation, different rules, different people involved, different legislation. So effectively I'm there to try and bring the best bits of that country systems back to the UK, but also to explore the best parts of the UK system, but also taking an international look and if, you know, some country far outside of my region, Asia, let's say, you know, has a great new initiative.
00:02:08
Speaker
Again, just being aware of a kind of wider kind of financial system and what we can do to kind of it you know as a collective to improve crime globally. Well, let's just set the scene for those who might not be familiar with that particular region. And you've mentioned quite a few jurisdictions there. What are some of the relevant regulators and legislation that you have to tackle with, especially with crypto?
EU's Mika Legislation Impact
00:02:27
Speaker
Especially with crypto, of course, yeah. So I think, yeah, regulation varies hugely. You know, regulators in the UK, I think we've got 26, 27. Similarly here in Latvia, there's around 10 AMR regulators. So there's lots of people involved, sometimes in very small areas. I think, like, you know, there might be regulators just for, say, gambling. But then there's also, you know, a large financial sector regulator for looking at, you know, traditionally banks. So this is all changing at the moment in the crypto space.
00:02:48
Speaker
So in the UK, previously, it was regulated by HMRC, which is kind of similar to what is in Latvia at the moment, where it's regulated by their state revenue service, their equivalent. But in the UK, that's recently moved to the Financial Conduct Authority, our main financial regulator. And in Latvia, and all of the other EU countries, when Mika comes into force at the end of this year, again, they'll all then be regulated by their main financial regulator. So wherever it regulates the banks, we have the same people that regulate the vast amount of exchanges and also the wider kind of crypto ecosystem, so things like stablecoins.
00:03:17
Speaker
So it's a really interesting time in those jurisdictions. Some of the ones outside of Europe are actually moving forward as well with very similar legislation. So I spoke with some colleagues from Georgia earlier this year, and they've already kind of brought in a Mika-like piece of legislation. So they're going through registration periods at the moment. Similarly, Ukraine has a bill before parliament that again will be bringing in a Mika-like system. So the EU has kind of started this framework in various countries around the world and certainly for countries that want to move towards the EU ascension.
00:03:44
Speaker
are suddenly looking at that. And the UK is currently looking at what to do with their legislation and also trying to learn, of course, a lot from Europe. Similarly, I know the US have been learning a lot from Europe and how they created Mika. So yeah, it's an interesting time for ah for crypto regulation with lots and lots of changes on the horizon.
00:04:00
Speaker
Yeah, sure. And so I guess that's a perfect example of of governments and regulators trying to sort of mitigate ah some of the risks that are coming into their financial systems.
Evolution of Crypto Risks
00:04:08
Speaker
But i I guess from your experience, how have you seen risks around crypto sort of evolve and sort of develop over the years? Yeah, so I think, you know, we still talk about crypto. Like it is it is brand new. You know, I'm here on a Future Financial Crime podcast talking about crypto, but it has been with us a long time. Yeah, we started, you know, Bitcoin started back in 2009 or so.
00:04:27
Speaker
So the fact that this has been with us a long time. So I think traditionally what we used to see at the beginning, certainly in the UK, which is where I was working until the last two and a half years. So the early days there, you know, it's a scary thing. No one you're working about it. There was no kind of like software like you have these days to kind of look at blockchain analytics. There was no people who, you know, had over training and over certifications. So we're worried about this, you know, this new Wild West money that people could use.
00:04:50
Speaker
2009, no one was using it. But you know, when it got to kind of 2017, we were still quite a bit behind in the regulation space and the law enforcement space. So it started off as this big scary thing that no one knew about. But as it developed, as companies began to be created, as the UK recognized this threat and other countries did, and started having training, started working with other countries, that kind of started to be corrected. I think sometimes it's still seen as a little bit scary. you know People who have been working with financial crime for 30, 40 years might be really, really comfortable looking through big bank statements or looking through companies' accounts or anything else, but still feel a bit scared about this crypto. So I think that's been an issue.
00:05:25
Speaker
I think, you know, early days, there was lots of issues around just a lack of regulation companies could effectively do what they want. A lot of the kind of virtual asset service providers were Basps. They were started as tech companies, not as finance companies. So they they themselves didn't understand some of the risks around there. And there was, you know, various issues with ah hacking and scamming to the extent they don't really see now there's big players in the market.
00:05:45
Speaker
So yes, I think they were kind of some of the early issues we saw.
Jurisdictional Movement of Crypto Services
00:05:47
Speaker
As it's now developed, we see kind of jurisdiction hopping. So in the EU, as I say, there is going to be this big overall legislation soon. But before then, we have seen people jumping around looking for effectively, you know, low speculatory jurisdictions. So in my region, we saw Estonia in kind of 2017, and have a huge number of Basps, I think around half of all Basps in the world, it was around 2000, just over.
