In this deck I present my point of view on how to approach the inevitability of regulation, and how to build a risk and compliance program the smart way. PART 1 provides a historical overview of AML regulation and explains why and how value transfer systems are regulated. PART 2 deals with the main risk areas facing non-bank financial institutions, how to identify the risks and how to prepare and present a risk assessment to regulators and bankers. PART 3 is about designing a program the smart way, i.e., with an engineering mindset. It also provides an introduction to suspicious activity detection via transaction monitoring and behavioral data analysis. PART 4 includes a few words of unsolicited advice (contrarian, of course) that I've followed myself to build several companies, obtain and maintain hundreds of bank accounts and pass dozens of examinations in multiple countries over the past 13 years. BOTTOM LINE: Regulation is inevitable and here to stay. Focusing on the spirit of the law (policy goals) is (should be) more important than focusing on the letter. Unfortunately, regulators and companies alike today focus on the formal aspects and the letter of the law. The result? A witch hunt for needles in the haystack after which only lawyers win. In the 21st century, compliance and risk should be done by engineers on both the business and government side.

1. Bitcoin & AML Regulation:
Strategies for
Successful Compliance &
Government Relations
by @Juan Llanos
Las Vegas InsideBitcoins Conference
Las Vegas, October 5, 2014

2. “Risk management is not only
about reducing downside
potential (the probability of pain),
but also about increasing
upside opportunity
(the prospects for gain).”
James Lam
© 2014 Juan Llanos

3. WANT
CAN
MUST
© 2014 Juan Llanos
WANT – MUST = CAN

4. Agenda
1. Brief history of AML standards
The latest FATF & EBA reports
2. Risk identification
Risk areas  Focus on AML
3. Risk mitigation
a) Program design tips
b) Overview of corporate and product safeguards
c) Customer identification and behavioral
analytics
4. Unsolicited (contrarian) advice
© 2014 Juan Llanos

5. Agenda
1. Brief history of AML standards
The latest FATF & EBA reports
2. Risk identification
Risk areas  Focus on AML
3. Risk mitigation
a) Program design tips
b) Overview of corporate and product safeguards
c) Customer identification and behavioral
analytics
4. Unsolicited (contrarian) advice
© 2014 Juan Llanos

6. Financial Action Task Force
Groupe d’Action Financière Internationale
(FATF-GAFI )
Independent inter-governmental body
Develops and promotes policies to protect the
global financial system against money laundering
and terrorist financing
FAFT recommendations
 define criminal justice and regulatory measures that
should be implemented to counter this problem
 are recognized as the global anti-money
laundering and counter-terrorist financing standard
(AML/CFT)

7. Financial Action Task Force
Groupe d’Action Financière Internationale
(FATF-GAFI )
Special Recommendation VI
Each country should take measures to ensure that
persons or legal entities, including agents, that
provide a service for the transmission of money
or value, including transmission through an informal
money or value transfer system or network, should be
licensed or registered and subject to all the FATF
Recommendations that apply to banks and non-bank
financial institutions. Each country should ensure that
persons or legal entities that carry out this service
illegally are subject to administrative, civil or
criminal sanctions

8. Anonymity = Anathema
• Anonymous identification
• No value limits
• Anonymous funding
• No transaction records
• Wide geographical use
• No usage limits
Cash features
© 2014 Juan Llanos
F AT F R e p o r t o n N e w P a y m e n t M e t h o d s ( 2 0 0 6 )

9. FATF New Payment Methods Risks
© 2014 Juan Llanos
F AT F R e p o r t o n N e w P a y m e n t M e t h o d s ( 2 0 1 3 )

