Virtual Currencies: Emerging Regulatory, Law Enforcement, and Consumer Protection Challenges
Published: 2014-05-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Virtual currencies—digital representations of value that are not government-issued—have grown in popularity in recent years. Some virtual currencies can be used to buy real goods and services and exchanged for dollars or other currencies. One example of these is bitcoin, which was developed in 2009. Bitcoin and similar virtual currency systems operate over the Internet and use computer protocols and encryption to conduct and verify transactions. While these virtual currency systems offer some benefits, they also pose risks. For example, they have been associated with illicit activity and security breaches, raising possible regulatory, law enforcement, and consumer protection issues. GAO was asked to examine federal policy and interagency collaboration issues concerning virtual currencies.
This report discusses (1) federal financial regulatory and law enforcement agency responsibilities related to the use of virtual currencies and associated challenges and (2) actions and collaborative efforts the agencies have undertaken regarding virtual currencies. To address these objectives, GAO reviewed federal laws and regulations, academic and industry research, and agency documents; and interviewed federal agency officials, researchers, and industry groups.
section_title: What GAO Found
paragraphs: Virtual currencies are financial innovations that pose emerging challenges to federal financial regulatory and law enforcement agencies in carrying out their responsibilities, as the following examples illustrate:
Virtual currency systems may provide greater anonymity than traditional payment systems and sometimes lack a central intermediary to maintain transaction information. As a result, financial regulators and law enforcement agencies may find it difficult to detect money laundering and other crimes involving virtual currencies.
Many virtual currency systems can be accessed globally to make payments and transfer funds across borders. Consequently, law enforcement agencies investigating and prosecuting crimes that involve virtual currencies may have to rely upon cooperation from international partners who may operate under different regulatory and legal regimes.
The emergence of virtual currencies has raised a number of consumer and investor protection issues. These include the reported loss of consumer funds maintained by bitcoin exchanges, volatility in bitcoin prices, and the development of virtual-currency-based investment products. For example, in February 2014, a Tokyo-based bitcoin exchange called Mt. Gox filed for bankruptcy after reporting that it had lost more than $460 million.
Federal financial regulatory and law enforcement agencies have taken a number of actions regarding virtual currencies. In March 2013, the Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) issued guidance that clarified which participants in virtual currency systems are subject to anti-money-laundering requirements and required virtual currency exchanges to register with FinCEN. Additionally, financial regulators have taken some actions regarding anti-money-laundering compliance and investor protection. For example, in July 2013, the Securities and Exchange Commission (SEC) charged an individual and his company with defrauding investors through a bitcoin-based investment scheme. Further, law enforcement agencies have taken actions against parties alleged to have used virtual currencies to facilitate money laundering or other crimes. For example, in October 2013, multiple agencies worked together to shut down Silk Road, an online marketplace where users paid for illegal goods and services with bitcoins.
Federal agencies also have begun to collaborate on virtual currency issues through informal discussions and interagency working groups primarily concerned with money laundering and other law enforcement matters. However, these working groups have not focused on emerging consumer protection issues, and the Consumer Financial Protection Bureau (CFPB)—whose responsibilities include providing consumers with information to make responsible decisions about financial transactions—has generally not participated in these groups. Therefore, interagency efforts related to virtual currencies may not be consistent with key practices that can benefit interagency collaboration, such as including all relevant participants to ensure they contribute to the outcomes of the effort. As a result, future interagency efforts may not be in a position to address consumer risks associated with virtual currencies in the most timely and effective manner.
section_title: What GAO Recommends
paragraphs: GAO recommends that CFPB take steps to identify and participate in pertinent interagency working groups addressing virtual currencies, in coordination with other participating agencies. CFPB concurred with this recommendation.

section_title: Letter
paragraphs: While not widely used or accepted, virtual currencies, such as bitcoin,  have grown in popularity in recent years and have emerged for some as  potential alternatives to traditional currencies issued by governments.  Virtual currencies operate over the Internet and, in some cases, may be  used to buy real goods and services and exchanged for traditional  currencies. They offer potential benefits over traditional currencies,  including lower transaction costs and faster funds transfers. Because  some virtual currency transactions provide greater anonymity than  transactions using traditional payment systems, law enforcement and  financial regulators have raised concerns about the use of virtual  currencies for illegal activities. Additionally, recent cases involving the  loss of funds from virtual currency exchanges have highlighted potential  consumer protection issues.
You asked us to examine potential policy issues related to virtual  currencies and the status of federal agency collaboration in this area. This  report focuses on the federal financial regulatory agencies and selected  federal law enforcement agencies that have a role in protecting the U.S.  financial system and investigating financial crimes. Specifically, this  report addresses (1) agency responsibilities related to the use of virtual  currencies and the emerging challenges these currencies pose to the  agencies; and (2) actions the agencies have taken in response to the  emergence of virtual currencies, including interagency collaborative  efforts. We selected the law enforcement agencies included in our review  based on their involvement in investigating virtual-currency-related crimes  and participation in interagency collaborative efforts and congressional  hearings on virtual currency issues.
To describe agency responsibilities related to the use of virtual currencies  and the emerging challenges these currencies pose, we reviewed the  following agency information: testimony and written statements from  relevant congressional hearings, written responses to congressional  questions, unclassified intelligence assessments, financial reports,  training presentations, and descriptions of missions and responsibilities  from agencies’ websites. We also reviewed prior GAO reports,  Congressional Research Service reports, and relevant laws and  regulations, including the Bank Secrecy Act (BSA) and related anti-money  laundering provisions such as Title III of the USA PATRIOT Act, to gain  an understanding of agencies’ responsibilities in administering and  enforcing anti-money-laundering laws and regulations, as well as in  investigating and prosecuting financial and other crimes.reviewed academic articles and papers from industry stakeholders.  Further, we interviewed officials from the following federal financial  regulatory and law enforcement agencies:
The Board of Governors of the Federal Reserve System (Federal
The Bureau of Consumer Financial Protection (also known as the  Consumer Financial Protection Bureau or CFPB);
The Commodity Futures Trading Commission (CFTC);
The Department of Homeland Security (DHS), including U.S.
Immigration and Customs Enforcement–Homeland Security  Investigations (ICE-HSI) and the U.S. Secret Service (Secret Service);
The Department of Justice (DOJ), including the Criminal Division and  two of its components—the Asset Forfeiture and Money Laundering  Section and Computer Crime and Intellectual Property Section—and  the Federal Bureau of Investigation (FBI);
The Department of the Treasury (Treasury), including the Financial  Crimes Enforcement Network (FinCEN) and the Office of the  Comptroller of the Currency (OCC);
The Federal Deposit Insurance Corporation (FDIC);
The National Credit Union Administration (NCUA); and
The Securities and Exchange Commission (SEC).
Additionally, we interviewed an academic whose research focused on  virtual currencies and industry stakeholders, including the Bitcoin  Foundation, the Digital Asset Transfer Authority (DATA), and the National  Money Transmitters Association, which represent the interests of a large  number of virtual currency and money transmission businesses.
