On May 29, the U.S. Department of the Treasury published its Illicit Finance Risk Assessment of Non-Fungible Tokens (Risk Assessment). The Risk Assessment “explores how vulnerabilities associated with non-fungible tokens (NFT) and NFT platforms may be exploited for illicit finance purposes, including money laundering, terrorist financing, and proliferation financing.” The Risk Assessment acknowledges that NFTs represent a small percentage of the illicit finance market. However, the Risk Assessment finds that NFTs “are highly susceptible to use in fraud and scams,” are used by criminals “to launder proceeds from predicate crimes,” and enable criminals to exploit certain vulnerabilities “to perpetuate fraud and theft.”
The Risk Assessment finds that “some NFT firms and platforms lack appropriate internal controls to mitigate risks to market integrity, money laundering and terrorist financing, and sanctions evasion.” Additionally, NFTs “may in some cases be virtual assets as defined by the Financial Action Task Force (FATF).” The Risk Assessment notes that it does not change any existing law.
NFT Market
While cautioning that the definitions used “apply only within the scope of this assessment,” the Risk Assessment defines several aspects of the NFT market, including the following:
NFT Platforms. NFT platforms “may operate as primary markets … where an NFT is originally minted and sold, as well as secondary markets where users may exchange and re-sell previously minted NFTs, or as both.” NFT platforms provide “NFT services, which could include supporting creation and sale as well as NFT lending, derivatives markets, or other activities.” Depending on the facts and circumstances, “many of these platforms have AML/CFT obligations under the Bank Secrecy Act (BSA),” and “any NFT platform, wherever located, is generally required to comply with economic sanctions programs administered and enforced by Treasury’s Office of Foreign Assets Control (OFAC) when a transaction involves a U.S. person.”
NFT Creation Activities. The NFT creation process includes the following key activities: (i) The Creator “[d]esigns appearance or content of NFT, typically in a digital format such as a JPEG, PNG, or GIF”; (ii) the Minter “[d]eploys/executes code such that NFT data are placed on the blockchain, usually done by uploading the NFT file to a digital asset wallet, connecting the wallet to an NFT platform, and choosing on which blockchain the NFT will be placed”; (iii) the Issuer “[c]onducts primary offer and sale of NFT, once uploaded to a blockchain, and can include an NFT platform”; and (iv) the Redeemer “[e]nables redemption of an NFT that purports to be redeemable for a referenced asset.”
Illicit Finance Risks
The Risk Assessment discusses the following illicit finance risks of NFTs:
Money Laundering. Money laundering techniques involving NFTs include “self-laundering, rapid sales, and the use of multiple NFT platforms.”
- Self-laundering occurs when illicit actors purchase an NFT with illicit funds and sell the NFT to themselves using a different digital wallet to create records of sale on the blockchain. The NFT can then be sold to unwitting victims who compensate criminals with clean funds not tied to a prior crime.
- Layering occurs when illicit actors (i) purchase and sell NFTs and then launder virtual asset proceeds using mixers or other obfuscation techniques before exchanging virtual assets for fiat currency, or (ii) buy or sell NFTs in a manner that may be perceived as for consumption or investment purposes to conceal illicit payments obscured by the fluctuating NFT prices.
- Use of multiple NFT platforms or accounts is a technique used to avoid detection, such as when an illicit actor buys or steals an NFT through one platform and sells the same NFT on a different platform.
Investment Fraud and Scams. The NFT market is particularly vulnerable to fraud and scams, including the following:
- Rug pulls, which occur when a scammer raises investment funds in a seemingly legitimate NFT project before ending the project and stealing invested funds.
- Market manipulation, which occurs when criminals manipulate NFT prices to deceive or defraud investors, such as in wash trading. According to the Risk Assessment, over $30 billion in NFT trading volume may be linked to wash trading.
- Fake and counterfeit sales, which occur when scammers (i) create NFTs that purport to be part of rare, popular and expensive collections or associated with existing brands but are in fact counterfeits, or (ii) mint NFTs that are unauthorized copies of copyrighted works or misrepresent the assets or rights associated with the NFT.
- Fraudulent NFT platforms, which are used by scammers to renege on agreements to exchange NFTs with other platform users or to otherwise steal users’ NFTs.
- Conflicts of interest scams, in which persons with access to confidential information related to NFT platforms use advanced knowledge of market activity for their own financial gain, such as in cases of insider trading and trading based on material, nonpublic information.
- Chargeback scams, which occur when scammers use credit cards to purchase NFTs from an NFT platform and send the NFT to a digital asset wallet, then dispute the transaction with their credit card company and claim they did not authorize the transaction and do not own the wallet to which the NFT was sent.
Theft. NFTs are vulnerable to theft through malware, exploitation of vulnerabilities in smart contracts and other deceptive practices. With respect to malware, illicit actors spread malware that drains victims’ digital asset wallets through malicious links to social media, purported advertisements by known industry participants, NFTs air-dropped into users’ digital asset wallets, and phishing links to spoofed websites that invite victims to connect their digital wallets to a drainer smart contract. Illicit actors have also exploited smart contracts to steal NFTs.
Proliferation Finance. The Democratic People’s Republic of Korea has generated revenue through NFTs, including “the alleged use of nearly 500 decoy websites designed to look like NFT products to socially engineer victims to expose their private keys by visiting malicious websites, allowing the cyber actors to steal their NFT holdings.”
