KYC and the risk-based approach

Graduate · enrolled learners

This lesson opens with Bitzlato, January 2023.

What happened

Bitzlato was a cryptocurrency exchange that US authorities identified in January 2023 as a haven for criminal proceeds, and its founder was arrested. The Financial Crimes Enforcement Network named Bitzlato a primary money-laundering concern in connection with Russian illicit finance, the first order issued under section 9714(a) of the Combating Russian Money Laundering Act, and prosecutors described the reason plainly: Bitzlato marketed itself as requiring minimal identification, and what little identification it did require was trivially circumvented, with the exchange repeatedly accepting identification belonging to other people, so-called straw-man registrants, while its managers knew many users were registered under others' identities. The result was that its largest counterparty was Hydra, the largest darknet market in the world, whose users exchanged more than 700 million dollars in cryptocurrency with Bitzlato, and it also received ransomware proceeds, because a customer's real identity and risk were never established. The founder pleaded guilty in December 2023. Bitzlato did not have weak know-your-customer that failed under pressure; it had know-your-customer that any customer could defeat by design, which is the same as having none, and that is precisely what made it useful to the people who used it.

The decision point

Know-your-customer is the institution establishing who a customer actually is and what activity to expect from them, and it exists so that everything downstream, monitoring, suspicious-activity reporting, sanctions screening, has a real identity and a real baseline to work from. Its governing principle is risk-based: the depth of verification and ongoing scrutiny is scaled to the risk a customer and their activity present, so a low-risk retail user is handled proportionately while a high-risk customer, jurisdiction or pattern draws deeper diligence. Bitzlato is the demonstration of the floor beneath which risk-based collapses into no basis at all: KYC that a customer can defeat by presenting someone else's identity establishes nothing, so there is no identity to which any risk can be attached and no baseline any monitoring can compare against. So the decision an institution makes is that KYC must actually establish identity before it can be scaled to risk, because a risk-based approach built on identities any customer can fake is not a proportionate program, it is Bitzlato with better branding.

Recorded loss

$700,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.