The exploitation of cryptocurrency for terrorism purposes is an evolving threat. Since 2012, jihadist groups have improved in this sector by shifting from a bottom-up experimental approach (from activists to small groups) until growing, over the years, as a legitimized financing modus operandi promoted and used directly by international jihadist groups[i].
These funding methods are more and more expanding in the EU too. Since 2012, the sending of cash through the hawala or money transfer services from the EU to collectors located in Middle-eastern conflict zones was the main vector for transferring funds to jihadists. The constant monitoring of these networks has led terrorist organizations to seek more opacity, calling for cryptocurrencies through public online crowdfunding campaigns or hidden networks.[ii]
The exploitation of digital assets by jihadist groups spreads as fast as cryptocurrencies are becoming more popular among users and investors for legitimate use,[iii] urging states to a twofold and quick adaptation. On the one hand, promote and profit from fin-tech evolution by encouraging digital asset use and investments throughout a regulated ecosystem, on the other hand, apply stricter and potentially disincentive measures.
Crypto-market: from the world to the EU – from the EU to member states
To date, bitcoin’s market cap stands at more than $575bn and, if its volatile market value drops substantially, according to JPMorgan it could climb by 4.6 times, matching the $2.7tn of private sector gold investment. In particular, the forecast expects that bitcoin could rally as high as $146,000.[iv] Indeed, along with bitcoin, the cryptocurrency market is growing faster and faster globally, with altcoins as Ethereum that have raised their market value until €107tn, Monero, €2tn, and Zcash, €563bn.[v]
With these premises, cryptocurrency is expected to be an ever-growing global phenomenon that national rules may struggle to contain, especially through stricter measures aimed at disincentivize investments in this field to benefit the conventional banking system.
For instance, in the past, Chinese regulators banned initial coin offerings (ICO),[vi] shut down local cryptocurrency trading exchanges, and limited bitcoin mining, but activity has continued through alternative channels in China despite the crackdown[vii].
In some countries, cryptocurrency has been evolving as an alternative method of payment or store of value precisely because of the community’s distrust in the banking system. According to ING statistics, in 2018 nearly one in five (18%) in Turkey say they own cryptocurrency where 53% (and volumes roughly quadrupled over the past years)[viii] of the interviewed people claimed that cryptocurrency is the future of spending online and the future of investment[ix]. In the Middle East, Turkey is followed by Iran and Egypt Then, in 2020 an incredibly high rate of cryptocurrency ownership has been registered in Nigeria[x] and, since 2018, the same happened in many other politically unstable States in Africa.[xi]
Focusing on the EU, in the top ten countries of the Global Crypto Adoption Index no EU member-state is included.[xii] France is the first mentioned, ranked 21st[xiii], leading the way with Germany, with a quantifiable value on blockchain higher than $7.5bn.
Regarding the appeal of digital assets at an onboarding or investors level, researches found that, in the EU, cryptocurrency is still perceived as a borderline method of payment, with 25% of European investors thinking that certain digital assets are too much free from government intervention to be considered as appealing. This perception has anecdotal evidence because, despite the upward trending number of institutions adopting digital assets, some reticence remains related to price volatility (53%), concerns around market manipulation (47%), and lack of fundamentals to gauge appropriate value (45%).[xiv]
Moreover, the lack of cohesion across jurisdictions makes it hard for cryptocurrency companies to be comfortable with doing business in the EU market, with some countries embracing transformative technologies with top-down initiatives,[xv] while others remaining to simple investor protection warnings. As happened in Germany after they passed stricter requirements for crypto businesses which forced some companies to stop doing business in the country or the Estonian plans, aimed to create a national cryptocurrency “estcoins”[xvi] and normalize ICO, that was swiftly shut down by European Central Bank and local banking authorities.[xvii]
So far, the EU anti-money-laundering AML regulatory regime targeting cryptocurrencies was enacted via Directive (EU) 2018/843[xviii], on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. The Directive was enacted on the basis of the overall EU project to harmonize measures regarding the establishment of the internal market and was mostly applied to the intermediaries involved in cryptocurrency transactions. In particular, it stated that “to combat the risks related to the anonymity, national Financial Intelligence Units (FIUs) should be able to obtain information allowing them to associate virtual currency addresses to the identity of the owner of virtual currency.”However, the margin of discretion allowed to member states’ national legislative implementation, has caused an asymmetrical harmonization.