Terrorist Financing. There is little known evidence of NFTs being used to fund terrorist groups or spread terrorist propaganda.
Vulnerabilities
The Risk Assessment discusses the following illicit finance vulnerabilities related to NFTs:
Cyber-Related Vulnerabilities. The smart contracts that mint NFTs are susceptible to hacks due to vulnerabilities including publicly available code that provides opportunities for cybercriminals to identify attack vectors; the reuse of code for various projects; and the lack of oversight, requisite experience or formal self-regulation for code audits.
Copyright and Trademark Protection. Criminals may violate copyright and trademark protections to market NFTs, and NFT marketplaces may not require sellers to provide real names, making it difficult to identify infringers.
Hype and Fluctuating Pricing. Due to the fluctuating prices of NFTs, it is difficult to determine whether an NFT is priced appropriately or is part of price manipulation, money laundering or other illicit finance schemes.
Noncompliant NFT Platforms; Varying Interpretations of U.S. Regulatory Obligations. Some NFT industry participants have claimed to not understand or not be subject to their obligations, including AML/CFT, investor protection and market integrity.
AML/CFT and Sanctions Obligations. Depending on their activities, NFT platforms “may qualify as financial institutions under the BSA and therefore have AML/CFT obligations.” Whether an NFT platform falls under the BSA’s definition of a “financial institution” depends on the specific facts and circumstances of the activity, including “the function of the NFTs offered.” With regard to sanctions obligations, “[a]ny NFT platform, wherever located, is generally required to comply with economic sanctions programs administered and enforced by OFAC when a transaction involves a U.S. person.”
Investor Protection and Market Integrity Obligations. Depending on the facts and circumstances, “an NFT could be offered and sold as a security subject to the federal securities issuers, securities intermediaries, or both laws.”
Uneven Application of AML/CFT Obligations in Foreign Jurisdictions. Under FATF guidance, “some NFTs may be considered virtual assets, in which case NFT platforms offering those virtual assets should have AML/CFT obligations.” However, many foreign jurisdictions lack sufficient regulation and oversight of virtual asset service providers (VASPs), enabling “regulatory arbitrage” that can expose the U.S. financial system to risk.
Mitigation Measures
The Risk Assessment discusses the following illicit finance mitigation measures related to NFTs:
Industry Tools. NFT platforms should use industry tools to (i) identify NFT addresses, smart contracts or projects linked to scams; (ii) identify NFT content that is being used in violation of copyright laws; (iii) detect and prevent fraud and money laundering; (iv) place controls on the frequency of user transactions to mitigate wash trading and other market manipulation; (v) identify wallets that pose sanctions risks; and (vi) risk-rate wallet addresses.
The “administrators of NFT smart contracts” should mitigate risk by “conducting enhanced software reviews and quality checks, building in the ability to halt transactions using the smart contracts in instances of theft or other illicit activity, or using oracles to screen against digital asset wallet addresses appearing on sanctions lists and to prevent sanctioned addresses from using NFT smart contracts.”
Applicability of Law Enforcement Authorities; Public Announcements. Law enforcement “may subject NFTs to asset recovery laws and regulations like other property,” and victims should report NFT crimes to a local FBI field office or via IC3.gov using the term “NFThack.”
Public Blockchain Transparency; Involvement of Covered Financial Institutions for NFT Transactions and Other Sources of Government Information. Information to assist law enforcement investigations involving NFTs may be gained from public blockchain records, social media, account information from VASPs and other financial institutions with effective BSA compliance programs, and information collected and retained by NFT platforms for tax compliance purposes.
Recommended Actions
The Risk Assessment recommends the following actions to address outstanding NFT risks:
- Consider Application of Regulations to NFTs and Raise Awareness for Relevant Regulatory Obligations. Relevant authorities should consider regulations or guidance specific to NFTs and assess opportunities to provide additional clarity on existing obligations for applicable NFT platforms. Future digital assets guidance could note how existing regulations and guidance apply to NFTs and NFT platforms.
- Continue to Enforce Existing Applicable Laws and Regulations. U.S. regulatory agencies should continue to supervise NFT market actors and, as appropriate, take enforcement actions when those actors fail to comply with BSA, sanctions and other obligations.
- Continue Private Sector Engagement to Support Understanding of Developments in NFT Ecosystem. The rapidly evolving nature of both NFT use cases and NFT platforms requires further research and private sector engagement, as well as continued monitoring to understand changes in the NFT ecosystem and the impact on AML/CFT obligations of platforms and illicit finance risks. NFT firms could benefit from enrollment in a Cybersecurity and Infrastructure Security Agency Cyber Hygiene Scanning Service and participation in the Financial Services Information Sharing and Analysis Center.
- Encourage Industry to Address Scams and Fraud. The U.S. government should engage with industry stakeholders to promote innovation that seeks to mitigate the illicit finance risks of NFTs and NFT platforms, especially risks relating to scams and fraud.
- Educate Consumers. The U.S. government and industry stakeholders should consider providing educational materials to improve consumer understanding about NFTs.
- Engage with Foreign Partners. The U.S. government should engage with foreign partners to encourage risk assessments and policy approaches to addressing illicit finance risks of NFTs and NFT platforms.