An introduction to

cryptoasset compliance
for commercial banks
Elisabete Botinas
Novo Banco - May 21st, 2021
“To revenge crime is important, but to prevent it is more so.”

2
0. Who we are and what is Instituto New Economy?

3
Clear, independent thinking
for the new digital economy

Collaborative Defending new technology

association as a public good

4
Clear, independent thinking
for the new digital economy

Collaborative association Defending new technology as a public good

• Industry leaders, professionals and citizens who wish to • We host educational events, publish research papers and
increase Portugal’s global standing and its participation in form committees for best practices and ethical
the digital economy. considerations for new and emerging technologies.

• We believe Portugal is at a crossroads in history where • We aim to promote a balance between risk-based
blockchain technology and cryptoassets are radically supervision and innovation, without stifling emergent
impacting our competitiveness in the global economy. technologies that are at the forefront of the new economy.

5
Get in touch with us
through our website

https://neweconomy.institute

[email protected]

6
Executive
summary
1. Some context about my experience in traditional financial institutions and crypto fintech
1. From branch manager to chief compliance officer

2. How can banks protect themselves when dealing with cryptoassets, directly and indirectly
1. Defining cryptoassets according to regulation
2. Cryptoassets and the traditional financial system
3. How can banks safely deal with cryptoassets

3. An overview of the KYC & AML processes used by the top exchanges and compliance software tools
1. Coinbase, Kraken, Bitstamp & Gemini
2. Elliptic
3. Chainalysis
4. TRM Labs
5. CipherTrace

7
1. Some context about my professional experience

8
The first eight years of my career revolved around
operations and business development for traditional banks

Branch Management & Operations Corporate Accounts & Trade Finance

9
After that, I’ve dedicated the last
ten years to all things compliance

Compliance Management Chief Compliance Officer

10
I’ve joined Uphold in 2014 to help the fully reserved, multi-asset
platform implement its compliance programs and best practices

11
In 2021, I’ve joined FinClusive, also as Chief Compliance Officer,
to help develop our Compliance as a Service offering

12
2. How can banks protect themselves from cryptoassets

13
2.1. Key definitions for today

14
 Before we begin, let’s define what we’re talking about,
noting these terms are fairly interchangeable

Cryptoassets Virtual Assets

• “A virtual asset is a digital representation of value that

can be digitally traded, or transferred, and can be used
• “Cryptoassets are a type of digital asset that depends
for payment or investment purposes”.
primarily on cryptography and distributed ledger or
similar technology (e.g. blockchain) as part of their
perceived or inherent value”. • “Virtual assets do not include digital representations of
fiat currencies, securities and other financial assets that
are already covered elsewhere by FATF”.

Note: Some key institutions, such as the Financial Stability Board and Bank for International Settlements, use cryptoassets, whereas others, such as FATF and Banco de Portugal, use virtual assets.
Cryptoasset is a superior definition, as many virtual assets (e.g. in-game currencies) aren’t related to the topic at hand, but they mostly overlap.

Source: Financial Action Task Force, Financial Stability Board 15

 From a theoretical perspective, cryptoassets started as
consumable/transformable assets, but are now its own superclass

Source: A General Taxonomy for Cryptographic Assets - Brave New Coin, 2018 16
 The taxonomy isn’t ever-evolving, but it shows the diversity of
applications and use-cases stemming from cryptoasset innovation

Source: A General Taxonomy for Cryptographic Assets - Brave New Coin, 2018 17
 Crypotassets are overwhelming, but they
are also also the present and the future of finance

Source: Deutsche Bank, 2018 18

2.2. Cryptoassets and the traditional financial system

19
 Over the past few years, all kinds of financial institutions have
forayed into the cryptoasset world, mostly by investing in startups

Source: CB Insights, 2018 20

 More recently, major public companies and international
watchdogs started to actively engage with cryptoassets

Source: Michael Morell et al, 2021 21

As the market matures and regulators catch-up, more and more
players are joining the space as “virtual asset service providers”

22
 Even if recently most of these banks claimed they
weren’t interested in offering crypto investing services

Source: Cornerstone Advisors survey of 260 community-based financial institution executives, 2020 23
 This change of mind is tied up to the fact customers
still show large interest in this new, exciting asset class

Source: Cornerstone Advisors survey of 260 community-based financial institution executives, 2020 24
2.3. How can banks safely deal with cryptoassets then?

