Policy Design of Retail Central Bank Digital Currencies: Embedding AML/CFT Compliance

Abstract

This paper provides a foundation on how to ensure effective and efficient Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) compliance measures in the Central Bank Digital Currency (CBDC) system, focusing particularly on the retail CBDC in a two-tiered system. By examining the existing AML/CFT practices and those implemented in newly launched CBDC projects, we build a policy framework of AML/CFT measures that should be embedded in the CBDC system to enhance compliance. The most common enforcement of AML/CFT measures associated with CBDC balances assumes the form of transaction amount or holding amount limits based on the level of Know-Your-Customer (KYC) findings. In this paper, we examine practices beyond the initial KYC measures and explore the processes of on-boarding and on-going customer due diligence, transaction analysis and evaluation, decision making and reporting to the Financial Investigation Unit (FIU).

The views expressed herein are those of the authors and do not necessarily reflect the opinions of the organizations the authors belong to. Any remaining errors are the sole responsibility of the authors.

Appendices

Appendix A. Generalized AML/CFT Process

Table A. Generalized AML/CFT Process. Notes: Based on the Japan Financial Services Agency (2021) “Final Report of JFSA Multilateral Joint Research on Digital Identity” (for processes 1 to 3), Osawa, et al. (2022) “Theory and Practice of Anti-Money Laundering and Combating the Financing of Terrorism” (in Japanese) (for process 4).

Appendix B. High Performing FIU (Israel, Italy, and Spain)

There are 11 effectiveness criteria to rate the effectiveness of the country’s measures and 40 technical compliance criteria to reflect the implementation of the recommendations which the FATF has made. For the effectiveness criteria we used the Immediate Outcomes (IO) concerning legal and operational issues which are directly related to the FIU. These include the following; IO6 “[f]inancial intelligence and all other relevant information are appropriately used by competent authorities for money laundering and terrorist financing investigations”, IO 7 “[m]oney laundering offences and activities are investigated and offenders are prosecuted and subject to effective, proportionate and dissuasive sanctions”, and IO 8 “[p]roceeds and instrumentalities of crime are confiscated” (FATF, 2013). As for the technical compliance, we used the assessment of recommendations directly related to the FIU. Those are Recommendation 29 “[f]inancial intelligence units”, Recommendation 30 “[r]esponsibilities of law enforcement and investigative authorities”, and Recommendation 31 “[p]owers of law enforcement and investigative authorities” (See Table B1).

Table B1. High Performing FIU (Israel, Italy, and Spain). Notes: “IO” is “Immediate Outcomes”, “R” is “Recommendation”, “HE” is “High level of effectiveness - The Immediate Outcome is achieved to a very large extent. Minor improvements needed”, “SE” is “Substantial level of effectiveness - The Immediate Outcome is achieved to a large extent. Moderate improvements needed”, “C” is “Compliant”.

Appendix C. Compliance Cost of the Financial Institutions

According to GAO (2020), compliance costs by the financial institutions on Bank Secrecy Act in the U.S. can be broken down into five categories: Customer Due Diligence Requirements (average of 28% of the total expenses), Reporting Requirements (29%), Compliance Program Requirements (18%), Other Requirements (9%), and Software and Other Parties (17%). The amount of time the banks spend on investigating and reporting each incident was 80 h for a small community bank, whereas it was 2 h for a large bank (GAO, 2020).

Fig. D1.

Estimated Total Direct Costs for Complying with the Bank Secrecy Act as a Percentage of Operating Expenses and Estimated Total Direct Compliance Costs for Selected Banks in 2018. Source: U.S. Government Accountability Office. 2020. “Anti-Money Laundering: Opportunities Exist to Increase Law Enforcement Use of Bank Secrecy Act Reports, and Banks’ Costs to Comply with the Act Varied”.

Fig. D2.

Estimated Costs for Compliance Requirements as a Percentage of Total Direct Costs for Bank Secrecy Act/Anti Money Laundering Compliance for Selected Banks in 2018. Source: U.S. Government Accountability Office. 2020. “Anti-Money Laundering: Opportunities Exist to Increase Law Enforcement Use of Bank Secrecy Act Reports, and Banks’ Costs to Comply with the Act Varied”.

Appendix D. Compliance Cost of the Financial Institutions

Table E shows the KYC process under different legislation in Japan. In addition to the identification requirements prescribed by laws and regulations in Table E, identification is often conducted as part of ordinances, voluntary standards of industry associations, or as an initiative of the business itself.

Some examples of identification processes not required by laws, yet still conducted in Japan include:

• Identity verification procedures when using Internet cafes in Tokyo (ordinance)

• Identity verification using official identification cards, individual financial/mobile phone numbers, etc. for shared services (industry associations)

• Identity verification procedures when accepting data communication contract applications (industry organization)

• Establishing social media usage environment according to user attributes such as age (each company’s own)

Table E. Various KYC Process Users Face in Japan

Appendix E. Number of Certified Anti-money Laundering Specialists Graduate List (Top 15 Countries/Regions)

Appendix F. Current AML/CFT Measures in Two-Tiered Retail CBDC