Chapter 6
Anti-money laundering and counter-terrorism financing regime
6.1
The Attorney-General's Department is currently conducting a statutory
review of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006
(AML/CTF Act) which is considering the emergence of digital currencies and
whether they should be brought within Australia's AML/CTF regime.[1]
6.2
In this chapter, the committee considers whether digital currencies should
be brought within the AML/CTF regime.
The relationship between digital currency businesses and banking services
6.3
A number of concerns were raised by digital currency businesses about
access to banking services. One submitter, whose company was considering
relocating its business overseas, in part because digital currencies are not
regulated under the AML/CTF Act, noted that Australian banks had 'uniformly
turned down any involvement with our company, citing the regulatory restraints
imposed by the Australian government'.[2]
6.4
The Bitcoin Foundation and Bitcoin Association of Australia expressed
concerns regarding the banking industry's approach to digital currencies. They
noted:
The issue of access to banking services is also key to the
growth of a local digital currency industry. Blanket classification of all
bitcoin businesses and users as 'high risk' customers is both inappropriate and
disproportionate.
Banking institutions should have a risk-based approach that
is 'tailored to the nature, size and complexity of their business and
proportionate to the level of money laundering and terrorism financing risk'.[3]
6.5
The Melbourne Bitcoin Technology Center noted that its members had
indicated that many individuals and businesses had experienced discrimination
and refusal of service by Australian banks. It proposed legislation to make it
an offence for banks to discriminate against a customer on the basis that they
are trading or transacting in Bitcoin.[4]
6.6
mHITs Limited, an Australian-based mobile money service company, was
concerned that some banks and payment industry members were overstating the
risks and downplaying the opportunities that digital currencies represent.[5] It stated:
By definition new and emerging fintech startups including
mHITs represent a potential threat to the status quo. In our 10 years of
operation, we have observed the reluctance of Australian banks to embrace
innovation outside the comfort of core business products of lending, cards and
insurance.[6]
6.7
ASIC's submission noted that it was 'aware of a number of banks taking
steps to cease dealing with Bitcoin related businesses due to concerns that
digital currency providers pose an unacceptable level of risk to the banks'
business and reputation'. ASIC advised that it 'does not have any power to
intervene in decisions made by businesses in relation to digital currencies,
and considers that this is a matter for the banks and businesses involved'.[7]
6.8
Mr Bezzi, from the ACCC, advised the committee that he was aware
of one case in the ACCC's records where a company involved in digital currency
transactions had had its accounts closed by a bank, because the business that
the company was involved in was not consistent with the bank's policies. Mr
Bezzi noted that the ACCC's view is that 'it is up to banks to determine who
they want to have as their customers'. He noted further that the ACCC had no
evidence of collusion between banks on the issue of providing banking services
to digital currency businesses.[8]
6.9
Mr Miller, Bit Trade Australia, explained why his business complies with
regulations that do not currently cover digital currencies:
We are dependent on our banking relationships. We have worked
closely with them to achieve a level of comfort for them because we require the
ability to bank in the Australian banking sector. We have mirrored their safe
harbour practices. We will require you to provide photo ID. We will require you
to provide proof of current residential address and date of birth.[9]
6.10
Dr Carmody, Westpac, was supportive of the approach by ADCCA to develop
best practices for digital currency businesses that replicate, as far as they are
able, the same sorts of safe-harbour obligations that would apply to a bank or
to a foreign exchange broker. In his view, this approach assists banks comply
with their obligations. He suggested that perhaps the 'sorts of businesses that
have been unable to get access to banking accounts are those that have been
unable to demonstrate that they are doing that level of due diligence'.[10]
He noted that these best practices were not in place when digital currency
businesses were first opening up in Australia. He remarked that in the 'early
days' the only thing that a customer may have been required to provide in order
to purchase Bitcoin was a Bitcoin wallet address and an email address, which
did not necessarily identify the customer. He noted:
In that scenario, it is fair to say that there is not a whole
lot of know-your-customer going on. A business operating like that would
