Global Markets May Face Risk of Virtual Currency Abuse as Russian Actors Seek to Circumvent Sanctions

The United States, the United Kingdom, and European Union have led a broad international coalition imposing a sweeping and unprecedented range of economic and financial sanctions against Russia and Belarus in response to Russia’s ongoing invasion of Ukraine. Experts and U.S. legislators warn that sanctioned Russian actors and their affiliates may turn to convertible virtual currencies (CVCs) in an attempt to evade these sanctions, protect their assets, and restore their ability to transact internationally.¹

• While it is unlikely that the Russian government will turn to well-established virtual currencies to evade sanctions on a large scale, Russia is expected to loosen regulatory requirements on CVCs to facilitate cryptocurrency transfers by private-sector actors, potentially including sanctioned persons, other illicit actors, and their networks and facilitators.
• At the same time, Russia is expected to expedite the development of its central bank digital currency (CBDC), the so-called digital ruble, which it hopes to use to trade directly with other countries.
• Russian state actors may also use CVCs to fund intelligence operations abroad and to accelerate cyberattacks against Western targets, including ransomware attacks and hacks targeting CVC exchanges.
• In response to these developments, the United States and its allies have called on financial institutions (FIs) and virtual asset service providers (VASPs) to be vigilant against efforts to evade sanctions and other restrictions through the use of virtual currencies and CVC-anonymizing tools.
• FIs and VASPs should be aware of red flags for potential sanctions evasion activity, apply enhanced scrutiny to CVC transactions associated with Russian and Belarusian customers and wallets, and expect additional sanctions on Russian CVC mining operations and the Russian VASP market.

Since 2020, the Russian government has progressively eased regulatory restrictions on CVCs and VASPs, reversing early moves to ban CVCs entirely and instead reclassifying them as foreign currency and permitting and taxing their use—even in the face of warnings from the Bank of Russia that digital currencies pose a threat to financial stability.²

•  If this trend continues in the face of recent sanctions and other restrictive measures, Russian oligarchs, government and military officials, and individuals active in the energy and finance sectors may turn increasingly to Russian-based VASPs and other third-party entities in an effort to evade sanctions, protect their assets, and restore their ability to transact internationally.³
•  Specifically, Russian actors may seek to use CVC transactions as a partial substitute for traditional cross-border payment channels, as well as to convert assets that may be subject to freezing or seizure into CVC. At the same time, major CVC exchanges have seen an increase in CVC transactions by non-sanctioned Russian individuals in the face of the ruble’s collapse.⁴
• Russia is home to several VASPs with weak or non-existing anti-money laundering (AML)/combating the financing of terrorism (CFT) controls, which have been known to be used by criminal groups to launder illicit funds from darknet markets, scams, fraud, and ransomware attacks. Primarily concentrated in Moscow, these VASPs received nearly $700 million worth of virtual currency from addresses associated with criminal activity between 2019 to 2021.⁵
• However, the CVC market in Russia remains relatively immature, and Russian businesses have been slow to adopt CVCs in the face of uncertainty surrounding Russia’s approach to regulating the CVC industry. Given the magnitude of the recent sanctions, industry analysts and the Biden Administration have stated that CVC transactions are unlikely to serve as an effective replacement for traditional financial channels at scale.⁶

Russia has long prioritized blockchain technology as an economic and national security goal, stating as early as 2020 that a digital ruble would diminish the dependence of the Russian economy on the U.S. dollar and help mitigate the impact of foreign sanctions.⁷ Faced with sweeping new restrictions, Russia is expected to expedite the development of the digital ruble as an alternative to the U.S. dollar and a means of evading sanctions that now span most of the world’s leading economies.

•  On February 15, 2022, the Bank of Russia announced the successful integration of three banks into the digital ruble pilot platform.⁸ Customers from two integrated banks also created digital ruble wallets using their mobile phones, converted rubles from their bank accounts into digital rubles, and conducted transactions.
• The Bank of Russia is expected to continue testing and refining the digital ruble platform in the coming months, including by expanding digital ruble access to additional users, testing the digital ruble as payment for goods and services, implementing smart contracts, and interacting with the Russian Federal Treasury.
• The acceleration of the digital ruble could complement Russian plans to expand its alternative international payments network—the System for Transfer of Financial Messages (SPFS)—following the removal of several Russian banks from the Society for Worldwide Interbank Financial Telecommunications (SWIFT) network.⁹
• However, analysts note that Russia’s so-called “SWIFT analogue” suffers from limited operating hours, size constraints, and a lack of international connectivity beyond Central Asia, making it unlikely to function as a full-scale SWIFT replacement.¹⁰

In the current environment, the Russian government is increasingly likely to view CVCs as a critical tool for funding intelligence operations abroad and conducting cyberattacks against Western targets. While these attacks often may be punitive in nature rather than a sanction-evasion strategy, the inherent features of CVCs make such operations potentially devastating to U.S. critical infrastructure, including financial institutions.

