A Measured Take on NBA Top Shot Withdrawals from an AML/KYC Compliance Specialist
No, Top Shot is not a "Money Laundering Business," Sir
Full Disclosure: I am a fan of the NBA Top Shot platform. I’ve purchased packs of moments and have bought and sold individual moments on the Top Shot marketplace. Additionally, I spoke to Jon Sarlin about AML compliance matters for his CNN Business story on Top Shot withdrawals. I’m a non-practicing attorney, AML Compliance Specialist, and crypto-enthusiast. Nothing in this article should be construed as legal advice or financial advice. Do your own research.
To say that Dapper Labs and its NBA Top Shot platform have received some positive media attention since the beginning of the year would be an understatement. There have been stories touting Dapper’s successful transition from Ethereum and its development of the Flow blockchain, viral tweets from athletes, a widely shared blog post from Mark Cuban, and click-baity headlines touting sales of certain moments for astronomical amounts.
In recent weeks, however, the tone of some mainstream coverage has started to trend more negative. This negativity stems from the growing, and understandable, concern about long delays that some Top Shot users are facing when attempting to withdraw their funds.1
Earlier this week, Jon Sarlin of CNN Business published a story titled, NBA Top Shot customers can't get their money out. Experts are confounded. In his piece, Sarlin links to an article by John Reed Stark (a former Chief of the SEC’s Office of Internet Enforcement) with the headline, Has the NBA Accidentally Built a Money Laundering Business? Say it Ain't So Joe . . . .
Although both of these articles are well-researched2 and present legitimate anti-money laundering (AML) concerns as well as other important regulatory issues, they share similar faults. Namely, both have inflammatory, attention-grabbing headlines that I feel exaggerate the issues (I get it, that’s how the game is played) and both articles fail to account for the necessary nuance and context that is required when talking about regulatory compliance matters. I’m going to do my best to provide those missing pieces below.
The Role of the Payment Processor
Neither of the referenced articles mention Circle Internet Financial, LLC, Dapper’s payment processing partner. This is a notable omission because, depending on how the contracts between Dapper and Circle are structured (I obviously don’t have access to that information), it is likely that the majority of the shared regulatory burden falls on Circle, not Dapper.
Stark rightly points out that “Dapper is not registered with [the U.S. Treasury’s Financial Crimes Enforcement Network -] FinCEN as a money services business.” He highlights this to suggest that Dapper “might lack the technological and professional investigative expertise that traditional financial institutions have spent years developing.”
However, a quick search of FinCEN’s money services business (MSB) registry shows that Circle is registered as an MSB engaged in money transmission. As a global payment processor, Circle likely has the expertise and experience Stark references. Again, depending on how the contracts are structured and how the custodial accounts and funds are handled between Dapper and Circle, a robust AML program may already be in place at one or both companies that would pass regulatory scrutiny (and would help explain the withdrawal delays).
Suspicious Activity Reports and Confidentiality
A suspicious activity report (SAR) is a form that a bank must file with FinCEN when unusual account activity or transactions (that may be indicative of money laundering or other financial crimes) reach certain threshold levels defined in the regulations. Law enforcement uses the financial information from submitted SARs to “combat terrorism, terrorist financing, money laundering, and other financial crimes.”
In his article, Sarlin quotes a financial crime expert as saying:
Hopefully the compliance folks are filing suspicious activity reports (SARs) on cases where the the winning bid is wildly out of proportion with comparable sales of that type of NFT.
I find this quote a little strange because it misrepresents who (i.e. which entity) would actually be filing the SAR. As discussed above, Dapper is not a bank, nor are they registered as a money transmitter. Thus, the obligation to file the SAR would fall on either Circle or Circle’s sponsor financial institution (that is the bank that “sponsors” Circle’s into the various card networks like Mastercard and Visa), not Dapper.
Yes, Dapper should absolutely be monitoring all accounts and transactions for suspicious activity. Additionally, Dapper should be reporting any potentially unusual, suspicious, or criminal activity to Circle and its other banking partners. However, the ultimate decision as to whether the activity rises to the level of “suspicious,” as defined in the regulations, and therefore whether to file the SAR with FinCEN, resides with the bank (or the directly regulated money transmitter). From there, as the expert correctly notes in the article, “it falls on law enforcement to determine if any illegal activity has occurred.”