10. FATF Virtual Currencies AML Risks
Convertible virtual currencies
• are potentially vulnerable to money laundering and terrorist financing abuse
• may allow greater anonymity than traditional non-cash payment methods
Virtual currency systems
• can be traded on the Internet (global reach)
• generally characterized by non-face-to-face customer relationships
• may permit anonymous funding
• may permit anonymous transfers
• may operate in jurisdictions with inadequate controls
Decentralized systems
• are vulnerable to anonymity risks. E.g., Bitcoin…
• addresses have no names or other customer identification attached
• has no central server or service provider
• does not require or provide identification and verification of participants
• does not generate historical records of transactions associated with real world identity
• has no central oversight body
• no AML software is currently available to monitor and identify suspicious
transaction patterns
• law enforcement cannot target one central location or entity for investigative
or asset forfeiture purposes
F AT F R e p o r t o n V i r t u a l C u r r e n c i e s ( 2 0 1 4 - 0 6 - 3 0 ) © 2014 Juan Llanos

11. 2014
EBA Opinion

12. Who is a money transmitter in the USA?
© 2014 Juan Llanos
IS IS NOT
…whoever as a business:
• Exchanges virtual currency for
government currency, and one
virtual currencies for another (e.g.,
exchanges)
• Mines and makes a payment to a
third party on behalf of a customer
(e.g., for-profit miners)
• Accepts value from A and delivers it
to B (e.g., some wallets)
• Accepts value from A and delivers it
to A at a different time or place
(e.g., vaults)
…whoever
• Mines, uses or invests virtual
currency for own benefit
• Provides network access
services to money
transmitters
• Acts as a payment processor
by agreement with a seller or
creditor
• Acts as intermediary between
BSA-regulated institutions

13. Money Transmitter Regulation (US)
Main Risk Areas Main Statutes and Regs
Anti-Money Laundering BSA, USA PATRIOT Act, Money
Safety and soundness State (via licensing)
Consumer protection State (via licensing) + Dodd-Frank /
© 2014 Juan Llanos
Laundering Acts
Anti-Terrorism Financing (CFT) USA PATRIOT Act, OFAC
Privacy and Information
Security
Gramm-Leach-Bliley
Regulation E (CFPB)
Focus  AML/BSA + State Compliance

14. Agenda
1. Brief history of AML standards
The latest FATF & EBA reports
2. Risk identification
Risk areas  Focus on AML
3. Risk mitigation
a) Program design tips
b) Overview of corporate and product safeguards
c) Customer identification and behavioral
analytics
4. Unsolicited (contrarian) advice
© 2014 Juan Llanos

15. Money transmitters
and their agents are perceived as
HIGH RISK of
• ABUSE TO CONSUMER
• MONEY LAUNDERING
• TERRORIST FINANCING
Money transmission = highly regulated industry
© 2014 Juan Llanos

16. How Can We Abuse
Consumers?
• Loss of funds
•Wrong product/service
• Failed transactions
• Overpricing
• Divulging/losing private data
• Claims ignored
© 2014 Juan Llanos

17. How Can Money be
Laundered Through Us?
• Identity theft &
impersonation
• Structuring
• Fraudulent acts
• Lax controls
FRONT
OFFICE
BACK
OFFICE
General risks (all FIs)  fake IDs, negligence, incompetence & wrongdoing
© 2014 Juan Llanos

18. Money Transmitter Risk Fronts
Operational Customer
(Sender & Recipient)
Foreign
MT Risks
Counterparty
Agent
(B&M, online)
© 2014 Juan Llanos

19. © 2014 Juan Llanos

20. Operational Risks and Mitigators
RISKS MITIGATORS
 Commingling/diversion of funds
 Poor cash management, accounting
and settlement
 Poor document management,
reporting and record-keeping
 Inadequate policies and procedures
 Poor controls
 Systems breakdowns
 Employee acceptance, monitoring
and termination protocols
 Employee training and education
 Professional financial, operational
and compliance management
 Dual controls and segregation of
duties
 Business continuity and disaster
recovery planning
 Independent auditing and testing
 State-of-the-art technology
© 2014 Juan Llanos