Nowadays, the EU Blockchain Observatory & Forum,[xix] an initiative sponsored by the European Commission which reports on the state of blockchain in the EU, has introduced a framework for ranking countries on a three-stage regulatory maturity curve.[xx] It designed an uneven framework. In this field, the EU is divided among countries where blockchain and digital assets regulation is generally absent (e.g. Belgium, Bulgaria, and Hungary), countries that have adopted wider regulatory schemes that relate to know-your-customer (KYC)/AML and investor protection (e.g. Italy, Austria, and Spain), and countries that have adopted specific legislation that pertains to digital assets, developing a national strategy to exploit them (e.g. France, Germany, and Malta).[xxi]
In this context, the European Commission has recently put forward plans to regulate crypto-assets[xxii], in a bid to reduce market fragmentation in this field by lowering risks for investors, while also giving legal certainty to those issuing these assets, to benefit consumers and businesses.[xxiii]
In particular, it will provide rules on digital asset custody and capital requirements, while also stipulating what the relationship between the token issuer and the token holder will be, including laying out a procedure for investors to file complaints against projects.[xxiv]
Upsetting national plans in the aftermath of terrorist attacks
On September 2020, more than 360 men from the France Direction centrale de la police judiciaire (DCPJ) and the Direction générale de la sécurité intérieure (DGSI), coordinated by the Parquet national antiterroriste (PNAT), dismantled a vast network of terrorist financing by cryptocurrencies benefitting French jihadists still settled in Syria.[xxv]
Active since 2019, the terrorist financing network was based on the purchase of cryptocurrency coupons, of a value between €10 and €150, in France. Then the references were transmitted by secure messaging to jihadists in Syria and these coupons were finally credited to accounts opened from abroad by jihadists who were in charge of converting them into cryptocurrencies on exchange platforms. According to prosecutors, two French jihadists, both 25, were the architects of the network, working from northeastern Syria[xxvi] as members of Hayat Tahrir Al-Sham since 2013.[xxvii]
The coupons to buy cryptocurrency in France were available at licensed tobacco outlets.[xxviii] There are about 24,000 in France offering various small payments services, with no identification legally required,[xxix] such as cashcard top-ups and money coupons, and (since a 2019 deal with a French fintech company) cryptocurrencies. A blind-spot for authorities that facilitated the perpetration of this illicit network for more than a year. This episode raised interest in terrorism financing by cryptocurrencies and brought France Minister of the Economy and Finance to declare that “cryptocurrencies pose a real problem of terrorist financing”. Nonetheless, in the aftermath of this event, no additional measure to regulate cryptocurrencies business was provided by the government.[xxx]
Apparently the approach changed in December 2020 when, in the aftermath of the recent terrorist attacks in France, France’s Council of Ministers planned a series of measures to tighten the surveillance of cryptocurrency, requiring full KYC measures for all crypto transactions and mandatory registration for all crypto-to-crypto exchanges[xxxi].
