In the narrative fabric of 2019, a common thread has been the vulnerability and counterparty risks of centralized exchanges and their detrimental effects on clients caught in the crossfire of hacks, mismanagement and fly-by-night fraud.
Barely into the new year, the topic was red hot. News of QuadrigaCX’s insolvency following the suspicious death of its founder (who allegedly passed with the sole knowledge of the exchange’s private keys) lit up discussions in the early part of the year. In the ensuing months, hackers poached Binance, Cryptopia, Bithumb and a handful of minor exchanges for roughly $200 million in cryptocurrency.
But these mishaps feel like sideshows compared to the main attraction: Bitfinex. At the end of April, an ex parte order filed with the New York State Supreme Court by the office of New York’s Attorney General (NYAG) revealed that Bitfinex lost $850 million to its third-party payment processor, Crypto Capital. Bitfinex then took out $625 million from Tether’s reserves and opened up a $900 million line of credit with the stablecoin to cover the missing funds.
The news set off a volley of court letters between Bitfinex and the NYAG. Bitfinex called the attorney general’s actions a “gross overreach.” The NYAG accused Bitfinex of gross negligence (like not disclosing the Tether deal to clients and conducting business with Crypto Capital with nothing but a verbal agreement). And Bitfinex even launched a token to recoup funds.
Plenty of unresolved questions still loom over both QuadrigaCX and Bitfinex’s recent failings. But one common link exists between both casualties.
Crypto Capital
Along with a motley of dubious fiduciary partners, QuadrigaCX also used Crypto Capital to process payments. In fact, Crypto Capital gets around: Kraken and ShapeShift made use of its services in the past as well. Typically, banks have more or less pushed exchanges toward payment processors like Crypto Capital; they refuse to open accounts for these exchanges for fear of being implicated in shady business practices. (Of course, this doesn’t stop these same banks from suffering regulatory bludgeoning and massive fines for money laundering in “legitimate” sectors.)
Given Crypto Capital’s deep roots in the crypto exchanging business, some critics have called it the industry’s “central point of failure.” This is overstated on a macro scale, but for the micro examples like QuadrigaCX and Bitfinex, there’s a grain of truth. The dangers became more apparent when Americans Reginald Fowler and Ravid Yosef, the heads of a company called Global Trading Solutions, were charged with running “a shadow bank that processed hundreds of millions of dollars of unregulated transactions on behalf of numerous cryptocurrency exchanges.” Global Trading Solutions is the parent company of Crypto Capital.
That phrase, “shadow banking,” has stuck to the tongue and ears of the community. It gave a form and definition to the intricate web of shell companies, makeshift fiduciaries and seedy practices that have come to define the lengths to which some exchanges have to go — whether by choice or necessity — to provide fiat services to their customers.
But what exactly is shadow banking and how is it possible? And how expansive is the web of third-party payment processes that prop up some of the space’s most popular exchanges?
Pulling the Strings
“There was some mis-information floating around with Crypto Capital — where the funds might be and how the Panama banking sector works,” Pamela Garner, director of financial investigations and education at CipherTrace, told Bitcoin Magazine.
Before joining the blockchain analytics firm, Garner spent a decade working for the U.S. Department of State as a foreign service officer. Her speciality was identifying money-laundering tactics used by the drug cartels, specifically in Mexico and Panama.
Panama also happens to be the seat of incorporation for Crypto Capital. For years, Panama was a prime spot for druglords to offload dirty money — Garner referenced this portrayal with Pablo Escobar in Narcos, for example.
But the Panamanian government, facing pressure from U.S. officials, tightened up its banking regulations in 2016 to quash such practices following the Panama Papers leak. It’s still absurdly easy, however, for foreign persons to set up a business in the country. According to Garner, the country’s privacy laws make it even easier to obscure ownership and even business history.
Law firms in Panama will sell entrepreneurs “off-the-shelf companies”: companies that exist in name only and have no active business attached to them. These law firms create these companies with the explicit purpose of selling them to customers at a later date, once they’ve reached a vintage that a buyer finds appealing. The law firm profits and the business owner gets the benefit of a company with history to its name. In reality, the business is just days old, but on paper, it could be as much as 5, 10 or 15 years old.
