How I Learned to Stop Worrying and Love Unhosted Wallets

Over the past year, governments around the world have expressed concern about the risks of illicit financial activities such as money laundering, terrorist financing, and the evasion of international sanctions arising from the use of “unhosted” wallets—software applications that allow users to conduct pseudonymous, personal transactions in crypto assets over the internet without the use of a financial intermediary. The clearest expression of this concern is a recent study published by the Financial Action Task Force (FATF), an intergovernmental body founded in 1989 by G7 countries to publish and promote global adoption of regulatory standards that combat illicit financial activities. That report acknowledged the limited risk currently posed by unhosted wallets in comparison to traditional financial channels, but nonetheless urged global regulators to consider various restrictive measures should adoption increase. Proposed measures for consideration included transaction limits on unhosted wallets, restricting the ability of regulated financial institutions to transact with them, and licensing, or even prohibiting, the platforms that support them. The report echoes fears about personal crypto transactions expressed by policymakers in the United States, which has traditionally been the vanguard of efforts to disrupt and dismantle illicit financial networks.

These recommendations represent a noticeable shift in global regulatory priorities to combat illicit financial activities that originated over 50 years ago in the United States with the passage of the Bank Secrecy Act (BSA), the first anti-money laundering (AML) regime in the world. The BSA was designed to address the illicit finance risks of cash—an earlier, more prevalent, technology enabling private transactions between individuals—that fueled the rise of organized crime and international narcotics trafficking. Despite the heightened illicit finance risk posed by cash, policymakers have traditionally avoided measures that segregate private transactions from formal financial channels. They have instead favored an approach that gives financial intermediaries, which perform critical aggregation and settlement functions, a key role in providing financial intelligence that can assist law enforcement investigations.

The BSA imposes record keeping and reporting requirements on financial institutions, chief among them requirements to report suspected criminal activities to law enforcement authorities and to maintain customer identification and “know your customer” records that can be obtained by law enforcement authorities with a subpoena or other legal process. It was intended to prevent financial institutions from using customer privacy as a shield for their own complicity in, or active indifference to, their customer’s illicit activity—a tactic employed in the past by Swiss banks and financial intermediaries in other bank secrecy jurisdictions.

Although not always acknowledged, all AML regimes involve tradeoffs between equally important social values of financial integrity, financial privacy, and financial access or inclusion. The BSA is no exception and reflects choices about the acceptable level of illicit financial activity that balances financial inclusion and financial privacy goals. On the one hand, it accepts the risks posed by private financial transactions in light of the countervailing benefits to financial privacy and economic opportunity. At the same time, it implicitly accepts the tangible costs of recordkeeping and reporting requirements that further financial transparency but can adversely impact access to financial services. And the intangible costs to financial privacy of mandated third-party surveillance are not ignored, but they are limited to preventing its misuse by the government in connection with criminal prosecutions. Customer records are protected by statutory rights of financial privacy, with an exception for disclosure of suspected criminal activity to law enforcement authorities; but public disclosure of so-called “suspicious activity reports” (SARs) is prohibited by fines and potential incarceration, including in connection with criminal prosecutions and other legal proceedings. And SARs themselves cannot be used as evidence; instead, law enforcement authorities must obtain evidence through other legal means, including subpoenas.

The principles first captured by the BSA have been effectively globalized through a set of recommendations that were originally published by the FATF in 1990 and have evolved over time to incorporate measures that address terrorist financing, international sanctions, and other new and emerging threats. These recommendations enshrine basic obligations like customer identification and “know your customer” requirements (KYC), the so-called travel rule, and suspicious activity reports, that require disclosure of possible criminal activity. Despite their evolution over time, the FATF recommendations continue to reflect the basic intuition at the heart of the BSA—i.e., that financial transparency through intermediary regulation is the most effective means to combat illicit finance consistent with the values of financial privacy and financial inclusion.

