Binance Investigations Officer: AML Cost Exchange ‘Billions in Revenue’

UPDATE (Aug. 1, 17:11 UTC): Clarifies headline and fixes transcript to reflect that it was not the addition of know-your-customer (KYC) identity checks, but rather the anti-money-laundering (AML) measure of removing sanctioned accounts in part because they hadn't gone through KYC, that cost Binance billions in revenue. Also corrects name of the executives' department (investigations, which reports to compliance but is separate).

Three leading members of Binance’s investigations team opened up about what it takes to deal with fraud, money laundering, terrorist financing and bad press for the world’s largest crypto exchange.

Reuters recently published a series of investigative reports on Binance and its association with illicit activity. The news service claimed that Binance has become a hub for criminal activity and that it overlooked several money-laundering red flags. Reuters claimed also that Hydra, a Russian-language darknet market, has links deeply entrenched within Binance’s user base, stating that the exchange facilitated $780 million in payments related to Hydra since 2017.

Binance’s investigations team is now led by Tigran Gambaryan and Matthew Price, former investigators at the U.S. Internal Revenue Service’s cybercrime unit. Both men played roles in taking down prominent darknet markets AlphaBay, Silk Road and Hydra.

The exchange, which operates in numerous jurisdictions despite not having a formally registered headquarters, also recruited ex-HSBC sanctions expert Chagri Poyraz as its new global head of sanctions compliance.

CoinDesk reached out to Binance to verify Reuters’ claims and ended up having two long conversations with Gambaryan, Price and Poyraz. They disputed a number of the claims, including allegations that Binance disproportionately facilitates more money-laundering than other exchanges and Binance has become a hotbed for criminality.

At times, the executives sounded like pub patrons venting to a bartender, occasionally using pejoratives to describe journalists, and such comments should be taken with a pinch of salt.

Nevertheless, they spoke with surprising candor on how the criminal underworld remains firmly ingrained within the crypto industry, despite their best efforts, In the process they offered a rare window into how they tracked down some of the world’s most notorious cybercriminals, all while trying to keep the lid on illicit funds being siphoned through Binance.

What do you make of the claims connecting Binance to Hydra?

Matthew Price: Yes, Hydra was humongous and yes, it did business in Russia, so it’s like saying that Bank of America supports money laundering for drug cartels. It really paints this picture that “Binance knew this market was operating, so they must support it.”

Tigran Gambaryan: You can’t control the money that’s going in. You cannot control deposits. You can control what you do afterward. When Indian scammers ask people to get Apple gift cards, does that mean Apple is now laundering hundreds of millions of dollars? No. The criminals go for the easiest and cheapest way possible. If Binance was the cheapest, why wouldn’t they use it?

MP: A good example, we identified HitBTC accounts that processed transactions [referring to two Canadian citizens who were charged with stealing $220,000 while posing as employees of a Hong Kong-based exchange]. We only had the email address. With that email address we [while working at the IRS] could obtain search warrants and we could see the content of those. We could see that the user was paying himself with gift cards. I was able to link it through email accounts, so I never got to a KYC (know your customer) crypto account until quite far down the investigation, but I already knew who that was and what they were doing.

MP: The only part KYC played was where he needed to get his fiat out. Coinbase, Circle and Kraken picked up on the transaction piece that came from the Helix mixer and kicked him off the platform. So he went off the exchange and started using initially LocalBitcoins, then face-to-face meetups. The exchanges are not where the dirty money happens. It’s offline because these guys know this [that activity is traced]. They don’t want to use exchanges. If [the criminal] tried to use Binance, the transaction would get picked up with transaction monitoring.

TG: Even in 2019, I was able to identify those two knuckleheads who were related to the Twitter VIP scam. That was Mason Sheppard in the U.K. That was all done through Binance.

How does Binance compare to other exchanges in terms of illicit activity?

TG: We did a study. If you take into consideration illicit funds going in against the total volume of the exchange, yes, there’s illegal money going in, but there’s a lot of money going in. Binance is better or the same as most exchanges. Our stuff was drastically better than Kraken, better than Coinbase in some areas and worse in some areas. But there’s not a single outlier.

We operate in different jurisdictions. It makes our job challenging. That’s why we have to focus more on those jurisdictions [France, Italy, Dubai]. But us working in those jurisdictions allows law enforcement agencies to take action.

We are doing a lot of incredible work. I can’t comment on what happened in the past as none of us were here. The whole industry was [messed] up – the whole thing was just kind of developing. They all went through this period when [bad things] happened.

Reuters claimed that users can evade sanctions and skirt the law by using VPNs (virtual private networks). What is your take on that?

TG: Here’s the thing about VPNs. No exchange blocks VPNs, for the record. No crypto exchange blocks VPN activity. VPN activity is not an indication of criminal activity. It is not by itself an indication that someone is a criminal. Using a VPN is not illegal and it is not something that exchanges block. With that being said, without getting into specifics, VPN activity can be useful [for investigations]. Because there are certain players that have patterns of using this – and that, in conjunction with other things, will then tell us who these people might be. VPN was never something that stopped me from identifying someone.

I’ve never once been stung by a VPN.

(Poyraz, who spoke to CoinDesk from Davos, Switzerland, where he was meeting 30 industry leaders, added that the exchange continues to serve Iranian customers outside of Iran because doing so isn’t a breach of U.S. sanctions. Reuters alleged that several Iranian traders had accessed Binance from 2019 to 2021 before the exchange tightened its KYC process. This week, The New York Times reported that rival exchange Kraken will likely face fines from the Treasury Department on suspicions that the exchange allowed Iranian users to use the platform.)