00:06:07
Speaker
and Now they've got like 50 or so, and all those that have moved, some of those will have closed, but a lot of them started to move around Europe. So a lot went down to Lithuania, a lot went across to Poland, and similarly as Lithuania brought in stronger regulations, more went to Poland. Now I think of EU, there's meant to be around 9,000 in the Czech Republic. So again, they're kind of bouncing jurisdiction to jurisdiction. The new regulation should end that because it would the same in the EU, so until you're established in one country, why why move unless you've got business reasons to do so? But we are now worried about where they're going to go next. So are they going to jump to a non-EU jurisdiction? And what does that mean then? Because if you've got them inside your jurisdiction, you know it's very easy to kind of manage that relationship and get information. But if they're registered in a very lax jurisdiction elsewhere, they may not even recognise your country's court orders or provide documents or kind of assist you with any investigations. So I think that's the hard part.
00:06:54
Speaker
I think on the public side, you know people have grown more comfortable using crypto. you know Adoption has really spread in the UK, in the U of S, in Europe. and But people are still sometimes a little bit unsure about when they're managing their own crypto, managing their own keys. So you know there have been certainly an increase in fraud, an increase in scams. It's still happening. There are kind of ripples still where people are setting up crypto coins, promising people to get rich, and then you know nothing happens. And they take all forms. There's a religious one recently, a preacher, started his own kind of coin linked to Christianity and use that to effectively con inspiration. So you get people to hosting all these different groups, but using the same version of some of these scams. And I think then also asset recovery is a huge focus of UK government at the moment, both at home and overseas. We changed our regulation at the end of 23.
00:07:40
Speaker
to effectively and make it easier for us to seize and freeze cryptocurrencies because effectively before you were searching a house and you came across like a seed race like 26 random words written on a piece of paper you couldn't necessarily take that recreate the wallet and then transfer the cryptocurrency to a law enforcement wallet but now as of the very beginning of this month you are able to do it you are able to do that so yeah lots of changes but new risks always coming along we're seeing you know crypto companies and people criminals who use crypto are very very technically a adapt very aware know what they're doing. So there's still issues with our privacy coins, which aren't able to be tracked in the same way that, say, Bitcoin is. And there are still issues with some companies as well who are doing offering almost like gambling services via crypto, where you've got huge amounts of leverage, you've got options trading. And even you know if those countries that don't have gambling, they might open up crypto casinos. So you can, again, kind of gamble offshore effectively. So yeah, seeps into so many different areas of industry, and different industries. It's ah yeah a really interesting problem.
00:08:39
Speaker
I guess it's a tricky one. I was going to ask you, you know, what, you know, what has been the response to mitigating the risk? But it sounds like, you know, attempting to sort of strengthen that regulation, having that sort of European-wide regulation and hopefully reaching a point where there's not such uneven regulation globally um should help sort of stimulate their ability to move to a ah jurisdiction with lower challenges. I guess the question really is, what what's been going right then in that space? What have you seen?
00:09:06
Speaker
countries, maybe even businesses doing the right way instead of trying to deal with that. Yeah,
Blockchain Intelligence in Risk Assessment
00:09:11
Speaker
so I think now most virtual service providers and most governments will all have access to kind of what we call kind of like blockchain intelligence tools, which effectively allows you to see where a lot of that cryptocurrency has come from. So you can see very easily, oh, this has been brought from a regulated exchange in our jurisdiction, and it's coming into you know and it's been sold in other regulated exchanges and it's coming into the main kind of financial system. So you won't have any concerns with that kind of transaction. This is very high value. You may want to do some further checks, but really, you know it's come through with fairly legit method.
00:09:40
Speaker
Or you might say, oh, well, this is actually being brought through cash, or this has been brought through a crypto provider who it goes through cash. So then you might say, well, why is someone buying cryptocurrency with cash? That seems a little bit odd. Maybe that's something I want to look into further, or maybe they're just you know privacy advocates and really, really don't want kind of a government looking at what they're doing, which, of course, isn't a crime. It's absolutely fine.