In 2013, the Financial Crimes Enforcement Network (FinCEN)—an agency within the U.S. Treasury Department responsible for administering the BSA—issued guidance applying these basic principles to the nascent cryptocurrency industry. FinCEN’s guidance asserted that only financial intermediaries acting on behalf of customers were subject to the record keeping and reporting requirements of the BSA as “money services businesses” (MSBs), and consistent with its core principles excluded “users” of cryptocurrency from its scope. That same distinction was reiterated and clarified by FinCEN in 2019 guidance, which coined the term “unhosted wallets” to describe software that enabled individuals to hold and use crypto assets on their personal devices, and it was contrasted to custodial products and services (“hosted wallets”) offered by financial intermediaries. FinCEN guidance was subsequently incorporated into the FATF’s revised recommendations published later that year, and those recommendations have become the basis for laws being adopted globally to mitigate illicit finance risks arising from crypto-assets. They are focused on bringing all jurisdictions to a minimum standard by extending existing record keeping and reporting requirements already imposed on traditional financial institutions to crypto-exchanges, custodians, and other “virtual asset service providers” (VASPs), the FATF-preferred name for financial intermediaries that have arisen to serve the developing crypto-ecosystem.

Regulatory priorities shift in response to Libra and the rise of DeFi

The FATF report released earlier this year presented the results of a year-long study to monitor the progress of jurisdictions in adopting its recommendations, and reflected a growing unease with trends in the cryptocurrency industry over the past year that could undermine the consensus balance between the competing concerns of financial transparency, financial privacy, and financial inclusion that has governed for the past 50 years. This unease arises from rapid innovation in the industry which has typically been dominated by start-up projects that face structural limitations to organic growth. The publication of the Libra whitepaper changed perceptions of the industry overnight, raising the possibility that global technology companies with massive installed user bases could drive adoption of crypto-assets to levels that rival traditional financial flows. In addition, although Libra itself has withdrawn plans to develop a fully decentralized blockchain network that supports unhosted wallets, rapid innovation has led to a proliferation of decentralized protocols that can run on mobile devices, support stable value crypto-assets (stablecoins), exchange crypto-assets (DEXs) and provide other financial services without intermediaries (DeFi)—all of which have the potential to increase the adoption of personal crypto transactions by mainstream users.

From this perspective, personal crypto transactions seem to marry the benefits of cash with the convenience of an electronic payment, but without either the physical constraints of the former or the risk controls imposed on the latter. This has led some to describe unhosted wallets as a personal Swiss bank account enhanced by the global reach of the internet—the very same danger which the global standards created by FATF over the past 5 decades was intended to address. Policymakers fear that full maturity of these decentralized protocols could foreshadow a future without financial intermediaries, which would significantly inhibit law enforcement’s ability to identify, prosecute and otherwise disrupt illicit financial networks in an environment when the effectiveness of these tools is already being challenged.

There are however strong reasons to believe that the opposite is true—that personal crypto transactions pose less illicit finance risk than commonly believed. Unhosted wallets are more like a personal billfold than a Swiss bank account; and unlike cash, crypto-assets are not legal tender, and thus still not universally accepted for goods and services in the real economy. While there are some exceptional circumstances such as hyperinflation or severe currency devaluations that allow crypto-assets to take on some of these attributes in specific regions, or “darknet” markets where illicit goods and services are priced and paid for in crypto-assets, these are unlikely to lead to wholesale and global changes in consumer behavior. Practically speaking, even illicit actors—much like legitimate businesses or individuals—must eventually convert between crypto assets and local fiat currencies to meet basic needs and run their operations. One could theoretically imagine a world where crypto assets serve this purpose, however that future remains uncertain and remote—a reality that is all too apparent to entrepreneurs launching crypto-projects, who daily contend with the challenge of achieving organic growth without deep and liquid fiat on and off ramps. Indeed, an important reason for Bitcoin’s continuing market dominance despite proliferation of other crypto-assets over the past decade, as well as the increasing market share of fiat-backed stablecoins, is ready convertibility to fiat currency through regulated intermediaries.

This conclusion is strongly supported by available evidence demonstrating that transactions involving a VASP/MSB on either side of a transaction, particularly those that involve fiat on and off-ramps, constitute a dominant and growing share of the global market by volume. As VASPs/MSBs, these intermediaries are required to comply with the recordkeeping and reporting requirements imposed by the BSA and jurisdictions that adopt the FATF recommendations. Moreover, even if—as policymakers fear and crypto-enthusiasts hope—DEXs and DeFi protocols begin to displace financial intermediaries, these developments are unlikely to affect fiat on and off ramps, which face significant technological and regulatory barriers to decentralization (specifically the need for some trusted intermediary to establish a banking relationship). All of this suggests that FATF’s focus on non-compliant VASPs and systemic vulnerabilities arising from jurisdictions with weak or non-existent illicit finance compliance requirements remains the most effective way of combating illicit financial activity involving personal crypto transactions.