In particular, the new regime provides that French Digital Asset Service Providers have to register with the French Financial Market Authority (Autorité des marchés financiers, AMF). Otherwise, they will no longer be able to offer their services to new customers.[xxxii] Thus, on the one hand, the AMF must verify that senior managers and shareholders are of good repute and competence through obtaining documents such as identification, a CV, and a statement that they are not the subject of a criminal conviction or a prohibition to engage in an activity. On the other hand, obtaining an AMF license for the provision of certain services is optional, providing a degree of flexibility that could potentially pose certain risks, leaving these services still unregulated and exposing investors to financial loss without the option of compensation.[xxxiii]
The other set of measures that will be implemented is related to strict KYC rules. All crypto transactions worth more than €0 will have to go through full KYC processes and require two government identification forms: a SEPA[xxxiv] transfer accompanied by an ID. The previous limit for KYC checks was €1,000, applying only to crypto-to-fiat (i.e. government-issued currency) transactions. So, these measures would help to ban anonymous accounts from crypto exchanges but also bring repercussions to investors.[xxxv]
Stricter rules could decrease investments (and the level of security)
In France, as in other EU member states, stricter regulations on cryptocurrency businesses could bring three options to the table of players: come up to new standards, consider relocating their operations away from the EU, not serving EU customers.[xxxvi]
AML/KYC measures can quickly and, in some cases, incoherently reshape the FinTech sector, hampering future growth. Same as in the US, with the recently Notice of Proposed Rulemaking (NPRM) submitted by the U.S. Department of the Treasury to the Federal Register, that would require cryptocurrency businesses to submit reports, keep records, and verify the identity of customers. By responding to the NPRM, Chainalysis gave an overall picture of the importance of proportionality of AML/KYC measures concerning the cryptocurrency landscape and monitoring methods available in this sector.[xxxvii]
According to the company, regulations on cryptocurrency shouldn’t be the mirror of measures applied to banks and other financial institutions. For instance, by taking into account that cryptocurrency transactions are automatically logged on public blockchains, law enforcement can already view transactions facilitated by cryptocurrency businesses, making currency transaction reports redundant and useless in this field. Moreover, the response to the NPRM stresses the fact that 62% of the illicit cryptocurrency traced by Chainalysis is cashed out at exchanges with functional compliance programs, including AML/KYC measures. Thus, is crucial to focus on vulnerabilities stemming from other platforms used to move illicit funds, first of all, mixers and non-compliant exchanges operating in high-risk jurisdictions. Another relevant issue is related to the privacy and security provided by a single governmental central database of users’ data and cryptocurrency transactions. In the case of a hacker attack, it would provide illicit actors with a list of targets, their location, and how much cryptocurrency they hold.
Hence, measures applied without understanding the technology behind cryptocurrencies could turn into a double-edged sword. In the EU, future events related to jihadist terrorism and fin-tech could push governments to propose stricter measures. This approach would provide an immediate sense of control over cryptocurrency businesses while becoming counterproductive in the long-term both at a security and economic level by lowering investments, number of users, and privacy. However, the current institutional awareness developing in this sector can be assessed as a good start. Nonetheless, it is fundamental for institutions to engage with representatives from the private sector to discuss how regulation can be tailored to reflect cryptocurrency technology. This cooperation is the best way to effectively avoid that cryptocurrencies evolve through legislative and economic grey zones, where risks can increase exponentially while jihadist funding can proliferate undisturbed.
[i] US Department of Justice – Office of Public Affairs (August 13, 2020) Global Disruption of Three Terror Finance Cyber-Enabled Campaigns – Largest Ever Seizure of Terrorist Organizations’ Cryptocurrency Accounts. The United States Department of Justice. https://www.justice.gov/opa/pr/global-disruption-three-terror-finance-cyber-enabled-campaigns
[ii] D.M. Barone (November 2019) The decentralized finance-violent extremism nexus: ideologies, technical skills, strong and weak points. Sicurezza, Terrorismo e Società. http://www.sicurezzaterrorismosocieta.it/wp-content/uploads/2019/11/The-decentralized-finance-violent-extremism-nexus_ideologies-technical-skills-strong-and-weak-points-Daniele-Barone.pdf
[iii] D.M. Barone (September 2, 2020) US multiagency operation dismantled part of al-Qaeda’s cryptocurrency network. What we learned so far and what to expect. ITSTIME. https://www.itstime.it/w/us-multiagency-operation-dismantled-part-of-al-qaedas-cryptocurrency-network-what-we-learned-so-far-and-what-to-expect-by-daniele-m-barone/
[iv] R. Browne (January 5, 2020) JPMorgan says bitcoin could rise to $146,000 long term as it competes with gold. CNBC. https://www.cnbc.com/2021/01/05/jpmorgan-bitcoin-price-could-rise-to-146k-as-it-competes-with-gold.html
[v] Today’s Cryptocurrency Prices by Market Cap. CoinMarketCap. https://coinmarketcap.com/it/
Viewed on January 8, 2020.
