At some point over the past 10 years, most readers will have heard of Bitcoin, even if they have not directly encountered it. Bitcoin is the most commonly-known and widely-used cryptocurrency (crypto), but others include Ethereum, Litecoin, and Dogecoin.

It is worth spelling out the basics of cryptocurrencies. Because they are inherently digital in nature, one cannot physically hold a Bitcoin. The movement of Bitcoins is recorded on a public ledger referred to as the blockchain — a ledger that is essentially a record of all transactions that occur using Bitcoin and is open to the public, meaning that every transaction is open to a certain level of scrutiny using a “blockchain explorer”. Although it would seem reasonable to assume that this public record means anonymity would be difficult to achieve, this is not the case.

Cryptocurrency is a national currency in only one country — El Salvador, where it shares the status of national currency with the US Dollar. Its adoption has been slow due to scepticism of the cryptocurrency by ordinary citizens in that country, so how commonplace Bitcoin transactions will become there remains to be seen.

It makes sense to consider crypto as a value-holding asset like a share. One may contend that this does not differ from ordinary money, but to date, crypto has lacked recognition as a form of money in most jurisdictions around the world.

In June 2021, a “Position Paper on Crypto Assets” was published by the Intergovernmental Fintech Working Group (IFWG) to make recommendations to lawmakers on how best to regulate the crypto environment and all that goes on in it. The paper’s foreword by Chairperson Olaotse Matshane unequivocally states that “crypto assets are not ‘money’”.

One of the major selling points of crypto is the decentralised and unregulated nature of transactions. However, the recent FTX crash shows that some regulation may be necessary in order to protect ordinary members of society.

The IFWG’s position paper posits three possible approaches through which governments may deal with crypto assets: ban them completely, regulate them, or simply do nothing. The option of doing nothing was considered and rejected in 2015 by the Financial Action Task Force — an international organisation formed by the G7 nations to work together on combating money laundering. In 2015, the Task Force published a paper making recommendations to countries on combating the use of crypto assets in crimes. This explicitly recommended regulation rather than the prohibition of crypto activities. The primary thrust of the argument was that regulation brings into the open what would otherwise remain hidden from the authorities – although, it must be accepted, regulation is not perfect and unlawful activities are always likely to occur in one form or another.

Led by the IFWG, South Africa has chosen the route of regulation, for which the IFWG made 25 recommendations in its position paper. One of the proposed recommendations would be the addition of Crypto Asset Service Providers to the list of “accountable institutions” under the Financial Intelligence Centre Act.

In October 2022, the Financial Sector Conduct Authority (FSCA) published a general Notice in the Government Gazette which introduced a definition for “crypto asset” under the Financial Advisory and Intermediary Services Act (the Fais Act) and, most importantly, declared crypto assets to be a financial product. Along with the Notice, the FSCA also published a policy document outlining the purpose and effect of the declaration and providing the background to how it came about. Interestingly, the policy document notes that non-fungible tokens, commonly referred to as NFTs, are still an emerging concept and do not, as yet, require oversight from the FSCA.

As things stand, persons or entities which “render financial services in relation to crypto assets” will be required to obtain licences to do so, unless they are exempted by the Fais Act.

The move is to be welcomed as it will serve to ensure that crypto service providers are held to strict standards and that users of their services can transact in a manner which protects their interest and have recourse to law should they require it.

This framework for the regulation of crypto assets requires mechanisms and strategies to be developed in order to detect deviations from what is legal, to successfully prosecute those who break the law, and to recover the proceeds of criminal activity.

Currently, the South African Revenue Service (Sars) treats crypto assets as regular assets under their income tax rules, or as income received. This means that “income received or accrued from crypto assets transactions” is taxed as part of an individual’s gross income. Alternatively, such assets may fall within the ambit of capital gains tax.

Perhaps the most straightforward crime to prosecute, in relation to crypto, would be tax evasion. Sars and law enforcement already have mechanisms in place to detect and prosecute such. The effective usage of these mechanisms is a discussion for another day.

But crimes other than tax evasion require SARS, law enforcement, and players from the private sector to collaborate on a strategy to prevent, detect, combat, and prosecute crimes in which crypto is used, particularly crimes in which crypto is used in the commission of the crime, such as money laundering.

Money laundering is notoriously difficult to detect because the various “front” transactions in a scheme do not always appear to be suspicious. A straightforward example of such a scheme would be a criminal organisation using, for the sake of simplicity, a laundromat to clean money received from its illegal activities.

Small cash-intensive businesses are ideal for the first step of laundering money because the presence of large amounts of cash does not usually raise suspicion in business operations such as laundromats or restaurants. Money received from legitimate dealings of the business may be mixed with the money received from illicit activities as the first stage of money laundering. The second stage of money laundering is commonly referred to as “layering”. This is the process in which the source of the illicit funds is further disguised by channelling it through multiple entities, through numerous transactions. Once the above stages are complete, money is usually channelled to jurisdictions with more flexible rules, less stringent scrutiny of transactions and the source of funds, and limited disclosure of the ultimate beneficiary of the money. Next, the cleaned money must be reintegrated into ordinary usage. One method of doing this is making various investments.

Visit Daily Maverick’s home page for more news, analysis and investigations

The process outlined above is a simplified version of what happens in reality and is merely for illustrative purposes. Each stage may consist of multiple sub-stages which have the purpose of further disguising the origins of the funds, or using channels to avoid paying taxes.