25
Banks can deal with cryptoassets in two more or less direct ways: 1) by
accepting customers who deal with cryptoassets in other venues
Being friendly with business customers Being friendly with customers who interact
which operate with cryptoassets with cryptoasset exchanges

26
Or 2) simply by directly offering cryptoasset-related services to
their customers, e.g. trading, custody, and wealth management

Offering trading and custody services Offering wealth management services

27
 In brief, banks only interact with cryptoassets directly if they provide
“virtual asset services” or if their customers deal with cryptoassets

E.g. directly dealing with

cryptoassets through
investment or mining

Otherwise they just share

the same customer base

Note: VASP stands for Virtual Service Provider

Source: CipherTrace Cryptocurrency Intelligence, 2021 28

 Under Portuguese regulation, only by performing any of the
following activities on behalf of a client is an entity considered a VASP

VASPs are now

considered obliged
entities
i. Exchange between virtual assets and fiat currencies;

ii. Exchange between one or more forms of virtual assets;

iii. Transfer of virtual assets;

iv. Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets;

Note: VASP stands for Virtual Service Provider

Source: FATF, 2021, Banco de Portugal, 2021 29

 Note VASPs are required to have stringent KYC and CTF procedures,
and the most well-reputed VASPs are under intense scrutiny here

Source: BCG, 2020 30

 The high level of compliance controls among the largest crypto
exchanges discourages illicit users from transacting through them

Banks can protect

themselves from this
minor percentage of
illicit transaction, in case
they are transferred to
fiat, through

Source: Chainalysis, 2020 31

 Moreover, the transparent nature of most blockchains has
diminished the appeal for illicit use of the top cryptoassets

Source: Elliptic, 2020 32

 That’s because it’s possible to investigate transactions at
an individual level, which hinders its illicit use potential

This makes cryptoassets

less and less appealing
for illicit use, especially
the cryptoassets accepted
by well-reputed
exchanges

Source: Chainalysis, 2020; Michael Morell et al, 2021 33

 This means fiat-to-fiat SEPA and SWIFT wire transfers between
banks and regulated exchanges in low-risk jurisdictions are fine

As long as those transfers happen between Or between legal, regulated entities (e.g.
legally-allowed citizens and exchanges crypto startups*) and exchanges

Note: As regulated by BdP 34

 For example, even though Revolut allowed its customers to buy
bitcoin contracts on its app, it used to blocked transfers to exchanges

Until April 2021, Revolut

shouldn’t be part of this
crypto-friendly list.

Source: Aximetria, 2020 35

But it’s now working with major exchanges, and even allows crypto
deposits and withdrawals - following a partnership with Elliptic

36
 Elliptic provides compliance solutions for cryptoasset risk
management. It’s backed by Wells Fargo and Santander Innoventures
Not all crypto exchanges and businesses are alike. Take a nuanced, risk-based
approach to better manage risk exposure to 250+ Virtual Asset Service Providers (VASPs).

Coinbase BTC-e

35 82
Low Counterparty High Counterparty
Risk Risk

For Financial For Banks: For Crypto Businesses: For Regulators:

Institutions: Indirect Exposure VASP Risk Assessment VASP Risk Monitoring
VASP Due Diligence
Every bank is exposed to Transacting with crypto Elliptic Discovery
Many financial cryptoassets when its businesses that have provides up-to-date risk
institutions are looking to customers transact with inadequate compliance profiles for all major
engage with cryptoasset VASPs. Identify and controls can expose you VASPs, so regulators can
businesses. Elliptic assess the level of risk, to significant risk. Get the monitor anti-money
Discovery provides the and ensure you aren’t insights you need to laundering, terrorist
rapid insights needed to handling the proceeds of assess this risk and financing (AML/CFT), and
perform due diligence and crime or violating transact with confidence. sanctions compliance for
onboard VASPs with sanctions. these businesses.
confidence.

Source: Elliptic 37
In the end, it’s all about capturing an opportunity with
a risk-based compliance to address relevant regulations

• Utilise state-of-the-art tools to screen the reputation of exchanges under consideration

• Use blockchain forensics tools to identify scammers and illicit schemes using bank accounts

• Serve crypto businesses which have successfully registered with Banco de Portugal

• Don’t allow customers to buy cryptoassets with a credit card nor pre-paid cards

38
3. An overview of key KYC & AML processes

39
 These exchanges stand as the most
reputable fiat gateways in Europe and USA

Identity Compliance
Headquarters EU Licenses
Verification Software

Formerly San
Required, done by
Coinbase Francisco, going UK and Ireland Coinbase Analytics
Jumio
fully remote
Required and
Kraken San Francisco UK tailored to Chainalysis
countries

London, founded Required, done by

Bitstamp Luxembourg Elliptic
in Slovenia Onfido

Required, done in- ComplyAdvantage

Gemini New York UK and Ireland
house AML

Source: Own analysis 40

 Elliptic Discovery
is our recommended tool

Source: Elliptic 41
 But Chainalysis Kryptos
is also suitable, it will be a matter of price

Source: Chainalysis 42
 We see Chainalysis Kryptos as
analogous to Elliptic Discovery

Source: Chainalysis 43
 And, overall, Chainalysis and Elliptic are
the most reputable players in the compliance field

Source: Elliptic 44
 CipherTrace Armada could also be a good
option but we haven’t engaged properly yet

Source: CipherTrace 45
TRM is also an emergent player in
area, but we’re to demo their platform

46
And, lastly, FinClusive is also developing an offering in this
field, with a full-stack financial crimes compliance platform

47
Thank you

48
Get in touch with us
through our website

https://neweconomy.institute

[email protected]

49
Questions & Answers

50