Economic Crime and Corporate Transparency Act: cryptoassets - technical
Updated 1 March 2024
© Crown copyright 2024
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/economic-crime-and-corporate-transparency-act-2023-factsheets/economic-crime-and-corporate-transparency-act-cryptoassets-technical
Background
Cryptoassets are a store of value which can be transferred or exchanged digitally. Bitcoin, the first cryptoasset, was originally created by an anonymous developer, or group of developers, under the name Satoshi Nakamoto. Nakamoto saw digital payments as pervasive and viewed cryptoassets as a solution to his perceived problems with the mainstream financial services sector.
Cryptoassets were designed to give individuals greater control over their finances, serving as a decentralised form of electronic currency that enabled peer-to-peer global transactions, without the input of a centralised authority such as a country or a bank.
Users can own and transact with cryptoassets in one of two ways:
1. Through third-party intermediaries who safeguard the cryptoassets on behalf of the consumer (akin to banks). These platforms have made the cryptoasset technology more accessible to everyday users.
2. Cryptoassets can also be held directly, in a personal hardware-wallet. In this instance the user takes responsibility for storing their assets and user information.
Key facts
Cryptoassets are a digital representation of value, the ownership of which is cryptographically proven (using computer code).
Cryptoassets do not generally have equivalent physical manifestations. “Coins”, for instance, only exist notionally.
Bitcoin, created in 2008, was the first cryptocurrency, and it remains by far the biggest, most influential and best-known cryptoasset.
Cryptoassets serve as a pseudo-anonymous and relatively quick method of moving funds globally. There are low barriers to entry, users merely need an internet-connected device to transact with cryptoassets. Given these characteristics, it is therefore no surprise that this technology is being exploited by criminals and terrorists alike.
Cryptoassets are increasingly accessible through cryptoasset exchanges, and their trading volumes have increased significantly in recent years despite high market volatility.
Cryptoassets typically fluctuate more in value than government-issued currencies. For example, the price of one Bitcoin fluctuated from an all-time high price on 8 November 2021 where it reached $67,567 per coin, to a recent low on 18 June 2022 to $17,744. [footnote 1]
The potential uses of Cryptoassets have expanded in recent years, with the introduction of new asset classes. For example, Non-Fungible Tokens (NFTs) are unique digital tokens that can represent a unique item such as art. In some cases, NFTs have been made purely for the purpose of money laundering. In 2021 NFT sales were estimated to be around $40 billion. There has also been an increase in the use of DeFi in recent years, which is the provision of traditional financial services, e.g., lending/saving accounts, but using cryptoassets.
Cryptoassets’ application and infrastructure are cross-border. As of June 2022, the various cryptocurrencies on offer (numbering over 20,000) were estimated to be worth a combined value of $929.51 billion. At its peak in November 2021, the cryptoasset market cap neared $3 trillion. [footnote 2]
How do cryptoasset transactions work?
The easiest way for a user to conduct a transaction using cryptoassets is to create a digital wallet, similar to an online bank account. This will generate a pair of alphanumeric digital keys required to transact in cryptoassets: a public key and a private key. The public key can be thought of as analogous to an account number, which is used to identify the user. The private key is analogous to a user’s PIN. These keys are used to send and receive transactions; they are a means of identifying the parties to a transaction and proving their ownership over the assets they intend to transact.
Transactions are recorded using “Distributed Ledger Technology” (DLT). Distributed networks like these eliminate the need for a central authority, such as a bank, to check for invalid transactions. Participants around the world (commonly referred to as ‘nodes’ or ‘peers’) connected through a peer-to-peer network compete to solve complex computational puzzles in order to validate the transactions. Through this process, all verified transactions are recorded on an electronic ledger.
Blockchain is the most widely known DLT network. The blockchain is comprised of transaction entries called ‘blocks’ which confirm and record users’ transactions. Each block is cryptographically connected to the previous block in the blockchain through a ‘hash’ (analogous to a digital fingerprint). This creates an auditable trail of the transaction.
The Bitcoin blockchain, and many others, are publicly available and transparent. As transactions are time-stamped on the blockchain and mathematically related to the previous ones, they are irreversible and impossible to alter.
How are cryptoassets traded and what role do exchanges play?
Cryptoassets can be bought and sold on centralised cryptoasset exchanges; the exchange may also store the cryptoassets.
Cryptoassets can also be traded through over-the-counter brokers, who facilitate direct trades between private individuals. This service is particularly vulnerable to abuse by criminals who take advantage of the reduced Anti-Money Laundering/Know Your Customer (AML/KYC) checks.
Individuals can also purchase cryptoassets from online fiat on-ramps using credit cards, debit cards, or through a bank transfer. These services tend to have minimal AML/KYC checks for the purchase of certain amounts of cryptoassets.
Many e-money institutions also allow customers to purchase certain cryptoassets through their platforms.
Finally, users can trade their cryptoassets using decentralised exchanges, which facilitate cryptoasset exchange through smart contracts. There are no AML/KYC requirements to use decentralised exchanges, making them vulnerable to abuse by criminals.
How are new cryptoassets created/do they enter circulation?
Some cryptoassets have a finite total supply (such as Bitcoin); others are launched with infinite total supply. Bitcoin was the first and is the most popular cryptoasset, currently holding the highest market cap of any coin. Bitcoin’s design set a precedent for future cryptoassets, however each has their own unique specifications.
Bitcoin is created through a process called mining, which involves using computing power to solve mathematical puzzles on the Bitcoin network. Every time a new block is added to the blockchain, new Bitcoins enter circulation. The participants (nodes) who solve the computational puzzle receive some Bitcoin as a reward for contributing their computing power to the Bitcoin network.
