Sanctions screening starts with effective KYC, says Refinitiv’s Neil Vaz, pointing to five “universal tools” crypto firms need to ensure compliance.
In recent weeks, more than 30 countries – led by the US, EU and UK – have imposed financial and economic sanctions against Russian and Belarusian entities and individuals. The sanctions are designed to ramp up pressure on Russia to end the Ukraine conflict.
Challenging as it may be to identify and mitigate their sanctions exposures each time a new list of designated entities and individuals is announced, banks and other financial institutions for the most part have policies, procedures and automated screening systems in place to streamline the process.
While this has not been the case for the crypto-asset sector, it is becoming increasingly clear what regulatory expectations are for crypto-asset services providers. The G7 has pledged to close “loopholes” that could enable sanctions evasion via crypto-assets.
Meanwhile, regulators from the US, Canada, the UK, Singapore and Japan – among others – have issued guidance setting out expectations for crypto-asset services providers to bolster their processes and controls to ensure sanctions compliance.
Blockchain analytics firm Elliptic recently said in a blog post that it has identified “several hundred thousand crypto addresses” linked to Russia-based sanctioned actors. But, given the unique characteristics of crypto-assets, effective sanctions screening requires more than simply matching wallet addresses.
The screening challenge
According to Neil Vaz, customer and digital identity risk specialist at Refinitiv, sanctions screening for a crypto-asset service provider starts with effective KYC at onboarding, as this is necessary to identify whether a customer is sanctioned or not.
But the challenge does not end there. The number of sanctioned individuals and entities globally has grown to more than 46,000 designations this year, up from about 19,000 in 2017. Yet, this does not include individuals and entities that may be implicitly sanctioned by way of a narrative statement accompanying a designation.
For example, under OFAC’s 50 Percent Rule, any entity that is at least 50 percent owned – either directly or indirectly – by a sanctioned entity or individual may also be implicitly sanctioned. A narrative statement can also extend a sanctions designation to the family members, associates and affiliates of a sanctioned individual.
“These ‘implicit’ sanctions make the task of screening a lot more difficult, because the sanctions order does not just tell you who the affiliates are,” Vaz says. “The onus lies on you, as someone who needs to comply with sanctions, to identify these relationships, which are often hidden.”
“When considering the global reach of sanctions regimes, unless you have in your team, people who speak Korean, Spanish, Farsi, Arabic, and you have access to ownership records globally, it’s very tough to actually identify who these implicitly sanctioned individuals or organisations are.”
Adding to the challenge is the frequent use of shell companies and nominee directors by sanctioned individuals and entities, and even sanctioned nation-states like Iran and North Korea, to avoid being identified as a designated entity.
To help the financial industry address these challenges, Refinitiv provides access to a database known as World-Check, which covers data on all sanctioned entities and individuals globally as well as millions of additional records firms can screen against to identify sanctions, regulatory, legal and reputational risks in their business activities.
Five universal tools
For crypto-asset service providers, Vaz says five “universal tools” are needed to ensure sanctions compliance:
- Sanctions screening tool: This should allow you to screen for both explicit sanctions and implicit sanctions, and include fuzzy logic capabilities to look for naming variations.
- Due diligence tool: This should allow you to identify the sources of funds and ultimate beneficial owners of customer entities to ensure you can detect any sanctions nexus.
- Authentication tool: This should help you to prevent document tampering and ID theft, which can often be used to conceal the identity of a transacting party.
- Cross chain analytics tool: This should enable you to gain visibility over money flows, to identify whether customers are receiving funds from potentially risky counterparties.
- Travel rule tool: This should enable you to streamline the collection and transmission of information about the originators and beneficiaries of transactions.
To help firms in the crypto sector comply with sanctions regulations, Refinitiv last month announced a partnership to integrate World-Check into a widely-used travel rule tool provided by Notabene. The collaboration enables crypto firms to perform sanctions screening on counterparties and automatically block crypto transactions being routed to sanctioned individuals.
According to Vaz, the biggest challenge in sanctions screening to date has been the high level of false positives. “The best tool you have against false positives is the collection of good quality data,” he says. “The customer’s name is not enough for sanction screening, or any AML screening for that matter.”
“You need to be able to collect things like date of birth, or nationality, and even gender to be able to reduce the false positive burden. Being able to collect that information, and then making sure the service you’re using has that information in the background – this will help you in your screening and offers the biggest fighting chance you have against false positives.”
To learn more about best practice AML compliance for cryptocurrency exchanges, register for this webinar on 19 April, featuring Malcolm Wright (GDF), George Oniwide (CoinJar), Mark Aruliah (Elliptic), Aravind Narayan (Refinitiv), and Che Sidanius (Refinitiv).