Bitzlato Founder Charged With Facilitating Money Laundering of More than $700 Million in Dark Web Funds

Anatoly Legkodymov, Russian founder of Hong Kong-registered cryptocurrency exchange Bitzlato Limited ("Bitzlato"), was arrested on January 17 based on an Amended Complaint filed by the Department of Justice ("DOJ") charging him with conducting an unlicensed money transmitting business that ignored anti-money laundering laws and facilitated illicit fund transmissions. The Amended Complaint against Legkodymov alleges that a substantial part of Bizlato's business has been conducted in the United States, such as knowingly servicing U.S. customers, conducting transactions with U.S.-based exchanges, using a U.S. online infrastructure, and, for some period, being managed by Legkodymov while he was in the U.S. According to the Amended Complaint, these alleged activities and further U.S. connections brought Bitzlato under the scope of U.S. state and federal money transmission laws, such as 18 U.S.C. § 1960, which criminalizes the operation of an unlicensed money transmitting business. In addition, Bitzlato was designated as a so-called "primary money laundering concern" in connection with Russian illicit finance, the first time such action was taken pursuant to section 9714(a) of the Combating Russian Money Laundering Act. We discuss below the actions that led to the charges and Bitzlato's designation and the implications for both Bitzlato and the wider cryptoasset industry.

U.S. Registration and Licensing Requirements

Bitzlato is a cryptocurrency exchange that was founded by Legkodymov in 2016. Bitzlato allows customers to purchase cryptocurrencies with cash, exchange cryptocurrencies for other cryptocurrencies, and send cryptocurrency to other users' wallets. According to the Amended Complaint, since May of 2018, Bitzlato has processed approximately $4.58 billion worth of cryptocurrency transactions, a large portion of which allegedly constitutes the proceeds of crime or funds intended for use in criminal transactions. Bitzlato was not registered as a money services business ("MSB") with the Financial Crimes Enforcement Network ("FinCEN"), and it had not obtained any money transmission licenses in the U.S.

Even though Bitzlato publicly stated it did not service U.S. customers, the Amended Complaint alleges that a substantial part of Bitzlato's business was conducted in the U.S. and facilitated transactions with the U.S. For example, Bitzlato was knowingly servicing U.S. customers, conducting transactions with U.S.-based exchanges, and using a U.S. online infrastructure. Bitzlato was also managed by Legkodymov for some time while he was in the U.S. The Amended Complaint further alleges that Bitzlato customer service repeatedly advised customers that transactions with the U.S. were permitted. By July of 2022, the U.S. was the fourth most common source of internet traffic for Bitzlato. According to the Amended Complaint, these activities brought the company within the scope of U.S. state and federal money transmission laws, which govern the transmission of funds within or from the U.S. and establish licensing and compliance obligations for entities engaging in the money transmission business.

The Amended Complaint charges violations of 18 U.S.C. § 1960, which prescribes criminal penalties for anyone who "knowingly conducts, controls, manages, supervises, directs, or owns all or part of an unlicensed money transmitting business." An "unlicensed money transmitting business" is one that affects interstate or foreign commerce that either "fails to comply with the money transmitting business registration requirements under section 5330 of title 31, United States Code, or regulations prescribed under such section," 18 U.S.C. § 1960(b)(1)(B), or "otherwise involves the transportation or transmission of funds that are known to the defendant to have been derived from a criminal offense or are intended to be used to promote or support unlawful activity," 18 U.S.C. § 1960(b)(1)(C). All MSBs, including money transmitters, are required to register with FinCEN, a division of the U.S. Department of Treasury ("Treasury"), unless specific exemptions apply. 31 C.F.R. § 1022.380(a)(1).

Separate from the federal regulatory regime under the Bank Secrecy Act ("BSA"), 49 states and the District of Columbia require individuals or entities engaged in the business of money transmission activities to obtain a license in each state in which they operate absent a valid exemption. Licensed money transmitters are subject to ongoing compliance requirements, including reporting, examinations, anti-money laundering ("AML") controls, and capital requirements. Money transmitters operating without required state licenses are subject to federal criminal exposure for knowingly operating an unlicensed money transmission business and may face punishment by fine or up to five years in prison. 18 U.S.C. § 1960.

BSA and AML Program Failures and Deficiencies

As alleged in the Amended Complaint, Bitzlato failed to implement AML safeguards required by law, only collecting minimal identification from its users. In instances when Bitzlato did direct users to submit identifying information, it allowed them to provide information belonging to "straw man" registrants. This failure to implement appropriate AML procedures, including know-your-customer ("KYC") controls, allegedly made Bitzlato an attractive vehicle for criminal enterprises to launder their funds.

