Menu

AML/CFT regulations and data protection require balance in regulating cryptocurrency 25 Apr 2024

The Federal High Court in March, on the application of the Economic and Financial Crimes Commission (EFCC), ordered Binance Holdings Limited to release “comprehensive” details of all persons from Nigeria trading on its platform to the EFCC. This application was made by the EFCC weeks after it was reported to have detained two of Binance’s top executives. The EFCC is alleging that the Binance platform is used for price discovery, confirmation and market manipulation, foreign exchange manipulation, and for facilitating illegal capital outflows.

Regulatory reaction to cryptocurrency in Nigeria and indeed around the world has been checkered. The financial regulatory landscape seemed to be turning more liberal in the country when the Central Bank of Nigeria (CBN), by its circular issued on the 22nd of December 2023, released the Guidelines on Operations of Bank Accounts for Virtual Assets Service Providers, which essentially reversed its earlier stance on the operation of bank accounts linked with cryptocurrency.

Binance’s recent regulatory quandaries, however, reveal the need for cryptocurrency platforms used in or operating in Nigeria – and indeed all virtual asset service providers – to understand the financial and regulatory framework that govern their operations especially on matters relating to Anti-money Laundering and Counter-terrorism Financing (AML/CFT) regulations and taxation. The Federal Inland Revenue Service (FIRS) is reported to have filed tax evasion charges against Binance on the 25th of March for its alleged failure to register with the federal tax authority for tax purposes, failure to collect and remit taxes, failure to pay applicable taxes and file tax returns, and complicity in aiding customers to evade taxes through its platform.

Governments all around the world are evolving in their regulation of cryptocurrency with even the most liberal jurisdictions recognising the need for regulations. With its fairly recent development, it is understandable that governments and regulators globally are still grappling with how best to harness the potentials of digital currency while regulating its uses, especially with protecting consumers and businesses from fraudulent activity, and preventing its illicit use for money laundering and terrorism financing. It will be a controversial process for some time with some countries making slower progress than others.

A general consensus seems to have been reached that regulation is inevitable. Most countries are developing laws to regulate the activities of cryptocurrency especially relating to AML/CFT obligations and taxation. With respect to taxation, most countries have recognised virtual or digital assets as property and outlined tax requirements for collecting taxes on income from them. With respect to AML/CFT obligations, governments and regulators recognise the high AML/CFT risks associated with cryptocurrencies and virtual assets.

The anonymity that cryptocurrency provides with no names, account numbers or verification checks on the source or destination of funds, or historical records of transactions, masks source of funds. The risks are further increased with the global reach to any jurisdiction as cross-border transactions can be conducted with the same ease as local transactions. The decentralised nature of the blockchain technology that enables cryptocurrency transactions creates a gap in oversight if no deliberate AML systems are implemented.

These risks can be extended to the regular financial system at the point of conversion from a crypto to a fiat currency as such conversion may allow the introduction of potentially suspicious funds into the banking system.

In Canada, which is considered a proactive jurisdiction, crypto trading platforms and dealers in the country are required to register with provincial regulators. Crypto investment firms are classified as money service businesses (MSBs) and are required to register with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). With respect to taxation, Canada treats cryptocurrency similarly to other commodities.

In the United Kingdom, there are cryptocurrency-specific reporting requirements relating to Know Your Client (KYC) standards as well as AML/CFT compliance requirements. Crypto exchanges and custodian wallet providers must comply with the reporting obligations of the Office of Financial Sanctions Implementation (OFSI). There are also reporting obligations on crypto firms who must notify the OFSI as soon as possible if they know or have reasonable suspicion that a person is subject to sanctions or has committed a financial sanctions offense. Taxation is also recognised and investors pay capital gains tax on crypto trading profits.

In Japan, cryptocurrencies are recognised as legal property under the country’s Payment Services Act (PSA). Crypto exchanges in the country must register with the country’s financial regulator with oversight functions on banking, securities and exchange, and insurance sectors – The Financial Services Agency – and comply with AML/CFT obligations. Profits or gains made from cryptocurrency is regarded as miscellaneous income and taxed accordingly.

