4.1 Introduction

In the days when cash was the predominant form of currency, MLFT required some form of physical transfer. The physical transfer depended on nearness, smuggling and/or money mules. Digital currency has facilitated remote payments. The introduction of remote payments evolved the face of MLFT from physical nearness to an emphasis on suspicious bank transactions. The introduction of virtual and immersive internet will induce the next evolution of MLFT. This chapter will discuss the risks associated with virtual reality and MLFT. The aim of this risk assessment is to provide a framework for regulatory needs.

It is not possible to provide accurate numbers on the volume of MLFT. The IMF estimates that on an annual basis, the amount of money laundered is between 2 and 5% of the global GDP.Footnote 1 Money laundering is traditionally conducted through three stages. These stages are placement, layering and integration.Footnote 2 Concerning virtual money laundering, the same stages can be identified.Footnote 3 These three stages will be discussed first. This chapter will then continue by discussing the differences between virtual and physical MLFT concerning risk. The chapter will close with a conclusion that provides the specific risks unique to the Metaverse. These risks will be used in the next chapters to analyze the legal framework.

4.2 The Three Phases of MLFT

4.2.1 Placement

The first is the placement of goods in an institution or through the purchase of an asset. The storage of virtual currency is through a virtual wallet (further: wallet). The wallet for virtual currencies can be offered in attachment to the avatar, a separate wallet provider or a payment system connected to the virtual room. Once the Metaverse is developed, additional technologies will likely be developed offering new payment solutions. A legislative framework therefore has to be broad enough to incorporate all wallets that allow for funds to enter the Metaverse. It furthermore has to be flexible enough to incorporate new technologies. Similarly, various types of currency can be distinguished within the Metaverse. Such as cryptocurrency, smart coins and centralized currency—the same therefore applies to currency inclusion. The first Metaverse-related risk is therefore the broad spectrum of wallets and currency available. In particular, because the accessibility of wallets facilitates a technology called smurfing.

Small amounts of money generally raise less suspicion than large transfers. To avoid detection money launderers opt for a placement technique called ‘smurfing’.Footnote 4 Smurfing is a process whereby small amounts of money are placed into the system. There are two types of smurfing techniques. The first is from multiple sources through one institution into multiple outlets. The second is placing small sums through multiple institutions into one outlet.Footnote 5 The advantage of smurfing techniques is that the small amounts often go unnoticed. The disadvantage of this technique was the intensity of bringing in a large number of small amounts. The use of smurfing is fairly easy to conduct through virtual financial institutions, in particular in combination with anonymous MMO accounts.Footnote 6 The virtual accounts can be created anonymously and generally without paperwork.Footnote 7 The placing of funds into the system is largely an automated process. This process can be carried out by robots or through self-executing smart contracts.Footnote 8 Virtual reality facilitates the process of smurfing. The lack of regulation and supervision within the Metaverse may generate a second case of Liberty Reserve.

The organization ‘Liberty Reserve’ conducted its transactions without customer verification.Footnote 9 It furthermore did not accept transactions with registered financial institutions and its customers used a cryptocurrency.Footnote 10 It acted in any form of customer due diligence that is expected of regulated financial institutes. The result was a large amount of money from criminal origins being moved. The ‘bank’ itself was established in Costa Rica and became known as the bank of the underworld.Footnote 11 The Liberty Reserve exemplifies the risks of unregulated institutes. Furthermore, the cryptocurrency used for transactions was largely anonymous, thus amplifying the attractiveness for criminals.

The risk of placement is therefore amplified when considering virtual currencies. This risk increases even further in the Metaverse. Smurfing used to be intensive as it required a lot of small amounts to be placed. This intensity can be reduced through the use of robots and smart contracts. The Metaverse will “[allow] anyone to build smart contracts and deploy them to the Metaverse chain, using tools like MetaMask, Remix, and Truffle. Smart contracts will be compatible through the provided support for Solidity as well as for anything that compiles to EVM bytecode.”Footnote 12 The use of smart contracts is built into the system, which can be designed and operated by anyone. Thus increasing the risk of smurfing. The placement of illegal proceeds into the Metaverse is fairly easy. Placing low amounts of money into the system is not illegal, but can indicate MLFT. Regulation and supervision is therefore of paramount importance.

