Ransomware and Crypto: The Growing Compliance Challenge

The growing threat of ransom demands, paid in cryptocurrencies, is becoming a huge compliance headache for financial institutions.

A recently published landmark report, , aims to equip public and private stakeholders such as law enforcement agencies, regulators, virtual asset service providers (VASPs) and financial institutions with the insights needed to tackle financial flows related to ransomware.

The report, released by the Financial Action Task Force (FATF), the international standard setter for anti-money laundering and countering the financing of terrorism (AML/CFT), addresses what has become one of the fastest growing and most disruptive forms of cybercrime in recent years.

Central to the FATF’s plea to fight back against ransomware is to shed light on the illicit financial flows of ransomware gangs and their support networks – financial flows that overwhelmingly occur in crypto-assets. Concurrent regulatory developments increasingly require compliance officers at VASPs and financial institutions to understand how to identify and manage financial crime risks associated with ransomware.

Ransomware & money laundering risk

Cybercriminals use malware to encrypt data on victims’ computers or deny them access to critical systems, and then demand a ransom in return to restore access to the victim. Ransomware has become particularly lucrative in recent years as cybercriminal gangs have identified ways to launch attacks with increasing efficiency and effectiveness.

Using a technique known as Big game hunting, ransomware gangs are now routinely targeting hospitals, government offices, energy companies and other critical infrastructure to try to generate the largest possible ransom. In recent years, ransom gangs – many of which operate out of Russia, as well as in jurisdictions such as Iran and North Korea – have collected hundreds of millions of dollars annually by extracting large ransoms from their victims. The perpetrators of these attacks have included Russian ransomware organizations such as the DarkSide, Conti and Ryuk gangs, as well as the Lazarus Group, North Korea’s cybercrime outfit.

Crypto-assets have been strongly affected by the growth of ransomware. Almost all ransomware payments are made in Bitcoin, making it possible for attackers to receive payments from victims into private Bitcoin wallets that are not held at regulated institutions.

After receiving payment in Bitcoin from their victims, ransom attackers generally have to convert their money on a crypto exchange or other VASP into fiat currencies, such as Russian rubles, euros, or other currencies. Because the Bitcoin blockchain is highly transparent, the flow of funds from these attacks can be observed as ransomware gangs attempt to launder them through the crypto ecosystem.

This activity can in turn generate red flag indicators of money laundering that compliance officers can detect, some of which FATF details in its reports, and which regulators such as the US Treasury’s Financial Crimes Enforcement Network (FinCEN) have also documented in notices to the private sector.

Some key money laundering red flags and behaviors that are often displayed in ransomware cases include:

While cryptoasset exchanges and other VASPs are most directly affected by this behavior, banks and other financial institutions must also be aware of the risk of money laundering. After all, once ransomware gangs have exchanged crypto-assets for fiat currencies, they attempt to launder those funds through the banking system. By understanding the key red flags and typologies involved, bank compliance teams can equip themselves to identify ransom-related money laundering.

The challenge of increasing sanctions

In addition to the risk of money laundering, transactions related to ransomware pose increasing risks and challenges for compliance with sanctions. Over the past 18 months, the US Treasury’s Office of Foreign Assets Control (OFAC) has targeted sanctions activity against ransomware attackers and their support networks with asset freezes.

This has often involved including crypto asset addresses belonging to attackers and their support networks on OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List). OFAC’s recent actions involving ransomware include:

As a result of these actions, VASPs and financial institutions must ensure that they do not facilitate prohibited payments with ransom gangs and those who support them that are subject to sanctions.

Respond to risks

It is possible to combat ransomware while complying with regulatory requirements, although there are challenges. Compliance teams at VASPs and financial institutions can take steps to ensure that they manage the related risks effectively.

First, compliance teams should be trained in the typologies and red flags associated with ransomware so that they have the knowledge needed to detect potential money laundering or sanctions evasion. Second, compliance teams should familiarize themselves with regulatory requirements and alerts related to ransomware – particularly OFAC sanctions – and ensure their policies and procedures reflect these developments.

Finally, compliance teams at VASPs and financial institutions should use blockchain analytics solutions to detect red flags and other indicators of transactional risks associated with ransomware. This should include the use of blockchain analytics solutions capable of identifying cross-chain money flows that indicate chain-hopping typologies of money laundering that ransomware attackers are increasingly using.

As a rapidly evolving form of cybercrime, ransomware activity poses significant compliance challenges; However, by following the steps above, compliance teams can work to successfully manage the risks.

Opinions expressed are those of the author. They do not reflect the views of Reuters News, which is committed under the fiduciary principles to integrity, independence and freedom from bias. The Thomson Reuters Institute is owned by Thomson Reuters and operates independently of Reuters News.