[vi] ICO is technically an acronym that stands for “Initial Coin Offering”, an expression used in analogy with the stock market lexicon, where “Initial Public Offering” (IPO ) means a public offering of shares in a company that intends to be listed on a regulated market for the first time. However, unlike IPOs, ICOs are not regulated and those who invest in an ICO do not get shares in exchange, but tokens (i.e. a unit of the new cryptocurrency that is launched).
[vii] (January 15, 2018) Any rule on Bitcoin must be global, Germany’s central bank says. Reuters. https://www.reuters.com/article/us-bitcoin-regulations-germany-idUSKBN1F420E
[viii] L. Cuen (August 2020) Istanbul or ‘Coinstantinople’? Inside Turkey’s Bitcoin Bull Market. Coindesk. https://www.coindesk.com/inside-turkey-bitcoin-bull-market
[ix] IPSOS for ING – International Survey (June 2018) Cracking the code on cryptocurrency. https://think.ing.com/uploads/reports/ING_International_Survey_Mobile_Banking_2018.pdf
[x] K. Buchholz (August 2020) How Common is Crypto?. Statista. https://www.statista.com/chart/18345/crypto-currency-adoption/
[xi] P. Rao (April 2018) Africa could be the next frontier for cryptocurrency. Africa Renewal. https://www.un.org/africarenewal/magazine/april-2018-july-2018/africa-could-be-next-frontier-cryptocurrency
[xii] Created by Chainalysis to quantify the differences in adoption between countries across the globe, by measuring cryptocurrency activity while accounting for each country’s population (as the country’s total number of internet users) and economy size (i.e. purchasing power parity per capita).
The 2020 Geography of Cryptocurrency Report Analysis of Geographic Trends in Cryptocurrency Adoption, Usage, and Regulation (September 2020). Chainalysis.
[xiii] https://markets.chainalysis.com/#geography-index
[xiv] (September 6, 2020) Growing Number of Institutional Investors Believe That Digital Assets Should Be a Part of Their Investment Portfolios, According to New Research from Fidelity Digital Assets. Fidelity Investments. https://newsroom.fidelity.com/press-releases/news-details/2020/Growing-Number-of-Institutional-Investors-Believe-That-Digital-Assets-Should-Be-a-Part-of-Their-Investment-Portfolios-According-to-New-Research-from-Fidelity-Digital-Assets/default.aspx
[xv] Digitals Wien. A digital pilot and research project for playful rewards for climate-friendly behaviour.. https://digitales.wien.gv.at/site/en/projekt/culture-token/?ref=hackernoon.com
[xvi] C. O’Brien (December 9, 2017) Estonia planning its own cryptocurrency, called ‘estcoin’, in bid to become global ICO hub. Venture Beat. https://venturebeat.com/2017/12/19/estonia-wants-its-own-cryptocurrency-called-estcoin-in-bid-to-become-global-ico-hub/?ref=hackernoon.com
[xvii] O. Ummelas (June 1, 2018) Estonia Scales Down Plan to Create National Cryptocurrency. Bloomberg. https://www.bloomberg.com/news/articles/2018-06-01/estonia-curbs-cryptocurrency-plan-that-drew-rebuke-from-draghi
[xviii] Official Journal of the European Union (May 30, 2018) https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018L0843
[xix] EU Blockchain Observatory & Forum. https://www.eublockchainforum.eu/
[xx] (November 20, 2020) EU Blockchain Ecosystem Developments. EU Blockchain Observatory & Forum. https://www.eublockchainforum.eu/sites/default/files/reports/EU%20Blockchain%20Ecosystem%20Report_final_0.pdf