4.2.2 Layering

The second stage of MLFT is to hide the criminal origin of the good through layering. During this process, false proof of origin is created. With physical goods, this would include creating false paperwork and other tedious processes. Virtual currencies have made this process much easier. Cryptocurrencies can be transferred fast, across borders and with little need for exchange or intermediary services.Footnote 13 The speed of blockchain transactions is largely due to the automized process. Unlike financial institutions a blockchain does not clear transactions, thus providing speed but through reduction of a governance layer. The transaction records are recorded on a blockchain but the encryption keys are private. And little to no private information has to be released in order to conduct a transaction over the blockchain.Footnote 14 The reduction of the clearing layer has made cryptocurrencies a popular alternative to bank transfers. The anonymity aids criminal activities and the reduction of official institutions greatly reduces the supervision. The blockchain has a clear record of all transactions but linking these transactions to a person is difficult.Footnote 15

It furthermore takes very little effort to create a new wallet to store the currencies. Thus facilitating layering through various wallets owned by a single individual. In addition, criminals can make use of “mixing” services. These are services that mix cryptocurrencies with other currencies through random transactions. Thereby concealing the origins of the currency.Footnote 16 In addition to mixing services, cryptocurrency users can initiate payments via TOR networks. These networks direct traffic through several relays, thereby hiding the origin of the transaction.Footnote 17 By hiding the origin of the transaction it becomes particularly difficult to estimate risks. Similarly, a person can own several wallets and quickly move the cryptocurrency from one wallet to another.Footnote 18 Legislation aiming to prevent layering should therefore aim to prevent anonymizing transactions.Footnote 19 In addition to decentralized payment systems, the Metaverse will likely also offer home to centralized virtual currencies.

Centralized virtual currencies are those that are offered and governed by a single platform. When considering centralized virtual currencies the regulation of layering is slightly easier. Centralized currencies can be largely regulated through the provider. Nevertheless, even centralized currencies can be transferred and layered quickly. Similarly, the currency that Facebook (now Meta) was planning to introduce, would allow transactions with multiple stores. These stores would however still be connected to the offering platform, in this case, Facebook. Regulating the provider is slightly easier but should not be considered a snake-oil cure. Currencies can be monitored for transaction rate and/or geographic holder movement. However, this does not provide a watertight system of governance. The main contribution would be that tokens could be followed in addition to currencies going in and out of a wallet. Think of it as adding GPS tracker systems to individual cash notes. These could flare up when passed very rapidly or across various borders. Whilst a useful addition in the fight against MLFT it would lose its function if the storage facilities were not monitored.

Whilst therefore made easier to regulate, transactions can still occur rapidly and privacy concerns may prevent monitoring every transaction. The legislative framework would therefore have to entail a supervisory element that allows monitoring without violation of privacy. Furthermore, there is a risk of black market exchange. Such exchange was identified as the main process of MLFT through gaming websites. This concerned a process of integration into the legal economy which will be discussed in the next paragraphs.

4.2.3 Integration

The third phase of MLFT is where the good goes through the process of integration into the legal economy.Footnote 20 This is an interesting issue that needs discussion. The integration into the legal economy through virtual currency often requires the exchange of fiat currency. A legislative framework therefore has to regulate the exchange of virtual currency into fiat currency. The regulation of formal exchanges, however, is not enough. Technically speaking a closed virtual currency system would pose less risk because there is no integration into the legal economy.Footnote 21 However, there are three issues with this theory. The first is that of black markets, the second is the concept of legal economy and the third is the redemption value of the currencies.

Gaming platforms theoretically posed little MLFT risks as they were a closed virtual currency system. However, large MLFT practices have been discovered to have occurred through gaming sites. The virtual currencies of gaming platforms had little to no value. Virtual objects have no value for either terrorists or crime syndicates. Therefore the virtual currency had to be exchanged into fiat currency or cryptocurrencies. Such an exchange is in most cases in violation of the intellectual property rights of the gaming platform. The intellectual property rights violation, however, did not prevent MLFT from occurring through closed virtual currency platforms. The MLFT was conducted through gaming sites, developed through the black market possibility of fiat exchanges. With the increase of exchange opportunities comes the increase in MLFT.