•  Several ransomware groups have been known to have connections to Russia’s Foreign Intelligence Service (SVR) and its Federal Security Service (FSB). It is likely that the Russian government will form closer ties with Russia-based ransomware groups to mount targeted cyberattacks against critical infrastructure in the U.S. and its allies.
• On February 27, 2022, an anonymous individual leaked a year’s worth of internal communications between members of Conti, a Russia-based ransomware group.¹¹ The leak occurred two days after the group threatened to launch cyberattacks on the critical infrastructure of any country that retaliated against Russia’s invasion of Ukraine. According to cybersecurity specialists, chat logs suggested that the group took direct orders from the FSB.¹²

The United States is taking an aggressive and proactive approach against the use of CVCs and VASPs to circumvent sanctions, aligning with previous U.S. government actions against individuals and entities engaged in illicit CVC and VASP activity.

•  On March 2, 2022, The U.S. Justice Department announced the launch of Task Force KleptoCapture, an interagency law enforcement force dedicated to enforcing the sanctions, export restrictions, and economic countermeasures imposed on Russia and Belarus.¹³ The mission of Task Force KleptoCapture includes investigating and prosecuting violations of new and future sanctions, combating unlawful efforts to undermine restrictions against Russian financial institutions, targeting efforts to use CVCs to evade sanctions or launder proceeds from corruption, and using civil and criminal asset forfeiture authorities to seize assets belongings to sanctioned persons.
• This effort complements the U.S. government’s ongoing campaign to target Russia-backed ransomware actors and operational infrastructure, including the Office of Foreign Asset Control’s (OFAC’s) September 2021 designation of a Russian virtual currency exchange and its November 2021 designation of a second Russian CVC exchange and its support network for facilitating transactions for ransomware actors.¹⁴

Key Considerations for the Private Sector

• VASPs and FIs serving VASP customers should be on guard for the use of CVCs and CVC-anonymizing tools by sanctioned persons and their networks for facilitators to evade sanctions and protect their assets internationally.
  • Established CVC exchanges have already taken steps to block CVC wallets with potential links to Russian sanctions targets, with Coinbase blocking 25,000 CVC wallet addresses related to Russian individuals or entities it believes to be engaging in illicit activity.¹⁵
  • VASPs may observe attempted or completed transactions tied to CVC wallets or other CVC activity associated with Russian, Belarusian, and other affiliated persons, and should scrutinize customers and transactions for the following red flags:¹⁶
    • Transactions initiated from or sent to Internet Protocol (IP) addresses previously flagged as suspicious and those from non-trusted sources or locations in Russia, Belarus, comprehensively sanctioned jurisdictions, and countries with weak AML/CFT regimes;
    • Transactions connected to CVC addresses listed on OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List); and
    • Customers using a VASP or foreign money services business in a jurisdiction with AML/CFT deficiencies.
  • FIs and VASPs should also be alert to the dangers posed by transactions made in connection with a Russian-related ransomware campaign, and should scrutinize customers and transactions for the following red flags:¹⁷
    • Customers receiving CVCs from an external wallet and immediately initiating multiple, rapid trades among multiple VASPs with no apparent related purpose, followed by a transaction off the platform;
    • Customers initiating a transfer of funds involving a CVC mixing service; and
    • Customers either directly or indirectly receiving transaction exposure identified by blockchain tracing software as related to ransomware.
• More generally, FIs and VASPs should review their sanctions compliance programs to ensure that risks associated with illicit CVC activity, including the use of CVCs to evade sanctions, are fully integrated into their policies, procedures, and controls.
  •  FIs should apply enhanced scrutiny to relationships with VASPs in jurisdictions with weak or undeveloped AML/CFT regimes and ensure that all VASP customers comply with international standards for due diligence and payment transparency.
  • VASPs should conduct annual risk assessments to determine their sanctions exposure risk and identify steps to take to minimize their risk. Risk assessments should reflect a VASP’s customer base, products, services, supply chain, counterparties, transactions, geographic locations, and the AML/CFT and sanctions controls of any relevant counterparties or customers.
  • VASPs that provide crypto-to-fiat conversion and nesting services to smaller exchanges should reassess their controls in light of evolving sanctions evasion risks. VASPs should request and review documents supporting and confirming that nested services have implemented an effective sanctions compliance program, monitor the transaction activity of such services, and request any information related to suspicious activity found on their accounts.
• FIs and VASPs should also ensure that they have the tools to understand the sanctions and other potential illicit finance risks associated with counterparty wallet addresses, going beyond simply screening wallet addresses against the OFAC SDN List. FIs and VASPs should consider implementing CVC transaction monitoring solutions that offer real-time monitoring and flagging of suspicious transactions, including transactions with potential exposure to sanctions.

Endnotes