Q & A on White House sanctions over technology from foreign adversaries

By Christine Duhaime | May 21st, 2019

Last Wednesday, the White House issued an executive order (the “Order“) under the International Emergency Economic Powers Act, 50 U.S.C. 1701, the National Emergencies Act, 50 U.S.C. 1601, and §301 of Title 3 of the United States Code, prohibiting transactions of hardware, software or other products or services that enable information processing, data processing, data storage, data retrieval or electronic communications to foreign adversaries.

Who does it apply to? 

The Order applies to all US citizens and residents, as well as US companies and companies resident in the US, or companies with US shareholders above the threshold.

The Order prohibits transactions and under correspondent banking law, the Order applies to any entity, any bank, and any person who avails itself of a US correspondent bank for a prohibited transaction involving Prohibited Tech with a foreign adversary.

What and who does it target? 

The Order targets financial and contractual transactions and specifically those involving communications and data technology associated with foreign adversaries, which means a foreign government engaged in serious conduct (or long-term patterned conduct) adverse to the national security of the US or to the security or safety of a US person (a natural and legal person).

It also targets a foreign person (legal or natural person) who is not part of a foreign government who engages in serious conduct adverse to the national security of the US or to the security or safety of a US person.

A foreign adversary can be any person or any company from any country that is not the US – what is targeted is the conduct by any non-US person or company from any country, as well as known foreign adversaries to the US (e.g., Iran, Korea) whose contractual dealings or transactions pose an undue risk to US security or tech resiliency.

Continue reading →

Canadian Member of Parliament Introduces Bill to Allow for Crypto Capital Gains Donations to Charities

By Christine Duhaime | May 17th, 2019

Canadian Parliamentarian Dan Albas, has introduced Bill C-452 in Parliament today which would allow holders of cryptocurrency to make charitable donations in crypto to Canadian charities and get a tax credit for their donations.

The short but powerful amendment to the Income Tax Act, amends §38(a.1) to include crypto as an approved category for the purposes of calculating capital gains and allowable capital losses. This means that crypto will be recognized for capital gains purposes for donations to charities for income tax purposes in the same way as shares are.

Currently the Income Tax Act in Canada allows shares, mutual fund units and such to qualify for the purposes of a disposition of gifts to qualified donees but it does not treat digital currencies in the same way as other assets like shares. If Bill C-452 passes, digital currencies like Bitcoin can be gifted to charities in the same way as shares for capital gains purposes.

In essence, the amendment, if passed, means that those Canadians who hold approved digital currencies can support Canadian charities with donations of crypto and take advantage of the Income Tax Act for their generosity.

Bill C-452 went through first reading today when it was released.

Not all digital currencies will be eligible — the government, if the Bill is passed, will list those digital currencies that qualify for gifts to charities for capital gains purposes and it will likely not approve ICOs or digital currencies where there are issues attached to the digital currency, or to the persons behind it to mitigate financial crime concerns.

Dan Albas is the Member of Parliament from British Columbia (Central Okanagan – Similkameen – Nicola) and is the shadow minister for Innovation, Science and Economic Development.

21-year-old SIM swapper who allegedly stole $81 million in crypto, ordered to pay it back

By Christine Duhaime | May 12th, 2019

Bitcoin investor, Michael Terpin, won a US$75.8 million civil judgment on Friday in California against 21-year-old Nicholas Truglia who SIM-swapped Terpin’s cellular phone and stole over US$23 million from Terpin’s digital currency wallets that held coins from three ICOs.

In all, Truglia is alleged to have stolen over US$81 million in crypto currencies via SIM swaps from various people and to have used the money to live a life of luxury, renting a penthouse in Manhattan, buying a US$100,000 Rolex diamond-embedded watch and to have booked private jet trips.

Truglia is currently incarcerated in California and is charged with impersonating numerous individuals to SIM swap them. He was also sued civilly by Michael Terpin for the theft of his crypto currencies and it was alleged in that pleading that Truglia laundered millions of dollars in proceeds of crime from stolen digital currencies through Coinbase, Gemini and Binance.