In 2012 Stokes concluded that the MLFT occurring through this type of gaming sites was limited.Footnote 22 A year later the same type of MLFT network was considered threatening.Footnote 23 In 2019 the Independent discovered that the MLFT through a game called ‘Fortnite’ was significant.Footnote 24 The main accomplices that aided in the integration of money into the legal economy were minors. The trade of V-BucksFootnote 25 was sold globally to normal players (the minors) through both ordinary social media such as Instagram and Twitter and illegal trading sites through the dark web.Footnote 26 Whilst the sale of virtual items was temporarily banned by eBay,Footnote 27 it is not difficult to transfer virtual currency into fiat currency. There are companies that trade in these currencies, despite it usually violating intellectual property. Supervision of these games and trading companies is virtually non-existent.Footnote 28 Closed currencies in the Metaverse can generate black markets if their value is considered high. The legal framework therefore has to include closed currency schemes in the supervision against MLFT, to prevent black markets from occurring. This leads to the second question, namely what constitutes the legal economy.

The Metaverse might change the concept of integration completely. Lin’s research indicates that virtual consumption might replace part of physical consumption.Footnote 29 Consumers can generate satisfaction from the consumption of virtual items, often similar to their consumption of physical items.Footnote 30 If simple activities such as watching television transcend into the Metaverse, the need for physical goods decreases. Thereby the need for integration into the physical legal economy decreases. The goods could be bought and consumed virtually. Arguably there is still a process of integration into the legal economy of the Metaverse. However, if the Metaverse economy is not regulated and actively supervised it would not constitute a legal economy as per the definition of MLFT. This is particularly difficult for the legislation to take into consideration. As discussed earlier certain types of goods will still be consumed physically such as a couch and a car. A legislative approach to MLFT therefore has to consider that the integration into the legal economy has changed. The integration has changed from exclusively the conversion of cryptocurrency to fiat currency to include the conversion of cryptocurrency to virtual assets. In addition, there is the question as to the redemption possibilities for physical assets. Whereby goods are bought in a virtual space and sent to the buyer’s physical address. This leads to the last integration question, that of redemption.

Closed currency schemes can generate black markets that facilitate MLFT or provide their own level of redemption. A closed scheme can pose a risk to MLFT when the redemption scope is increased. A loyalty programme such as air miles with a large redemption scope can be an attractive currency. The risk of a scheme therefore should not be based solely on the possibility of exchanging the currency to fiat currency. Important risk factors are the possibility of purchasing awards, international transaction possibility and a potential unregulated market.Footnote 31 In the earlier mentioned Liberty Reserve case customers could wire currency or spend it in shops that accepted the Liberty Reserve currency. When a virtual currency is increasingly accepted by sellers, the need for conversion decreases. El Salvador has currently made Bitcoin a legal tender,Footnote 32 indicating the potential rise in acceptance of cryptocurrency.Footnote 33 The increased acceptance of cryptocurrency reduces the need to convert to fiat currency. In particular, the Metaverse provides this risk. Virtual realities can be created to mimic shopping streets. These streets could either accept cryptocurrency or even create their own coins. The shops located on these streets can send physical goods to the buyer. This possibility is increased by new technological developments in the area of virtual fitting. It is now possible to generate an avatar based on body measurements or a body scan and try on an item of clothing. Virtual reality can show the potential customer how the item fits and falls around the body without the need to physically try it. The only challenge at present is the feel of the item, will the shoes be comfortable and is the blouse of good quality. Nevertheless, the use of realistic avatars has greatly improved the experience of virtual shopping. Physical items being purchased online are therefore likely to increase. Thus strongly reducing the need for exchange into fiat currency whilst allowing for a good to be integrated into the economy, which if needed can be resold second-hand. The regulatory framework therefore has to include supervision of currencies that have a large redemption rate.

Whilst the above closes the discussion on integration and thereby the traditional three-layered process of MLFT, the Metaverse introduces new risks. The 3-step model to define MLFT is therefore useful as a concept but too limited to encompass all risks associated with the Metaverse. The next paragraphs will discuss three distinct risks associated with the Metaverse reality.