[xxi] L. Dionysopulos (November 26, 2020) At the brink of a tectonic shift, EU countries that do crypto-regulation right
[xxii] European Commission (September 24, 2020) Digital Finance Package: Commission sets out new, ambitious approach to encourage responsible innovation to benefit consumers and businesses. https://ec.europa.eu/commission/presscorner/detail/en/IP_20_1684
[xxiii] S. Amaro (September 24, 2020) The EU announces its first ever plan to regulate cryptocurrencies. CNBC. https://www.cnbc.com/2020/09/24/eu-valdis-dombrovskis.html
[xxiv] P. Baker (September 24, 2020) EU Proposes Full Regulatory Framework for Cryptocurrencies. CoinDesk. https://www.coindesk.com/eu-proposes-full-regulatory-framework-for-cryptocurrencies
[xxv] C. Cornevin (September 29, 2020) Vaste filière de financement du terrorisme démantelée: 29 interpellés en France. Le Figaro. https://www.lefigaro.fr/actualite-france/vaste-filiere-de-financement-du-terrorisme-demantelee-29-interpelles-en-france-20200929
[xxvi] (September 29, 2020) France arrests 29 in anti-terror Syria financing sting. France 24. https://www.france24.com/en/20200929-france-arrests-29-in-anti-terror-syria-financing-sting
[xxvii] (October 03, 2020) 8 charged in French cryptocurrency scheme to finance jihadis. ABC News. https://abcnews.go.com/International/wireStory/charged-french-cryptocurrency-scheme-finance-jihadis-73403002
[xxviii] (January 8, 2019) French ‘Tabac’ shops diversify, selling bitcoin for cash. Reuters. https://www.reuters.com/article/us-france-bitcoin-tobacco-idUSKCN1P21ZN
[xxix] Keplerk. Points of sales. https://www.bykep.com/en/store-locator
[xxx] P.R. DeMichelis (December 21, 2020) Le secteur des cryptomonnaies en pleine effervescence cette année. Les Echos. https://investir.lesechos.fr/placements/vie-pratique/actualites/le-secteur-des-cryptomonnaies-en-pleine-effervescence-cette-annee-1940574.php
[xxxi] Y. Khatri (December 8, 2020) France is on the verge of imposing mandatory KYC rules for all crypto transactions, industry sources say. The Block. https://www.theblockcrypto.com/post/87001/france-crypto-rules-mandatory-kyc-crypto-to-crypto
[xxxii] (December 8, 2020) Bitcoin Daily: France Eyes Strict Rules For Crypto Transactions; Messari Report Says US Last Hurdle For Bitcoin. Pymnts. https://www.pymnts.com/blockchain/bitcoin/2020/bitcoin-daily-france-eyes-strict-rules-crypto-transactions-messari-report-says-united-states-last-hurdle/
[xxxiii] J. Galea New Regime for French Digital Asset Service Providers. BlockGeeks. https://blockgeeks.com/guides/new-regime-for-french-digital-asset-service-providers/
[xxxiv] Single Euro Payments Area (SEPA): is a fast and cheap payment method that allows transferring of Euros between EU residents’ bank accounts. SEPA allows to buy cryptocurrency directly using a bank account in Europe and in Euros.
[xxxv] K. Helmes (December 13, 2020) France Approves New Cryptocurrency Measures to Fight Anonymous Transactions. Bitcoin.com. https://news.bitcoin.com/france-new-cryptocurrency-measures-fight-anonymous-transactions/
[xxxvi] K. Barnato (May 2, 2016) Will terror attacks end bitcoin free-for-all in Europe? CNBC. https://www.cnbc.com/2016/05/02/will-terror-attacks-end-bitcoin-free-for-all-in-europe.html
[xxxvii] (January 7, 2021) Chainalysis’ Formal Response to Treasury’s Proposed Rules Regarding Unhosted Cryptocurrency Wallets. Chainalysis. https://blog.chainalysis.com/reports/chainalysis-response-to-treasury-proposed-rules-unhosted-cryptocurrency-wallets