Facing the challenge of the metaverse: the fundamentals of anti-money laundering still apply

If you imagine a nightmare for anti-money laundering practitioners and investigators it might look something this: A network of virtual worlds where people from around the world can use pseudonyms and avatars to connect with each other and exchange digital assets.

Leading tech companies are heavily investing to make the virtual worlds of the metaverse mainstream. They predict it will radically change how we do business. As Mark Zuckerberg, CEO of Meta, famously asserted: ‘Metaverse isn’t a thing a company builds. It’s the next chapter of the Internet overall.’

This complex digital landscape – the Web 3.0 metaverse – already functions as a component of the existing Internet. It was conceived from the outset to have decentralised control and ownership, based on blockchain technology.

As it develops, it presents a novel set of challenges for money laundering efforts. Regulators, lawmakers, law enforcement agencies, and partners across the private and non-profit sectors, will need to rapidly understand the complex challenges presented by the metaverse.

Users of the metaverse will be able to meet virtually and conduct transactions, free from the threat of interception and entirely anonymously. This level of privacy is a step-change beyond ‘end-to-end’ encryption and challenges the foundations of anti-money laundering supervision.

The architects and pioneers shaping this new reality are driven by innovation and profit. But apart from a few exceptions, legislatures and regulators are years behind the reality of the Web 3.0 metaverse. Even if mainstream adoption takes some time, this space will draw in those who see the value in staying most hidden from official view.

Artificial intelligence (AI) is playing a significant role in this. “AI is entwined with the development of the metaverse,” explains Liam Ennis, Key Expert on Law Enforcement for the EU Global Facility for Anti-Money Laundering and Countering Financing of Terrorism (EUGF). “You can’t discuss the metaverse without addressing that, and money laundering in the metaverse is no exception.”

In a virtual, digitally connected world, AI offers previously unparalleled scope to facilitate identity fraud via deepfakes and information scraping at scale, challenging the very basis of Know Your Customer. “AI provides the key to unlock the virtual meeting rooms and transactions that can take place in the metaverse. This key may result from a stolen identity or an entirely falsely created one; either way it will mean criminal parties can meet and transactions can take place in complete privacy,” says Liam Ennis.

These techniques for obscuring ownership and identity will be available to those who finance terrorist groups too. Whether the group is part of a loose alliance, or is formed as a highly organised, corporate structure, the metaverse offers a readily accessible virtual sanctuary and trading place for designated armed groups.

The UAE’s new licencing regime for Virtual Asset Service Providers (VASPs) is backed up in law by oversight provisions, including for Suspicious Transaction Reports. The UAE’s new licencing rules explicitly map out how the country expects VASPs to operate in line with FATF guidance on Virtual Assets.

The metaverse will force authorities to strengthen all the basics of anti-money laundering; Know Your Customer, Suspicious Transaction Reporting, mapping typologies, information sharing, registers, and more.

But regulation in this area is only as good as its weakest link, and some international partners are finding it a challenge to keep pace with technology and the new risks it brings. So how will suspicious transactions and assets be identified, tracked, and matched to participants’ real-world identities?

Supervision and enforcement through the metaverse require the ability to source and sift data, spot patterns, and share information rapidly. The volume of anti-money laundering data that needs to be analysed and shared is set to become a tidal wave. Everyone will be challenged to play their part better and faster.

To apply resources effectively, law enforcement will need to get to grips with understanding these new threats and vulnerabilities. In particular, the challenge will be to identify typologies that criminals and terrorists will use in the metaverse. These in turn can help inform the application of AI by Fintech and others to identify suspicious transactions and mitigate risks.

This is a daunting prospect for many, which is why the EU Global Facility is supporting partners and working collaboratively to anticipate the challenges that the metaverse will present. This in turn will facilitate the sharing of technical expertise in financial investigations in the metaverse.

Those tools include advanced data analytics using AI. Even in the absence of traditional transaction records, these can identify patterns indicating money laundering which would be missed by human analysts. The EU Global Facility’s Strategy on Cryptocurrencies also describes how blockchain technology itself presents opportunities to apply traditional investigative methods in novel ways.

Blockchain underpins thousands of cryptocurrencies and authenticates the ownership of everything in a metaverse world. It normalises pseudonymous transactions and obscures, at least in part, the individuals behind transactions. At the same time, as blockchain records are immutable they allow investigative agencies some ability to monitor the source and destination of crypto-assets.

Indeed, in the shadowy world of the metaverse it may be that going back to traditional policing techniques, such as the use of informants and undercover law enforcement, will play a more significant role than previously seen in anti-money laundering investigations.

Responsible authorities must also establish collaborative platforms and forums with users, developers and operators. These include channels for efficient data-sharing and automated reporting, and spaces for both sides to identify emerging risks and typologies together. Communicating and educating can even contribute to the ‘designing out’ of some risks through early consultation.

To implement FATF recommendations effectively, countries will have to adapt as the technology develops, just as they have already had to respond to the advent of crypto-currencies. The virtual environment will not be set in stone, and will continue to evolve rapidly, often faster than legislation.

This puts the onus on countries to proactively engage with tech companies as they develop the metaverse, and to feel empowered to innovate and adapt in response. There are many unknowns, but sharing knowledge and lessons globally, and adopting the pragmatic shifts seen in response to earlier technological shifts can help to contribute to the safe evolution of the metaverse.