Lastly, even if I’ve misjudged the relationship between Dapper and Circle completely and it turns out that Dapper is required to file SARs directly with FinCEN (I really don’t see how this could be true), it doesn’t surprise me that, according to Sarlin’s article, Dapper CEO Roham Gharegozlou said “he cannot recall ever filing SARs."
First, it is highly unlikely that a CEO would be involved with the minutiae of one specific regulatory report (although he would likely receive executive reporting as to quantity, key trends, etc.). Second, even if Roham was aware of SARs being filed, he would not be able to disclose details because SARs have strict confidentiality requirements. According to federal regulation, “SARs are confidential and generally no information about or contained in a SAR may be disclosed.”
Wire Transfers are not “Cyrpto Transactions”
One method Dapper offers for withdrawing funds from Top Shot is by wire transfer. Sarlin notes as an aside that wire transfers on Top Shot “carry a $25 fee.” This is an odd piece of information to include without the context that this fee is at par with wire transfer fees charged across the financial sector.
Another compliance expert in the article is quoted as saying the following regarding the lengthy delay for a wire transfer to be completed after a request is made:
Isn't the whole point of these crypto transactions to be instant?
Wire transfers date back to 19th century telegraph networks and moving money via Western Union. I’m not sure anybody is comparing them to “crypto transactions” (or any other type of cutting edge FinTech).
With that said, I’ve now read this Top Shot blog post multiple times and I still don’t quite understand why, after an account is approved for withdrawal, another 21 to 40 days would be required to review an account before the wire transfer is completed.
Top Shot is not a Haven for Money Launderers
Perhaps that header is too definitive. Hey, I had to make up for my boring headline with an attention-grabbing sub-heading of my own (maybe I don’t understand how the game is played).
Obviously, I can’t be certain Top Shot isn’t rife with money laundering activity. Plus, if these two articles are any indication, other compliance experts clearly disagree with me on this point. It just seems to me that money launderers would have other crypto and crypto-adjacent mechanisms to use that would be far more efficient at obfuscating the source of their funds than an NFT collectibles marketplace with traditional banking system connections.
As discussed briefly in Sarlin’s article, Dapper sits at the intersection of two vastly different financial worlds. In their pursuit of mainstream adoption by consumers of a crypto-derived NFT product, Dapper chose to allow for purchases in fiat currency via credit cards. This connection to core banking and payments systems brings the type of regulatory strings that DeFi enthusiasts generally abhor. It is for this reason that many thinkers and influencers in the crypto space have serious problems with Dapper, with FLOW, and with Top Shot. If given the choice, I would think a money launderer would prefer not to operate in an environment that brings in the very governmental regimes designed to prevent what they are trying to do.
I think Stark inadvertently makes this point in his section on “Crypto-conversions.” He lays out a potential ransomware money laundering scheme as follows:
Ransomware attackers can cloak their cryptocurrency even further by engaging in multiple cryptocurrency conversions on multiple cryptocurrency trading platforms before depositing it into an NBA Top Shots Marketplace account. By working with regular cryptocurrency exchanges or by participating in an Initial Coin Offering (ICO), a ransomware attacker can use one type of cryptocurrency to pay for another type, which can further obfuscate the digital currency's origin.
Why, after going through all that effort to convert funds from one currency to another on deregulated exchanges, would a money launderer then deposit their illicit funds into a NFT marketplace that is going to require KYC, identify verification, and stringent account reviews before withdrawal? A marketplace that has, at times, prioritized strict adherence to regulatory compliance mandates to the detriment of user experience and customer satisfaction. That doesn’t make any sense.
As I have stated before, I do not think Dapper is completely without fault in regard to the withdrawal controversy. Innocent users have a right to be upset and to ask serious questions about access to their funds. Clearly the compliance apparatus Dapper had in place at the beginning of 2021 was not ready for the massive influx of new users in February and March and didn’t scale adequately. Even now, as recently hired compliance personnel are onboarded, some of the quoted withdrawal delays in Top Shot blogs and FAQs are inexplicable to me. The most important thing, as far as I’m concerned, is that readers understand all of the distinct, yet interconnected issues at play before rushing to judgment. I hope this article helps anybody engaged in that pursuit.
The Stark piece contains a thorough exploration of the various methods that money launderers use to obfuscate the source of illicit funds.