In some cases, cryptoassets are only generated in response to demand. For example, Stablecoins are only created or “minted” once an individual deposits the equivalent amount in fiat currency, e.g., sterling. These cryptoasset tokens can then subsequently be taken out of circulation if the cryptoasset is sold.
How long does a cryptoasset transaction take to complete?
The time taken to verify and record a transaction using the DLT varies among cryptoassets. For example, on the Bitcoin network, the average confirmation time for a Bitcoin payment is about 10 minutes. The two main factors that influence transaction time are the volume of network activity and transaction fees. The more transactions that the network needs to process, the longer each transaction takes. This is because there are only so many nodes competing to solve the computational puzzle (the step required to verify a transaction) at any one time.
Sometimes users will pay more in transaction fees in order to get their transactions processed more quickly. This means that, in some cases, cryptoasset transactions will not be as cost effective or as efficient as transactions done through a government issued currency.
How are cryptoassets regulated in the UK?
The Financial Conduct Authority (FCA) is the UK’s main financial regulatory body. The FCA regulates financial firms providing services to consumers and maintains the integrity of the financial markets in the United Kingdom. It focuses on the regulation of conduct by both retail and wholesale financial services firms.
The FCA currently has oversight to check that cryptoasset firms have effective anti-money laundering (AML) and terrorist financing procedures in place, but generally cryptoassets themselves are not regulated. Security tokens (tokens with specific characteristics that provide rights and obligations akin to specified investments, like a share or a debt instrument) are the only FCA-regulated cryptoasset.
If firms are registered with the FCA it means they follow a level of AML regulation acceptable to the FCA and conduct appropriate customer due diligence and checks before onboarding clients.
The UK Advertising Standards Agency (ASA) has also become involved in cryptoasset oversight, regulating the promotion of cryptoassets to consumers by increasing its scrutiny of social media, web pages and ads.
Currently AML regulations for cryptoassets vary considerably between jurisdictions, with a number of jurisdictions yet to implement international standards set out by the Financial Action Task Force (FATF).
What proportion of cryptoassets are used for licit vs. illicit purposes?
There is no definitive figure for the proportion of cryptoasset transactions that are illicit. In the UK, the NCA’s National Assessment Centre estimates that likely over £1 billion of illicit cash is transferred overseas using cryptoassets. They also estimate that hundreds of millions of pounds are likely laundered via over-the-counter crypto brokers and professional money launderers have widely adopted cryptoassets to facilitate crime.
There is also evidence of cryptoassets featuring in terrorist investigations with increasing frequency, with some choosing to use the pseudo-anonymous method of payment and to fundraise on social media.
What are some of the security issues with cryptoassets?
A blockchain is a series of blocks that records data with timestamps so that the data cannot be changed or interfered with. This technology along with users’ constant review of the system have made it difficult to ‘hack’ cryptoassets.
The key to blockchain’s security is that any changes made to the database are immediately sent to all users to create a secure, established record. With copies of the data in all users’ hands, the overall database remains safe even if some individual users cryptoassets are hacked.
This “consensus mechanism” ensures that even if one actor behaves nefariously (or is hacked), because of the consensus needed amongst those users or miners working on the blockchain, you still eventually arrive at a ‘correct’ version of the blockchain.
The fact that cryptoassets are considered difficult to hack does not mean that it’s necessarily a safe investment. The potential for security risks remains at various stages of the trading process.
‘51% attacks’ are an example of where the security of cryptoassets could be breached. These involve a group of miners who control over 50% of the network’s computational power. This kind of attack enables a bad actor to pause new transactions, prevent miners from verifying blocks, and spend coins twice or “double spend”.
Cryptoasset users are assigned private keys, which allow access to their cryptoassets. Hackers can infiltrate wallets and steal these assets if they know a user’s private key. If hackers can determine some of your non-cryptoasset related personal information, even if it is your name and address, they may be able to infiltrate your transactions in that space regardless, for example through phishing attacks.
There is also the potential for a hardware wallet containing cryptoasset information being lost, stolen or attacked.
What are the advantages and disadvantages to using cryptoassets to transfer value vs. an ordinary bank transfer?
Cryptoassets’ low transaction fees and transaction speed could be seen to be beneficial when compared to dealing with some financial transactions such as international payments. Cryptoasset transactions often take less than a minute to complete (no matter where the parties are located).
In the UK, we have the Faster Payments Scheme, so there is not as much of an advantage in terms of speed or cost to using cryptoassets to transfer value. However, in developing countries and even jurisdictions like the U.S where wire transfers can take several days and cost much more, cryptoasset transfers may be more efficient and therefore more appealing.
International transfers are another area where blockchain technology may outplay traditional banking institutions. Cryptoassets are borderless and can be transferred among users living in different countries at the same high speed. The international banking system does not exhibit this level of efficiency and varying jurisdictional rules and regulations may slow the process.
Fluctuations in the market make it harder for companies to accept cryptoassets as payment for goods and services; the price of a cryptoasset can vary considerably, even hourly. The cryptoasset ecosystem also remains a relatively new phenomenon; despite their relative normalisation, cryptoassets are still not a widely accepted payment method.
It is unclear whether cryptoassets will ever become a mainstream means of exchange. Issues such as processing capacity and their mining’s vast energy consumption, still need to be resolved. There are also still AML concerns and requirements that need to be addressed and broadly upheld across the majority of jurisdictions for cryptoasset transfers to be considered as innocuous as bank transfers.