How to Regulate NFTs

From the beginning, the principal attraction of NFTs has been the ability for creators to monetize digital art, to shape the terms of their own markets through smart contracts, and to bypass traditional gatekeepers. However, because NFTs can technically represent any type of asset, including physical objects, it can be difficult to ascertain the legality of activities employing NFTs. The cross-border nature of NFT transactions, as well as the widespread use of unhosted (non-custodial) wallets, makes Web3 a difficult ecosystem to regulate. 

The potential of NFTs to be used for money laundering, tax evasion, price manipulation, and other illicit activities is a growing concern for regulators and law enforcement. Recent research suggests that the manipulable nature of NFT prices could theoretically help criminals to justify their illicit proceeds to tax authorities on the basis that they were legitimate earnings from NFT trading. Unable to evaluate the true cost of NFTs tied to illicit trading activity, authorities face great difficulty in establishing genuine criminality. Right now, crime represents a small proportion of overall NFT trading at 0.02%. However, it has a disproportionate impact on the industry’s reputation, undermining investor and consumer protection. 

‍‍

The case of Shvembldr

On February 10, 2022, Latvian generative artist Ilja “Shvembldr” Borisovs had his bank accounts frozen by Latvian law enforcement on the grounds of alleged money laundering. If found guilty, he is likely to face a 12-year jail sentence. On 18 July, 2022, Borisovs published a website, Art is Crime, detailing how law enforcement went about freezing his bank accounts without communicating the nature of the allegations against him.

The case proceedings illustrate the struggles of regulators trying to catch up with fast-evolving technology, with legal uncertainty the result of outdated and unworkable regulatory compliance policies and frameworks.‍

According to Borisovs, in 2021, he minted and sold 3,557 NFTs on the Ethereum blockchain, earning 4253 ETH (€8.7 million) in the process, which was then deposited in his Latvian bank account. Due to a lack of clear crypto tax regulations in Latvia, a European Union (EU) Member State, Borisovs initiated contact with the Latvian State Revenue Service (VID) on how to become tax compliant with his cryptocurrency earnings. Borisovs was allegedly advised to register as a “self-employed” individual and to pay taxes on the amount deposited in Euros. At the time of writing, Borisovs owes Latvia €2.23 million as annual income tax for 2021 and €3.10 million in total, with interest accruing at an unknown daily rate, all while his bank account remains frozen.

Borisovs’s lawyer managed to challenge the freezing of his bank account, with the court granting him orders to access the money on 30 June, 2022. Yet Borisovs’s account was never unfrozen. On 3 July 2022, Borisovs made an application to the court to contest the freezing of his accounts but this application was subsequently denied. The new investigator assigned to the case promptly obtained court orders to seize Borisovs’s property, informing the artist that there was no convincing evidence that his money had been obtained legally. Borisovs was therefore unable to prevent the criminal case proceeding against him. The case proceedings remain ongoing.‍

Legal and regulatory compliance developments‍

EU Anti-Money Laundering Directives‍

On 10 January, 2020 the EU’s Fifth Anti-Money Laundering Directive (5AMLD) came into effect across the EU, having already been implemented in Latvia in 2019. The Directive aims to regulate the art market as a target for money laundering, while a more recent report seeks to demystify NFTs in light of the Directive. Under 5AMLD, artworks are a category of “High Value Goods” (HVGs) that carry the potential risk of money laundering. For artworks exceeding  €10,000, the legislation requires dealers to register with the government in order to verify client identities and report suspicious transactions. 

However, the Fifth Anti-Money Laundering Directive did not define regulations specific to NFTs and the legislation is yet to be extended to NFT markets.‍

The latest draft of the EU’s Markets in Crypto Assets regulations (MiCA) excludes NFTs if they fall under existing crypto-asset categories. MiCA is intended to protect consumers against some of the risks associated with crypto-assets, and to help them avoid fraudulent schemes. In August 2022, EU Advisor Peter Kerstens confirmed that NFT collections will now receive the same treatment as cryptocurrencies under the MiCA regulations, which will come into full effect around 2024. This means that exchanges trading in NFTs would be subject to the same stringent identity checks and transaction reporting requirements as other obligated entities, such as banks.‍

FATF guidance‍

The Financial Action Task Force (FATF) is the global money laundering and terrorist financing watchdog. Included in its remit is the review of new risks, including the trade in virtual assets, which has grown alongside the rise of cryptocurrencies. While FATF’s recommendations are non-binding and do not overrule national laws, they do set global standards against money laundering and terrorist financing, assisting countries in taking action successfully against the illicit use of their financial systems.