To examine the actions and collaborative efforts federal agencies have  undertaken in response to the emergence of virtual currencies, we  reviewed agency information, including FinCEN’s regulatory guidance  and administrative rulings on the applicability of BSA to virtual currency  participants, testimony and written statements from the previously  mentioned congressional hearings, written responses to congressional  questions, intelligence assessments, a CFPB query of its Consumer  Complaint Database, and press releases.from the agencies listed previously to obtain further information on the  actions they have taken to address the emergence of virtual currencies  and their efforts to collaborate with other federal agencies on this issue.  Additionally, we interviewed the academic and industry stakeholders  noted previously, as well as the Digital Economy Task Force, to  determine the extent to which private sector groups were involved in   We also interviewed officials  interagency collaborative efforts. We reviewed GAO’s key practices on  collaboration and assessed whether interagency collaborative efforts  related to virtual currencies were consistent with practices concerning the  inclusion of relevant participants.
We conducted this performance audit from November 2013 to May 2014  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Virtual currencies are financial innovations that have grown in number  and popularity in recent years. While there is no statutory definition for  virtual currency, the term refers to a digital representation of value that is  not government-issued legal tender. Unlike U.S. dollars and other  government-issued currencies, virtual currencies do not necessarily have  a physical coin or bill associated with their circulation. While virtual  currencies can function as a unit of account, store of value, and medium  of exchange, they are not widely used or accepted. Some virtual  currencies can only be used within virtual economies (for example, within  online role-playing games) and may not be readily exchanged for  government-issued currencies such as U.S. dollars, euro, or yen. Other  virtual currencies may be used to purchase goods and services in the real  economy and can be converted into government-issued currencies  through virtual currency exchanges. In previous work, we described the  latter type of virtual currencies as “open flow.” Open-flow virtual  currencies have received considerable attention from federal financial  regulatory and law enforcement agencies, in part because these  currencies interact with the real economy and because depository  institutions (for example, banks and credit unions) may have business  relationships with companies that exchange virtual currencies for  government-issued currencies. Throughout the remainder of this report,  we use the term virtual currencies to mean open-flow virtual currencies,  unless otherwise stated.
Virtual currency systems, which include protocols for conducting  transactions in addition to digital representations of value, can either be  centralized or decentralized. Centralized virtual currency systems have a  single administering authority that issues the currency and has the  authority to withdraw the currency from circulation. In addition, the  administrating authority issues rules for use of the currency and maintains  a central payment ledger. In contrast, decentralized virtual currency  systems have no central administering authority. Validation and  certification of transactions are performed by users of the system and  therefore do not require a third party to perform intermediation activities.
A prominent example of a decentralized virtual currency system is bitcoin.  Bitcoin was developed in 2009 by an unidentified programmer or  programmers using the name Satoshi Nakamoto. According to industry  stakeholders, bitcoin is the most widely circulated decentralized virtual  currency. The bitcoin computer protocol permits the storage of unique  digital representations of value (bitcoins) and facilitates the assignment of  bitcoins from one user to another through a peer-to-peer, Internet-based  network. Each bitcoin is divisible to eight decimal places, enabling their  use in any kind of transaction regardless of the value. Users’ bitcoin  balances are associated with bitcoin addresses (long strings of numbers  and letters) that use principles of cryptography to help safeguard against  inappropriate tampering with bitcoin transactions and balances. When  users transfer bitcoins, the recipient provides their bitcoin address to the  sender, and the sender authorizes the transaction with their private key  (essentially a secret code that proves the sender’s control over their  bitcoin address). Bitcoin transactions are irrevocable and do not require  the sender or receiver to disclose their identities to each other or a third  party. However, each transaction is registered in a public ledger called  the “blockchain,” which maintains the associated bitcoin addresses and  transaction dates, times, and amounts. Users can define how much  additional information they require of each other to conduct a transaction.
According to industry observers, examples of technologies used to increase the privacy  of participants in virtual currency transactions include (1) anonymizing networks, which  use a distributed network of computers to conceal the real Internet address of users, such  as The Onion Router (TOR); (2) “tumblers” such as BitcoinBath and BitLaundry that  combine payments from multiple users to obstruct identification through the blockchain;  and (3) alternative virtual currencies such as Zerocoin and Anoncoin that aim to make  transactions fully anonymous. the identities of participants in bitcoin transactions. In addition,  researchers have developed methods to determine identities of parties  involved in some bitcoin transactions by analyzing clusters of transactions  between specific addresses.
By design, there will be a maximum of 21 million bitcoins in circulation once all bitcoins  have been mined, which is projected to occur in the year 2140. Once all bitcoins have  been mined, miners will be rewarded for solving the math problems that verify the validity  of bitcoin transactions through fees rather than bitcoins. directly or use third-party payment processors that take payments in  bitcoins from buyers and provide businesses the payments in the form of  a traditional currency or a combination of bitcoins and traditional currency.  Figure 1 shows various ways that individuals can obtain and spend  bitcoins. http://blockchain.info. (Accessed on Mar. 31, 2014.) Due to data limitations, it is difficult  to calculate the velocity, or the rate at which bitcoins are spent, and the number of  transactions between unique users in a given time period.  https://blockchain.info. (Accessed on Apr. 1, 2014.) million commercial Automated Clearing House (a traditional payment  processor) transactions per day in 2013.
While bitcoin is the most widely used virtual currency, numerous others  have been created. For example, dozens of decentralized virtual  currencies are based on the bitcoin protocol such as Litecoin, Auroracoin,  Peercoin, and Dogecoin. Similar to the bitcoin market, the size of the  market for these virtual currencies is unclear. However, as of March 31,  2014, the total reported value of each of these currencies was less than  $400 million (ranging from about $33 million for Dogecoin to about $346  million for Litecoin). Other virtual currencies that have been created are  not based on the bitcoin protocol. One of the more prominent examples is  XRP, which is used within a decentralized payment system called Ripple.  Ripple allows users to make peer-to-peer transfers in any currency. A key  function of XRP is to facilitate the conversion from one currency to  another. For example, if a direct conversion between Mexican pesos and  Thai baht is not available, the pesos can be exchanged for XRP, and then  the XRP for baht. As of March 31, 2014, the total value of XRP was $878  million.
Virtual currencies have drawn attention from federal agencies with  responsibilities for protecting the U.S. financial system and its participants  and investigating financial crimes. These include, but are not limited to,  CFPB, CFTC, DHS, DOJ, SEC, Treasury, and the prudential banking  regulators. The prudential banking regulators are the FDIC, Federal  Reserve, NCUA, and OCC. Within Treasury, FinCEN has a particular  interest in the emergence of virtual currencies because of concerns about  the use of these currencies for money laundering and FinCEN’s role in   Additionally, because virtual currencies (like  combating such activity. government-issued currencies) can play a role in a range of financial and  other crimes, including cross-border criminal activity, key components of  DOJ and DHS have an interest in how virtual currencies are used.  Relevant DOJ components include the Criminal Division (which oversees  the Computer Crime and Intellectual Property Section and the Asset  Forfeiture and Money Laundering Section), the FBI, and the Offices of the  U.S. Attorneys (U.S. Attorneys). Relevant DHS components include the  Secret Service and ICE-HSI.