4.3 Additional Risks Associated with the Metaverse

4.3.1 Anonymity

The stages of MLFT are largely the same between virtual MLFT and ordinary MLFT, the introduction of the Metaverse has changed the scope of these risks. The first difference between physical and virtual MLFT risk is that of anonymity. Non-virtual MLFT requires some form of identification or risk of identification. The most obvious is when MLFT is conducted through a bank account, bank accounts within the EU and more broadly are linked to verified persons. Whilst cash is generally anonymous, it can be obtained from or placed into a bank account and thus linking it to a person. Large transactions are reported and even the physical act of obtaining or spending the cash generally includes a person being recorded by security cameras. The need for a person to be present during the spending of the money decreases the anonymity. To decrease the connection between a person and funds, criminals use shell corporations. The corporations create a layer between the owner and the funds. Anonymity within the Metaverse, however, will be achieved more easily.

A user can remain fully anonymous quite easily as there is no legislation requiring the identity verification of users. The danger is that anonymity can spur crime, Kelly and Lynes’ research indicates that the anonymity an avatar provides promotes white-collar crime. Their research considered that within virtual reality, users were increasingly willing to commit fraud.Footnote 34 This fraud was aimed at taking other users’ virtual assets to gain status. Whilst perhaps not as serious as financing terrorism it indicates the sense of security through anonymity that an avatar provides. When considering virtual currency it is both the avatar and the wallet that needs investigating. This means that when a wallet is not connected to an avatar, the wallet owner needs identification. As demonstrated in the previous sections the Metaverse’s interoperability allows for the use of different avatar and payment providers. There is no need for an avatar to be provided by the same company as the payment system. Furthermore, peer-to-peer payments are facilitated on a fairly anonymous basis. This raises the question of whether users should verify the identity of the person they are trading with.

Cassella in his paper considers the situation of a person aiming to finance terrorism. Cassella considers that the person can go through the complicated MLFT stages, or post the money to the right destination.Footnote 35 The latter can achieve the same effects as through the earlier defined stages of MLFT. Cassella argues that the person sending the money is worthwhile investigating.Footnote 36 Irwin and others consider that MLFT largely occurs through the same channels virtually and physically. However, financing of terrorism prefers methods with high levels of anonymity.Footnote 37 It is therefore important to decrease the level of anonymity in the Metaverse. Whereby emphasis should be on those persons who enter the economy which includes the transfer and storage of value. The regulatory framework therefore has to lift the anonymity of the Metaverse economy.

4.3.2 Jurisdiction

In his research, Stokes compares the risks of MLFT via Bitcoin and L$.Footnote 38 His research concludes that the risk of illegal activities is enhanced through both Bitcoin and L$. This risk enhancement stems from the anonymity of the platforms, large-scale access and the possibility of peer-to-peer payments without the need for the heavily regulated financial sector.Footnote 39 Similar conclusions have been reached with regard to Second Life and WoW by Irwin and Slay.Footnote 40 Furthermore, Dyer-Whitford and De Peuter argue that the majority of these parties are located in the Cayman Islands a jurisdiction known for its weak financial regulation.Footnote 41 These factors sound numerous but describe two issues.

The first is the easy accessibility of parties internationally. The provider of the virtual world and its customers do not require close proximity to transact. The companies providing the virtual world and its payment system can therefore choose to locate in favourable jurisdictions. Favorable in this case means low levels of taxation, legislation or enforcement obligations. These type of jurisdictions are attractive to providers as it saves costs. Additionally, the firms can avoid heavily regulated financial institutions through peer-to-peer payment structures. Peer-to-peer payment without the need for intervention of regulated parties generates high-risk transactions. When making a payment from the EU to a low-regulated jurisdiction through a bank or money transfer agency the transaction is recorded by the financial institution in the EU. This institution should, in case of suspicious transaction levels, report the transactions to the appropriate authority. Peer-to-peer payment systems ensure trust through technologies such as blockchain. Blockchain generates sufficient trust among consumers that their transactions are conducted. These transactions can be conducted without borders whilst avoiding regulated institutions.