Chagri Poyraz: From a sanctions point of view, Iranian citizens living outside Iran is not even an issue for OFAC [Office of Foreign Assets Control, the U.S. agency that enforces sanctions]. … If it’s North Korea or Syria, those are U.N. sanctions. They are applicable anywhere that U.N. sanctions are recognized. But if it's U.S. sanctions, which is Iran and Cuba, it’s only applicable according to U.S. legislation and enforcement. And by the way, they will never go after Iranian citizens living abroad. It is illegal to do that.

TG: In European countries, it’s illegal for companies to comply with U.S. sanctions against Iran. [Sanctions rules between Europe and the U.S. are vague and contradictory, according to a Financial Times report].

CP: The reason Binance hires people like Tigran and me is to build sophistication around the sanctions program. I actually enabled an Iranian refugee in the U.K. to get a Binance account. Even that was not allowed before [Binance improved its controls to make a distinction between a resident and national of a sanctioned country], which was a wrong thing to do.

TG: It is illegal to comply with U.S. sanctions in the EU. This shows again the complicated fact that we are not a U.S. entity. We take a very conservative approach that is putting us at risk in non-U.S. jurisdictions. But we are complying with [U.S. sanctions]. Our compliance with them is putting us technically in an illegal position in other jurisdictions as my understanding is that it goes against EU law.

CP: Just to expand, please ask any bank if they open accounts for Iranian accounts for people residing in their country or the United States. The answer will be yes. … If you want to talk about Iranians living in Iran, we take every single measure. Yes, there is always evasion, but when there is evasion, we find it and upgrade our controls.

Reuters reported that Telegram messages suggested that Binance CEO Changpeng “CZ” Zhao ignored calls from compliance officers over a loose KYC and anti-money-laundering (AML) policy. What is your view on CZ?

TG: CZ has been incredibly supportive.

CP: I have been a compliance officer for 17-plus years now. The main job is to explain to the business, including the CEO, what the risk and the problem is and to make a risk-based decision. You never ask them to do something illegal, but if there is something in a gray area, make a risk based decision. The CZ I know – and I’ve been here long enough – when you explain something to him, I have never seen him hesitate [to act properly]. He will never do the wrong thing.

TG: He did not have the same caliber of people around him that he does now. This was a small company. They grew, and look at the people they have now. I can’t defend anything that happened before. We are here fixing those issues. I know for a fact that CZ has made decisions that have cost [Binance] a ton of money. We out-platformed accounts that had millions of users on it because of those risk-based decisions. Because it was the right thing to do. It cost billions of dollars, but he did it.

In July 2021, Binance decided to lower the controversial 2-BTC withdrawal limit for non-KYC accounts to 0.06 BTC. Was there a notable decline in illicit activity after this change?

TG: We did. We actually commissioned a study. If you want to go on LinkedIn and see a colorful exchange between me and someone who is on the January 6 commission who used to be at the [U.S. Department of Justice], Amanda Wick, I was having an argument because she is steering a narrative. It’s kind of weird having someone from the DOJ come in and comment on something an exchange put out.

TG: But anyway, I’ve commissioned something for the investigations team to do: What is the effect of 2021 and when this thing started compared to the past 6-8 months? There is a huge difference [in amount of illicit activity], not only in deposits, if you look at a total percentage of transactions. Binance is exponentially larger than its competitors.

If you use real math, the numbers [of illicit activity] are the same industry-wide. Better than some, worse than others. But again, this is largely based on the jurisdiction we operate which puts extra strain on those [Binance staff working in] jurisdictions to make sure the numbers are cleaner. But there is no single outlier.

There is nothing that screams that Binance is a den of criminal activity, and that’s what I wanted. I wanted to kind of put something out there that [supports] this.

CP: We should be demonstrating it more, but us demonstrating it is tipping off other criminals. We cannot do it every day because it will tip them off. One example, I respect your domain and that you will do your own fact checks. Check when we exited [stopped doing business with] Garantex [an Estonia-based exchange that was sanctioned by the U.S. for laundering over $100 million of illicit funds]. Almost a month before it was designated by OFAC. We can take that call as CZ lets us take that call. All I know is that I exited a month before because we are empowered to do so.

TG: There are other exchanges that continue to do business with them. I think we lost 90% of customers [of one entity that a Binance spokesperson says represented a sliver of exchange volume] from that user because not everybody came in to get KYC, and this cost us billions of dollars in revenue.

Why does Binance have no physical headquarters?

Jessica Lung (Binance spokesperson): Yes, so we have registration in Italy, France, Abu Dhabi and now Spain.

(Binance would not disclose where the main headquarters is located or where it will be located.)

TG: I was just in Paris. I met with law enforcement in Paris – it’s not a secret. We have offices everywhere. So we’re actively expanding into Europe, APAC (Asian Pacific) and Latin America. There is ongoing licensing in place.

JL: If you look at the requirements for the France registration, it’s super stringent and the due diligence and requirements are a very high bar. So if you look at that, you can see what our actual process is like.

TG: I hope I could one day give you access to our law enforcement intake to see how much we’re working on and providing for the world. Binance staff in Brazil did a weeklong class with federal police out there. We’re in France [where licenses are hard to get]. So it’s crazy for me to know what’s going on [at Binance that the Reuters story missed]. I guess I’m just upset. Ignore me. I hate wasting my time with those [journalists].