Hey Compliance Nerd!
We have a customer that frequently sells bitcoin. She told us that her bitcoin is from mining, but we noticed that it usually seems to be coming from, or have passed through, a wallet that we think is associated with a “Silk Road” type of dark web site. What should we do? We’re not certain that she’s doing anything illegal, but if she is, I don’t want to share a jail cell with her!
First of all, congratulations on harnessing the power of the bitcoin’s blockchain to detect transactions that could be a little bit shady. You’re right to want to protect yourself and your business.
If you are already registered as a money services business (MSB), you can report the transaction(s) to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) electronically using the F2R system.
If you’re not registered and can’t submit reports electronically, you can still voluntarily submit a report to FINTRAC by fax or snail mail.
The transactions can be reported in a single Suspicious Transaction Report (STR). These reports aren’t set up for digital currency transactions, so you will need to provide the details in the freeform section of the report. You should start this section by describing the reasons that you are suspicious, then provide the details for each of the individual transactions, and any relevant links (for instance to the reason that you believe a wallet address is related to a site that is related to criminal activity).
When you submit this type of report, you are protected under the law as long as you are acting “in good faith” (meaning that you’re submitting the report because you think that something shady may be happening, rather than to get back at an ex-girlfriend). Do not let your customer know that you are submitting an STR about her activity.
Next up you’ll want to consider whether or not you want to keep this person as a customer. If you believe that you can manage the risk associated with the customer (for instance by continuing to monitor her account closely and collect additional information and/or identification from her), there is nothing that would prohibit you from keeping her as a customer… unless of course, you no longer want to deal with this customer.
If that’s the case, you can either let her know directly that her account will be closed. You are not obligated to provide any specific reasons for this (and if you do, you should not say that it was due to suspicious activity). Another option is to suspend the account pending additional verification, which may include verification of the customer’s identity and/or proof that the customer is mining bitcoin. In many cases, this type of request will cause a customer who is not above board to move their business elsewhere.
In all cases, you should document all of the steps that you are taking, including any STRs that you have submitted or additional information you collected from her. These records demonstrate that you’ve done your due diligence.
Amber D. Scott, MBA, CIPP, CBP, CAMS
Founder & Chief AML Ninja, Outlier Solutions Inc.
Amber is a long time, self-described “compliance nerd”. Amber is a firm believer in the idea that good compliance can enable good business. Find out how at www.outliercanada.com or reach out to her directly at [email protected].