Indian Crypto Exchanges Try To Beef Up Compliance As Buyers Pile In

While no formal estimates of cryptocurrency holders exist in India, the top three exchanges claim they each have users in the range of 1 to 10 million.

Who are these users? Investors? Believers in cryptocurrencies? Could they also be those who want to launder money? Or finance illegal activities?

For a while now, regulators, seeking a clampdown on or regulation of cryptocurrencies, have argued that these tokens can be misused. Crypto exchanges, in turn, are trying to convince regulators that they can track users well enough to sniff out misuse.

All this in the hope that cryptocurrencies are regulated but not banned.

As a first step, these exchanges claim they're following know-your-customer processes similar to banks to weed out miscreants.

"The first layer of defence is a robust KYC system that is on a par with India's standards," said Shashi Jha, head of legal and compliance at WazirX. The exchange requires the user to submit their PAN card, passport or driving license, along with an active mobile number. "We further verify the bank account details of the user by penny dropping. It establishes a surrogate KYC on the bank's end as well."

According to the exchange, a user can only transfer fiat money to the crypto exchange via the linked bank account. This allows banks to identify where the funds are headed.

"Secondly, we deploy internal triggers to watch out for any unusual or erratic behaviour," Jha said. "Suspicious behaviour is flagged based on trading volume, obscure orders and pre-known bad actors within the blockchain."

WazirX, one of India's largest exchanges, had received a show cause notice from the Enforcement Directorate in June this year. The notice, BloombergQuint had reported, alleged that WazirX was in violation of Anti-Money Laundering and Combating of Financing of Terrorism precaution norms and FEMA guidelines which are also applicable to Virtual Currency exchanges.

Earlier this month, WazirX released a transparency report, highlighting its efforts to curb malicious accounts and attempted frauds.

According to the report, WazirX has blocked 377 user accounts in response to requests from Indian and foreign law enforcement agencies between April and September 2021. Almost 1,500 accounts were locked due to payment disputes or ongoing investigations.

CoinSwitch Kuber told BloombergQuint nearly two lakh accounts have come under the scanner owing to suspicious activities.

"The action we take depends on the severity. We first warn the user if unusual activity is spotted, and block them if it continues. If the severity is high, we block the account immediately," said Sharan Nair, chief business officer of CoinSwitch Kuber. "So far, we have suspended 1,80,000 accounts in the last six months. We are focused on retail customers, so protecting their interest is extremely important."

We regularly share our data with law enforcement agencies and flag 20-25 transactions daily for moderation. More than 350 accounts have been blocked so far," said Vikram Subburaj, chief executive officer and co-founder of Giottus exchange.

Crypto exchanges are also working with third-party intelligence providers such as TRM Labs, Chainalysis and Elliptic to provide "Know Your Transaction" services.

These services use artificial intelligence and machine learning models to keep track of bad wallets, addresses, links and even organisations. Any wallet which is known to have indulged in illicit transactions or illegal activities, is called a bad wallet. It can exist inside a smartphone app, hard drive, or even the cloud.

Transactions are compared against all known threats and any suspicion of illegal activity is immediately flagged.

"Our database is constantly growing, which helps improve accuracy," said Akand Sitra, lead of business strategy, TRM Labs. We collaborate with global law enforcement agencies, exchanges, and other stakeholders to weed out the bad from the good, he said.

"For example, if we know a particular wallet or address was used by a terrorist organisation to transfer coins, we can not only flag it for future reference but also track down all the other tainted transactions that passed through it," Sitra said.

In fact, the process can map an unbroken flow of funds and visualise it, which can provide information about other bad actors within the system.

According to him, while conventional banking systems are often hard to access because each bank has its own private database and limits data sharing, transactions on the blockchain are actually easier to map.

"We have developed multiple tools to ensure that maximum data is being scanned and judged. Some of them are wallet screening, transaction monitoring, and forensics graphical visualiser," Sitra said. "Our models can raise a flag with varying severity, depending on the nature of the transaction. It includes political issues, sanctioned regimes, gambling, narcotics, and child pornography."

TRM Labs currently provides its services to WazirX, CoinSwitch Kuber, and Giottus. CoinDCX did not respond to BloombergQuint's queries.

Some exchanges have put in place other measures to track transactions better.

For instance, CoinSwitch Kuber said it doesn't allow users to transfer coins out of the exchange. If you want to exit, you have to sell and exit in cash. Transfers via hard wallets aren't permitted.

"Since we primarily cater to retail investors on our platform, we implement this model to provide a regulated pathway to our customers without impacting the safe experience," said CoinSwitch Kuber's Nair.

WazirX does allow for coin transfers but believes that this does not pose a risk.

Even if coins are transferred to other exchanges or wallets, the final party will be forced to come back online to use them successfully, WazirX's Shashi said. And the moment they do, the blockchain shall record the transaction, making it practically impossible to go untracked.

At present, though, any and all compliance processes are being defined by the exchanges themselves with no third-party oversight.

Subburaj of Giottus said that regulations should come from the government rather than exchanges forming their own set of rules. Equally, law enforcement officials need to better understand the crypto ecosystem.

The bigger problem is lack of know-how among the law enforcement agencies, he said. "They are well versed with banking or social media procedures but are fairly new to blockchain."

Compliance processes put in place by exchanges also lack any third-party audits, oversight, or certification.

"The government is treading cautiously because it has to investigate and consider all sides of the argument," said Vaishali Basu Sharma, a consultant for macroeconomic and security issues and former assistant director of the National Security Council, India. "Cryptocurrencies have primarily remained unregulated globally due to their complexity and radical approach."

Basu explained that while a blockchain records all transactions, this is the equivalent of having an IP address, realistically. For law enforcement, it's a herculean task to trace down someone based on a single line of code. And the complications further increase when cross-border cases are involved.

Basu's concerns are reflected in data.

According to blockchain analytics firm CipherTrace, notable thefts, hacks, and frauds linked to cryptocurrencies totaled $4.5 billion in 2020. In addition, 84% of the bitcoin moved in exchange-to-exchange transactions was moved cross-border.

"Technologically, an exchange can be set up virtually anywhere, including the dark web. And, many offer services with little-to-no AML or KYC regulations in place," she said. "So, while the organised sector can team up for self-regulation, it still keeps the gate open for obscure platforms to grow."

FATF has also highlighted concerns about anonymity-centric cryptocurrencies like Monero, which can be easily traded online. While the user may not buy crypto via fiat, the decentralised world of crypto offers enough solutions to swap one crypto for another within seconds, she cautioned.