A SIM swap is a type of hacking fraud where a person communicates with a cellular service provider, impersonates a cellular account holder and convinces them to change the SIM card associated with a cellular device so that the hacker can gain control of the victim’s data.

When a SIM swap occurs, the cellular phone of the victim goes black and the fraudster then controls the data, and can text, call and interact as if they were the victim.

With respect to digital currency wallets, because some service providers use 2FA on cellular phones, it allows hackers access to steal digital currencies by changing the 2FA on the cellular phone when prompted. The hackers gain access to wallets and quickly transfer the digital currencies to Trezors under their control.

Technically, the theft of digital currencies from an exchange is always from the pooled wallet of the digital currency exchange although the victim’s account is debited from the exchange to reflect the loss, or it may be from a hard wallet with no third party intermediary involved. If a thief is stealing through an exchange, it is impossible to steal from an individual account.

One of the deponents in the civil litigation that resulted in the judgment this week, who is a private jet broker, deposed that Truglia had no job during the time he knew him, and shortly after the SIM swap, had over US$72 million in crypto currencies on various wallets and a stash of US$100,000 chilling on his coffee table for spending money. Truglia alleged he earned his wealth from mining. Shortly after the heist, Truglia allegedly made plans to buy a US$250,000 McLaren sports car. Allegedly, Truglia’s Twitter account was Nick @erupts – that account holder took to Twitter to brag about stealing US$24 million, and posted images of the US$100,000 diamond watch and private jet trips.

A McLaren sports car, private jet trips, an expensive watch, fistfuls of cash and no salary to match it – sounds like a perfect SAR that never got filed.

France & Spain go after Syrian PEP, the Butcher of Hama’s $1 billion in unexplained wealth

By Christine Duhaime | May 12th, 2019

Rifaat al-Assad, the uncle of Syria’s President Bashar al-Assad, is facing permanent asset forfeiture in France in connection with unexplained wealth and asset accumulation in France. He was charged in France last month with corruption, money laundering and embezzlement of state assets from Syria. He was ordered to remain in France. He is a politically exposed person (“PEP“).

al-Assad was Syria’s vice president in the 1980s. He lives in mansions in Spain, Paris and London. The Assad family is claiming their unexplained wealth is not unexplained because they were given gifts of money from King Abdullah of Saudi Arabia, which would be equal to close to US$1 billion.

In this article in France, the son somewhat contradicts his father and says all their wealth was gifted by multiple parties including friends and many governments, including Arab countries, to the family. He alleges the government of France invited al-Assad to live in France and the government bought properties for the family and funded them all to live there. The son alleges that al-Assad left Syria without one penny with 400 members of his family and servants, and landed in Switzerland, penniless and homeless, essentially as refugees. He does not explain how the private large jet was able to be fuelled and paid for by a penniless refugee from Syria, and how he housed, fed and clothed the 400 family members and servants that made up the group of refugees. He does not explain how Switzerland processed a flock of 400 penniless PEPs from Syria when they landed, purely as a matter of AML and immigration law.

al-Assad owns a  £10 million Georgian mansion off Park Lane in London, next door to his son Ribal, who lives in a similar mansion. He owns €90 million in real estate in Paris and owns 500 properties in Spain worth €690 million. His real estate was bought through private companies registered in Panama, Curacao, Liechtenstein and Luxembourg. Spain has seized 503 properties and over 200 bank accounts of al-Assad and under his children’s and private company names.

His 3 children bought immigration status from England on the condition that their mother invest in the UK, and presumably move some wealth from unexplained sources to London. That decision was controversial and appears to be subject to a review over concerns of potential blood money because al-Assad is also known as the “butcher of Hama”, a name he acquired for allegedly ordering the murder of 40,000 civilians in Syria in 1982. Author Thomas Friedman claimed that al-Assad was “proud” of how many people died in Hama, saying: “We killed 38,000.”