present a real challenge for a bank to provide banking services to because they
cannot get satisfied that the underlying business is understood. I think there
has been a lot of work from a number of businesses to try and move well beyond
that and do the appropriate level of due diligence, which is something we would
certainly support.[11]
6.11
Dr Carmody further explained that he supported digital currency businesses
coming under the AML/CTF regime. He noted:
From the point of view of a bank that is providing banking
services, if we cannot satisfy ourselves that we can do all the things that we
have to do under the legislation to understand the nature of the transactions
and what is going on there, it puts us in a very difficult position to be able
to provide those banking services. The issues are particularly intense when it
comes to moving payments internationally, because obviously we have counterpart
banks to deal with globally and they have got their own anti-money-laundering,
counter-terrorism-finance obligations, and they will expect us to understand
the nature of the payments as well.[12]
6.12
PayPal explained that it had chosen to partner with BitPay, Coinbase and
GoCoin as all three companies had taken steps to develop anti-money laundering
programs and to ensure they know their customers. PayPal noted that it was
proceeding gradually in its approach to digital currencies, so it could ensure that
while embracing innovation it remained committed to making payments safer and
more reliable for customers. PayPal noted that while all users of PayPal were
linked to a specific named PayPal account, with consumer protection for buyers,
these standards were not currently required for payments using Bitcoin.[13]
6.13
The ABA noted that banks and other participants that operate within the
regulated payments systems have made significant investments in processes and
technologies in order to meet their requirements under the AML/CTF regime. As
digital currency does not currently come under this regime they are not required
to meet these standards and operational requirements.[14]
MasterCard maintained that any regulation should include 'obligations to
perform KYC [know your customer], maintain an Anti-Money-Laundering and Counter
Terrorist Financing program, file suspicious activity reports, and address
cybersecurity.[15]
6.14
Dr Carmody, Westpac, noted that digital currency intermediaries are
providing similar services to businesses that are regulated under the AML/CTF
regime. He observed:
I would see a very close analogy between the business a
foreign exchange broker is carrying on, and a company that is in the business
of buying and selling Bitcoin for cash. It is just that under the definitions
of the current AML framework foreign currency broking is included as a
designated service but Bitcoin broking is not.[16]
6.15
In its submission the Attorney-General's Department noted that the ABA
and the Australian Financial Conference (AFC) had made submissions to the
statutory review of the AML/CTF Act. Both the ABA and the AFC expressed concern
that financial institutions were being placed in a vulnerable position when
offering designated services to digital currency businesses, and recommended
that trading in digital currencies should be listed as a designated service
under the AML/CTF Act.[17]
The ABA also recommended that the statutory review consider whether all digital
currency payments mechanisms should be brought under the AML/CTF regime.[18]
Know your customer programs
6.16
Under the AML/CTF regime, businesses must ensure that they know their
customers and understand their customers' financial activities. Under the
AML/CTF business must monitor transactions and collect and verify customer
identification information—for example, documents, data or other information
obtained from a reliable and independent source. The 'know your customer' (KYC)
and customer due diligence processes increase the ability of businesses to
better identify and mitigate money laundering and terrorism financing risks in
the conduct of their transactions.[19]
6.17
Dr Carmody explained the advantages of digital currencies coming under the
AML/CTF regime, in relation to know your customer requirements:
There was an example given about a bitcoin broker who might
have had a bank account with the Commonwealth Bank. If a cash payment came in
then the bank would know, presumably, with the purchase of bitcoin. That is
about all we would know. That is why there are a lot of advantages in the
know-your-customer and due-diligence obligations also sitting with the broker,
because the broker who has facilitated that purchase for the customer would
also know, for example the wallet address that the customer used. Where they
received that bitcoin that is not something the bank would know. If that did
prove to be associated with suspicious activity, that would then be something
that could be provided under requests from law-enforcement authorities.
