Transnational criminal organizations can circumvent anti-money laundering controls or the efforts of regulators to counter the financing of terrorism by exploiting newly minted devices known as Bitcoin Teller Machines (BTMs). BTMs are located both in the U.S. and internationally and in a variety of locations such as international airports, coffee shops, casinos, company offices, kiosks, shopping malls, supermarkets, subway systems and money service businesses (MSBs).
The criminals’ goal is to launder proceeds into, within, and out of the U.S. because these BTMs, which operate much like standard ATMs, can provide easy and secure ways to deposit, send, and convert Bitcoin cryptocurrency into cash and cash into cryptocurrency, thereby circumventing traditional financial institutions.
How BTMs Operate
Some BTMs accept cash deposits and withdrawals without verifying their customers’ identification, source of funds, and bank account information.
Most BTM transactions can be managed on a cell phone by just scanning the Quick Response (QR) code created from your Bitcoin wallet receipt on a cell phone or on a paper receipt. The QR code contains the digital wallet address allowing you to store, receive, and send Bitcoin anonymously by just using your cell phone. Criminals will more than likely use burner phones to further disguise their identities.
Some BTMs also accept prepaid Visa and MasterCard debit or credit cards requiring limited or no personally identifiable information. And some BTMs will allow you to sell your Bitcoin and have cash dispensed on the spot, while others will give you the option to accept a paper receipt that contains a QR code or send your deposit directly into a digital wallet where your Bitcoin can be safely stored. And it can remain there until you’re ready to split it into multiple international wallets, exchangers, mixing, and shifting services — mirroring the money-laundering cycle — to exploit international financial institutions that have correspondent banking relationships with the U.S.
For example, BitPay is a U.S. company based in Atlanta, that offers services to convert your Bitcoin into fiat currency using BitPay wallets or other wallet types that will accommodate up to 30 fiat currencies. Once a criminal organization is able — through deception, identity theft, use of nominees or by some other means — to pass BitPay’s verification requirements, a criminal may use Visa cards or digital wallets to deposit and withdraw fiat currency from international BTMs or other digital wallets without the need to physically be located in the U.S. From there, they can then send their fiat currency into U.S. financial institutions from outside the United States using BTMs.
A National Security Threat: Criminal Organizations can Purchase their Own BTMs
Transnational criminal organizations can also start their own Bitcoin ATM business disguised as a legitimate registered money service business — in a brick & mortar operation, for example —and build a strong relationship with a bank to purchase BTMs or collude with an existing money service business owner to place their own BTMs within his operation.
There are two main types of BTMs that criminals can purchase: the basic ones, allowing the users only to purchase Bitcoins; and more advanced ones, enabling the users both to buy and sell Bitcoin. As of April 2018, the main manufacturers of BTMs were Genesis Coin, based in San Diego and General Bytes, based in Prague and Bradenton, Fla. In addition, transnational criminal organizations can mask their identities and intentions when purchasing BTMs; and BTMs located inside and outside of the U.S. can even be purchased online.
Currently, there are BTMs in more than 70 countries, according to Coin ATM Radar. The U.S. has the most BTMs with Canada in second place. As of August 2018, the highest number of Bitcoin ATMs was recorded in the U.S. In total, approximately 74% percent of global ATMs were concentrated in North America.
Criminals Can Use other Cryptocurrencies Besides Bitcoin
As of October 2017, Bitcoin was the preferred cryptocurrency for criminal organizations across the world, due to the cryptocurrency’s longevity and growing acceptance at legitimate businesses and institutions worldwide. However, so-called “privacy coins” such as Monero are designed to avoid being tracked and seem to be growing in popularity with criminals, especially as financial regulators adopt the hi-tech tools to better monitor Bitcoin transactions, according to a recent news report. Other cryptocurrencies, like Zcash and Ethereum are also gaining popularity within the digital underground.
The main advantage for criminals is that some of these privacy-focused coins, unlike Bitcoin, allow users to mask their true identities or by issuing fake addresses or encrypting the senders’ real addresses, the report said.
While it is well known that transnational criminal organizations are enamored of Bitcoin and other cryptocurrencies, the BTM threat is not as well understood but just as serious. Indeed, it adds yet another layer of anonymity to the chain of ownership documented in the blockchain, the underlying technology to all cryptocurrencies.
Yet the international regulatory focus seems almost entirely on cryptocurrencies themselves with barely a mention of BTMs. For example, in the 2015 Guidance by the Financial Action Task Force, there is only a few mentions of ‘VC ATMs’ or ‘bitcoin ATMs’ without clear standards on how countries should deal with this expanding threat. And in FATF’s August 2018 Report to G20 Finance Ministers and Central Bank Governors, ‘Bitcoin ATMs’ are mentioned once, as part of a list of processes “to move and store funds for money laundering and terrorist financing”. Finally, in October 2018, FATF updated Recommendation 15 of its Forty Recommendations issued in 2012 to cover virtual currencies, but there is nary a mention of BTMs or Bitcoin ATMs.
Is this a case of “maybe if we don’t talk about it, it will go away”? If so, all international and national bodies whose main mission is to combat money laundering and terrorist financing risks are giving the concept of sticking your head in the sand a bad name. This is more like sticking your head in quicksand — and if they’re not careful, it can swallow them whole!
This article was co-authored by Lourdes C. Miranda, a cryptocurrency analyst and financial crimes investigator; and Ross S. Delston, an attorney, certified anti-money laundering specialist, and former banking regulator with more than 40 years of experience in the financial services sector.