Money laundering is the process of disguising or concealing the source of funds  acquired illicitly to make the acquisition appear legitimate.
section_title: Federal Agencies Face Emerging Challenges in Carrying Out Responsibilities Related to the Use of Virtual Currencies
paragraphs: While federal agencies’ responsibilities with respect to virtual currency are  still being clarified, some virtual currency activities and products have  implications for the responsibilities of federal financial regulatory and law  enforcement agencies. Virtual currencies have presented these agencies  with emerging challenges as they carry out their different responsibilities.  These challenges stem partly from certain characteristics of virtual  currency systems, such as the higher degree of anonymity they provide  compared with traditional payment systems and the ease with which they  can be accessed globally to make payments and transfer funds across  borders.
subsections: section_title: Some Virtual Currency Activities and Products May Have Implications for Federal Agencies’ Responsibilities
paragraphs: Although virtual currencies are not government-issued and do not  currently pass through U.S. banks, some activities and products that  involve virtual currencies have implications for the responsibilities of  federal financial regulatory and law enforcement agencies. These  activities and products encompass both legitimate and illegitimate uses of  virtual currencies. Examples of legitimate uses include buying virtual  currencies and registered virtual-currency-denominated investment  products. Examples of illegitimate uses include money laundering and  purchasing illegal goods and services using virtual currencies.
The goal of  FinCEN administers BSA and its implementing regulations.BSA is to prevent financial institutions from being used as intermediaries  for the transfer or deposit of money derived from criminal activity and to  provide a paper trail to assist law enforcement agencies in their money  laundering investigations. To the extent that entities engaged in money  transmission conduct virtual currency transactions with U.S. customers or  become customers of a U.S. financial institution, FinCEN has  responsibilities for helping ensure that these entities comply with BSA and  anti-money-laundering regulations.
Under 31 C.F.R. § 1010.100(ff)(1)-(7), money services businesses are generally defined  as any of the following: (1) currency dealer or exchanger, (2) check casher, (3) issuer or  seller of traveler’s checks or money orders, (4) provider or seller of prepaid access, (5)  money transmitter, and (6) the U.S. Postal Service. FinCEN’s regulations define a money  transmitter as a person that provides money transmission services, or any other person  engaged in the transfer of funds. 31 C.F.R. § 1010.100(ff)(5)(i).The term money  transmission services means the “acceptance of currency, funds, or other value that  substitutes for currency to another location or person by any means.” Id. services businesses are also required to monitor transactions and file  reports on large currency transactions and suspicious activities. In  addition, certain financial institutions must establish a written customer  identification program that includes procedures for obtaining minimum  identification information from customers who open an account, such as  date of birth, a government identification number, and physical address.  Further, financial institutions must file currency transaction reports on  customer cash transactions exceeding $10,000 that include information  about the account owner’s identity and occupation.
FinCEN also supports the investigative and prosecutive efforts of multiple  federal and state law enforcement agencies through its administration of  the financial transaction reporting and recordkeeping requirements  mandated or authorized under BSA. In addition, FinCEN has the authority  to take enforcement actions, such as assessing civil money penalties,  against financial institutions, including money services businesses, that  violate BSA requirements.
subsections: section_title: Prudential Banking Regulators
paragraphs: The prudential banking regulators—FDIC, Federal Reserve, NCUA, and  OCC—provide oversight of depository institutions’ compliance with BSA  and anti-money-laundering requirements. Therefore, these regulators are  responsible for providing guidance and oversight to help ensure that  depository institutions that have opened accounts for virtual currency  exchanges or other money services businesses have adequate anti-  In April 2005, FinCEN  money-laundering controls for those accounts.and the prudential banking regulators issued joint guidance to banking  organizations (depository institutions and bank holding companies) to  clarify BSA requirements with respect to money services businesses and  to set forth the minimum steps that banking organizations should take  when providing banking services to these businesses. As part of safety  and soundness or targeted BSA compliance examinations of depository  institutions, the prudential banking regulators assess compliance with  BSA and related anti-money-laundering requirements using procedures  that are consistent with their overall risk-focused examination approach.  In examining depository institutions for BSA compliance, the regulators  review whether depository institutions (1) have developed anti-money- laundering programs and procedures to detect and report unusual or  suspicious activities possibly related to money laundering; and (2) comply  with the technical recordkeeping and reporting requirements of BSA.  While most cases of BSA noncompliance are corrected within the  examination framework, regulators can take a range of supervisory  actions, including formal enforcement actions, against the entities they  supervise for violations of BSA and anti-money-laundering requirements.  These formal enforcement actions can include imposing civil money  penalties and initiating cease-and-desist proceedings.
section_title: Consumer Financial Protection Bureau
paragraphs: CFPB is an independent entity within the Federal Reserve that has broad  consumer protection responsibilities over an array of consumer financial  products and services, including taking deposits and transferring money.  CFPB is responsible for enforcing federal consumer protection laws, and  it is the primary consumer protection supervisor over many of the  institutions that offer consumer financial products and services. CFPB  also has authority to issue and revise regulations that implement federal  consumer financial protection laws, including the Electronic Fund Transfer  Act and title X of the Dodd-Frank Wall Street Reform and Consumer  Protection Act (Dodd-Frank Act). CFPB officials stated that they are  reviewing how these responsibilities are implicated by consumer use (or  potential consumer use) of virtual currencies.
Other relevant CFPB responsibilities concerning virtual currencies include  accepting and handling consumer complaints, promoting financial  education, researching consumer behavior, and monitoring financial  markets for new risks to consumers. For example, under authorities  provided by the Dodd-Frank Act, CFPB maintains a Consumer Complaint  Database and helps monitor and assess risks to consumers in the  offering or provision of consumer financial products or services. CFPB also issues consumer advisories to promote clarity, transparency, and  fairness in consumer financial markets.
section_title: Securities and Exchange Commission
paragraphs: SEC regulates the securities markets—including participants such as  securities exchanges, broker-dealers, investment companies, and  investment advisers—and takes enforcement actions against individuals  and companies for violations of federal securities laws. SEC’s mission is  to protect investors; maintain fair, orderly, and efficient markets; and  facilitate capital formation. Virtual currencies may have implications for a  number of SEC responsibilities. For example, SEC has enforcement  authority for violations of federal securities laws prohibiting fraud by any  person in the purchase, offer, or sale of securities. SEC enforcement  extends to virtual-currency-related securities transactions. Additionally,  when companies offer and sell securities (including virtual-currency- related securities), they are subject to SEC requirements to either register  the offering with SEC or qualify for a registration exemption. SEC reviews  registration statements to ensure that potential investors receive  adequate information about the issuer, the security, and the offering.  Further, if a registered national securities exchange wanted to list a  virtual-currency-related security, it could only do so if the listing complied  with the exchange’s existing rules or the exchange had filed a proposed  rule change with SEC to permit the listing.
Virtual currencies may also have implications for other SEC  responsibilities, as the following examples illustrate:
SEC has examination authority for entities it regulates, including  registered broker-dealers, to ensure compliance with federal  securities laws, SEC rules and regulations, and BSA requirements.  According to SEC officials, if a broker-dealer were to accept payments  in virtual currencies from customers, this could raise potential anti- money-laundering issues that the broker-dealer would have to  account for.
