KYC and the risk-based approach

Graduate · enrolled learners

This lesson opens with Bitzlato, January 2023.

What happened

Bitzlato was a cryptocurrency exchange that US authorities identified in January 2023 as a haven for criminal proceeds, and its founder was arrested. The Financial Crimes Enforcement Network issued its first order of a new kind naming Bitzlato a primary money-laundering concern, and prosecutors described the reason plainly: Bitzlato marketed itself as requiring minimal identification, and what little identification it did require was trivially circumvented, with the exchange knowingly accepting identification belonging to other people, so-called straw-man accounts. The result was that a large share of its business, hundreds of millions of dollars, flowed to and from darknet markets and Russian illicit actors, because a customer's real identity and risk were never established. Bitzlato did not have weak know-your-customer that failed under pressure; it had know-your-customer that any customer could defeat by design, which is the same as having none, and that is precisely what made it useful to the people who used it.

The decision point

Know-your-customer is the institution establishing who a customer actually is and what activity to expect from them, and it exists so that everything downstream, monitoring, suspicious-activity reporting, sanctions screening, has a real identity and a real baseline to work from. Its governing principle is risk-based: the depth of verification and ongoing scrutiny is scaled to the risk a customer and their activity present, so a low-risk retail user is handled proportionately while a high-risk customer, jurisdiction or pattern draws deeper diligence. Bitzlato is the demonstration of the floor beneath which risk-based collapses into no basis at all: KYC that a customer can defeat by presenting someone else's identity establishes nothing, so there is no identity to which any risk can be attached and no baseline any monitoring can compare against. So the decision an institution makes is that KYC must actually establish identity before it can be scaled to risk, because a risk-based approach built on identities any customer can fake is not a proportionate program, it is Bitzlato with better branding.

Recorded loss

$700,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.