Perhaps most importantly, policymakers must come to terms with a technological shift that is driving the rise of decentralized blockchain protocols. Those changes have the potential to transform the architecture of the internet, collapse the distinction between communication and settlement of value on networks, and rewire some of the ways we think about financial services, particular in driving financial inclusion. Critically, these are primarily technological advances that give rise to financial innovations, and thus policymakers seeking to prohibit or restrict their development and use would be wise to heed King Canute’s warning about the futility of stopping the ocean’s tides from rising. A sober review of the technology explains why such efforts are bound to fail and will only serve to undermine rather than enhance efforts to detect and disrupt illicit financial activity.

Demystifying blockchain technology

Although first created in connection with Bitcoin, blockchains are not simply a financial technology. They are an emerging family of cryptographic protocols which solve a fundamental problem that evaded generations of computer scientists before publication of the original Bitcoin whitepaper—i.e., how to create a resilient network that avoids reliance on single points of failure. Blockchains shun reliance on a central server acting as a single source of truth in favor of consensus among a distributed network of computers. They accomplish this by allowing anyone who wants to participate in operating the network to download and run open source code which gives rise to redundant copies of a common ledger stored on each networked computer. This distributed ledger is public and open to anyone for inspection, increasing community trust in its content. New information is only recorded in the ledger when a majority of computers agree on the information captured—a consensus based mechanism that contributes to better network resilience against malicious attacks than server based networks because a successful attack requires acquisition or compromise of a majority of networked computers, rather than a single, central server. Resilience increases as the network scales since it becomes increasingly difficult for malicious attackers to acquire a controlling stake. Applications built on distributed networks are in their infancy, but are beginning to be used for a variety of functions not limited to financial services, including network security, secure file storage, and private web browsing that could support the development of a web 3.0.

Blockchain protocols create economic incentives to overcome the collective action problem inherent in a consensus based network of computers that do not know, or have reason to trust, one another. They do so by rewarding users who are part of the majority consensus with crypto-assets that can be freely sent between network users. These crypto-assets are actively traded on secondary markets, and their prices—although not precisely understood—appear to reflect the scale of network adoption, giving holders an economic stake in the network’s integrity. As an internet-based technology, this effectively opens up network operations to a dynamic group of user-operators whose composition can change over time, and who share the economic benefits of network success, potentially mitigating the concentration of economic power that characterizes the current internet. It also places a premium on establishing secure ownership of crypto-assets.

Ownership is recorded on the distributed ledger by associating a network user’s unique identifier—their “public address”—with the crypto-assets that belong to them; however, the transparency of the ledger exposes holders of crypto-assets to the potential risk of theft and fraud. Therefore, encryption algorithms built into the protocol address this vulnerability by allowing users to create a private key known only to them that generates a public address from which their private key cannot be reverse-engineered. Since assets can only be sent from a public address by a holder of the private key, a user can share their public wallet address without concern—unlike, for example, a bank account number—allowing it to serve as a secure pseudonym for blockchain transactions. A private key is the essential feature that enables users to interact on a blockchain network, and the function to generate one is accessible through a native—though not particularly user friendly—command line interface contained in the open source protocol. Once generated, users are responsible for securely preserving their own private keys, theft or loss of which results in permanent loss, making crypto assets a digital bearer instrument owned by a private key holder.

As the industry has matured, third-party developers have created software applications known as wallets to securely hold public/private key pairs to help drive adoption by less sophisticated users, which regulators refer to as “unhosted” wallets. While these software wallets typically grab the attention of policymakers worried about illicit finance risks, an “unhosted” wallet can be—and often has been—nothing more than a piece of paper on which a user jots down their public/private key pair. As a result, transaction limits, or other restrictions on them—let alone outright prohibition—are not practically feasible, and would prove little more than an empty gesture that might hinder mainstream adoption, but would do little to deter illicit financial activity.