I think the phrase that has been used in some of the previous
inquiries is on-ramps and off-ramps. It is very much that. If you are relying
on trying to get visibility of the on-ramps and off-ramps only, through the
bank part of the transaction, you do not really see that linkage to the bitcoin
wallet. I know Bit Trade and others like them are endeavouring to put that same
sort of know-your-customer monitoring within their activities as well. That
makes a lot of sense.[20]
Document Verification Service
6.18
Veda expressed concern that the current lack of regulatory certainty
meant that digital currency businesses have limited access to identity
verification services. Veda noted that access to the best identity verification
sources—the electoral roll, Document Verification Service (DVS), and credit
reporting information— is restricted to those entities verifying identity for
an AML/CTF purpose.[21]
6.19
The Attorney-General's Department manages the DVS. It is a secure,
real-time on-line, electronic document verification system. Identity documents
that can be verified using the DVS include: birth, marriage and change of name
certificates; citizenship certificates; drivers' licences; Medicare cards;
passports; and visas.[22]
In order to access the DVS, organisations must meet strict eligibility criteria
and abide by the terms and conditions of use, including having an approved
reason for using the DVS, obtaining client consent and information and
communications technology security.[23]
The current access rules for the DVS require an applicant to cite a
Commonwealth legislated requirement, such as the AML/CTF Act.[24]
6.20
Mr Miller, Bit Trade Australia, advised the committee that as they do
not have access to the DVS at this point in time, in order to verify documents
his business has to 'go to each of the individual document providers—for
example, driver's licence from each state'.[25]
He explained that they currently use a service provider to verify identities. However,
without access to the DVS, 'the information is patchy' and when information
cannot be verified electronically his business has to verify it manually. Mr Miller
stated that as his business is already paying for access to a service which is
suboptimal, it would happy to pay for access to the DVS.[26]
6.21
ADCCA maintained that digital currency businesses should be given access
to the DVS in order to better facilitate KYC practices.[27]
The AML/CTF regime
6.22
Mr Mossop, Attorney-General's Department, noted that when the AML/CTF
regime came into force in 2006, e-currency was covered as it was backed by
bullion or backed by fiat currency, but digital currencies are backed by
mathematically based formulas. He stated:
First and foremost, digital currency and cryptocurrencies
have evolved in a way that is not currently covered by Australia's
anti-money-laundering regime. That is an issue for us in that, at the time the
act was drafted, we did not really think about these types of currencies.[28]
6.23
Mr Mossop noted one of the difficulties with digital currencies is peer-to-peer
transfers as it means transactions using digital currencies can be made
directly to people anywhere in the world. He explained that this creates a
particular challenge when working out how to regulate digital currencies:
While we might have some visibility of the on-ramps and
off-ramps in the places where they intersect directly with the financial
sector, short of having everybody who has a bitcoin and makes a transaction
report to AUSTRAC, it is going to be very difficult to find a point where all
those transactions are co-located in a way they can be reported.
So that is a big challenge for us, because we are going to
lose visibility of how these bitcoins move around once they are inside the
bitcoin system. We can see people buying them, we can see people selling them
to a large extent, but we lose visibility of what happens within the system.[29]
6.24
Mr Mossop explained that there was still work to do to determine exactly
which digital currency businesses should be brought under the AML/CTF regime.[30]
Internationally, countries such as Canada, Singapore and the UK have decided to
bring digital currency exchanges under their equivalent AML/CTF regimes. Mr Mossop
noted that one of the considerations in the statutory review is how to define
digital currency exchanges, and whether they should be defined as businesses
that buy and sell digital currency, or if the definition should also include
businesses that facilitate peer-to-peer exchanges, such as Bitcoin ATMs.[31]
Finding the right balance
6.25
Mr Mossop explained that an additional challenge was figuring out how to
regulate digital currencies without stifling the growth of the industry.
Regulators need to find a balance between trying to mitigate risks while
allowing the more positive uses of digital currency to develop.[32]
6.26
DFAT was concerned about the application of AML/CTF regulations
worldwide on small-value transactions that are predominantly made by people in
poverty. Ms Rebecca Bryant, DFAT, explained that these small-value transaction
are being made by:
...itinerant workers who want to send money across specific
corridors home to family and friends. In many instances they are unable to do
that because they cannot show adequate identification. It is worse than that in
a sense, because even people with identification today are having trouble
transferring money across corridors that are considered risky.[33]
6.27
Ms Bryant, raised concerns that this would lead to people using
black-market providers, outside the regulatory framework:
And that is the danger: the more money you push into those
corridors the less transparency you have. You do not know how much it is. You
do not know who it is being transferred from and to. So, if money is pushed out
of the formal system—I am not suggesting that it is excessive regulation—you
will not see it. You cannot see it; you do not know where it is going. And that
is the real concern.[34]
6.28
The Justice and International Mission Unit, Synod of Victoria and
Tasmania, Uniting Church of Australia supported the regulation of digital
currencies under the AML/CTF regime to ensure they are not used for serious
criminal activities. It also noted potential benefits for financial inclusion.