“Now my company isn’t brand new when I go to open a bank account in Switzerland tomorrow, instead of them seeing that this company was created last week,” Garner explained.
For the next step, all you need is a Panamanian citizen to sign on as a board member, a director or in some other leadership role to get started. Garner did this when she set up her own business in Panama and asked her nanny to sign on as secretary. In her case, she knew this nanny. But other entrepreneurs are free to ask any random person off the street for their ID and signature to get their company started.
“You can go out and pay somebody $100 to sign a document, take their identification and then they’re on a board of directors,” she said.
Shadow Banking With Shadow Identities
These presta nombres, which literally translates to “loaned names,” can then act as decoys for the company’s leadership. This could explain why Panamanian citizens are all over Crypto Capital’s list of nominal subscribers, Garner said. If you go to the company’s website, information on team members is nowhere to be found, and if you were to search Panamanian records, you’d also come up short of finding any team members other than these presta nombres.
For example, one of Crypto Capital’s nominal subscribers, Ivan Manuel Molina Lee, is also listed as its president. Media has pegged him as a Canadian citizen, but Garner suggested that, because of his position as president under Panamanian business laws, it’s entirely likely that he also has Panamanian citizenship. These nominal subscribers are the only names that go on record. Because of Panama’s lax business laws, the actual equity holders of a company are rarely — if ever — put into the books.
“What Panama does really well is that it hides beneficial ownership. Beneficial owners are almost never written down in Panama, so nobody knows who actually owns the company,” Garner said.
Instead, Panama issues bearer shares to represent company ownership; whoever owns the paper, owns that share of the company. To make pinning down company stakeholders even more slippery, law firms that help these companies incorporate grease the process by pre-drafting letters of resignation. These signed-and-ready documents allow for fast-and-loose restructuring, as they only need to be dated to seal the deal.
The benefit of something like this? “We still don’t know who owns and runs Crypto Capital. That’s the benefit,” Garner said.
Internet sleuths and certain journalists have pegged Fowler and Yosef, the two Americans implicated in the legal takedown of Crypto Capital’s parent company, Global Trading Solutions, as the ostensible owners of the payment processor. This is “unlikely,” according to Garner, due to Panama’s banking laws.
“Panama came to an agreement with the U.S. in 2016 requiring U.S. persons to provide info and report to the IRS when they open a bank account, so it’s unlikely that the owners are U.S. persons,” she explained.
Moreover, when a company signs on with a Panamanian bank, that bank is required by law to conduct know-your-customer (KYC) due diligence on anyone with over 25 percent equity in that company.
Funneling Money
Indeed, CipherTrace in its research for its Anti-Money Laundering (AML) report found no evidence of Crypto Capital establishing bank accounts in Panama. So how did Crypto Capital move funds if they didn’t have Panamanian bank accounts? This is where Global Trading Solutions comes in.
“They set up in Panama but they’ve also registered in other countries as well,” Garner said. In fact, global trading solutions has set up shop in multiple countries: There’s Global Trading Solutions LLC (U.S.), Global Trading Solutions AG (Switzerland) and Global Trading Solutions GmbH (Germany), among others. This makes getting a bank account in those regions feasible, and, in turn, gives Crypto Capital/Global Trading Solutions a roulette of banks to cycle through to move funds.
Why not just bank with Crypto Capital? Well, the name itself wouldn’t exactly inspire confidence with a potential banking partner. Banks don’t want to work with cryptocurrency companies because the potential for money laundering (particularly with any exchanges that don’t implement KYC rules) is outside of their risk tolerance. As Garner put it: “Global Trading Solutions is a better name than Crypto Capital if you’re trying to hide stuff.”
Once Global Trading Solutions opened up accounts in these countries, it likely didn’t tell the banks the nature of its business, lest its accounts get shuttered. And if it didn’t tell the bank, it probably didn’t register as a money services business in these jurisdictions, either. The company would play this game until it got caught.