00:09:59
Speaker
Or you might say, oh, though this actually has been linked with a scam, or this has been linked with, effectively, the money washing kind of tools that they have, where they put in huge amounts of Bitcoin, from more different people, all kind of launders together, comes back out like there's a famous one called tornado cash that the US shut down. So yeah, you'll have different levels of indicators and different levels of red flags when you look at those tools. So that'll give you a really quick and easy kind of look at what you're seeing there. But then again, if you're a law enforcement official, or if you're working in banking,
00:10:23
Speaker
you've been doing your traditional kind of risk-based approach in banking and saying, okay, well, what is our leverage of crypto? How much do we want to accept? How much of this do we want to like onboard or offboard? I remember when I first kind of broke some crypto in kind of 2013, you couldn't use your bank code or you couldn't use your bank account in the UK to buy that, even though I was buying from from Coinbase, who were already you know quite a big player by then. So it all had to be done through kind of like PayPal and, you know, electric money to shoot in this quite convoluted way. Whereas now you can go onto any big kind of crypto provider, connect your bank account, connect your card.
00:10:53
Speaker
I think that makes it easier for the general person as well. They understand those technologies, and then they understand if if these crypto companies are in effectively a jurisdiction they trust, if they're in their home jurisdiction, maybe if they're you know in the UK, they say, okay, well, these are actually approved by the FCA, which is you a small list of companies, about 45, 46. So it is quite a high level of trust that that then gives. So I think we see that we see that changing, but I think some of these new areas that are kind of branching into is still really difficult. I think no real major exchanges that work with traditional financial institutions even want to host things like privacy coins because they know that they're risking effectively being cut off from banking. They're hosting and then converting to fiat currency, things like privacy enhancing coins because they are seeing traditionally has been used in criminality. Well, of course, it's not their only use. Yeah, sure.
00:11:34
Speaker
And I guess what in discussing that and what's been going right in that sort of space, what, are there any mistakes you're afraid that people might be making as, as we go forward? Is there
VASPs and Regulatory Influence
00:11:45
Speaker
any sort of red flags, things that people aren't discussing as yet? Well, I think one of the reasons why countries have been quite easily able to bring in really strict regulations on VASPs about much pushback is they haven't been huge economic players. So even if you're like, it'd be a Sony case. I mentioned that they had two and a half hours and.
00:12:01
Speaker
good to come and see companies with virtual service providers, but they weren't providing jobs or certainly not a huge number of jobs. They weren't providing tax for the country or certainly again, not a huge amount. So these are all very, very small, very scrappy companies with you know one, two, a handful of employees and almost no profit.
00:12:18
Speaker
So it's very very easy to take action against those kind of companies. But, you know, last year, if VAS was the fourth biggest taxpayer in Lithuania, I think second biggest when you take off state companies. So and that gives that vast a huge amount of power if they're paying that much tax into a country, you're not necessarily going to want to bring in regulations and in the same way, essentially. So I think it's good that the regulations coming in now. And it's important time to do that before they do.
00:12:38
Speaker
become bigger and bigger. And they have become big lobbyists as well. you know There are lobbyists for the big companies. and They are gaining more and more power. And the traditional financial system has always had that. So it's not necessarily a problem. But yeah, we need to be careful about how that affects kind of legislation and how that affects regulation and how we bring that in. So I think that is kind of coming in at the right time. And it's going well. And there's been lots of public consultations and you know involving them to the public who haven't used cryptocurrencies, ah involving the vasps, involving others, and kind of making this a real partnership.
00:13:05
Speaker
between industry, the public government there too. So yeah, I think that's a really good approach. I think wider red flags that people aren't necessarily aware of. Yeah, I think one of the problems is as more and more banks sometimes don't want to open accounts with small crypto companies, because again, it's not really profitable with a bank. They're offering a lot of services, but it's not necessarily making them any money. So more and more banks maybe say no to cryptocurrency companies, and that forces them into the hands of kind of payment service providers, ESPs, and electronic money issues, EMI's.
00:13:30
Speaker
and sometimes they themselves have a much higher risk threshold and much less kind of much smaller compliance departments. So then you're kind of factoring kind of a risk by having you know maybe potentially quite a risky task but we can acquire a risky PSP and then getting into additional financial system. and But again let's go with someone else behind that so I think that's something that we need to look at.
00:13:46
Speaker
and something that there can be an issue with. I think publishing kind of license then refused licenses is really good. As in the UK on the FCA website you can immediately look at kind of the 45 or so companies that have a license and you can also look at the ones that have actually been refused licenses. Some countries have that, some countries don't. I think that's a really really important thing that more people need to have when you know transparency in this field is really important. and and We have a big issue with reversal solicitation. and So effectively to offer crypto services in the UK, you don't have to be based in the UK. So you could be based in a really large jurisdiction, but then it works through the way that the customer has to effectively come to you. So if I'm based in an offshore jurisdiction, I can't be kind of highly advertising on UK TV.
