Crypto-assets, Stablecoins, and Anti-Money Laundering

1. Introduction

It is with great pleasure that I welcome you to the fifth edition of the conference on 'Quantitative Methods and the Fight Against Economic Crime', an initiative jointly launched in 2015 by the Financial Intelligence Unit (UIF) of Italy and the Baffi Center at Bocconi University.

The size of the criminal economy is very difficult to measure and highly uncertain. According to the most recent estimates by ISTAT, the shadow economy and illegal activities generated € 218 billion of value added in 2023, equal to 10 percent of GDP. Based on an experimental mapping conducted by the UIF, 2 percent of the firms operating in the Italian economy during the 2011-2020 decade are estimated to have had potential links to mafia organizations.¹ And about 15 percent out of the approximately 145,000 suspicious transaction reports (STR) received by the UIF last year showed connections between businesses and organized crime.²

The actions of mafia groups entail significant economic and social costs.³ In the past decade, substantial progress has been made thanks to a multi-pronged strategy that has involved economic development measures, investigative and judicial actions, and targeted preventive measures, especially in the financial sector.

These initiatives can be strongly supported by technology and research, as today's presentations will demonstrate. Technology, however, can also facilitate criminal activity, and criminals in fact use it skillfully. Below, after briefly touching on new trends in organized crime, I will focus on the use of crypto-assets for illegal purposes.

2. New trends in organised crime

The integration of assets from criminal activities into the legal economy have characterized the entire history of illegality. The phenomenon is not easy to measure: reliable data for comparisons over time or across countries are not available.⁴ Globalization has been accompanied by the transnational expansion of criminal organizations. More recently, as international relations have deteriorated, growing connections have emerged between criminal activities and States.

A second point of relevance is related to the use of new technologies for illegal purposes, not only in the digital sphere, such as the continuous introduction of new synthetic drugs onto the market, the use of 3D printing for the production of weapons, and the use of drones for drug trafficking.⁵ Some criminal groups are engaged in large-scale, industrial-level cyber fraud.⁶ One manifestation of this trend is payment fraud targeting bank customers. Such fraud is on the rise in Italy in recent years, although its value remains stable relative to the total volume of transactions. Recently, several online customer identification procedures used by banks have been circumvented through the use of altered real images or entirely synthetic ones.

Another significant trend is the specialization of illicit activities according to crime-as-a-service and fraud-as-a-service models, with the establishment of international networks specializing by activity and macro-geographic area to provide services to the crime and fraud industry.⁷

At the same time, illegal markets continue to expand. The number of consumers of psychotropic substances - who fuel a highly profitable market for criminal organizations -is estimated to have increased by 29 percent between 2013 and 2023.⁸

3. Developments in the world of finance and payments

This set of illegal activities generates its own demand for financial and payment services, which benefits from the digital revolution in the financial system.⁹ In this context, the use of crypto-assets for money laundering and terrorist financing is of great interest. This is not a new phenomenon, but it is evolving in ways that are worth exploring from multiple perspectives, including AML/CFT.

The fight against the illicit use of crypto-assets occurs primarily through the regulation of specialized intermediaries, who handle the majority of crypto-asset transactions. These intermediaries, originally created to safeguard clients' bitcoins and to enable conversion into legal currency and vice-versa, have gradually expanded their offerings to include hundreds of tokens and more complex trading and investment services. Under the leadership of the Financial Action Task Force (FATF), major jurisdictions have introduced regulations for these operators. In the EU, MiCAR has established the category of crypto-asset service providers (CASPs), who are required to comply with AML/CFT rules similar to those applied to traditional financial intermediaries. Similar provisions exist in various countries, including the United States.

Overall, although regulation remains far from the desirable degree of international harmonization, efforts to counter the illegal use of crypto-assets through the regulation of specialized intermediaries appear to be underway.

Precisely due to regulatory heterogeneity, the role of traditional intermediaries remains important. For example, a European user might attempt to bypass MiCAR controls by operating on crypto-platforms located in more permissive jurisdictions. However, he would not be able to avoid the controls imposed by banking institutions when requesting that the foreign platform convert crypto-assets into legal currency and transfer the funds to an account within the EU. In this domain, therefore, traditional mechanisms for combating illegal activity are already active and require conceptually simple-though practically complex-adaptations.

From an AML/CFT perspective, crypto-assets nonetheless pose specific challenges that are not easy to overcome. The most evident is the possibility of transferring these instruments without specialized intermediaries. It is well-known that crypto-assets were born with the intention of eliminating financial intermediation and can be exchanged directly between private individuals through so-called unhosted (or self-custodial) wallets. These are combinations of software and hardware, readily available, that allow users to hold and use their crypto-assets directly without being subject to customer due diligence by intermediaries, thereby operating on blockchains in a pseudo-anonymous manner;¹⁰ they differ from hosted (custodial) wallets, which are managed by a CASP and therefore subject to AML/CFT regulation.¹¹

Today, therefore, a criminal can replace the classic briefcase filled with high-denomination banknotes with a self-custodial wallet - a sort of "electronic briefcase" - that can contain far greater value and can be conveniently stored and transported on a device resembling a USB key with advanced encryption, or even on a mobile phone.

