Hong Kong customs officials last year dismantled a syndicate that was using cryptocurrencies to “clean” HK$1.2 billion of illegal funds. While it was the first time that money launderers had been caught using cryptocurrencies in Hong Kong, it is unlikely to be an isolated incident. Globally, cybercriminals are estimated to have laundered US$8.6 billion through cryptocurrencies in 2021 – a 30 percent increase on the previous year, according to research by Chainanalysis.
Thomas Tsang CPA, Associate Director, Risk Consulting, KPMG China, is not surprised by the statistic. “Decentralized finance, including cryptocurrency, and virtual assets, such as non-fungible tokens (NFTs), have become very popular as a new avenue for money laundering that criminals are taking advantage of,” he says.
Tsang explains that cryptocurrency and other virtual assets have qualities that make them very attractive to money launderers. Firstly, unlike opening bank accounts, crypto wallets can be easily set up. “You can download an app onto your smartphone and this does not require know-your-customer (KYC) procedures,” he says. Even for cryptocurrency exchanges that have implemented KYC procedures, the level of these measures being applied may not be as stringent as those applied by regulated financial institutions. Secondly, cryptocurrency provides a higher degree of anonymity. “Even if transactions from one wallet to another are recorded on a blockchain, as is the case for Bitcoin, you may not know who holds or owns the wallets,” adds Tsang.
Albert Lo FCPA, Partner, Deloitte Asia-Pacific, agrees, pointing out that the decentralized nature of cryptocurrency attracts criminals as it enables them to move money without leaving as much of a trail as they would if they used traditional banking. He adds that the transaction costs are also relatively low when compared to traditional means of laundering the proceeds of crime.
Chris Fordham CPA, Independent Forensic Consultant and Founding Member of the Hong Kong Institute of CPAs’ Forensics Interest Group, points out that although cryptocurrencies have been around for more than a decade, the regulation surrounding them is still emerging. “In the past there is a perception that crypto assets have been poorly regulated, but that is changing. There is emerging regulation across the globe, and with that regulation will come enforcement, but there are still going to be some weaknesses in the meantime.”
But Fordham adds that criminals still need a way to convert cryptocurrency back to fiat currency, as there are limits to what cryptocurrency can be used for. “To convert it back, they need an exchange and an account, so they are still ultimately looking for a weakness on an exchange where there is a failing on KYC so that they can withdraw their funds in cash,” he explains.
Despite the benefits of cryptocurrencies to launder money, Tsang says the sector may have lost some of its appeal recently due to the crash in prices of cryptocurrencies and virtual assets (e.g. NFTs) and the receding market liquidity. The crash was triggered by stablecoin TerraUSD’s value dropping below its peg of US$1 following a large sale of the currency, leading to more tokens being minted to support the price, which in turn led to the price of Terra LUNA crashing. Bitcoin was also impacted by the crash, and has seen its value more than halve since January. He explains that as a result of this price volatility, cryptocurrency is deemed to be higher risk and less liquid, and it has lost some of its popularity as a means of money laundering, with criminals instead focusing on more traditional methods.
The situation in Hong Kong
The extent to which cryptocurrency is being used for money laundering in Hong Kong is difficult to gauge.
Tsang explains that virtual asset service providers (VASP) operating in Hong Kong are typically not licensed by the Securities and Futures Commission (SFC), unless they perform regulated activities that fall under the SFC’s regulatory regime, such as dealing in virtual assets that are classed as securities or futures contracts, or by distributing or managing virtual asset funds. He adds that there is currently only one SFC-licensed virtual asset trading platform in Hong Kong, among a handful of other asset managers who distribute or manage virtual asset portfolios for professional investors. The regulatory landscape is set to change, as the Hong Kong government gazetted Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022 in June, which will amend the current Anti-Money Laundering and Counter-Terrorist Financing Ordinance and introduce a licensing regime to close the existing regulatory gap by imposing anti-money laundering (AML) or counter-financing of terrorism requirements for VASPs of non-securities virtual assets in Hong Kong by 2023.
Although over the past year Hong Kong has detected a few money laundering cases with cryptocurrency usage, it is difficult to accurately estimate the volume of funds currently being laundered using cryptocurrency or VASPs in Hong Kong. However, Tsang believes there is no reason to think Hong Kong is different to other markets in terms of cryptocurrency being used as an avenue for money laundering, as the use of cryptocurrency is increasingly common. Fordham agrees: “I suspect the situation in Hong Kong, as a major financial centre in the world, is no better or worse than anywhere else.”
