FinCEN Advisory: Financial Institutions Need to Keep Up With the Changing Business of Ransomware

The Financial Crimes Enforcement Network (FinCEN) recently issued an updated version of its Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments (the Advisory).¹ The Advisory emphasizes that financial institutions should be on guard for signs that their customers are attempting to make or receive ransomware payments—even as the logistics of the ransomware business become increasingly complicated.

Background

The updated Advisory, which replaces FinCEN’s October 1, 2020 advisory of the same name, comes against the backdrop of increasing ransomware attacks against US institutions and infrastructure and a rising enforcement response from the US government as the Biden Administration continues its “whole-of-government” approach to ransomware.²

The same day that FinCEN published its Advisory, the US Department of the Treasury announced that its Office of Foreign Assets Control (OFAC) had sanctioned two ransomware operators, a Ukrainian citizen and a Russian citizen, and the virtual currency exchange Chatex for their respective roles in ransomware operations.³

Relatedly, on October 6, 2021, the Department of Justice (DOJ) announced the creation of a National Cryptocurrency Enforcement Team “to tackle complex investigations and prosecutions of criminal misuses of cryptocurrency, particularly crimes committed by virtual currency exchanges, mixing and tumbling services, and money laundering infrastructure actors.” DOJ stated that the team will the team will also assist in tracing and recovering assets lost to fraud and extortion, including cryptocurrency payments to ransomware groups.⁴

The FinCEN Advisory

FinCEN’s Advisory makes clear that, although most cybercriminals require that ransomware payments be made in convertible virtual currencies (CVCs) (e.g., Bitcoin),⁵ nearly every ransomware payment will involve the use of at least one depository institution as an intermediary. Financial institutions are therefore in a position to play a pivotal role in identifying and reporting ransomware attacks and assisting law enforcements efforts to combat ransomware.⁶

To encourage and facilitate effective action by financial institutions, FinCEN has identified four types of ransomware “red flags” to which financial institutions should be alert.

1. Unprecedented CVC Transactions

Financial institutions should be alert for circumstances in which (1) a customer has no or limited history of CVC transactions and then transfers funds to a CVC exchange; or (2) a customer shows little knowledge of CVC but inquires about or purchases CVC—especially in large amounts or through rush requests.

In addition, financial institutions should note anytime a customer provides information that a payment is in response to a ransomware incident.

2. Transactions Involving Digital Forensic Response Companies or Cybersecurity Insurers

Digital forensic incident response (DFIR) companies frequently assist ransomware victims in responding to ransomware attacks; these companies may also help facilitate the ransomware payment by taking the victim’s money, converting it to CVC, and then transferring the CVC to the attacker.⁷

Cybersecurity liability insurance companies (CICs) also often play a role in ransomware transactions, by reimbursing policy holders for remediation efforts, including the use of a DFIR company.

Financial institutions should be alert for any instance in which an organization sends an irregular transaction to a DFIR or CIC, especially if the DFIR is known to facilitate ransomware payments and especially if the organization is in a sector at a high risk for ransomware attacks (e.g., government, financial, educational, healthcare, etc.). Similarly, financial institutions should monitor transactions where a DFIR or CIC customer receives funds from a counterparty and then quickly sends an equivalent amount to a CVC exchange.

3. Suspicious CVC Transactions

A financial institution should be alert for signs that a customer is (1) using an encrypted network (e.g., Tor) to communicate with the recipient of the CVC transaction; (2) using a CVC exchange that is based in a foreign country, particularly in a high-risk jurisdiction lacking adequate AML/CFT regulations; (3) initiating a transfer of funds using a mixing service;⁸ (4) receiving CVC and then initiating multiple rapid trades across multiple CVCs (especially CVCs with enhanced anonymity features) with no apparent purpose, followed by a transaction off the platform; or (5) appearing to act as an unregistered money service business by executing large numbers of offsetting transactions between CVCs.

4. Publicly-identified Ransomware Signs

Additional red flags, such as (1) knowing the “IT enterprise activity connected to ransomware cyber indicators or known cyber threat actors” and (2) whether a customer’s CVC address, or an address with which a customer conducts transactions is connected to ransomware variants,⁹payments, or related activity, emerge on an ongoing basis.  FinCEN identifies several sources of information on these emerging indicators, such as the Cybersecurity & Infrastructure Security Agency Technical Alerts and FinCEN’s Cyber Indicator Lists, which it encourages financial institutions to monitor.¹⁰

To help thwart the emerging threats and challenges posed by ransomware, financial institutions must stay current with changing virtual currency technologies and associated trends and typologies and may need to adjust their AML monitoring programs in order to meet their reporting obligations.

*          *          *          *          *

Financial institutions with questions about the Advisory, or individuals or entities that believe they may have been the victim of fraud, can reach out to the authors or any attorney in Arnold & Porter’s Financial Services or Privacy, Cybersecurity & Data Strategy practice.

© Arnold & Porter Kaye Scholer LLP 2021 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.