21. Customer Risks and Mitigators
RISKS MITIGATORS
 Complicity with agent or foreign
counterparty
 Complicity with recipient (or sender)
 ‘Drip-irrigation’ transfer of illicit funds
(O2M recipients, M2O recipient, M2M
recipients)
 Intra-company structuring
 Inter-company structuring (‘smurfing’)
 Terrorist financing
 Customer acceptance, monitoring
and termination protocols
 Transaction & behavior monitoring
 Lower identity verification thresholds
at origin and destination
 For cards, maximum loadable
amounts, expiration date, and limited
number of recipients.
 Redundant identity verification
procedures at destination
 POS training
 OFAC screening
 Eventually, intercompany transaction
monitoring by highly-professional
and secure clearing house. This is
the only possible antidote against
‘smurfing’.
© 2014 Juan Llanos

22. Foreign Counterparty
Risks and Mitigators
RISKS MITIGATORS
 Complicity with sender or agent
 Poor cash sourcing, management,
accounting and settlement
 Poor documentation and record-keeping
 Lax policies, procedures and controls
 Poor regulatory regime
 Credit risk
 Systems breakdowns
 Foreign counterparty acceptance,
monitoring and termination
protocols
 Selecting reputable partners with
proven track record and effective
systems and controls
 Transaction monitoring
 Independent auditing and testing
 OFAC screening
© 2014 Juan Llanos

23. Agenda
1. Brief history of AML standards
The latest FATF & EBA reports
2. Risk identification
Risk areas  Focus on AML
3. Risk mitigation
a) Program design tips
b) Overview of corporate and product safeguards
c) Customer identification and behavioral
analytics
4. Unsolicited (contrarian) advice
© 2014 Juan Llanos

24. Program Design Tips
1. Always understand the flow of DATA and
the flow of MONEY.
2. Life-cycle management and the right mix
of detective and deterrent techniques,
including effective training, are key.
3. Document or perish
© 2014 Juan Llanos

25. Bottom-Up Program Design
1. Map Flows,
and Processes
2. Identify
Risks
Spirit of law +
Engineering Mindset
3. Design
Controls
4. Write PPCs
6. Enhance
and Improve
5. Execute
and Measure
© 2014 Juan Llanos

26. CORPORATE Safeguards*
1. A designated compliance officer + professional team
2. Written policies and procedures + operational controls:
• Licensing, renewal and reporting procedures (S)
• Registration, record-keeping and report-filing procedures (F)
• KY (Know Your…) Subprograms: Acceptance, monitoring, correction and
* AML Program Elements (Section 352 of the USA PATRIOT Act)
termination
• KY…Customer
• KY…Agent (if applicable)
• KY…Foreign Counterparty
• KY…Employee
• KY…Vendor
• Monitoring, analysis and investigating procedures
• OFAC compliance program
• Response to official information requests
• Privacy and information security protection protocols
3. An on-going training program
• Risk & Compliance Committee
4. An independent compliance auditing function
© 2014 Juan Llanos

27. CUSTOMER Identification
Documentary  Review an unexpired government-issued form of
identification from most customers. This identification must provide
evidence of a customer’s nationality or residence and bear a photograph
or similar safeguard; examples include a driver’s license or passport.
However, other forms of identification may be used if they enable the
bank to form a reasonable belief that it knows the true identity of the
customer.
© 2014 Juan Llanos
Non-Face to Face  “Card not present” standards
Non-documentary  contacting a customer; independently
verifying the customer’s identity through the comparison of information
provided by the customer with information obtained from a consumer
reporting agency, public database, or other source; checking references
with other financial institutions; and obtaining a financial statement.