00:14:26
Speaker
I'm talking to UK people online to bring them to my unregistered in the UK service. But if I'm someone in the UK who wants to get crypto and maybe doesn't want too many checks done, I can go to people in offshore jurisdictions and without anything necessarily coming through to the UK. So that's the issues with that. But again, as you say, we need a global approach. You know, Bifatif has started looking at this and they've brought out a recommendation linked to VASPs. But arguably, some people say they're trying to attach traditional financial monitoring to crypto monitoring. It is very different because you traditional financial monitoring the bank is going to know if I send you some money for a bank, they're going to know it's coming from me, it's going to you, the amount, how it's been sent and and all those details using the blockchain. and You can see that someone has sent some amount of money to someone else and everyone can see exactly what that amount of money is and what those addresses are, but they're not publicly attributable.
00:15:11
Speaker
Now there are ways that various companies and governments try and attribute that, but it's not perfect. So I think they're very different kind of systems and do need to be treated probably slightly more differently than they are. And I think one of the final issues on this point is around money laundering reporting offices, MLROs. So there is some jurisdictions where there's huge amounts of crypto companies, huge amounts of VASPs, but they've not effectively got enough MRLOs within their jurisdiction. So they were trying to track them from overseas. But one of the stories I heard fairly recently was that there's a bunch of MRLOs in one jurisdiction where effectively people are working part-time, they're students, they're doing four hours a week as an MRLO for a BASP, and effectively that means they're the ones that are on the line potentially, legally, if there was such a big money laundering issue at that BASP, and can they do their job effectively when they're, you know, a 19, 20 year old student doing that job four hours a week when that BASP may be managing tens of millions or even more.
00:16:01
Speaker
So I think that's kind of really really concerning development. And I can see why the companies do it. And we've still got this issue where where you know are they a tech company or are they a finance company? And corporate culture you know in the banks and our compliance, corporate culture comes down from the top. And we need to see that from CEO ceo level down to have an effect. But if the person who's self-abassed is kind of a bit more of a a tech-broke kind of vibe and against regulation in general, how can ah m MRLO air work effectively in that company without just being seen as kind of a bit of an outsider?
00:16:28
Speaker
Well, we're down to the end of the podcast. Any advice for financial crime professionals, businesses, those even working in the regulatory space, you know, who are trying to looking at this crypto issue? um you've You've already brought out the red flags and even some solutions to those red flags, which is really good. You've made this easy. But yeah, is there anything else you want to mention that would help people sort of get through in this space?
00:16:48
Speaker
no I think people just really need to understand that you know we talk about the way crypto a lot, but there's so much that falls under that. There isn't an obvious, this is what we mean by crypto. We talked a lot today about the VASPs, which are service providers, but there's many other people in both. There's liquidity providers as well. There's also kind of you know the banks themselves working with those. There's decentralized finance. There's things like NFTs, which don't fall into some of the new regulations, and these things go up and down in waves.
00:17:12
Speaker
So I think really understanding these risks is really important. It's such a wide industry. And just having, say, if you're working in a in a large bank, just having one risk category for VASPs or one risk category for crypto just isn't enough because it is very hugely. And I don't think they do do that. There's no no implication there. But I think you a deep understanding of when the team is needed.
00:17:29
Speaker
and I think when you're you know if you are a financial institute or a country and you're looking for support in this area, but you can be really careful as well. There's a lot of people out there now who kind of promote themselves as crypto experts, and some of those I've worked with are absolutely fantastic and are true, true experts and I've learned a lot from. but Some of them are kind of slightly snake oil salesmen, aren't really experts, but know a little bit.
00:17:49
Speaker
and then they don't kind of really have the impact you need them to have. So I think that's a really risky area at the moment for governments, for industry, for banks, and for rather financial institutions. So now that's the only bit of advice I'd give to take away. If anyone
Organizational Strategies Against Financial Crime
00:18:01
Speaker
wants to reach out and discuss further, you can find me on LinkedIn. But no, thank you very much for giving me the opportunity to speak today. Really appreciate it.
00:18:09
Speaker
Yeah, before I let you run away, there's no chance there's some kind of registry where we can find who's an expert from who's not an expert, is there? I wish, I wish. Unfortunately, not as always in this field, it is kind of hard. You need your own little expert, you know, if a big expert knows enough really. So I know, i you know, I'm not a major expert, but I know enough to be able to root out the good experts from the bad.
00:18:30
Speaker
and But if you haven't even got that understanding at the beginning, yeah, it can be ah it can be really difficult. So again, bringing this talent in or training up your own people with you know some of the big providers is a really good start to get someone who's got at least a really base level knowledge to really round out your organization and then be able to see whatever you need to improve in and then kind of check the experts as it were. Sure. Well, thank you so much for your time, Kane. No, thank you, Kwame. I really enjoyed it. Thank you.
00:18:54
Speaker
This has been a production of Arctic Intelligence. And the music is a production by Royalty Free Music.