Money Laundering, Bitcoin and Blockchain: Anonymity, Transparency and Privacy are not Incompatible
29 May 2016, Bachir El Nakib (CAMS) Senior Consultant Compliance Alert LLC
Whether it be the revelations regarding the “Panama Papers” and “Luxleaks” or the consecration of virtual currencies and the blockchain as means to facilitate the disintermediation and the anonymity of transactions, these two phenomena push us to ask ourselves: what are the legal consequences for anti-money laundering and privacy?
Every individual has the right to privacy and the protection of their personal data; moreover, they can choose to act in an anonymous manner. However, many courts including the European Court of Human Rights as well as the European Court of Justice have found that this right is not absolute.
Indeed, European Union law and law of Member States may limit the rights of individuals, under the condition that the fundamental rights and liberties are not emptied of their substance or rendered ineffective, and that the measures are necessary and proportional within a democratic society. Such legitimate European Union public interests limiting rights include the prevention and detection of criminality such as money laundering, as well as its investigations and legal proceedings[1].
Anonymity, a heightened risk for money laundering
In 2015, the Financial Action Task Force (FATF) underlined the heightened level of risk for money laundering in regard to virtual currencies or “crypto-currencies” that use decentralized solutions to execute transactions under pseudonyms such as Liberty Reserve or Bitcoin. The FATF recognized two key elements within their guidelines that provide for the heighten risk:
- the circumvention of the identification of beneficial owners,
- and the multiplication of software tools that are created only to help render these transactions completely anonymous. External services such as “mixers” like BitLaunder obscure the transaction chain on the blockchain by linking said transactions to false addresses. By means of these tools, the founders of Liberty Reserve were able to launder for 6 years hundreds of millions of dollars for criminal organizations[2].
Anonymity does not guarantee privacy
Contrary to Liberty Reserve, Bitcoin with its blockchain presents itself as privacy and transparency innovations for financial transactions. However, they beg the observations: if an anonymous ledger is made public, the transparency advantages are lost; and if a ledger containing personal data is published, the transparency objective is achieved at the expense of privacy and the protection of personal data.
With regards to “privacy” and the protection of personal data, the use of pseudonyms cannot be considered to be an anonymization procedure, because by definition anonymization should be irreversible and ensure that the data cannot be traced back to an individual. Hence, “privacy” and anonymity cannot be considered as synonyms but antonyms. Anonymization is a technique used to erase the personalization of the data when it is not required for the purpose of the data processing activities (i.e. statistical data). This technique allows companies such as financial institutions to retain and process data after the expiration of their legal conservation period or for other purposes. In this case, the data no longer fall under the scope of the personal data protection regime because they are no longer identifiable.
Identification and privacy as legitimate interests
The European Union and countries around the world have a legitimate interest in fighting money laundering, terrorism financing, and any criminal activity aiming to destabilize their economy. The identification of beneficial owners lies at the heart of the fight against money laundering, and without it, any legal or technical measure would become ineffective.
However, this step does not equal a carte blanche for financial institutions with regard to fundamental rights and data protection. The anti-money laundering regulatory framework as well as the data protection framework require financial institutions to perform risk-based analyses to ensure the proper identification of beneficial owners based on the risk they pose. The necessary amount of information for said identification should increase and decrease in correlation with the money laundering risk. Likewise, the security measures and data protection measures regarding this personal data should increase in correlation with the sensitivity of the information collected.
Consequently, only an “Data Protection by Design” approach should be able to reconcile the fundamental rights of individuals with the legitimate interest of fighting money laundering.
Data Protection by Design: the balancing act
Only an approach that incorporates a protective stance on the processed information at the conception of KYC and payment service technologies will be able to fulfill due diligence obligations as well as respond to transparency and anonymity needs.
Take for example, a technical rule regarding the use of an account and the identification of the user that grows in correlation with the amount of money transferred or deposited to an account. This type of rule would give access and allow users to remain anonymous for transactions of low or insignificant risk, and block the account and require the identification of beneficial owners once certain ceilings have been reached. One could also foresee the parallel use of the unique identifier proposed by the 2015 Payment Services Directive for the blockchain’s pseudonymization technique.
Contrary to an “all or nothing” strategy, Data Protection by Design ensures the integration of data protection and privacy principles into technologies and allows financial institutions to effectively fulfill the due diligence obligations resulting from the anti-money laundering regulatory framework.
[1] CJEU [2013] Jyske Bank Gibraltar v. Administracion del Estado, Case C-212/11, para. 62
[2] The founder of Liberty Reserve, Arthur Budovsky, was sentenced by the American justice system to 20 years in federal prison on May 6th, 2016.
https://www.finextra.com/blogposting/12663/money-laundering-bitcoin-and-blockchain-anonymity-transparency-and-privacy-are-not-incompatible