The second difficulty with jurisdiction is related to the first. Companies can locate to low regulatory jurisdictions or detach themselves from jurisdictions altogether. The virtual environments in the Metaverse can be created without jurisdiction. A provider of a virtual environment can opt to build the environment without identifying himself. Without an identified provider as a host, it is difficult to determine jurisdiction. The server where the environment is hosted could be traced and used as jurisdiction. This process, however, would be difficult and costly. Therefore those within the environment operate within a vacuum. Providing a financial service in such an environment was difficult as the financial institution required trust from its customers. Very few would trust an unregulated and unbacked financial institution. The peer-to-peer payments however ask that consumers trust the blockchain. The blockchain does not need to be located in a jurisdiction to be considered trustworthy. Thus creating a jurisdictional vacuum.

The regulatory framework therefore has to incorporate a limitation to the type of peer-to-peer transactions. In particular, those that occur without (strongly) regulated payment facilities. Whilst a seemingly impossible task, the alternative is an unregulated space for MLFT. The Metaverse will be compatible with a large amount of virtual reality providers. There is no limitation on where these providers or users are located globally. The Metaverse is therefore likely to be accessible globally thus increasing the risk of regulatory avoidance. A legislative framework therefore has to reduce the potential for avoiding regulations.

These conclude the main aspects of MLFT through the Metaverse. There is, however, another odd occurrence that disserves attention; that of the Non-Fungible Tokens.

4.3.3 Non Fungible Tokens

Non-Fungible Tokens (NFT) are a form of token based upon a blockchain and correspond with a non-fungible item. These items have to be unique such as a painting, collector item or piece of music. The owner of the item can create NFTs based on the item to ensure ownership. The NFT then functions as a form of certificate of originality and ownership in a virtual world.Footnote 42 This certificate can be bought and transferred but the (virtual) item does not need to be transferred.Footnote 43 The NFTs are considered the virtual equivalent of ownership rights.Footnote 44 It is therefore likely that NFTs are a technology to stay for the foreseeable future.Footnote 45 Additionally, Metaverse will generate an additional place where digital art can be showcased on virtual walls. Therefore providing an incentive to the digital art market. A market that is already rapidly expanding. The CryptoPunk art with their NFTs has generated a $2.5 billion trade due to their scarcity and uniqueness.Footnote 46 The NFTs are traded in a similar fashion as cryptocurrencies. An NFT can be bought through trading platforms or privately and stored in virtual wallets.

NFTs and MLFT are related similarly to physical real estate and artworks. They are objects used as an investment for criminal money. The investment can be used as an object for the personal enjoyment of the criminal. Another use for art is to store value or use art as a payment method.Footnote 47 The Financial Action Task Force considers (FATF) that in particular small art objects are used as payment methods or bribes. These objects are easier to move undetected in comparison with bank transfers.Footnote 48 The report further identifies that these small objects include digital art stored on USB sticks.Footnote 49 In theory therefore these do not particularly include NFTs. Nevertheless, most digital art is worthless without an NFT as it can be easily copied. In addition, many NFTs can be transferred through wallets without moving the physical counterpart. Thereby making it easier to transfer ownership of valuable items without moving the physical item. In addition, the value of NFTs can be artificially increased through “wash trading”. Wash trading means that an NFT moves through several wallets of the same owner to appear in high demand and trade ability. It is suspected that this practice has generated an $8.9 million profit in 2021 alone.Footnote 50 This facilitates money laundering as art can be cheaply bought and the price inflated through a relatively simple fraud scam. The NFT moves through wallets similar to cryptocurrencies. For the purpose of regulation against MLFT, the NFTs can be regulated and treated as if they are cryptocurrencies. Nevertheless, a new danger of NFT has been discovered. Namely the NFT as a method of transmitting information.

NFTs can contain information software that can be shared between two parties.Footnote 51 The transfer of NFTs through these wallets is aimed at sharing information. Providing a safe method of communication as the NFT can be destroyed or burned after receiving the information. The destruction of an NFT is similar to that of a cryptocurrency. An NFT needs to be stored within a virtual wallet. To destroy an NFT it can be sent to a wallet that does not exist. Since the wallet does not exist and can therefore not be accessed the NFT is practically burned. This process cannot be reversed and therefore adds security. When one party is apprehended by a national Financial Intelligence Unit the information on the NFT remains lost. This process of information sharing is therefore attractive to organized crime and terrorist cells.