SEC also regulates and has examination authority over investment  advisers subject to its jurisdiction. Under the Investment Advisers  Act of 1940, investment advisers are fiduciaries. To the extent that  an investment adviser recommends virtual currencies or virtual- currency-related securities, the investment adviser’s federal fiduciary  duty would govern this conduct.  If registered broker-dealers held virtual currencies for their own  account or an account of a customer, SEC would have to determine  how to treat the virtual currencies for purposes of its broker-dealer  financial responsibility rules, including the net capital rule.
section_title: Commodity Futures Trading Commission
paragraphs: CFTC has the authority to regulate financial derivative products and their  markets, including commodity futures and options. In addition, CFTC  investigates and prosecutes alleged violations of the Commodity  Exchange Act and related regulations. CFTC’s mission is to protect  market users and the public from fraud, manipulation, abusive practices,  and systemic risk related to derivatives subject to the Commodity  Exchange Act. CFTC’s responsibilities with respect to virtual currencies  depend partly on whether bitcoin or other virtual currencies meet the  definition of a commodity under the Commodity Exchange Act.  CFTC  officials said the agency would not make a formal determination on this  issue until market circumstances require one. According to CFTC, such  circumstances could include virtual-currency derivatives emerging or  being offered in the United States or CFTC becoming aware of the  existence of fraud or manipulative schemes involving virtual currencies.  The officials said that if prospective derivatives that are backed by or  denominated in virtual currencies that CFTC determines to be  commodities emerge, CFTC’s regulatory authorities would apply to those  derivatives just as they would for any other derivative product subject to  CFTC's jurisdiction. To carry out its regulatory responsibilities, CFTC  would, among other things, evaluate the derivatives to ensure they were  not susceptible to manipulation, review applications for new exchanges  wishing to offer such derivatives, and examine exchanges offering these  derivatives to ensure compliance with the applicable commodity  exchange laws.
Similar to SEC, CFTC has examination authority for BSA compliance—in  this case directed at futures commission merchants and other futures  market intermediaries—and acceptance of virtual currency payments by  these entities could raise BSA compliance concerns.would also have to make determinations about the capital treatment of  virtual currencies if these entities held virtual currencies for their own  account or an account of a customer.
section_title: Departments of Homeland Security and Justice
paragraphs: Law enforcement agencies, including but not limited to DHS and DOJ  component agencies and offices, have responsibilities to investigate a  variety of federal crimes that may involve the use of virtual currencies and  to support the prosecution of those who commit these crimes. Like  traditional currencies, virtual currencies can facilitate a range of criminal  activities, including fraud schemes and the sale of illicit goods and  services, that may fall under the purview of federal law enforcement  agencies.
The emergence of virtual currencies has had particular significance for  financial crimes. According to DOJ officials, the main law enforcement  interests with respect to virtual currencies are to (1) deter and prosecute  criminals who use virtual currency systems to launder money (that is,  move or hide money that either facilitates or is derived from criminal or  terrorist activities); and (2) investigate and prosecute virtual currency  services that themselves violate money transmission and money  laundering laws.FBI, ICE-HSI, and Secret Service, investigate financial crimes as part of  their broader responsibilities. In addition, DOJ’s Asset Forfeiture and  Money Laundering Section prosecutes money laundering violations, and  DOJ and DHS manage the seizure and forfeiture of assets that represent  the proceeds of, or were used to facilitate, federal crimes. Key laws that  may apply to the use of virtual currencies in financial crimes include BSA,   A number of DOJ and DHS components, including the  as amended by Title III of the USA PATRIOT Act, and anti-money- laundering statutes.
Additionally, because virtual currencies operate over the Internet, they  have implications for agency components that investigate and prosecute  computer crimes (also called cybercrimes). For example, DOJ’s  Computer Crime and Intellectual Property Section stated that virtual  currencies can be attractive to entities that seek to facilitate or conduct  computer crimes over the Internet, such as computer-based fraud and  identity theft. The section’s responsibilities include improving legal  processes for obtaining electronic evidence and working with other law  enforcement agencies in improving the technological and operational  means for gathering and analyzing electronic evidence. The FBI, Secret  Service, and ICE-HSI also investigate computer crimes.
section_title: Virtual Currencies Present Regulatory, Law Enforcement, and Consumer Protection Challenges
paragraphs: The emergence of virtual currencies presents challenges to federal  agencies responsible for financial regulation, law enforcement, and  consumer and investor protection. These challenges stem partly from  certain characteristics of virtual currencies, such as the higher degree of  anonymity they provide and the ease with which they can be sent across  borders. In addition, the growing popularity of virtual currencies has  highlighted both risks and benefits for agencies to consider in carrying out  their responsibilities.
subsections: section_title: Greater Anonymity
paragraphs: As previously noted, some virtual currency systems may provide a higher  degree of anonymity than traditional payment systems because they do  not require the disclosure of personally identifiable information (that is,  information that can be used to locate or identify an individual, such as  names or Social Security numbers) to transfer funds from one party to  another. When transferring funds in the amount of $3,000 or more  between the bank accounts of two individuals, the banks involved are  required by FinCEN regulations to obtain and keep the names and other  information of the individuals, as well as information on the transaction  itself. The customer identification information collected by the banks  helps create a paper trail of financial transactions that law enforcement  agencies can use to detect illegal activity, such as money laundering or  terrorist financing, and to identify and apprehend criminals. However, in  a transfer between two individuals using bitcoins (or a similar type of  decentralized virtual currency) no personally identifiable information is  necessarily disclosed either to the two individuals or a third-party  intermediary. As a result, virtual currencies may be attractive to parties  seeking to protect personally identifiable information, maintain financial  privacy, buy or sell illicit goods and services, or move or conceal money  obtained by illegal means. Further, virtual currency exchangers or  administrators may be used to facilitate money laundering if they do not  collect identifying information from customers and retain other transaction  information. For these reasons, law enforcement and federal financial  regulatory agencies have indicated that virtual currencies can create  challenges for agencies in detecting unlawful actions and the entities that  carry them out. For example, the FBI has noted that because bitcoin does  not have a centralized entity to monitor and report suspicious activity and  process legal requests such as subpoenas, law enforcement agencies  face difficulty in detecting suspicious transactions using bitcoins and  identifying parties involved in these transactions.
section_title: Cross-Jurisdictional Nature
paragraphs: Because they operate over the Internet, virtual currencies can be used  globally to make payments and funds transfers across borders. In  addition, according to agency officials, many of the entities that exchange  traditional currencies for virtual currencies (or vice versa) are located  outside of the United States. If these exchangers have customers located  in the United States, they must comply with BSA and anti-money- laundering requirements. Due to the cross-jurisdictional nature of virtual  currency systems, federal financial regulatory and law enforcement  agencies face challenges in enforcing these requirements and  investigating and prosecuting transnational crimes that may involve virtual  currencies. For example, law enforcement may have to rely upon  cooperation from international partners to conduct investigations, make  arrests, and seize criminal assets. Additionally, violators, victims, and  witnesses may reside outside of the United States, and relevant customer  and transaction records may be held by entities in different jurisdictions,  making it difficult for law enforcement and financial regulators to access  them. Further, virtual currency exchangers or administrators may operate  out of countries that have weak legal and regulatory regimes or that are  less willing to cooperate with U.S. law enforcement.
section_title: Balancing Risks and Benefits
paragraphs: Virtual currency industry stakeholders have noted that virtual currencies  present both risks and benefits that federal agencies need to consider in  regulating entities that may be associated with virtual-currency-related  activities. As previously noted, the risks include the attractiveness of  virtual currencies to those who may want to launder money or purchase  illicit goods and services. Another emerging set of risks involves  consumer and investor protection—in particular, whether consumers and  investors understand the potential drawbacks of buying, holding, and  using virtual currencies or investing in virtual-currency-based securities.  Consumers may not be aware of certain characteristics and risks of  virtual currencies, including the following:
Lack of bank involvement. Virtual currency exchanges and wallet  providers are not banks. If they go out of business, there may be no  specific protections like deposit insurance to cover consumer losses.