Japan’s AML law – the Japanese Act on Prevention of Transfer of Criminal Proceeds – imposes KYC obligations on business operators, which include crypto exchanges. In Australia as well, crypto exchanges are allowed to operate, provided they register with the Australian Transaction Reports and Analysis Centre (AUSTRAC) and meet specific AML/CTF obligations prescribed. The transactions are subject to capital gains tax as cryptocurrency is regarded as legal property.

Nigeria is coming into its own with its regulation of cryptocurrency and the current interface with Binance will set the tone for the implementation of AML/CFT laws and regulations governing cryptocurrency in the country. A major concern from the regulatory interventions with Binance in Nigeria is, however, data protection. The orders obtained by the EFCC supposedly gives it access to almost all the data of the users of the Binance platform.

Under the Money Laundering (Prevention and Prohibition) Act 2022, “financial institution” is defined to include “banks, body corporates, associations or group of persons, whether corporate or incorporate which carries on the business of investment and securities, virtual asset service providers, a discount house, insurance institution, debt factorisation and conversion firm, bureau de change, finance company, money brokerage firm whose principal business includes factoring, project financing, equipment leasing, debt administration, fund management, private ledger service, investment management, local purchase order financing, export finance, project consultancy, financial consultancy, pension funds management and such other business as the Central Bank or other appropriate regulatory authorities may designate.” The KYC, reporting and other AML/CFT obligations under the Act, therefore, applies to all virtual asset service providers, which will include cryptocurrency exchanges.

Section 15 of the Act grants certain powers to “a competent authority” exercisable upon the grant of interim orders of the Federal High Court to enable such authority to “identify and locate proceeds, properties, objects or other things related to the commission of an offence.” Such powers include placing any bank account or any other account comparable to a bank account under surveillance; obtaining access to any suspected computer system; and obtaining private instruments or contracts, all bank, financial and commercial records, when the account, or computer system is used by any person suspected of taking part in a transaction involving the proceeds of a financial crime or other crime.

It is reported in the media that EFCC had stated in the affidavit in support of the application seeking the interim orders granted by the courts that Binance had revealed to the Office of the National Security Adviser that trading volume in Nigeria in 2023 alone stood at $21.6 billion. The Governor of the CBN had sometime in February stated that about $26 billion passed through Binance from unidentified sources. Binance subsequently discontinued all transactions in naira on its platform.

The powers of the EFCC to seek those orders are established under the Money Laundering (Prevention and Prohibition) Act 2022 as well as their establishment Act. The scope of the orders vis-à-vis available information on the investigations carried out can be debated and this highlights the delicate balance to be sought between AML/CFT regulations and data privacy.

Balancing the privacy of cryptocurrency users in line data protection regulations and preventing AML/CFT infractions is a complex challenge for cryptocurrency operators and exchanges. Cryptocurrency users demand privacy, while governments and regulatory bodies seek to ensure transparency to prevent illicit and fraudulent activities. Data privacy remains a critical concern in the cryptocurrency space, as the pseudonymous nature of transactions can clash with AML/CFT regulations.

Achieving a balance between user privacy and regulatory compliance is essential to more favourable adoption of cryptocurrency by governments and regulators. Regulators, however, have a duty to ensure that AML/CFT policies are designed and implemented with consideration of privacy rights. They must appreciate real-world use cases of cryptocurrencies and their underlying technology just as much as they implement KYC and AML policies.

For the virtual asset service providers (VASPs), including cryptocurrency platforms, they must learn to walk the delicate balance in their compliance with data protection laws, and performance of AML/CFT obligations which may require them to grant access to their systems to regulators or provide information as requested. Both stakeholders must continue to engage with one another.

Funmilayo Odude is Partner at Commercial and Energy Law Practice (CANDELP).