It noted that the FATF is an intergovernmental body that develops and promotes
policies to protect the global financial system against money laundering and
terrorism financing. In particular, the FATF aims to support countries and
financial institutions in designing AML/CFT measures that meet the national
goal of financial inclusion, without compromising the measures that exist for
the purpose of combating crime. It noted that:
FATF has stated that it recognises that applying an overly
cautious response to AML/CFT safeguards can have the unintended consequence of
excluding legitimate businesses and consumers from the financial system,
thereby compelling them to use services that are not subject to regulatory and
supervisory oversight. They argue the AML/CFT controls must not inhibit access
to formal financial services for financially excluded and unbanked persons. The
FATF recognises that financial exclusion could undermine the effectiveness [of]
an AML/CFT regime. Hence, financial inclusion and AML/CFT should be seen as
serving complementary objectives.[35]
Legislative changes
6.29
AUSTRAC advised that in order to cover digital currency in the AML/CTF
regime, it would be necessary to change the Act not just the regulations.[36]
Ms Jane Atkins, AUSTRAC, explained that although designated services
can be added to the AML/CTF Act by regulation there would be other more complex
consequential changes to be made if the decision was made to cover digital
currencies. 'Obviously, the [statutory] review is the logical place to be
looking at that and looking at what needs to be done'.[37]
6.30
AUSTRAC recognised that digital currency may pose a potential risk in
the future, noting 'but right now we are not seeing that there is the sort of
risk that has us saying to government, "It is imperative that you give us
sight over this'''.[38]
Ms Atkins, AUSTRAC, outlined the requirements for designated services under the
AML/CTF regime:
The sort of obligations in our act then are for them to have
an anti-money laundering and counter-terrorism financing program, which means
that they need to assess the risks of money laundering for their customers and
the types of transactions that they are dealing with. They have to have a
program in place to mitigate those risks. They have to carry out know your
customer procedures with their customers. They have to have ongoing due
diligence programs around watching whether their customers risk is going up and
down and whether they need to do more than they have done before.
They need transaction monitoring systems so that they can
report whatever equivalent—perhaps you would have an equivalent of $10,000
digital currency. You might have a report about that and you might have a
report where they were transmitting internationally, as we talked about. If
they are going to transact in the same way as what we would call remittance
providers transact, then there would seem to be at the moment—off the top of my
head—no policy reason why you would not cover them in the same way. We would
certainly want suspicious matter reporting.[39]
6.31
Mr Mossop, Attorney-General's Department, noted that the pace of
innovation makes it difficult to anticipate where the technology will go and
where it will lead. 'We need to regulate in a way that prevents having to come
back and regulate again in a relatively short amount of time for a new product
that comes out'.[40]
6.32
ADCCA outlined the views of Australian digital currency businesses. It
stated:
In Australia the vast majority of Digital Currency businesses
and users are law-abiding and desire the enhanced legitimacy of appropriate
legal oversight and recognition. Incorporating Digital Currency into law
enforcement legislation, particularly through the Anti-Money Laundering and
Counter-Terrorism Financing Act 2006, is a necessary step toward
guaranteeing the security and legitimacy of Digital Currencies in Australia.[41]
6.33
Bitcoin Group Limited stated that it fully anticipates the 'costs
associated with being subject to compliance protocols and the likelihood of the
obligations from national laws requiring access to our records and compelling
our company to actively monitor and proactively report suspicious transaction
activity'.[42]
6.34
Given that digital currencies are a global phenomenon, the
Attorney-General's Department emphasised the importance of ongoing
international cooperation through forums such as the Financial Action Task
Force. It argued international cooperation was essential to developing a
consistent international approach to regulation to avoid the risk of regulatory
arbitrage, where businesses take advantage of more favourable regulations in
other jurisdictions.[43]
Committee view
6.35
In order to help manage relationships with banking services and be
prepared for future regulation, some digital currency businesses have tried to
mirror the obligations that are required by designated services under the
AML/CTF regime, such as implementing know your customer programs. However, the
AML/CTF Act currently does not cover digital currencies that are not backed by
precious metal or bullion.[44]
Consequently, digital currency businesses are not able to access the Document
Verification Service which would better facilitate identity checking to meet
AML/CTF requirements. Furthermore, they currently stand outside this robust
regulatory regime designed to detect and deter money laundering and terrorism financing.
6.36
The committee strongly supports applying AML/CTF regulation to digital
currency exchanges, noting that similar steps have been taken in Canada, the UK
and Singapore. The committee notes that the Attorney-General's Department is
currently conducting a statutory review of the AML/CTF Act which is examining
whether digital currency businesses should be brought under the AML/CTF regime,
and if so which businesses should be included.
Recommendation 4
6.37
The committee recommends that the statutory review considers
applying AML/CTF regulations to digital currency exchanges.
Senator
Sam Dastyari
Chair
Navigation: Previous Page | Contents | Next Page