Stated limits on financial recourse. Some virtual currency wallet  providers purport to disclaim responsibility for consumer losses  associated with unauthorized wallet access. In contrast, credit and  debit card networks state that consumers have no liability for  fraudulent use of accounts.
Volatile prices. The prices of virtual currencies can change quickly  and dramatically (as shown previously in fig. 2).
Additionally, an SEC official told us that virtual-currency-based securities  may be attracting individuals who are younger and less experienced than  typical investors. The official expressed concern that younger investors  may lack the sophistication to properly assess the risks of such  investments and the financial resources to recover from losses on the  investments, including losses resulting from fraud schemes.
While virtual currencies present risks to consumers and investors, they  also provide several potential benefits to consumers and business.
Cost and speed. Decentralized virtual currency systems may, in some  circumstances, provide lower transaction costs and be faster than  traditional funds transfer systems because the transactions do not  need to go through a third-party intermediary. The irrevocable feature  of virtual currency payments may also contribute to lower transaction  costs by eliminating the costs of consumer chargebacks. Industry  stakeholders have noted that cost and time savings may be especially  significant for international remittances (personal funds immigrants  send to their home countries), which sometimes involve sizeable fees  and can take several days. In addition, industry stakeholders have  indicated that the potentially lower costs of virtual currency  transactions—for example, relative to credit and debit cards—may  facilitate the use of micropayments (very small financial transactions)  as a way of selling items such as online news articles, music, and  smartphone applications.
Financial privacy. To the extent that bitcoin (or other virtual currency)  addresses are not publicly associated with a specific individual, peer- to-peer virtual currency transactions can provide a greater degree of  financial privacy than transactions using traditional payment systems,  because no personally identifiable information is exchanged.
Access. Because virtual currencies can be accessed anywhere over  the Internet, they are a potential way to provide basic financial  services to populations without access to traditional financial  institutions, such as rural populations in developing countries.However, the potential benefit hinges on access to the Internet, which  these populations may not have, and may be offset by the lack of  protections against losses noted previously.
Federal agency officials have acknowledged the need to consider both  the risks and benefits of virtual currencies in carrying out their  responsibilities. For example, the Director of FinCEN has testified that the  emergence of virtual currencies has prompted consideration of  vulnerabilities that these currencies create in the financial system and  how illicit actors will take advantage of them. However, she also noted  that innovation is an important part of the economy and that FinCEN  needs to have regulation that mitigates concerns about illicit actors while  minimizing regulatory burden. Similarly, the former Acting Assistant  Attorney General for DOJ’s Criminal Division has testified that law  enforcement needs to be vigilant about the criminal misuse of virtual  currency systems while recognizing that there are many legitimate users  of those services. Balancing concerns about the illicit use of virtual  currencies against the potential benefits of these technological  innovations will likely be an ongoing challenge for federal agencies.
section_title: Agencies Have Taken Some Actions on Virtual Currencies, but Interagency Working Groups Have Not Focused on Consumer Risks
paragraphs: Federal financial regulators and law enforcement agencies have taken a  number of actions related to the emergence of virtual currencies,  including providing regulatory guidance, assessing anti-money-laundering  compliance, and investigating crimes and violations that have been  facilitated by the use of virtual currencies. However, interagency working  groups addressing virtual currencies have not focused on consumer  protection and have generally not included CFPB.
subsections: section_title: FinCEN Has Issued Rules, Guidance, and Administrative Rulings Regarding Virtual Currencies
paragraphs: FinCEN has taken a number of actions in recent years to establish and  clarify requirements for participants in virtual currency systems. For  example, in July 2011, FinCEN finalized a rule that modified the  definitions of certain money services businesses. Among other things,  the rule states that persons who accept and transmit currency, funds, or  “other value that substitutes for currency,” are considered to be money  transmitters. Additionally, in March 2013, FinCEN issued guidance that  clarified the applicability of BSA regulations to participants in certain  virtual currency systems. The FinCEN guidance classified virtual  currency exchangers and administrators as money services businesses  and, more specifically, as money transmitters. The guidance also  specified that virtual currency users are not money services businesses.  As a result, the guidance clarified that virtual currency exchangers and  administrators must follow requirements to register with FinCEN as  money transmitters; institute risk assessment procedures and anti- money-laundering program control measures; and implement certain  recordkeeping, reporting, and transaction monitoring requirements,  unless an exception to these requirements applies. According to  FinCEN officials, as of December 2013, approximately 40 virtual currency  exchangers or administrators had registered with FinCEN.
In 2014, in response to questions from industry stakeholders, FinCEN  issued administrative rulings to clarify the types of participants to which  the March 2013 guidance applies. In January 2014, FinCEN issued  rulings stating that the way in which a virtual currency is obtained is not  material, but the way in which a person or corporation uses the virtual  currency is. As a result, the rulings specify that two kinds of users are not  considered money transmitters subject to FinCEN’s regulations: miners  who use and convert virtual currencies exclusively for their own purposes  and companies that invest in virtual currencies exclusively as an  investment for their own account. However, the rulings specify that  these two kinds of users may no longer be exempt from FinCEN’s money  transmitter requirements if they conduct their activities as a business  service for others. The rulings also note that transfers of virtual currencies  from these types of users to third parties should be closely scrutinized  because they may constitute money transmission. In April 2014, FinCEN  issued another administrative ruling, which states that companies that  rent computer systems for mining virtual currencies are not considered  money transmitters subject to FinCEN’s regulations.
FinCEN has also taken additional steps to help ensure that companies  required to register as money services businesses under FinCEN’s March  2013 virtual currency guidance have done so. According to FinCEN  officials, FinCEN has responded to letters from companies seeking  clarification about their requirements. Also, officials told us that FinCEN  has proactively informed other companies that they should register as  money services businesses.
section_title: Some Financial Regulators Have Taken Actions Concerning Anti- Money-Laundering and Securities Law Compliance
paragraphs: As part of their oversight activities, NCUA and SEC have addressed  situations involving virtual currencies, and other federal financial  regulators have had internal discussions regarding virtual currencies.  NCUA has had two supervisory situations in which credit unions were  involved with activity related to virtual currencies. These situations  emerged after reviews of credit unions found that their anti-money- laundering and antifraud measures needed to be revised in light of activity  involving virtual currency exchanges.