Chris Doyle, director of the Council for Arab-British Understanding said that al-Assad was one of the kingpins and founding godfathers of the regime that has decimated Syria for decades and notes:

“having fleeced Syria for so much wealth, it is galling to Syrians to see them flaunt their ill-gotten millions across Europe while millions of Syrians languish in refugee camps.”

Bank AML processes are supposed to stop PEPs being able to move suspected stolen state assets to other countries, especially to tax havens like Switzerland.

US seeks money laundering forfeiture of a large cargo ship citing sanctions and correspondent banking violations

By Christine Duhaime | May 11th, 2019

The US government unsealed a federal forfeiture complaint this week, seeking in rem forfeiture of a cargo ship that was used for sanctions avoidance to benefit North Korea which used US correspondent banks to engage in sanctions avoidance. The case has no tie to the US except for the use of correspondent banks and is an excellent and important example of jurisdiction (competence or kompetenz) of the US that arises purely by virtue of correspondent banking of US denominated currency. This is the first forfeiture of a large cargo ship for sanctions violations.

The cargo ship, M/V Wise Honest, was seized by Indonesia in April 2018 and then by the US pursuant to a Court order. It was transporting coal from North Korea to foreign buyers, which violates UN Security Council Resolutions as well as US sanctions law. Authorities found evidence that the cargo ship was used to import into North Korea, heavy machinery, and then coal out of North Korea. The cargo manifest indicated that the coal was from Russia but satellite pictures tracked the course of the vessel from docks in North Korea to Indonesia. The complaint alleges that the M/V Wise Honest turned off its AIS system while in transit to avoid detection of its location and course when it left North Korea.

The ship is registered in North Korea but in order to obtain supplies and services, the ship owner allegedly sent details in respect of the vessel from letterhead showing an address in Hong Kong, and at other times represented the vessel’s nationality was Tanzanian.

Correspondent Banks

In order to pay for its operations, the ship’s owner would buy goods and services and pay for those goods and services by wiring funds, which used the SWIFT network and which had to pass through correspondent US banks where such payments were denominated in US dollars. US correspondent banks are subject to US sanctions.

The way it works under correspondent banking law is that a person from China, as an example, sends a wire in USD to a person in Germany, for example. The bank in China debits the customer’s account then transmits the payment instructions to the US correspondent bank which debits the customer’s bank account while transmitting those US dollars from the US bank to the recipient’s bank in Germany, which credits its customer’s bank account. The use of USD triggers the use of a US correspondent bank and ergo, invokes US law for all those transactions, including sanctions law.

The payment of goods and services for the M/V Wise Honest that used the correspondent banks in the US was prohibited by sanctions law and thus the persons associated with the M/V Wise Honest violated US sanctions law by making those wire payments, the proceeds of crime of which are subject to forfeiture. According to the complaint, more than 30 such payments were sent in violation of US sanctions law, totalling US$750,000.

The M/V Wise Honest is worth $2.9 million.

UN Security Council Report on M/V Wise Honest

The United Nations Security Council commissioned a report in respect of the M/V Wise Honest, available here. It found that:

  • A Blockchain / Bitcoin company called Marine Chain was set up in Hong Kong and launched an ICO with a DPRK individual behind the company to engage in the cargo shipping business and the UNSC says there is concern that it could be used to raise funds for North Korea, for sanctions avoidance and to obfuscate cargo vessel movements. It raised $500,000 in its ICO.
  • Global banks and insurance companies are facilitating payments and providing coverage for vessels involved in illegal shipments of petroleum and coal in violation of sanctions.
  • Luxury car manufacturers such as Rolls-Royce, Mercedes-Benz and Lexus are indirectly selling luxury and racing cars to North Korea in violation of sanctions law, in some instances in the past, such vehicles were bought in bulk and were shipped to California, then to China, then to North Korea.
  • Cargo captains are being paid in bulk cash for piloting cargo ships that violate sanctions, and mention was made of the case of Kim Kwang Il,  who is on the UN sanctions list, who received US$179,000 in a black garbage bag seized by Russian authorities.
  • Banks in western countries are not de-risking the accounts of foreign nationals from North Korea or seizing assets, as required.