“They use those accounts as much as they can until they get caught by the bank,” Garner said. “And it’s not the government closing those accounts; it’s the banks. Once they see where the money is coming from, that’s going to exceed the risk appetite of that bank.”
Red Flags
Crypto Capital/Global Trading Solutions’ banking partners, on several occasions, seem to have felt like they bit off more than they could chew. Between Global Trading Solutions AG/LLC/GmbH and a few other front corporations, the Crypto Capital shell company empire has had bank accounts shut down with HSBC and U.S. Bank in the U.S., Deutsche Bank in Germany, Caixa Geral de Depósitos in Portugal, Bank Zachodni and Bank Spółdzielczy W Skierniewicach in Poland and Bank ING in the Netherlands.
Most likely these closures arose from suspicious activity. When asked what suspicious activity could entail, rather than just dealing in cryptocurrency, Garner declined to comment.
If a bank flags suspicious activity, the account holder would have fair warning before the account is closed. But to keep it open, they have to give a reason for the bank to trust the nature of their business.
“In most cases,” Garner said, “the bank would reach out to the company and ask for additional details (like, ‘What are these transactions for? What are you guys doing?’) and they probably never received any additional details.”
Picking Up the Pieces
Garner made it clear in her talk that, while she might belabor her explanation, the differences between establishing business relationships and establishing banking relationships in Panama are significant. The latter is riddled with limitations due to the Panamanian government’s legal agreements with the U.S. This is why it is unlikely that Crypto Capital did any banking in the country.
“Everyone likes to say that the money is sitting in Panama. We haven’t seen any Panamanian banks mentioned in any of the documentation, so it doesn't appear that Crypto Capital was utilizing Panamanian banks, or if they were, they were closed pretty quickly,” Garner said.
After following the trail of closed accounts and Crypto Capital’s scrambling to move funds internationally, Garner thinks that “the Crypto Capital money is in various bank accounts around the world.”
So the $850 million in Bitfinex’s missing funds is likely fragmented and scattered in other bank deposits or in the form of cashier checks that one of Crypto Capital’s multitudinous shell companies has yet to deposit. They might be in limbo after a bank account closure, as sometimes it takes months for the funds to be returned.
Another possibility is that a significant chunk of these funds was seized by Polish and Portuguese officials following the account closures of Crypto Capital’s shell companies in those jurisdictions. Bitfinex argued as much in one of its legal responses to the NYAG’s ex parte order.
Garner said that it’s unlikely that Bitfinex knew much at all about Crypto Capital’s business. (It didn’t even get their business relationship in writing.) These “intimate relationships” which are extremely loose in structure require “implicit trust,” Garner opined.
Crypto Banking Woes "Not Overstated"
Therein lies the rub for the “dangers of a third-party payment processor system and the industry’s over reliance on it,” said Garner.
“Because of that relationship and trust, it tends to be the case that KYC/AML procedures aren’t followed.”
If KYC/AML policies were followed, these exchanges and/or their payment processor partners might find it easier to secure banking relationships. Still, Garner said that it’s inordinately difficult for these crypto companies to convince banks to open their accounts to them. Because of this, they have to turn to entities like Crypto Capital to provide fiat on/off ramps for their clients.
Whether by nature of lax regulation or the company’s own decision, she believes that crypto banking woes are “not overstated.” This is especially true in places like Canada, where QuadrigaCX operated, where there’s no litmus for an exchange’s trustworthiness.
The solution, then, is more regulation, even if some of the space’s more principled disciples are clambering for less. Garner’s of the mindset that a fusion of New York’s BitLicense, which she finds heavy-handed, and FinCEN’s guidance, which she says is too light, would offer a good balance.
“Regulation goes both ways,” she said. “It can keep the QuadrigaCXs out there from playing fast and loose. And it can also set expectations for what is a good, well-oiled exchange for banks to support. Banks want regulation to know how to evaluate a cryptocurrency exchange. They need a checklist.”
So regulations can’t resurrect the cash that Crypto Capital may have lost, laundered or simply been unable to find a home for. But, at the very least, they could save customers and exchanges like Bitfinex from stumbling into similar pitfalls down the road.