According to a 2018 FATF report, “Latvia’s own level of corruption, vulnerability to international organised crime and significant shadow economy are also key factors of the overall ML [money laundering] risk faced by Latvia.” It also notes that “the main sources of criminal proceeds are corruption and bribery, tax offences, fraud and smuggling…” According to the report, a significant amount of laundered proceeds are generated abroad, while domestic money laundering pertains mainly to self-laundering. At the same time, “Latvia has a sound legal system and institutional framework for the investigation and prosecution of money laundering,” especially in cases involving bank employees who are active as facilitators.

In October 2021, FATF developed a “travel rule” mandating that Virtual Asset Service Providers (VASPs) such as crypto exchanges, crypto ATM operators, and other crypto-related businesses obtain, hold, and exchange information about the originators and beneficiaries of virtual asset transfers of above €1000. The travel rule enables financial institutions and VASPs to conduct sanctions screening and to detect suspicious transactions. 

FATF acknowledges that countries are implementing its recommendations on Anti-Money laundering/Combatting the Financing of Terrorism (AML/CFT) for Virtual Asset Service Providers (VASPs) at different paces. This presents challenges for VASPs in determining their approach to jurisdictions where the travel rule is not yet in force. The potential for increased anonymity or obfuscation undermines a VASP’s ability to know its customers and therefore to implement effective Customer Due Diligence (CDD) and other AML/CFT measures. To mitigate risk, FATF recommends that VASPs should collect the required originator and beneficiary information on unhosted wallets from their customers.

‍Sanctions and crackdowns‍

In November 2021, a Latvia-based exchange, Chatex, was sanctioned by the US Office of Foreign Assets Control (OFAC). Chatex was tied to SUEX, a Russian-based exchange that shared the same founder, which had already been sanctioned in September 2021 for facilitating the laundering of ransomware, crypto fraud, and darknet market proceeds. According to a recent report, OpenSea blocked an account associated with Chatex’s wallet address and delisted its NFTs (though they remain visible on non-US-based NFT marketplaces). This represents the first example of NFTs being placed under international sanction owing to their possession by criminals accused of laundering cybercrime proceeds.

NFTs can be weaponized for illicit activity in two primary areas — money laundering and wash trading. ‍

‍‍The latter has been of particular concern recently, with cryptocurrency exchanges allegedly inflating their trading volumes. In criminal cases, blockchain analytical tools may be used to observe self-financed addresses. In February 2022, the UK tax authority obtained a court order to prevent the resale of NFTs in a case of suspected VAT fraud amounting to £1.4 million. Three individuals were arrested and three NFTs seized along with £5,000 worth of crypto-assets. It is alleged that the defendants used 250 fake companies and stolen identities to wash trade and artificially inflate the value of the NFTs in order to claim back the overstated levels of VAT.

In NFT wash trading, the goal is to make an NFT appear more valuable than it really is by “selling” it to a wallet also controlled by the owner. A report published earlier this year identified “262 users who [had] sold an NFT to a self-financed address more than 25 times,” identifying them as “habitual” wash traders. According to the report, by February 2022, NFT wash traders had made a collective profit of nearly $8.9 million from only 110 wallet addresses. This figure is most likely derived from sales to unsuspecting buyers who believe that the NFTs they are buying have increased in value after being owned by multiple different collectors. Yet even today, NFT wash trading remains legal in most jurisdictions. ‍

Analysis‍

Based on the current ambiguities around regulatory compliance, it is arguably not possible to conclude whether or not Shvembldr was involved in criminal activity. His case raises pertinent questions of law, which should be examined carefully by a court as it seeks to shape the legal and regulatory framework surrounding digital assets. In any event, the transparent nature of blockchains provides the ultimate “paper trail” for digital forensics specialists, law enforcement agencies, tax authorities, and regulatory compliance professionals. This plainly suggests that NFTs are the least ideal channel to conduct illegal activity because the blockchain trail is permanent.

As an emergent technology, NFTs are yet to be addressed on their own terms, remaining subject to outdated legal and regulatory regimes. It is therefore vital that global AML/CFT requirements on digital/virtual assets as well as VASPs are adapted to accommodate digital assets rather than stifle their development. Regulators should be encouraged to (i) keep abreast of digital art innovations (ii) educate themselves on digital asset fraud and scam techniques to identify situational red flags, and (iii) work with supranational bodies to create an internationally consistent NFT regime. In this way, a well-coordinated regulatory landscape can drive consumer and investor confidence, while ensuring that digital assets benefit from consistent legal recognition and protection in a way that acknowledges the nuances of the assets themselves.