Gloria So CPA, Partner, Risk Advisory Services, SW Hong Kong, says: “With the rising trend of using cryptocurrency as an option of settlement across businesses, it is becoming an area of concern for potential money laundering activities for local regulators.”
She points out that in May, four people were arrested for laundering HK$600 million over a two-year period, HK$50 million of which was processed through an overseas cryptocurrency trading platform. “This shows that while the traditional medium of bank transfers and cross-border remittance remains the major means for money laundering activities, the use of cryptocurrency is a significant method being exploited by criminals,” So says.
Lo agrees that while there is a growing trend to use cryptocurrency for money laundering in Hong Kong, it has not yet become a major channel. “Traditional banking, the use of e-wallets and other money service operators are still more commonly found ways for money laundering,” he says.
Cynthia Chan CPA, Compliance Manager at a bank, thinks the most common methods continue to be structuring large money transfers through multiple small transactions made through banks, with amounts often just below the approval threshold. Other popular methods include buying and selling real estate, using shell companies with nominee arrangements, and cross-border wire transfers.
“With the rising trend of using cryptocurrency as an option of settlement across businesses, it is becoming an area of concern for potential money laundering activities for local regulators.”
Online opportunities
The pandemic has changed the behaviour of individuals and companies, providing more opportunities for criminals to commit crimes and launder the proceeds, according to Lo. “In particular, the pandemic has further promoted e-commerce and consumers have shifted to conducting their shopping online. Criminals have taken the opportunity to set up scam websites,” he says. “Also, individuals who are facing financial difficulties because of the economic downturn become easy targets for recruitments by criminals to launder money through ‘stooge accounts.’”
Chan points out that since the onset of the pandemic, there has been an increase in the use of online payments, third-party or cross-border fund transfers and remote account opening at banks.
Agnes Cheuk CPA, Compliance Manager at Airwallex Hong Kong, agrees. She points out that with the shift to online activities becoming the “new normal” as a result of COVID-19, there has been a surge in online fraud. “The pandemic has accelerated data and tech adoption, and created opportunities for more innovative solutions. Over the last few years, there has been an increasing trend in remote account openings. While there are benefits to the convenience and ease of opening an account remotely, this also creates more loopholes which criminals can exploit for money laundering,” she says.
Fordham points out that the weakest link in a system is often humans, and working patterns adopted during the pandemic, such as working remotely or in split teams, has created more risk, which criminals have taken advantage of. “The compliance teams and anti-money laundering teams have also been working from home, and that has put pressure on them and their systems.”
He points out that if someone receives an instruction they are not sure about in the office, they can walk over to someone else to check it, but this is harder to do when working remotely.
Anti-money laundering defences
While there is not much corporates can do to prevent money laundering through cryptocurrencies, there are a number of steps they can take to identify money laundering through other means. Chan advises businesses to formulate internal policies and guidelines related to AML and incorporate AML risk mitigating controls into their operations. These include taking steps such as performing adequate customer due diligence, conducting periodic reviews on customers, and carrying out ongoing transaction monitoring.
She adds that it is also important to set up a channel for staff to report suspicious transactions, backed by a team to investigate these reports, as well as providing continuous AML training to employees. Chan suggests accountants should be particularly cautious when providing advice to clients on the formation of trust or private funds, or the purchase and sale of real estate.
Chan adds individual consumers should also perform online background searches on counterparties before making any online payments, and not disclose their personal information, such as bank account passwords, which could be used by money launderers.
Cheuk suggests accountants should constantly question things and have a sceptical mindset. “Being sceptical is about being thoughtful and to have a questioning mind. This will allow you to be alert to situations and potential situations of error or fraud,” she says.
She adds that accountants should also bear in mind that previous cases and patterns may not reflect the latest money laundering activities. “There is no one-size-fits-all solution for every scenario. An individual should exercise judgement based on the totality of facts, experience, and professional scepticism.”
For financial institutions, Cheuk says technology is a key building block to implement money laundering controls. “Automation facilitates the customer life cycle management process in financial institutions, such as onboarding, sanctions screening, and transaction monitoring,” she says. “Technology also plays an important part in the data analysis relating to emerging money laundering typologies with existing customer activities, as well as designing respective controls to manage money laundering risk,” she says.
Mary Wong, Partner, AML and Sanctions Services, Greater Bay Area, KPMG China, also stresses that professional accountants should always be aware of new and emerging risks. She adds that they should be particularly vigilant as the economic situation is currently tough, which has already led to an increase in fraudulent activities. “As professional accountants, we need to be aware of all the evolving risks, since we are exposed to different industries.”
