"FIU Coin Transaction Investigation Details Could Be Stolen by Foreign Firms" [Crypto Radar]

FIU to Adopt Foreign Solutions for Virtual Asset Anti-Money Laundering Analysis
"Internet-connected cloud use raises risk of data leaks"

The Financial Intelligence Unit (FIU) under the Financial Services Commission is pursuing the introduction of a dedicated system to prevent money laundering involving virtual assets. However, concerns have been raised that investigative secrets could be leaked overseas. The FIU has also been criticized for drawing up its budget with only one foreign vendor in mind.

According to the National Assembly and other sources on November 12, Kwak Hyunjun, senior specialist member of the National Assembly’s Political Affairs Committee, noted in a preliminary review report on the Financial Services Commission’s budget proposal that “the budget was calculated with a focus on a specific vendor, and security measures for using overseas cloud services are inadequate.” His comments concerned the FIU’s money laundering prevention project.

As part of the project, the FIU newly requested a budget of KRW 1.93 billion to introduce a solution for analyzing and tracing on-chain virtual asset data. The FIU explained that the current system can verify only transactions conducted through regulated virtual asset service providers, while it is difficult to track the flow of and trace blockchain transactions, including those involving personal wallets. It said the solution was necessary for this reason. According to Financial Services Commission data, reports of suspicious transactions by virtual asset exchanges are increasing, but the FIU’s analytical capacity has remained stagnant. The analysis rate—the number of cases analyzed compared with the number received—fell from 11.1% in 2023 to 0.88% as of September this year.

The FIU receives reports of suspicious transactions from financial institutions, analyzes the possibility of money laundering, and provides its findings to the police and other agencies. The analysis solution can trace the movement of virtual assets between wallets. The FIU plans to examine together the suspicious transaction reports submitted by virtual asset service providers and the transaction records, then provide agencies with specific information.

However, Senior Specialist Member Kwak expressed concern that most of the on-chain analysis solutions the FIU is considering are offered by foreign vendors. In particular, because these solutions operate through externally connected cloud services (SaaS), there is a risk that investigative secrets could be leaked overseas. For example, if an analyst searches for the address of a wallet suspected of criminal activity in a foreign SaaS search bar via an external internet connection, the private vendor’s servers would record in real time which wallets and suspected funds the FIU is analyzing and tracing.

“There is a risk that critical national financial information and information linked to law enforcement agencies could be leaked externally,” Senior Specialist Member Kwak noted. He also said that, because the solution itself would operate under the control of a foreign private vendor, the system could be affected by server outages or security incidents. “There may be limits to ensuring data sovereignty, so effective alternatives, such as measures to secure data transmissions, must be presented,” he said.

He also criticized the FIU for preparing its budget based on a single quotation from one vendor. “There was no process to assess the substitutability of other companies’ products, obtain multiple quotations, or survey market prices,” Senior Specialist Member Kwak said. The FIU’s budget estimate named a proprietary product from blockchain data analytics company Chainalysis. The FIU explained that it did so because Chainalysis has a high market share in on-chain analysis of virtual assets.

However, Senior Specialist Member Kwak countered that the Enforcement Decree of the Act on Contracts to Which the State Is a Party does not recognize simply having a high market share as grounds for designating a specific product through a negotiated contract. He also pointed out that drawing up a budget with a particular company in mind could lead to product specifications being designed around that company, restricting competitors from entering the market. “When pursuing the project, the FIU should obtain multiple quotations from at least two companies and the results of a market price survey to strengthen the basis for calculating project costs and expand opportunities to participate in the bidding,” he recommended.

This content was produced with the assistance of AI translation services.