On January 18, 2023, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) designated Bitzlato Limited (Bitzlato), a crypto asset exchange business incorporated in Hong Kong, as a “primary money laundering concern.” FinCEN accordingly issued an order, effective February 1, 2023, prohibiting U.S. financial institutions from transmitting funds to or from Bitzlato, unless otherwise permitted in the order. “Financial institution” is defined in the U.S. Bank Secrecy Act and includes banks, broker-dealers, and money services businesses (a type of financial institution that includes, among other business types, money transmitters, dealers in foreign exchange, and providers and sellers of prepaid access). This action serves as a reminder that regulators are continuing to scrutinize not only U.S.-based crypto asset exchanges but also crypto asset exchanges located outside the U.S. that facilitate illicit activity.

Bitzlato is a convertible crypto asset exchange that offers peer-to-peer (P2P) services and has allegedly been linked to Russian money laundering. This is the first order issued by FinCEN pursuant to the Combating Russian Money Laundering Act, which specifically authorizes FinCEN to impose restrictions on transacting with entities that are connected to Russian illicit finance.

FinCEN alleges that Bitzlato is a “primary money laundering concern in connection with Russian illicit finance” because it facilitated the transfer of funds from Russian ransomware groups and darknet markets. These groups allegedly include Conti, a ransomware group that pledged allegiance to the Russian government in February 2022, and Hydra, a former Russian dark web marketplace that has been dismantled by U.S. and German authorities. Illicit transactions involving Russian actors, or “otherwise risky sources,” have allegedly accounted for 48 percent of all Bitzlato transactions and are worth a total of at least $439 million.

FinCEN alleges that Bitzlato “does not effectively implement policies and procedures designed to combat money laundering and illicit finance, and in fact, has advertised that it lacks such policies, procedures, or internal controls.” According to FinCEN, Bitzlato did not collect any “information that would be necessary to facilitate meaningful [know-your customer (KYC)] analysis” and advertised its lack of KYC measures on its website. Given the lack of controls in place, FinCEN alleges that “Bitzlato’s services are used, to an unusually large extent, to facilitate illicit finance…, and by illicit actors who seek to circumvent AML/CFT obligations and obfuscate the source of funds or their intended use.”

To comply with FinCEN’s order, U.S. financial institutions must cease or reject all transmittals of funds from or to Bitzlato or any account administered by Bitzlato, unless otherwise set forth in the order, and ensure that these obligations are incorporated into their anti-money laundering (AML) programs.¹ FinCEN recommends that financial institutions use a combination of AML precautions, including “traditional compliance screening and blockchain tracing software” to identify transactions that are linked to Bitzlato.² Financial institutions should also “develop an established process for rejections that can be referenced in an audit.”³ Further, financial institutions may, but depending on the circumstances might not be required to, file Suspicious Activity Reports (SARs) when transactions that likely involve Bitzlato are identified.⁴

The FinCEN order was accompanied by a range of other enforcement actions by the United States and European authorities against Bitzlato and against top Bitzlato employees. On January 18, 2023, the U.S. Attorney’s Office for the Eastern District of New York announced that Anatoly Legkodymov, Bitzlato’s founder, was arrested in Miami and charged with unlicensed money transmission. In addition, coordinated action in Europe led by the French government and Europol has resulted in an additional four arrests and eight house searches in Spain, Cyprus, and Portugal. Authorities in Europe have also dismantled Bitzlato’s servers located in France, frozen hundreds of accounts at other crypto asset exchanges, and seized $18 million worth of crypto assets.

Whether a crypto asset company is operating in or outside of the U.S., AML considerations should be at the forefront of a compliance program; otherwise, the company may become the target of international regulators and cut off from the U.S. financial system.

If you have any questions about AML issues or other regulatory developments affecting the crypto asset industry, please contact any member of Wilson Sonsini's national security practice or fintech and financial services practice.

[1] FinCEN, FAQs Bitzlato, available at https://www.fincen.gov/sites/default/files/shared/FAQs_Bitzlato%20FINAL%20508.pdf.

[2] Id.

[3] Id.

[4] Id.