In contrast, what regulators refer to as “hosted” wallets are not really wallets at all. They are internal accounting systems maintained by VASPs, which actually hold one or more encrypted key pairs which they use to aggregate holdings of their clients. Customers have contractual rights to a portion of the assets held by the VASP. “Hosted wallets” replace the inherent transparency of the blockchain with the artificial opacity of a private ledger. Importantly, transactions through both “hosted” and “unhosted” wallets are indistinguishable on the blockchain—they both appear as pseudonymous crypto-transactions on a public ledger.

Restricting personal cryptocurrency transactions is impractical and ineffective

Since personal cryptocurrency transactions are an inherent attribute of blockchain technology, not an incidental feature enabled by unhosted wallets, restricting their use would require prohibiting the development of blockchain protocols themselves—or requiring that protocols only support hosted wallets, which amounts to the same thing—something that would be practically difficult to accomplish. Most blockchain technology is open source code freely available to anyone with an internet connection who chooses to participate in the network. At least in the United States, restrictions on the dissemination of open source software face constitutional and policy barriers, and regardless, likely require a degree of repression that raises foundational questions in any open and democratic society. Perhaps more importantly, the practical experience of countries that have attempted to impose either formal or informal restrictions on crypto-assets demonstrates their ineffectiveness. The development of blockchain technology and crypto-assets has exploded in countries as different as Lebanon, China and South Korea despite attempts to limit or restrict their general availability, recently leading South Korea to abandon this approach.

Efforts to regulate the use of open source software by establishing licensing requirements for software protocols or mandating the inclusion of certain features within them is unlikely to prove any more successful than prohibiting their use. As an initial matter, financial regulators should carefully consider whether they have sufficient knowledge and experience to manage the technical decisions of software developers. While financial regulators have a great deal of experience supervising vendor risk management practices at financial institutions, those efforts are focused on assessing the effectiveness of controls put in place to minimize disruptions to their core business rather than assessing and managing technology development, which regulators have wisely refrained from doing. At any rate, successful implementation of such a licensing or regulatory regime would likely prove to be a pyrrhic victory. Open source protocols are by their nature developed by a community of developers that span the globe and as a result are not subject to the regulatory regime of any single country. Licensing restrictions would have no impact on the development of this technology, and would merely push it to countries without similar requirements. Unless accompanied by repressive measures to restrict the flow of information, such restrictions would not impact their availability within those regulated jurisdictions, particularly for illicit actors seeking to misuse the technology.

Policymakers globally have also considered more targeted approaches, for example requiring VASPs to verify the identity of unhosted wallets with which its customers transact; however, such approaches would cause more harm than good, and ultimately fail to mitigate the risk of illicit financial activity. They effectively establish KYCC—“know your customer’s customer/counterparty”—requirements that have traditionally been resisted by financial regulators for good reason. Unlike KYC requirements which arise from a direct customer relationship, KYCC requirements unreasonably obligate non-customers to provide personally identifying information to a VASP/MSB they do not know or do business with, and whose security and privacy practices they have not evaluated, simply because they happen to transact with one of its customers. Collecting identity information from individuals who are not customers would also prove challenging for VASPs, and likely only limit access to legitimate customers—particularly those from financially disadvantaged communities who stand to benefit most from this technology—since illicit actors would simply employ so-called money mules, or use stolen and synthetic identities to defeat the requirement, just as they do with respect to KYC requirements today. The result would be to further exclude financially marginalized populations and hinder innovation which could serve their needs, without meaningfully affecting illicit financial activity.

Prohibitions or restrictions against personal cryptocurrency transactions are not only impractical and ineffective at deterring illicit financial activity, they can also actively undermine efforts to combat it. This should come as no surprise since restrictions on blockchain technology and personal cryptocurrency transactions are analogous to capital controls, which tend to drive financial activity into underground black markets where they have been adopted. Black-market peso exchanges, hawalas, and other informal channels that support illicit financial activity were born in part because of capital controls that deprive businesses and individuals—including many on the margins of the financial systems—of legitimate and safer institutional channels to meet their daily economic needs. In a similar vein, countries that have adopted draconian restrictions on crypto assets have found that users have resorted to private back alley transactions, and homegrown digital hawalas. Experience teaches us that these mechanisms can be difficult to detect since those running a hawala or black market peso exchange often conceal their activities through a front company operating as a corner bodega or electronics business that are difficult to distinguish from their legitimate counterparts. These informal exchanges also reduce the effectiveness of blockchain analytic tools that can mitigate this risk, which depend on continued direct interaction between VASPs and unhosted wallets. Moreover, once established, they provide a highly effective channel for illicit financial activity, and as a result are exceedingly difficult to eliminate even after restrictions are lifted.