In 2013, NCUA issued a preliminary warning letter to a federal credit  union that provided account services to money services businesses  that also served as bitcoin exchanges. The warning letter was based  on various conditions that NCUA determined could undermine the  credit union’s stability. For example, the credit union did not have  adequate anti-money-laundering controls in place for its money  services business accounts. Further, the letter stated that the credit  union should not have served money services businesses that were  not part of the credit union’s strategic plan, and that serving these  businesses was not consistent with the credit union’s charter, which  called for serving the local community. The warning letter required the  credit union to immediately cease all transactions with these money  services business accounts and establish an appropriate BSA and  anti-money-laundering infrastructure. As a result, the credit union  ceased such activity and strengthened its BSA and anti-money- laundering compliance program.  In 2012, NCUA provided support to a state regulator’s review of a  credit union’s commercial customer. The state regulator found that  this commercial customer was a payment processor—that is, a  payment network that allows any business or person to send, request,  and accept money—that had customers that were bitcoin exchanges.  According to NCUA, the state regulator worked with the credit union to  ensure that its BSA compliance program was adequate to monitor and  address the risks associated with payment processors that serve  bitcoin exchanges. The state regulator also worked to ensure that the  payment processor’s risk management practices included sufficient  antifraud and anti-money-laundering measures. The payment  processor subsequently suspended all accounts that served virtual  currency exchanges.
In addition, SEC has taken enforcement action against an individual and  entity that are alleged to have defrauded investors through a bitcoin- denominated Ponzi scheme.investor alerts, has begun to review a registration statement from an  entity that wants to offer virtual-currency-related securities, and is  monitoring for potential securities law violations related to virtual  currencies.
In addition, in March 2014, the Financial Industry Regulatory Authority, a self-regulatory  organization for the securities industry, issued an investor alert about the risks of buying,  using, and speculating in virtual currencies and the potential for related scams. See  http://www.finra.org/Investors/ProtectYourself/InvestorAlerts/FraudsAndScams/P456458.  Also, in April 2014, the North American Securities Administrators Association issued an  investor advisory on virtual currencies, related investment risks, and the types of  investments that might involve virtual currencies. See  http://www.nasaa.org/30631/informed-investor-advisory-virtual-currency.
2014, addressed fraud and other investment risks related to virtual  currencies.
SEC staff have begun to review a registration statement from a  company that wants to conduct a public offering of virtual-currency- related securities and has received notice of a company offering a  private virtual-currency-related security, relying upon an exemption  from registration. In July 2013, the Winklevoss Bitcoin Trust filed a  registration statement for an initial public offering of its securities. The  Trust is structured similarly to an exchange-traded fund and will hold  bitcoins as its only assets. The Trust filed amended registration  statements in October 2013 and February 2014, but the registration  statement remains pending as of April 14, 2014, meaning that the  Trust is not yet permitted to sell its securities in a public offering. Also,  in October 2013, Bitcoin Investment Trust, a bitcoin-denominated  pooled investment fund affiliated with SecondMarket, Inc. and  available only to accredited investors, filed a notice with SEC  indicating that it had sold securities in an exempt offering in reliance  on Rule 506(c) of the Securities Act. Rule 506(c) allows an issuer to  raise an unlimited amount of money, but imposes restrictions on who  can invest in the offering and requires the issuer to take reasonable  steps to verify that those investing are accredited investors.
SEC staff are also monitoring the Internet and other sources, such as  referrals from other agencies, for potential securities law violations  involving bitcoin and other virtual currencies.
Further, all of the federal financial regulatory agencies we interviewed  have had internal discussions on how virtual currencies work and what  implications the emergence of virtual currencies might have for their  responsibilities. While agencies generally told us that their conversations  have been informal and ad hoc, some efforts have been more organized:  In 2013, the Federal Reserve took several steps to share information  on virtual currencies among the Board of Governors and the 12  Federal Reserve Banks. Among other things, the Board of Governors’  BSA and anti-money-laundering specialist conference included a  session focused on FinCEN’s virtual currency guidance and recent  law enforcement actions. The Board of Governors also circulated  general information about virtual currencies within the Federal  Reserve System to use in answering questions from media and the  public about virtual currencies and federal financial regulatory actions  to date.  In 2013, SEC formed an internal Digital Currency Working Group,  which aims to foster information sharing internally and externally.  According to SEC, the working group consists of approximately 50  members from among SEC’s divisions and offices.  In 2012, FinCEN held three internal information-sharing events on  virtual currencies. These events covered issues including how virtual  currencies compare to traditional currencies and risks related to  emerging payment systems such as virtual currencies.
section_title: Law Enforcement Agencies Have Taken Actions against Parties Alleged to Have Used Virtual Currencies to Facilitate Crimes
paragraphs: Law enforcement agencies have taken actions against parties involved in  the illicit use of virtual currencies to facilitate crimes. These parties have  included administrators and users of centralized virtual currency systems  designed to facilitate money laundering or other crimes, parties who have  used virtual currencies to buy or sell illicit goods and services online, and  virtual currency exchanges and online payment processors operating  without the proper licenses.
In 2013 and 2014, law enforcement agencies took actions against Silk  Road, a black market website that allegedly accepted bitcoin as the  sole payment method for the purchase of illegal goods and services.  The website contained over 13,000 listings for controlled substances  as well as listings for malicious software programs, pirated media  content, fake passports, and computer hacking services (see fig.3).  The FBI; Drug Enforcement Administration (DEA); IRS; ICE-HSI; the  Bureau of Alcohol, Tobacco, Firearms, and Explosives; the Secret  Service; the U.S. Marshals Service; and Treasury’s Office of Foreign  Assets Control investigated the case together, along with officials from  New York as well as Australia, Iceland, Ireland, and France. In  September and October 2013, law enforcement shut down the Silk  Road website and seized approximately 174,000 bitcoins, which the  FBI reported were worth approximately $34 million at the time of  seizure. In February 2014, DOJ indicted Silk Road’s alleged owner  and operator on charges including narcotics conspiracy, engaging in a  continuing criminal enterprise, conspiracy to commit computer  hacking, and money laundering conspiracy.
In May 2013, law enforcement agencies seized the accounts of a  U.S.-based subsidiary of Mt. Gox, a now-defunct Tokyo-based virtual  currency exchange with users from multiple countries including the  United States, on the basis that the subsidiary was operating as an  unlicensed money services business. The seizure included U.S. bank  accounts of Mt. Gox that were held by a private bank and Dwolla, an  online payment processor that allegedly allowed users to buy and sell  bitcoins on Mt. Gox. According to ICE-HSI, Mt. Gox had moved funds  into numerous online black markets, the bulk of which were  associated with the illicit purchase of drugs, firearms, and child  pornography. At the direction of the U.S. Attorney’s office, ICE-HSI  ordered Dwolla to stop all payments to Mt. Gox and seized $5.1  million from the Mt. Gox subsidiary’s U.S. accounts.
Also in May 2013, law enforcement agencies shut down Liberty  Reserve, a centralized virtual currency system that was allegedly  designed and frequently used to facilitate money laundering and had  its own virtual currency. Secret Service, ICE-HSI, and IRS  investigated the case together, along with officials from 16 other  countries. To shut down the site, FinCEN identified Liberty Reserve as  a financial institution of primary money laundering concern under  section 311 of the USA PATRIOT Act, effectively cutting it off from the  U.S. financial system. DOJ then charged Liberty Reserve with  operating an unlicensed money transmission business and with  money laundering for facilitating the movement of more than $6 billion  in illicit proceeds.$40 million in seizures and had resulted in the arrests of five  individuals.
