Building a Crypto Compliance Program and a Crypto Investigations Team

With any emerging technology, change is inevitable. At the 35th Annual ACFE Global Fraud Conference, Lourdes Miranda, CFE, CEO of the FinTech Advisory Group, LLC, outlined what the future of compliance programs looks like alongside the evolution of cryptocurrency. It’s a daunting proposition when traditional banking remains the global standard, but as Miranda pointed out, the term “crypto wallet” is synonymous with a traditional “bank account.” With basic training, compliance and investigative professionals are much closer to a working knowledge of crypto than many think. 

“Crypto takes time to learn,” Miranda said. “Don’t expect to learn crypto overnight; give yourself a break. But I promise you that you need to embrace it.” 

Being able to recognize crypto addresses, or public keys, for various currencies is vital. You need to know what you’re looking at before reviewing transaction records to understand where the currencies are being traded. Miranda showed examples of Bitcoin, Monero and Ethereum crypto addresses, particularly the first few characters of each. Every address and blockchain requires different methods of investigations, so it’s critical that compliance and investigative teams can recognize where those characters come from before beginning an investigation. 

Using platforms like CoinMarketCap or Messari allows you to understand the cryptocurrency’s value. You need to be able to verify the value of the currency on the day the person was victimized; not the value when the report was received. These tools exist, and investigative methods remain the same. It’s the training and know-how to track transaction records and see the bigger picture of how everything fits together 

Types of Crypto Financial Crimes 

While crypto may not be your biggest priority, it’s likely already being used by third-party vendors, potential partners and even consumers. Teams need to be prepared to combat challenges that arise. While investigators are typically reactive, it’s important for compliance teams to think proactively and anticipate when and how fraudsters could exploit an organization.  

“Compliance officers are the first line of defense; we rely on you,” Miranda said. “Turn your investigative cap on. Take investigative classes and think like a bad actor.” 

Miranda highlighted a wide range of crypto financial crimes that fraudsters employ, further proving the need for everyone across the fraud ecosystem to receive training on cryptocurrencies and crypto transactions. 

Bad actors constantly hunt for vulnerabilities within a company. One of the most dangerous targets are company websites that lack terms of use, privacy policies or copyright information. Additionally, by publicly offering information like global fiat conversion capabilities on a website, bad actors can operate across borders. These factors likely mean that no compliance initiatives are in place at the organization, and bad actors know they have an inroad to exploit your organization. 

With the speed and scale in which crypto transactions move, collaboration between international entities is vital. As Miranda pointed out, U.S. institutions like FinCEN maintain strong relationships with international financial intelligence units (FIUs). Especially for victims of crypto fraud, contacting local FIUs connects them to trained professionals who are available to review a transaction history and start an investigation if suspicious activity is found. 

“If you engage in crypto, personally or professionally, or have customers who are involved in cryptocurrency, or you’re building your first crypto compliance department or crypto investigations division, you have to understand how valuable FIUs are,” Miranda said. “These FIUs are your friend.” 

Building a Crypto Compliance Program 

When Miranda transitioned from a 25-year career as a senior CIA officer and FBI intelligence analyst to compliance, she realized that teams within various organizations weren’t communicating with each other. Communication is essential to any investigation. If there’s no clear connection between what’s happening within an anti-fraud program, nothing can get done effectively and efficiently. 

Being creative in building crypto compliance teams is essential with how fast the industry is moving, and more importantly, the vast amount of legislation and proposals in review around the world. By hiring country managers where products and services are being produced, your team has a subject-matter expert who can provide insight into what’s happening within local markets. 

Additionally, marketing and advertising teams need to be involved and trained by compliance professionals. These groups aren’t focused on sanctions and regulations. Compliance teams need to be responsible for ensuring the communications arms of a business know where and how they should be operating.  

The knowledge gap between traditional methods and new technologies requires attention and training. But, as Miranda highlighted, the future of compliance in the crypto space is laid out and ready to be tackled.