MSBs are required to comply with certain aspects of the BSA, such as filing reports of suspicious transactions ("SARs"), 31 U.S.C. § 5318(g); 31 C.F.R. § 1022.320(a); and implementing an effective AML program, 31 C.F.R. § 1022.210. An AML program must, at a minimum, "[i]ncorporate policies, procedures, and internal controls reasonably designed to assure compliance" with an MSB's obligations to verify customer identification, file reports, creating and retaining records, and respond to law enforcement requests. 31 C.F.R. § 1022.210(d)(1). FinCEN has stated previously, including in its guidance, that those who offer certain services in virtual currency, such as those offered by Bitzlato, come within the regulations applicable to MSBs. According to the Amended Complaint against Legkodymov, Bitzlato failed to establish an effective AML program in compliance with U.S. laws. Bitzlato advertised "Simple Registration without KYC. Neither selfies nor passports required. Only your email needed." This alleged failure permitted rampant use of Bitzlato by criminals laundering the proceeds of various crimes, such as the users of Hydra, which was alleged to be the largest and longest-running "darknet" marketplace for narcotics, stolen financial information, fraudulent identification documents, and money laundering services.

The Amended Complaint alleged Bitzlato's involvement in illicit transactions. Bitzlato facilitated more than $700 million in cryptocurrency exchanges for users of Hydra Market. Bitzlato also received more than $15 million in ransomware proceeds from actors based in Russia. The Amended Complaint alleges that Legkodymov and Bitzlato's other senior managers were aware of the practices that facilitated illicit transactions. The Amended Complaint cites to internal discussions and documents highlighting Bitzlato's avoidance of KYC controls and company management's awareness of the volume of "dirty money" transmitted using the Bitzlato platform, including business practices targeted at drug dealers. Many of Bitzlato's users were registered under others' identities, but nothing was done to rectify it. Instead, Bitzlato was often marketed as an exchange with minimal, if any, KYC obligations.

Ultimately, following collaboration with U.S. investigators, French authorities, working with Europol and partners in Spain, Portugal, and Cyprus, seized Bitzlato's cryptocurrency and shut down its online operations.

Bitzlato Deemed a “Primary Money Laundering Concern” by FinCEN

In addition to the Amended Complaint against Legkodymov, FinCEN has issued an order designating Bitzlato a "primary money-laundering concern" under the USA Patriot Act. This action, which is rarely used, cuts off the entity from the U.S. financial system. When used against financial institutions in the past, it has often forced their closure.

FinCEN's order was also the first Section 9714 action, which is an order issued pursuant to Section 9714(a) of the Combating Russian Money Laundering Act, as amended. The Section 9714 action identifies Bitzlato as a so-called "primary money laundering concern" in connection with Russian illicit finance and authorizes the U.S. Treasury to impose one or more of the following measures:

1. Special measures under section 311 of the USA PATRIOT Act, including measures requiring financial institutions to record and report certain financial transactions, obtain and retain information relating to beneficial ownership, certain payable-through accounts, and certain correspondent accounts, or avoid opening or maintaining certain correspondent or payable-through accounts; or
2. Special measures prohibiting or restricting certain fund transmittals by any domestic financial institution or domestic financial agency.

Next Steps for Covered Financial Institutions

Financial institutions within and outside the cryptocurrency ecosystem should consider evaluating and updating their AML controls in light of FinCEN's order. Pursuant to FinCEN's Section 9714 action against Bitzlato, domestic financial institutions ("Covered Financial Institutions") subject to FinCEN's regulatory requirements are expected to do the following, effective February 1, 2023:

1. Cease any and all transmittals of funds, including convertible virtual currency ("CVC"), from or to Bitzlato, or from or to any account or CVC address administered by Bitzlato, with exceptions as outlined in FinCEN’s order; and
2. Incorporate the determination that Bitzlato is of primary money laundering concern into their Anti-Money Laundering/Combating the Financing of Terrorism ("AML/CFT") compliance programs.

If a Covered Financial Institution determines that it is in receipt of CVC from Bitzlato or a related address, the institution may: (1) reject the CVC transaction by preventing the intended recipient from accessing the CVC and returning the CVC to Bitzlato or related CVC wallet address; and (2) cover the transmittal fee by paying the fee itself or taking a portion of the original rejected CVC. If a transfer of funds subject to FinCEN’s order is in the form of fiat currency, a Covered Financial Institution is instead required to reject the transaction without accepting the funds.

FinCEN expects Covered Financial Institutions to take reasonable steps to identify prohibited transactions with a nexus to Bitzlato by using appropriate AML/CFT procedures and systems, such as traditional compliance methods and blockchain analytics software. However, given technical constraints that may prevent institutions from preventing CVC transmittals to or from Bitzlato and related accounts or addresses, FinCEN offers Covered Financial Institutions limited flexibility to decide how to handle such CVC transfers, subject to the terms of the Section 9714 order and other applicable laws or regulations, including those of OFAC. Covered Financial Institutions also have flexibility to decide whether to report a transaction involving Bitzlato through a SAR.

***
The DOJ's and FinCEN's actions convey a clear intent to enforce the laws and regulations applicable to payment activity within the jurisdiction of the U.S., especially in the cryptoasset space. While AML enforcement actions and the laws and regulations requiring AML compliance programs are nothing new to the industry, businesses must also ensure they have conducted sufficient analysis to determine whether their operations are those that require licensure or registration at the state or federal levels under applicable money transmitter and MSB requirements. A failure to do so risks such businesses carrying out illegal money transmitter activities and implementing otherwise required AML compliance programs.

Arianna Skipper (White & Case, Law Clerk, New York) contributed to the development of this publication.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2023 White & Case LLP}