As of April 2014, this investigation had produced  In April 2013, law enforcement agencies filed a civil asset forfeiture  complaint against Tcash Ads Inc., an online payment processor that  allegedly enabled users to make purchases anonymously from virtual  currency exchanges, with operating an unlicensed money services  business. Additionally, law enforcement agencies seized the bank  accounts of Tcash Ads Inc. The Secret Service worked on the case  with FinCEN and DOJ’s Asset Forfeiture and Money Laundering  Section.
From October 2010 through November 2012, law enforcement  agencies convicted three organizers of a worldwide conspiracy to use  a network of virus-controlled computers that deployed e-mail spam  designed to manipulate stock prices. The organizers paid the  spammers $1.4 million for their illegal services via the centralized  virtual currency e-Gold and wire transfers. Charges included  conspiring to further securities fraud using spam, conspiring to  transmit spam through unauthorized access to computers, and four  counts of transmission of spam by unauthorized computers.
Law enforcement agencies have also taken other actions to help support  investigations involving the illicit use of virtual currencies, including the  following examples.
The FBI has produced numerous criminal intelligence products  addressing virtual currencies. These intelligence products have  generally focused on cases involving the illicit use of virtual  currencies, ways in which virtual currencies have been or could be  used to facilitate crimes, and the related challenges for law  enforcement. The FBI shares these products with foreign, state, and  local law enforcement partners as appropriate.
Through standing bilateral agreements governing the exchange of law  enforcement information, ICE-HSI is arranging meetings with various  international partners to exchange intelligence and garner operational  support on virtual currency issues.
ICE-HSI also developed the Illicit Digital Economy Program, which  aims to target the use of virtual currencies for money-laundering  purposes by defining and organizing the primary facets of the digital  economy, building internal capacity, training and developing agents  and analysts, engaging other agencies, and promoting public-private  partnerships.
section_title: Interagency Working Groups Have Begun to Address Virtual Currencies, but Have Not Emphasized Consumer Risks or Generally Included CFPB
paragraphs: Federal agency efforts to collaborate on virtual currency issues have  involved creating a working group specifically focused on virtual currency,  leveraging existing interagency mechanisms, and sharing information  through informal interagency channels. For example, in 2012, the FBI  formed the Virtual Currency Emerging Threats Working Group (VCET),  an interagency working group that includes other DOJ components,  FinCEN, ICE-HSI, SEC, Secret Service, Treasury, and other relevant  federal partners. The purpose of VCET is to leverage members’ expertise  to address new virtual currency trends, address potential implications for  law enforcement and the U.S. intelligence community, and mitigate the  cross-programmatic threats arising from illicit actors’ use of virtual  currency systems. The VCET meets about once every 3 months.
Federal agencies have also begun to discuss virtual currency issues in  existing interagency working groups that address broader topics such as  money laundering, electronic crimes, and the digital economy, as follows:
The BSA Advisory Group—which is chaired by FinCEN and includes  the prudential banking regulators, Treasury, federal and state law  enforcement and regulatory agencies, and industry representatives— has addressed virtual currency issues in a number of ways. In May  2013, FinCEN provided a briefing on bitcoin, and in December 2013  three stakeholders from the virtual currency industry gave  presentations on their business models and regulatory challenges. In  addition, the BSA Advisory Group invited a representative of the  virtual currency industry to join the group in 2014.
The Federal Financial Institutions Examination Council (FFIEC) Bank  Secrecy Act/Anti-Money-Laundering Working Group—which is  currently chaired by OCC and includes the prudential banking  regulators and CFPB—is in the process of revising the current (2010)
FFIEC BSA/Anti-Money Laundering Examination Manual.revisions related to virtual currencies may include information on  FinCEN’s March 2013 guidance and regulatory expectations that  depository institutions should undertake a risk assessment with a  particular focus on the money laundering risks posed by new products  and services.
The Secret Service-sponsored Electronic Crimes Task Forces (ECTF)  includes 35 Secret Service field offices; federal law enforcement  agencies such as ICE-HSI; and members of the private sector,  academia, and state and local law enforcement. This group’s  mission is to prevent, detect, and investigate electronic crimes,  including those involving virtual currency. This group has conducted  computer forensics and other investigative activity on various virtual  currencies and made arrests of individuals who have used virtual  currencies as part of their criminal activities. This group has also held  quarterly meetings on virtual currencies to discuss legal and  regulatory issues and trends in crimes involving virtual currencies.
The Digital Economy Task Force was established in 2013 by  Thomson Reuters (a multinational media and information firm) and the  International Centre for Missing & Exploited Children. This task force  includes members from both the public and private sectors. Task  force members from the federal government include representatives  from the FBI, ICE-HSI, Secret Service, the Department of State, and  the United States Agency for International Development. This group  published a report in March 2014 on the benefits and challenges of  the digital economy.continuing private and public research into the digital economy and  illegal activities, investing in law enforcement training, rethinking  investigative techniques, fostering cooperation between agencies, and  promoting a national and global dialogue on policy related to virtual  currencies.
Among other things, the report recommended  A number of other existing interagency working groups have discussed or  addressed virtual currency issues to some extent. See appendix II for  more information on these groups.
Federal agencies have also started to collaborate outside of these  working groups to help improve their knowledge of issues related to the  emergence of virtual currencies and share pertinent information with  various agencies.
FinCEN and SEC have hosted meetings with industry representatives  and consultants to discuss how virtual currency systems such as  bitcoin and Ripple work and what legal, regulatory, technology, and  law enforcement issues they present. These agencies have invited  officials from other federal agencies to these sessions.
FinCEN consulted with financial regulators and law enforcement  agencies as it was formulating its March 2013 guidance on virtual  currencies. These agencies included CFPB, CFTC, DEA, FBI, ICE- HSI, IRS, the prudential banking regulators, SEC, and the Secret  Service.
SEC notified CFTC of its review of the Winklevoss Bitcoin Trust  registration statement.
FinCEN issued a Networking Bulletin on cryptocurrencies in March  2013 to provide details to law enforcement agencies and assist them  in following money moving between virtual currency channels and the  traditional U.S. financial system. Among other things, the bulletin  addressed the role of entities that facilitate the purchase and  exchange of virtual currencies and the types of records these entities  maintain that could be useful to investigative officials. Also, the  Networking Bulletin elicited information from its recipients, which in  turn helped FinCEN issue additional analytical products of a tactical  nature to inform law enforcement operations. FinCEN has also shared  this information with several regulatory and foreign financial  intelligence unit partners.
CFPB officials said they had recently conferred on virtual currency  issues with a number of domestic and international regulators,  including the Federal Reserve Bank of San Francisco, the Federal  Trade Commission, NCUA, OCC, Treasury, New York State’s  Department of Financial Services, and the European Banking  Authority. In addition, the officials said they had met with industry  participants on these issues and conferred with interested academic  and consumer group stakeholders, as well as law firms,  consultancies, and industry associations.