The risk of information sharing through NFTs should be viewed with some limitations. If a party wishes to finance terrorism, the party needs to ensure the money ends up with the right final party. Under ‘ordinary MLFT’ any type of funds can reach the other side, meaning it does not need to be exactly the same euro bill or cryptocurrency coin that reaches the other wallet. As described in the paragraphs on layering it is even preferred that not the exact same currency reaches the final destination. As long as a certain value is received at the end of the chain, the initiator is satisfied. When using NFT to transfer information, the exact same NFT that is sent needs to reach the final destination. The NFT process has several groups of stakeholders that are involved in the initial offering of the token.Footnote 52 The amount of stakeholders involved in the process of creating and transferring an NFT generates risks.

The first is that a party in between does not transfer the NFT. It may not wish to resell, get confiscated or lost. In this scenario, the information is lost to the sending and receiving parties. Secondly, the in-between party may take some time to resell the NFT, therefore making the information obsolete. Thirdly the information on the NFT could be discovered and decrypted by a third party. Thereby revealing the information to third parties and possibly the authorities. Transmitting information or value through NFTs is therefore risky. The easiest way around these risks is by transferring an NFT directly from the sender to the aimed receiver. Thus generating a direct link between the two parties. This link is encrypted but stored on a public blockchain. A potential investigation can thus more easily trace the entire network.

The risk of information sent through NFTs is not strictly one of financial concern. The aim is to transmit information rather than funding. The criminal intent and potential destructiveness are however no less than crime funding. To discover this process, will require the supervision of wallets as NFTs are held within the same wallet as cryptocurrency. Furthermore, as certificates of ownership NFTs can represent high-value items such as art or real estate. These items are often associated with MLFT. This book will therefore include examining NFTs within the legal framework.

4.4 Conclusion

This chapter has examined the risks associated with the Metaverse with regard to MLFT. This risk assessment generated a practical framework to evaluate the current legal approach to MLFT. This chapter has conducted the risk assessment by first analyzing the standard three-step process of MLFT. It then continued by analyzing additional risks that are associated specifically with virtual currencies and the Metaverse. This analysis has generated a set of questions that the legal framework will have to abide by in order to prevent MLFT. These questions were sorted per theme, the first of which is that of placement.

The potential routes via which to place funds into the Metaverse are diverse. Whilst diversity is not per se an issue, it provides a difficulty for the legislative framework. The legislative framework has to encompass all methods of placing funds into the Metaverse under supervision. It is furthermore likely that technology will continue to develop. Therefore the legislative framework either has to continue changing, or not be limited to technologies currently in existence. Furthermore, to place funds into the financial system, smurfing is a popular method. This method is facilitated by the Metaverse environment through the integration of smart contracts and the ease of owning multiple wallets. The second phase of MLFT is the layering of funds to disable the tracing of the (criminal) origin. Due to the speed of blockchain transactions and the lack of clearing institutions, layering is fairly easy. The transactions occur in real time thus limiting transaction monitoring.Footnote 53 In particular transactions through the Metaverse can be done rather quickly worldwide. A high risk is the potential use of disguising mechanisms such as mixing services and TOR networks. The integration phase is the phase whereby the funds are integrated into the legal economy. The legal economy in the Metaverse is, however, different from the normal concept of legal economy. The consumption of virtual items can be equated to real consumption. The legislative framework should therefore be considerate of the change in the real economy. In addition to the traditional phases of MLFT, this chapter discovered risks specific to the Metaverse. These have been identified as anonymity, accessibility and NFTs. To effectively regulate the Metaverse a legal framework should incorporate these new risks.

The establishment of these risks specific to the Metaverse says little about the current legal framework. The next chapters will examine the legal approach adopted by the EU and evaluate whether it effectively addresses these issues. The chapters are structured along the different MLFT phases and evaluate the legal framework and where needed introduce suggestions for improvement.