Crypto transactions are usually stored on the blockchain for that specific cryptocurrency. How then do individuals and criminal organisations go about laundering their proceeds from criminal activities through crypto?

The steps for laundering funds using crypto are structurally similar to those for money laundering using regular currency. The major difference is that money received from illicit activities needs to be first converted to crypto. Or the initial payment for illegal conduct or goods can be made in crypto.

It is fairly easy to exchange regular currency for crypto on numerous online crypto exchanges, or even at designated crypto exchange ATMs. However, there is a catch and this stage of the laundering process is the one that is most likely to alert authorities to the activities of the individual: every crypto transaction is immutably recorded on the blockchain and thus every exchange of fiat currency to crypto leaves a paper trail of sorts.

The paper trail left by Bitcoin transactions helped the US authorities to trace the proceeds of one of the biggest hacks of a crypto exchange to have ever taken place. On 2 August 2016, Bitfinex suffered a security breach and 119,756 bitcoin were stolen and transferred to a single digital wallet. At the time, the value of these Bitcoin was around $72-million. Although they have not been charged for the theft of the bitcoin, Ilya Lichtenstein and Heather Morgan, a married couple living in New York, were arrested for conspiracy to launder the stolen bitcoin. At the time of their arrest in February 2022, the value of the stolen Bitcoin had grown exponentially to $3.6-billion.

What is noteworthy about the investigation which led to the arrests of Lichtenstein and Morgan is that the authorities played a waiting game to see if there was movement of the Bitcoin on the blockchain. Although they could not with certainty link the hack to the couple, they could monitor their transactions and they realised that these transactions appeared to be money laundering in action.

As of the start of 2023, the criminal trial of Lichtenstein and Morgan has not yet begun. If the prosecution is successful, it may set a global precedent for investigating and prosecuting this type of crime.

Money laundering is probably best combated by tracking the movement of illicit funds from the moment of exchange. In many countries, and as part of good practice, banks are required to implement Know-Your-Customer policies — policies which could, and should, be implemented by crypto exchanges as a means to deter persons who wish to launder funds through crypto. One possible policy would be to require detailed disclosure of the source of funds at the time of conversion to crypto.

One of the major conclusions to come out of an Interpol conference held in December 2021 was the necessity of a multi-layered and multi-sector approach to the prevention and combating of crypto crimes, including cooperation between law enforcement and the private sector.

Recent shocking revelations about the entirety of the SAPS being without digital forensic tools as a result of expired licences is cause for concern. Such deficiencies hamper the SAPS in the battle against crime.

The recent pronouncement by the deputy governor of the Reserve Bank, Kuben Naidoo, that the institution is looking at ways to regulate cryptocurrency, suggests that more policy documents will be published and formal discussions around crypto will be held. We can only hope that such discussions are not only held internally and will include local and global experts in crypto crimes and law enforcement.

As things stand, the State simply does not have the capacity to effectively deal with crypto crimes. This is not a slight at the individuals involved in law enforcement, but arises as a result of the underfunding and under-resourcing of the various institutions involved. Further, it is crucial that crypto crimes are not dealt with using the one-size-fits-all approach that we have seen in other areas of police work. Innovative solutions must be conceptualised and implemented. If possible, a small but efficient specialised unit should be established within the SAPS in order to combat crypto crimes.

The lack of resources available to law enforcement to engage in certain types of investigative work can be mitigated by forming partnerships with the private sector, but this cannot be the sole or long-term solution. A focus on training new SAPS recruits in techniques of detection and investigation relevant to this area is crucial and would ensure that, in the long run, the SAPS is not wholly dependent on the private sector in doing its work. Although we may have been caught on the back foot, this is no reason to despair as there are solutions available and it is a necessity to ensure that such solutions are pursued and properly implemented.

As far back as 2014, the United Nations Office on Drugs and Crime published a “Basic Manual on the Detection And Investigation of the Laundering of Crime Proceeds Using Virtual Currencies”. It is crucial that those drafting policies for the regulation of crypto, and those working on methods of prevention and detection of crypto crimes have reference to such documents so that they do not begin their work with no foundation.

The battle against crypto crimes cannot solely be addressed as one of policy — it needs to be innovative and practical as well. An example of this approach was a collaboration in England in which several universities and the law enforcement agencies which operate in the areas where the universities are based formed the N8 Policing Research Partnership (N8 PRP). The collaboration gave rise to an experiment aimed at preparing police investigators to detect illicit crypto transactions and the use of crypto in the commission of offences.

The experiment made several key findings, chief amongst them was “a lack of experience in law enforcement agencies in conducting [effective] investigations and prosecutions of crimes involving cryptocurrencies”. This is not unique to the UK and it emphasises the need for a concerted effort from multiple sectors to combat crypto crime worldwide.

Although the experiment is related to crypto crime, the partnership also aims at collaboration for research to assist with the challenges of 21st-century policing. It is a clear necessity that we create such partnerships in South Africa with similar purposes so as to ensure a form of policing that is able to respond to the challenges advanced criminal techniques have created.

There is currently no foolproof way to go about detecting and prosecuting crypto crimes. The State, through cooperation with the private sector, must gain the requisite knowledge and experience in order to ensure the competent and efficient detection, combating, and prosecution of yet another avenue that criminal minds may try and exploit.

The relevant authorities need to future-proof their methods. DM

Thulani Dlamini is a candidate attorney at Werksmans Attorneys. He works in the Business Crimes & Investigations practice area under Bernard Hotz (Practice Head) and Jeremy Gobetz.