Relevant Legislation

Relevant legislation in this post:

United States Code, 18 U.S.C. § 981(a)(1)(C), 18 U.S.C. § 981 (a)(1)(A), 18 U.S.C. §1956

United States Code, 28 U.S.C. §§ 1345, 1355

International Emergency Economic Powers Act, 50 U.S.C. § 1701

North Korea Sanctions and Policy Enhancement Act of 2016, 11 U.S.C. § 9201 et seq.

United Nations Security Council Resolution 1718 (2006), S/RES/1718

United Nations Security Council Resolution 2094 (2013), S/RES/2094

United Nations Security Council Resolution 2270 (2016), S/RES/2270

United Nations Security Council Resolution 2397 (2017), S/RES/2397

Executive Orders 13382, 13466, 13570, 13687, 13722, 13810

Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. § 544.101 et seq.

North Korea Sanctions Regulations, 31 C.F.R. Part 510

Former Head of Financial Crime Regulator and Director of Danske Bank Charged with Money Laundering Failures

By Christine Duhaime | May 10th, 2019

According to the Danish press, Henrik Ramlau-Hansen, the former head of the Danish Financial Supervisory Authority, Denmark’s bank regulator, who was a director of Danske Bank, has been criminally charged and his house raided in connection with a €200 billion money laundering scandal involving Danske Bank. The charges are pursuant to Denmark’s anti-money laundering legislation and are related to his alleged failure to have performed or supervised, anti-money laundering law properly over the bank’s activities, allowing hundreds of billions of dollars of proceeds of crime to flow through the Danske Bank from 2011 to 2015 that was tied to politically exposed persons from, among others jurisdictions, Russia.

Thomas Borgen, the CEO of Danske Bank was criminally charged earlier this week, and additional executives have been charged but their names have not been released.

The €200 billion money laundering and PEP scandal cost the Danske Bank more than half of its capitalization and sparked a criminal investigation in the US, Estonia, France and Denmark.

Mr. Ramlau-Hansen was head of the Danish Financial Supervisory Authority from 2016 until 2018.

At an ACAMS national conference a few years ago, a US government official did say in reference to the global ecosystem, that regulators want banker heads on a stick. This may be that occasion.

Lax AML compliance can downgrade a bank’s credit rating

By Christine Duhaime | May 10th, 2019

According to this article in the Wall Street Journal, the level to which a bank is AML compliant, or not, is now a key factor used to determine its credit rating, and is more material than any other non-financial factor. The new report cites the fact that bank supervisors and federal regulators around the globe are now beginning to crack down on AML failures in banks and adopting a zero-tolerance approve to compliance. The report cites the downgrading of Swedbank AB and Danske Bank A/S resulting directly from their reported lax AML controls pursuant to which they accepted hundreds of millions of dollars from politically exposed persons without complying with PEP law. Both Swedbank and Danske Bank have replaced their CEOs over AML compliance issues.

Darknet news and promo website seized and founders indicted for money laundering

By Christine Duhaime | May 8th, 2019

The US Department of Justice for the Western District of Pennsylvania announced the unsealing of a federal indictment in Pennsylvania of two Israeli men who are alleged to be the co-owners and administrators of the website Deep Dot, which charges them with conspiracy to commit money laundering in association with that website. The site acted as a news source for information in respect of the Darknet but it also provided addresses of Darknet marketplace sites accessible on TOR and links to the sites on TOR. The accused were arrested simultaneously in Israel and France.

The website was seized by the FBI and taken offline.

Darknet marketplaces are websites that sell illegal goods and services for Bitcoin. Fentanyl sales from China are often transacted on Darknet websites on TOR and paid for with Bitcoin, then cashed out at a digital currency exchange for fiat through a bank.

Some Darknet marketplaces also sell illegal weapons, offer murder for hire services and traffic in stolen identity products and sell child pornography. Some of these sites broker sales of stolen customer and account data from banks and credit card issuers in order to allow fraudsters to steal millions of dollars online from banks. All of this activity is paid for with Bitcoin and cashed out at digital currency exchanges for fiat, with criminals looking for exchanges with the most rapid and least friction in cash outs where AML processes are less stringent than at banks.