28. “What customers do
speaks so loudly
that I cannot hear
what they’re saying.”
(Paraphrasing Ralph Waldo Emerson)
Customer identification vs. customer knowledge
BEHAVIORAL ANALYTICS
© 2014 Juan Llanos

29. Machine Learning (AI) Methods
SUPERVISED LEARNING: relies on two labeled classes (good vs. bad)
© 2014 Juan Llanos
Goal  Detect known suspicious patterns
1. Training set:
a. Select dataset with clean and dirty cases.
b. Classification algorithm to discriminate between the two
classes (finds the rules or conditions)
c. Probabilities of class 1 and class 2 assignment
2. Run discrimination method on all future purchases.
UNSUPERVISED LEARNING: no class labels
Goal  Detect anomalies
1. Takes recent purchase history and summarize in descriptive
statistics.
2. Measure whether selected variables exceed a certain threshold.
(deviations from the norm)
3. Sounds alarm and records a high score.
© 2014 Juan Llanos

30. Examples of
Known Unusual Behaviors
• High amounts
• High frequency
• Use of multiple locations
• Use of multiple identities
• Use of untrusted device
• Values just below threshold
• Immediate withdrawals
© 2014 Juan Llanos

31. Agenda
1. Brief history of AML standards
The latest FATF & EBA reports
2. Risk identification
Risk areas  Focus on AML
3. Risk mitigation
a) Program design tips
b) Overview of corporate and product safeguards
c) Customer identification and behavioral
analytics
4. Unsolicited (contrarian) advice
© 2014 Juan Llanos

32. Risks & Stakeholders
Risk Areas
• operational
• credit
• money laundering
• terrorist financing
• information loss
• liquidity
• fraud
• Identity Theft
Stakeholders
• federal agencies
• state agencies
• investors
• consumers
• employees
• society
Goals
• safety
• soundness
• security
• privacy
• crime prevention
• health
• integrity
Regulation  Inevitable, yet valid
Compliance  Onerous, yet valuable
© 2014 Juan Llanos

33. • Prevention trumps damage control
• Risk MGT  Both reducing downside and
increasing upside
• Simplicity and common sense
• Train for behavior change, not theoretical
knowledge
• Form-substance continuum  substance
• Letter-spirit continuum  focus on spirit
(underlying purpose and values) facilitates
• Operational synergies (leveraging tech)
• Compliance without compromising performance
• Flexibility and sustainability
© 2014 Juan Llanos

34. Evolution of Regulatory Relations
VALUES AND CULTURE REGULATORY RELATIONSHIP
Minimum Standards
As little as can get away with
Unthinking, mechanical
Compliance Culture
By the book
Bureaucratic
Beyond Compliance
Risk focused, self-policing
Ethical business
Values-based
Spirit, not just letter
Focus on prevention
Strong learning
Policing
Enforcement lesson
Basic training
Supervising / Educating
Look for early warnings
Themed, focused visits
Educating / Consulting
Culture development
Lighter touch
Mature relationship
Reinforce best practice
Benchmark
Reallocate resources to problem firms
Source: Financial Services Authority, UK
© 2014 Juan Llanos
Banking

35. FORM(seem)
Handbooks, written policies, talk
(lawyers, public relations)
SUBSTANCE (be)
Operationalization, quality, walk
(compliance officers, engineers, leaders)
© 2014 Juan Llanos

36. “Prosecutors are looking for
substantive AML programs (not just
paper ones) in determining whether
you’re a victim or a suspect.”
Former federal prosecutor
“A well-written AML program will not
by itself be sufficient. It’s the
everyday operation, the execution
and delivery, that matters.”
Wells Fargo MSB Risk Manager
© 2014 Juan Llanos

37. INNOVATE
IMPLEMENT
INFLUENCE
© 2014 Juan Llanos

38. © 2014 Juan Llanos
Thank you!
Juan Llanos
EVP, Strategic Partnerships & Chief Transparency Officer
Bitreserve, Inc.
New York, NY
Mobile: (917) 684-0560
Email: juanbllanos@gmail.com
LinkedIn: www.linkedin.com/in/Juan Llanos
Twitter: @JuanLlanos
Blog: ContrarianCompliance.com