In this context, the phenomenon of stablecoins becomes relevant: crypto-assets generally issued by an identifiable entity, designed to maintain a stable value pegged to one or more assets - typically an official currency - and thus allowing criminals to minimize the risks associated with the high volatility of other crypto-assets (such as Bitcoin). The "electronic briefcase" can therefore contain monetary amounts that are not only extremely large, but also essentially stable. Stablecoins thus represent a "red risk" for the anti-money laundering and organized crime prevention system.

Efforts to counter the illegal use of self-custodial wallets remain at an early stage. European law requires CASPs to adopt measures to verify the identity of users interacting with self-custodial wallets.¹² Preliminary discussions between supervisory authorities and Italian CASPs indicate that CASPs are adopting measures to mitigate risks arising from the use of these instruments, including mechanisms based on whitelists of authorized wallets, as well as analytical tools capable of examining public blockchain ledgers. These tools help identify suspicious transactions, such as those linked to cybercriminal groups, sanctioned entities, or operators and individuals in high-risk jurisdictions.

Another approach to combating the illegal use of self-custodial wallets relies on the issuers of crypto-assets themselves. These issuers can not only monitor transactions recorded on public blockchains (similarly to CASPs, law enforcement, or any other technically capable actor); under certain conditions, they can also block or recover crypto-assets used in suspicious or illicit activities, even when held in self-custodial wallets.¹³ It is to be hoped that clear provisions regulating the powers of issuers will complement the obligations imposed on crypto-asset service providers. Such provisions are not present in current EU legislation, though they are being introduced or discussed in other jurisdictions, including the United States.¹⁴

Nonetheless, transactions conducted exclusively through self-custodial wallets, without passing through the blockchain, evade the control of both issuers and specialized operators.¹⁵ Moreover, although still limited in Europe, decentralized finance ("DeFi") schemes are spreading, in which crypto-asset services are provided without CASPs and therefore without AML/CFT safeguards.¹⁶

Today, virtually all stablecoins in circulation are denominated in U.S. dollars and issued by two entities: Tether International S.A. and Circle. Tether is legally headquartered in El Salvador and is not authorized under EU or U.S. regulation.¹⁷ In Europe, Tether-issued stablecoins cannot be traded by CASPs, and their exchanges are subject to limited AML/CFT oversight within the EU;¹⁸ such safeguards apply to transactions in stablecoins issued by Circle¹⁹ (which complies with MiCAR), but only when transactions occur via CASPs.

The current stock of stablecoins in circulation is valued at approximately $ 310 billion -a significant absolute amount but negligible when compared, for example, with U.S. bank deposits (1.5 percent).²⁰ The intense international debate surrounding stablecoin risks is motivated by concerns about their potential growth. Euro-denominated stablecoins distributed by major technology firms, which have access to massive customer bases, could quickly achieve a level of acceptance not far from that of traditional payment instruments. Should this occur, the need to convert the proceeds of crime into traditional instruments could diminish, or even disappear. The challenges this would create for combating illegal activities are evident. It would also pose risks to financial stability, which I will not address here.²¹

The FATF's Virtual Asset Contact Group is working on analyzing and mitigating AML/CFT risks related to stablecoins and decentralized finance;²² dedicated reports will be published on these topics, which may provide the impetus to strengthen preventive measures and reduce opportunities for regulatory arbitrage.

4. Conclusions

Technological progress is exploited both by the criminal industry and by the system tasked with combating it. Banca d'Italia, and UIF in particular, possess extensive, unique and internationally recognized datasets that make it possible to model behaviors, identify risk areas, and assess the extent of criminal infiltration across sectors, taking into account not only economic interests but also the relational dimension of criminal phenomena. Some results of this work will be presented throughout the day.

These studies show that quantitative methods, combined with high-quality microdata, can significantly increase the efficiency and effectiveness of the UIF's actions, offsetting the increasing sophistication and complexity of the techniques used by criminal organizations to evade controls.

For the system to function effectively in combating illegality, all actors are required to share techniques, information and results and, more broadly, to foster strategic interaction and collaboration: supervisory authorities, investigative bodies, judicial authorities, financial intermediaries, and the research community. Today's initiative aims to pursue this objective and testifies to our institutions' and our enterprises' commitment to safeguarding the integrity and legality of the economic system.