The site allegedly generated millions of dollars in commissions by providing kick-backs to the site owners when purchases were made with Bitcoin from a Darknet site of illegal goods and services.

Over 23% of all of the AlphaBay transactions (the Canadian Darknet website on TOR that processed over $1 billion in illegal goods and services using Bitcoin), came from a referral from Deep Dot. Hansa, another Darknet website that was taken down, received half of its customers from Deep Dot. In total, the two indicted are alleged to have received 8,155 Bitcoin in commissions for website linkages that generated commissions, equal to more than US$15 million.

The indictment mentions a Darknet marketplace site called Tochka Market. Tochka Market advertised the launch of an initial coin offering to raise money, and issued a white paper for its ICO to support its TOR activities. According to the indictment, Tochka Market has been in operation since 2015 and sells illegal narcotics, counterfeit goods and other contraband.

The first take down of an online marketplace on TOR was Silk Road. Its creator and administrator, Ross Ulbricht, is serving two life sentences in a federal jail in the US after having been convicted by a jury of narcotics trafficking over the Internet, operating a criminal enterprise, computer hacking, trafficking in stolen identity products in order to defraud banks and open accounts to defeat AML purposes, and money laundering. He forfeited $183 million in Bitcoin proceeds of crime. His darknet marketplace allowed anyone, including teenagers, to use Bitcoin to buy heroin online and have it shipped to them using the US postal service. Several teenagers died of drug overdoses from Silk Road. Silk Road trafficked as well in child pornography, human trafficking and weapons. At his sentencing, the learned Judge noted that after thinking about it for just six minutes, Ulbricht approved listing cyanide for sale on Silk Road, knowing that people would buy it to murder others but he didn’t care so long as he would earn commission in Bitcoin from the sales.

The Deep Dot website was also used for non-criminal purposes by researchers and financial crime investigators and wallet tracers.

Spanish police seize €9 million in Bitcoin as part of money laundering Bitcoin ATM ring

By Christine Duhaime | May 8th, 2019

The Spanish Guardia Civil has arrested eight people and seized over €9 million, luxury cars, cannabis plants and jewellery in connection with an alleged money laundering operation in Spain that involved the use of Bitcoin ATMs and digital currency exchanges to launder proceeds of crime and avoid the filing of suspicious transaction reports.

According to Europol, the alleged money launderers were members of organized crime who used private corporations to open bank accounts and transfer funds from digital currency exchanges in other countries which were proceeds of drug trafficking.

The police say that organized crime used digital currency exchanges overseas (which from Spain usually means North or South America), where there is a strong tie to organized crime and drug trafficking and where it is easy to cash out from Bitcoin through a digital currency exchange to a bank account (which on speculation, may mean the US or Canada but considering there is no US involvement in this arrest, it may mean Canada).

OFAC releases framework for sanctions compliance

By Christine Duhaime | May 3rd, 2019

The Department of the Treasury’s Office of Foreign Assets Control (OFAC) published a framework for sanctions compliance yesterday which describes the sanctions compliance program standards for US legal and natural persons and for US-origin goods or services. The framework mirrors the requirements for a competence AML program and includes:

  • commitment from the top down in writing.
  • creation of sanctions committee of senior management to drive and support the sanctions compliance program and inculcate a culture of compliance.
  • undertaking a risk assessment to identify risks of sanctions exposure.
  • creation of internal controls, including policies and procedures after the risk assessment.
  • testing and auditing of the program to ensure that it is effective, responds to the risk assessment and can identify weaknesses and gaps for remediation.
  • training on an on-going basis of personnel across the organization.

The framework also describes the most common ways in which sanctions are violated, inadvertently or otherwise and those include lack of a program, lack of legal advice in respect of the law of sanctions or a misinterpretation of sanctions law, facilitating sanctions using foreign subsidiaries or affiliates.

Meanwhile, in Iran, people were posting the opening of crypto mining operations for international transfers.

Bitcoin mining in Iran published on Twitter.