A Spanish effort to prosecute a gang that used bitcoin automated cash machines suspected of being a front for illegal-drug payments has exposed a hole in European anti-money-laundering controls, law enforcement authorities in the country said.
Rules designed to force money handlers to vet their clients don’t apply to the cash machines’ owners or to cryptocurrency trading platforms, according to drug enforcement officials from the Civil Guard, a type of police in Spain.
Bitcoin ATMs are a relatively new phenomenon and are spreading rapidly.
There are more than 5,400 machines installed worldwide, a number that has grown by more than half over the past year, according to Coin ATM Radar, a website that tracks the industry. Of those, 89 are in Spain.
In the U.S., crypto ATMs have proliferated at corner stores, casinos and smoke shops. Their owners, like those in Spain, don’t have to comply with strict anti-money-laundering regulations.
Spanish police announced in May that they had taken down a laundering operation that used bitcoin ATMs.
They arrested eight Spaniards and Latin Americans who allegedly used nine companies to transfer more than 9 million euros ($10 million) for drug traffickers in Colombia and other countries.
The authorities say the cash machines were crucial.
According to the Civil Guard officials, who spoke on condition of anonymity, the group hired two ATMs from unsuspecting trading platforms and installed them in an office in Madrid that masqueraded as a center for sending remittances and trading cryptocurrencies.
The gang would then transfer money from bank accounts to the trading platforms in order to top up the machines with bitcoin or other digital currencies.
People linked to the group, who registered at the platform’s office using false identities, would deposit cash in the machines and receive a QR code or a numerical code with which they could claim their cryptocurrencies from the exchanges.
Those bitcoins could then be sent to the drug traffickers who could cash them in.
The scheme provided justification for large amounts of cash to be deposited in bank accounts in Spain and abroad without raising red flags.
Prosecuting the case, however, is taking the Civil Guard into new territory. As part of the bust, the police seized the two bitcoin ATMs along with four cold wallets (for offline storage for cryptocurrencies) and 20 online wallets.
It is now trying to prove the relationship between the machines and the digital cash it confiscated, a task made more difficult by a lack of clarity around bitcoin’s legal status in Spain.
In a separate case, Spain’s Supreme Court issued its first decision on cryptocurrency-related fraud last week, ruling that bitcoins are not legal electronic money but are assets and that any repayment of the fraud would need to happen in euros.
The Civil Guard officials said the ruling was welcome because it starts to define bitcoin.
New European Union legislation set to take effect by next year aims to include cryptocurrency exchanges and the custodians of online wallets in anti-money-laundering rules that already require banks, jewelry dealers and certain other firms to report suspicious financial activities.
It won’t, however, include independent bitcoin ATM owners, a breach that increasingly sophisticated money launderers will be sure to try to exploit, the officials said.