The most likely outcome of these and other efforts to regulate, restrict, or prohibit the development and use of open source software would be to drive private crypto activity from regulated and transparent financial intermediaries that can provide actionable information to law enforcement into opaque, back alley operations or jurisdictions with weak compliance requirements that affirmatively frustrate such efforts. Law enforcement authorities and regulators would find themselves engaged in a game of “whack-a-mole” to address a problem that they created. In sum, restrictions or prohibitions on blockchain protocols ultimately lead to less efficient use of law enforcement resources.

Cryptocurrency is the solution not the problem

Paradoxically, the most effective way of minimizing the misuse of blockchain technology to conduct illicit financial activities is to embrace industry trends that are driving decentralized protocols, rather than attempting to inhibit or restrict their development and use. Although policymakers often publicly recognize the regulatory benefits that flow from the traceability of transactions, they have been slow to truly appreciate how the inherent transparency of blockchain transforms the very way we think about combating illicit financial activity. Specifically, mandated financial surveillance was never intended as an end in itself—it was designed to overcome barriers to law enforcement investigations that arise from the essential anonymity of cash transactions combined with the role of financial intermediaries in aggregating and settling transactions on private ledgers. Banks and other traditional financial institutions spend enormous sums of money implementing transaction monitoring systems that typically generate false positives in excess of 90 percent and require armies of investigators to clear. Governments then invest enormous resources on their own data analytic tools that unwind this noisy data to identify trends and leads that can support law enforcement investigations. Moreover, limited by legal restrictions, the government struggles to share information with financial institutions that would provide the context essential to generate high value SARs. While public authorities in the United States, U.K. and elsewhere have had some success addressing these issues through public-private partnerships that facilitate information sharing, these arrangements face clear limits to scalability.

Keen observers have always recognized that the SAR regime is a second best solution driven by historical circumstance rather than a logical necessity, and that law enforcement investigations would be better served by directly obtaining raw transaction data. However, those solutions have been rightly constrained by legal and prudential concerns about their privacy implications—until the emergence of decentralized blockchain protocols, which natively allows law enforcement to conduct investigations unconstrained by the barriers posed by financial intermediation. This allows law enforcement to triangulate transaction data with investigative information and intelligence sources to more effectively identify, disrupt and dismantle illicit financial networks. Additionally, blockchains maintain data on a distributed network of computers unconstrained by legal jurisdiction and allow law enforcement to conduct real time illicit finance investigations that no longer require formal and cumbersome international treaty requests for financial information that can take years to fulfill and often frustrate investigators. Significantly, financial transparency, previously dependent on a financial institution’s operational ability—or willingness—to implement effective controls, is instead hard coded into decentralized blockchain protocols. As a result, law enforcement authorities and regulators no longer have to expend resources ensuring regulatory compliance that would be better spent directly detecting, investigating and preventing illicit financial activity.

In sum, decentralized protocols do not circumvent regulatory recordkeeping and reporting requirements—as some critics argue—they render them unnecessary, leading to a far more effective allocation of resources in the process. Governments no longer have to spend constrained budgets re-analyzing noisy data and enforcing compliance obligations against third party intelligence collectors, and can instead redeploy those resources to detect illicit financial activity, prosecute illicit actors, forfeit illicit proceeds, and dismantle illicit financial networks. Blockchain analytics companies can achieve economies of scale and act as a kind of public utility offering commoditized services that were previously performed by separate financial intelligence functions within each VASP. Intermediaries that build on decentralized blockchain protocols can more effectively focus their resources on managing the actual illicit finance risks that arise from their businesses. And while these benefits are currently limited to the cryptocurrency industry, as blockchain technology is incorporated into traditional financial services it provides a model that can scale, and allows for consideration of new regulations targeted to the actual risks that manifest in this new environment.

Jai Ramaswamy is Head of Risk, Compliance and Regulatory Policy at cLabs, working on Celo, and was previously Chief of the Asset Forfeiture & Money Laundering Section of the Department of Justice’s Criminal Division. He has also served as the Global Head of AML Compliance at Bank of America/Merrill Lynch and the Head of Enterprise Risk Management at Capital One.