Earlier this year, the Treasury Department issued the first ever Anti-Money Laundering (“AML”)/Countering the Financing of Terrorism (“CFT”) strategic priorities. These priorities are a set of eight (8) areas that are aligned to the most pressing national security AML/CFT threats with a nexus to financial institutions facing the U.S., as agreed upon by the national security and law enforcement communities.
The priorities were issued as part of the Anti-Money Laundering Act (“AMLA”) of 2020, the first major change to AML regulations since the passage of the USA PATRIOT Act in 2001. The AMLA was included as part of the broader National Defense Authorization Act of 2020, and as such, is effectively more of a framework with a commitment to deliver regulations related to the AMLA itself, as well as regulations related to the above mentioned strategic priorities.
Although all of the strategic priorities have a potential nexus to cybersecurity and/or cybercrime, one in particular is centered on the topic – Cybercrime, including Relevant Cybersecurity and Virtual Currency Considerations. As noted, the regulations related to the priorities have not been drafted yet.
Objective
Utilizing the description of the Cybercrime, including Relevant Cybersecurity and Virtual Currency Considerations strategic priority, as well as the 2020 and 2016 Financial Crimes Enforcement Network (“FinCEN”) advisories referenced therein, create a hypothetical framework for what the regulations will include.
The framework should include:
A basic overview of what the proposed regulation will require financial institutions to detect and/or report (the above advisories will serve as a foundation);
A minimum of two domestic and/or extraterritorial criminal charges that have a nexus to the strategic priority (e.g., crimes under the Computer Fraud and Abuse Act (“CFAA”) and an explanation of how they apply to financial institutions’ risk profile (e.g., account access, customer information, company intellectual property);
Optional – An analysis of at least one computer-, technical-, or cybercrime-related law that is not included in the scope of the regulation (e.g., online Identity Theft should likely not be included because . . .); or “Under the AMLA, privacy laws such as the SHIELD Act would not likely be enhanced because . . .) and,
Potential federal agency/entity responses from the Department of Justice, Office of Foreign Assets Control (“OFAC”), or other branches. This means that, with a new regulation and/or law in place, how might the DOJ utilize this to bring or enhance charges; how might OFAC change who and how it sanctions entities:
OFAC Example – Treasury Takes Robust Actions to Counter Ransomware
USDOJ Example – High-Level Member of Hacking Group Sentenced to Prison for Scheme that Compromised Tens of Millions of Debit and Credit Cards
This assignment may rely on any research previously done for this course, as well as new sources; however, all sources must be formally cited.
Please note that the assignment is not requiring a law to be drafted, rather, a framework for what might hypothetically be in a law/regulation when it is passed. Please also note that the emphasis should center on financial institutions’ responsibilities as private entities, as that will be the focus of the regulation.
Grading:
This assignment is worth 15 percentage points of the overall grade for the course. The grading for this assignment will be broken down as follows:
Overview – 4 points
Explanation of laws and application to financial institutions – 5 points
Potential agency responses – 4 points
Structure, grammar, syntax, and use of original sources – 2 points
Optional analysis – potential for +2 additional points
Structure:
This should be able to be achieved within 7-10 pages, not including cover page, table of contents (if used), and bibliography, however, if the paper exceeds that range, that is alright.
If it is easier to use an outline format, rather than essay style, that matches the bullet points under “Objective”, that is acceptable so long as there is appropriate research and critical analysis behind the content.