Although there are numerous interagency collaborative efforts that have  addressed virtual currency issues in some manner, interagency working  groups have not focused on consumer protection issues. Rather, as  previously discussed, these efforts have focused on BSA and anti-money- laundering controls and investigations of crimes in which virtual  currencies have been used. In addition, CFPB’s involvement in  interagency working groups that address virtual currencies has been  limited. GAO’s key practices on collaboration state that it is important to  include relevant participants in interagency collaborative efforts in order to  ensure, among other things, that these participants contribute knowledge,  skills, and abilities to the outcomes of the effort. In addition, these key  practices state that once an interagency group has been established, it is  important to reach out to potential participants who may have a shared  interest in order to ensure that opportunities for achieving outcomes are  not missed. CFPB might be a relevant participant in a broader set of  collaborative efforts on virtual currencies because virtual currency  systems provide a new way of making financial transactions, and CFPB’s  responsibilities include ensuring that consumers have timely and  understandable information to make responsible decisions about financial   Further, CFPB’s strategic goals include helping consumers  transactions.understand the costs, risks, and tradeoffs of financial decisions and  surfacing financial trends and emergent risks relevant to consumers.
Although interagency working groups addressing virtual currencies have  not focused on consumer protection issues, recent events have  highlighted the risks individuals face in buying and holding these  currencies. For example, notable examples of bitcoin thefts by computer  hackers have occurred in the past few years, including the theft of more  than 35,000 bitcoins from a virtual wallet provider in April 2013 and  24,000 bitcoins from a bitcoin exchange in September 2012. More  recently, in February 2014, Mt. Gox filed for bankruptcy, stating that a  security breach resulted in the loss of 850,000 bitcoins, the vast majority  of which belonged to its customers. These bitcoins were worth more than  $460 million when Mt. Gox filed for bankruptcy. Mt. Gox subsequently  reported that it had found 200,000 of these bitcoins in an unused virtual  wallet.
Certain parties have taken actions to inform consumers about the  potential risks associated with virtual currencies, but these actions have  occurred outside of federal interagency efforts and have not included  CFPB. In April 2014, the Conference of State Bank Supervisors and the  North American Securities Administrators Association issued joint model  consumer guidance to assist state regulatory agencies in educating  consumers about virtual currencies and the risks of purchasing,  exchanging, and investing in virtual currencies. Additionally, from  February through April 2014, a number of states issued consumer alerts  about virtual currencies. On the international front, the European  Banking Authority issued a warning to consumers in December 2013  about the risks involved in buying or holding virtual currencies.
Federal interagency working groups addressing virtual currency issues  have not focused on consumer protection, and CFPB has generally not  participated in these groups, for a number of potential reasons. For  example, the extent to which individuals using virtual currencies are  speculative investors or ordinary consumers is unclear, and CFPB has  received few consumer complaints about these currencies. incidents involving the use of virtual currencies for illicit purposes have  made money laundering and other law enforcement issues primary  concerns, and existing interagency working groups are primarily  composed of agencies that share responsibilities for these matters.  However, emerging consumer risks indicate that interagency collaborative  efforts may need to place greater emphasis on consumer protection  issues in order to address the full range of challenges posed by virtual  currencies. Additionally, without CFPB’s participation, interagency  working groups are not fully leveraging the expertise of the lead  consumer financial protection agency, and CFPB may not be receiving  information that it could use to assess the risks that virtual currencies  pose to consumers.
section_title: Conclusions
paragraphs: CFPB’s complaint intake system is not specifically geared towards virtual currency  complaints. However, in February 2014, CFPB ran a query of its Consumer Complaint  Database to determine the number of complaints that had mentioned virtual currency or  bitcoin and found that only 14 out of about 290,000 complaints met that condition. evidenced by the loss or theft of bitcoins from exchanges and virtual  wallet providers and consumer warnings issued by nonfederal and non- U.S. entities. However, federal interagency working groups addressing  virtual currencies have thus far not emphasized consumer-protection  issues, and participation by the federal government’s lead consumer  financial protection agency, CFPB, has been limited. Therefore, these  efforts may not be consistent with key practices that can benefit  interagency collaboration, such as including all relevant participants to  ensure that their knowledge, skills, and abilities contribute to the  outcomes of the effort. As a result, future interagency efforts may not be  in a position to address consumer risks associated with virtual currencies  in the most timely and effective manner.
section_title: Recommendation for Executive Action
paragraphs: To help ensure that federal interagency collaboration on virtual currencies  addresses emerging consumer protection issues, we recommend that the  Director of CFPB (1) identify which interagency working groups could help  CFPB maintain awareness of these issues or would benefit from CFPB’s  participation; and (2) decide, in coordination with the agencies already  participating in these efforts, which ones CFPB should participate in.
section_title: Agency Comments
paragraphs: We provided a draft of this report to CFPB, CFTC, DOJ, DHS, FDIC, the  Federal Reserve, NCUA, OCC, SEC, and Treasury for review and  comment. CFPB and NCUA provided written comments, which are  reprinted in appendixes III and IV. In addition, CFPB, CFTC, DHS, DOJ,  the Federal Reserve, NCUA, OCC, SEC, and Treasury provided technical  comments, which we incorporated into the report where appropriate.
In its letter, CFPB concurred with our recommendation to identify and  participate in pertinent interagency working groups addressing virtual  currencies. CFPB stated that, to date, these groups have primarily  focused on BSA concerns, anti-money-laundering controls, and the  investigation of crimes involving virtual currencies. CFPB said that, as a  result, its participation in these working groups has been limited. CFPB  also stated that as consumer protection concerns have increased in  recent months, its own work on virtual currencies and the work of other  financial regulators in this area could benefit from a collaborative  approach.
In its letter, NCUA said that the report provides a clear discussion of the  risks related to virtual currencies as well as a survey of current efforts in  the regulatory community to address the related policy issues. NCUA also  expressed support for increasing emphasis on consumer protection  issues pertaining to virtual currencies.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to CFPB,  CFTC, DOJ, DHS, FDIC, the Federal Reserve, NCUA, OCC, SEC,  Treasury, interested congressional committees and members, and others.  This report will also be available at no charge on our website at  http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-8678 or evansl@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix V.
section_title: Appendix I: How Bitcoins Enter into Circulation and Are Used in Transactions
paragraphs: This appendix shows how bitcoins enter into circulation through “mining,”  how transactions are conducted, and how miners verify transactions (see  fig. 4).
section_title: Appendix II: Interagency Working Groups that Have Addressed Virtual Currency Issues
paragraphs: In this appendix, we present some of the interagency working groups  (including task forces and other interagency collaborative bodies) that  have discussed virtual currency issues, and in some cases, taken specific  actions. This list is based on information we obtained from the federal  financial regulatory and law enforcement agencies we met with and is not  intended to be an exhaustive list.
section_title: Appendix III: Comments from the Consumer Financial Protection Bureau
section_title: Appendix IV: Comments from the National Credit Union Administration
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Lawrance L. Evans, Jr. (202) 512-8678 or evansl@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Steve Westley (Assistant  Director), Bethany Benitez, Chloe Brown, Anna Chung, Tonita Gillich,  José R. Peña, and Robert Pollard made key contributions to this report.  Also contributing to this report were Jennifer Schwartz, Jena Sinkfield,  Ardith Spence, Andrew Stavisky, and Sarah Veale.