She points out that the pandemic has accelerated the adoption of regulatory technology (RegTech) across all aspects of operations, in line with expectations for the financial service industry as highlighted by the local regulator. However, accountants should also explore how to use technology to assist their audit work, for example performing data analytics and industry benchmarking on sales or revenue figures to identify suspicious transaction patterns which may be indicative of fraud or even money laundering.
Fordham stresses the importance of training staff to be alert to the latest developments, as well as investing in technology. “It is important that institutions ensure their staff remain current in their knowledge, as criminals innovate, so staff need to be aware of the latest typologies, as these emerge and change.
“Institutions should continue to invest in technology, such as artificial intelligence and data analytics, and continue to give relevant and appropriate training to their staff,” he says.
Fordham adds that accounting firms should also ensure that there is no disconnect between the training they provide and what employees experience in day-to-day life as auditors. “Training should not be done in a vacuum, but should relate to real risks,” he says.
Professionals should also make use of the resources available, such as those provided by the Association of Certified Anti-Money Laundering Specialists, to stay up to date with the latest trends, Fordham says. “Criminals innovate to get around controls, so you have to keep abreast of risk.”
For small and medium practices (SMPs), So suggests taking the SAFE approach proposed by the Joint Financial Intelligence Unit (JFIU) to identify suspicious transactions.
This approach involves screening accounts for suspicious indicators, asking the customer appropriate questions, finding the customers’ records and reviewing information already known about them when assessing suspicious activity, and evaluating all the above information to determine if a transaction is suspicious. “The JFIU pointed out that many reporting institutions did not adopt a systematic approach in identifying suspicious financial activities. Commonly, institutions make a suspicious transaction report merely because a suspicious activity indicator has been recognized, but often they fail to capture the necessary information to make a solid case. Therefore, the SAFE approach can act as a systematic approach for SMPs to follow for effective reporting,” she says.
But So adds that SMPs face a number of challenges in implementing AML controls. Smaller firms may lack a risk-based, regularly updated and business-aligned AML and counter-terrorism financing policy dynamic enough to keep pace with changes to the industry.
A failure to have comprehensive customer onboarding procedures can also lead to a lack of proper due diligence at the customer acquisition stage, while ongoing monitoring can also be an issue. “As SMPs may lack the necessary resources to install their own internal AML compliance function to perform the above, especially keeping up with changes in the industry, SMPs can ask for regular reviews of their compliance by an external consultant as an alternative to mitigate AML risks in an efficient manner,” she says.
“As professional accountants, we need to be aware of all the evolving risks, since we are exposed to different industries.”
Identifying warning signs
Alongside having robust AML policies and procedures in place, it is also important that accountants are alert to potential warning signs that money laundering may be taking place.
Red flags, Lo suggests, include transactions that seem to be inconsistent with a customer’s known legitimate business or personal activities, or their means, as well as unusual deviations from normal account and transaction patterns. “They should also be alert for situations in which it is difficult to confirm the identity of a person, unauthorized or improperly recorded transactions, inadequate audit trails, and settlements by a third party, which are different from the customer represented,” he says.
So suggests keeping an eye on large or frequent cash transactions resulting from deposits or withdrawals, accounts used as a temporary repository for funds, and periods of significantly increased activity following periods during which an account has been relatively dormant.
Other indicators can be “structuring” or “smurfing,” when many lower value transactions are conducted when just one, or a few, large transactions could have been used, as well as “U-turn” transactions, which is when money passes from one person or company to another, and then back to the originator. Situations in which a customer is unwilling to provide an explanation for a transaction, or their explanation is found to be untrue should also spark concern.
Finally, So suggests accountants should be alert for transactions involving politically exposed persons, countries or nationals of countries commonly associated with terrorist activities, and currencies commonly associated with international crime or drug trafficking.
If accountants do uncover a potentially suspicious transaction, Cheuk says it is crucial to escalate it to the appropriate channel in a timely manner. Financial institutions and accounting firms should have a money laundering reporting officer, in accordance with the regulatory requirements, to review any suspicious activity reported and file it with the JFIU.
Fordham agrees: “Accountants need to follow the policies and procedures within their organization, talk to their supervisor, make an internal assessment report, and liaise with the money laundering reporting officer.”
He stresses that it is also important to keep the issue confidential, as individuals must not tip off potential suspects. “There is a personal risk and liability. At the end of the day, there is a very good reason why we try to stop criminals laundering the proceeds of their clients: so that crime does not pay.”
Globally, cybercriminals are estimated to have laundered US$8.6 billion through cryptocurrencies in 2021 – a 30 percent increase on the previous year, according to research by Chainanalysis.
