ICE, Directive: HSI 18-04 Seizure and Forfeiture of Cryptocurrency - Aug. 16, 2018

U.S. IMMIGRATION AND CUSTOMS ENFORCEMENT HOMELAND SECURITY INVESTIGATIONS HSI Directive 18-04: Seizure and Forfeiture of Cryptocurrency August 16, 2018 Issue Date: Effective Date: August 16, 2018 Superseded: Federal Enterprise Architecture Number: 306-112-002b None. 1. 2. Purpose/Background.

Cryptocurrency seizures and forfeitures have become increasingly common in U.S. Immigration and Customs Enforcement, Homeland Security Investigations (HSI). Cryptocurrency is an encrypted, decentralized digital currency or asset that can be bought, sold, and traded for U.S. dollars or other currencies, and used as a medium of exchange to purchase goods and services. This Directive provides HSI field offices with guidance regarding the seizure, handling, tracking, and final disposition of all forms of cryptocurrency. Policy.

It is the policy of HSI to ensure that all cryptocurrency seizures are handled in a consistent and secure manner that mitigates the Government’s liability and protects all parties’ interest in the asset. This Directive establishes the roles and responsibilities related to the seizure, custody, storage, and disposition of cryptocurrency. HSI field offices are required to follow the guidance provided in this Directive in investigations that involve the seizure and forfeiture of cryptocurrency. 3.

Definitions. The following definitions apply for the purposes of this Directive only: 3.1. Address. A string of alphanumeric characters that is transmitted, unencrypted, to a destination or storage location for digital currency (also known as a public key).

3.2. Altcoin. All cryptocurrencies other than Bitcoin. 3.3.

Anonymity Enhanced Cryptocurrencies (AECs). Cryptocurrencies that use integrated technology, such as mixers and tumblers, to enhance anonymity and obscure virtual currency addresses and transactional history. This type of cryptocurrency can be utilized for the specific purpose of eluding law enforcement. 3.4.

Bitcoin. A type of decentralized cryptocurrency that can be bought, sold, and traded for U.S. dollars or other currencies, and used as a medium of exchange to purchase goods and services. Bitcoin was launched in 2009 to provide a method for processing financial transactions securely without the use of a central authority or traditional banking system. Bitcoins can be identified by the abbreviations BTC and XBT.

3.5. Blockchain. A public ledger of all transactions for a digital currency. _____________________________________________________________________________________________ Seizure and Forfeiture of Cryptocurrency 2 3.6. Centralized Exchanges.

Digital currency transactions performed under the authority of a single figure, group, or platform. 3.7. Cold Storage. A data storage method that is not directly connected to a computer or alternate processing unit (also known as “offline wallet” or hardware wallet).

3.8. Cryptocurrency. A type of decentralized digital currency or asset that can be bought, sold, and traded for U.S. dollars or other currencies, and used as a medium of exchange to purchase goods and services. 3.9.

Cryptocurrency Exchange Platform. A business that allows customers to buy, sell, and trade digital currencies. Exchange platforms have also been identified as Money Services Businesses and are required to be registered by the Financial Crimes Enforcement Network (FinCEN), unless a limitation to or exemption from the definition of “money transmitter” applies.1 3.10. Decentralized Exchanges.

Digital currency transactions performed absent the authority of a single figure, group, or platform. 3.11. Digital Currency. A centralized or decentralized digital representation of value that is issued by neither a central bank nor a public authority but is accepted by persons as a means of payment or is exchanged based on its value and can be transferred, stored, and traded electronically.

Virtual currency and cryptocurrency are types of digital currency. For the purpose of seizure and forfeiture, HSI treats digital currency as high-risk tangible property. 3.12. Fiat Currency.

Refers to currency authorized or adopted by a government as a part of its currency (also known as legal tender or money). 3.13. Liquidation. The process of converting digital currency into fiat currency.

3.14. Mixers. Cryptocurrency mixers are special services used to obfuscate transaction trails, maintain privacy, and/or mask illicit activity (also known as “tumblers”). 3.15.

Offline Wallet. A wallet used to securely store unused digital currency offline from a connected network (also known as cold storage). 3.16. Online Wallet.

A digital wallet used to store unused cryptocurrency on a connected network, whose private keys are controlled by a third party (also known as a “hot wallet”). 1 FinCEN’s regulations provide that whether a person is a money transmitter is a matter of facts and circumstances. The regulations identify six circumstances under which a person is not a money transmitter, despite accepting and transmitting currency, funds, or value that substitutes for currency. Title 31, Code of Federal Regulations (C.F.R.) Section 1010.100(ff)(5)(ii)(A)–(F). _____________________________________________________________________________________________ Seizure and Forfeiture of Cryptocurrency 3 3.17.

Private Key. A digital code (key) which is encrypted and only known by the intended recipient or owner. The private key is used to “sign” an outgoing transaction. 3.18.

Public Key. Half of an asymmetric key pair represented as an address. Each public key has a corresponding private key. 3.19.

Screenshot. A digital image copy of the screen of a computer monitor, telephone, or other visual output device (also known as a screen capture or screen grab). 3.20. Recovery Seed.

A list of words which store the information needed to recover a cryptocurrency wallet (also known as a mnemonic phrase). 3.21. Virtual Currency. A type of centralized or decentralized digital currency having a medium of exchange that operates like currency.

3.22. Wallet. A software application or other mechanism used to manage addresses and conduct transactions with a digital currency. A wallet is also used for holding, storing, and transferring a digital currency.

4. Responsibilities. 4.1. 4.2.

4.3. 4.4. 4.5. 4.6.

4.7. 4.8. The Executive Associate Director of HSI is responsible for the oversight of the policy and procedures in this Directive. The Deputy Assistant Director, Investigative Services Division, is responsible for ensuring the implementation of the provisions of this Directive within HSI.

The Unit Chief, Asset Forfeiture Unit (AFU), is responsible for implementing the provisions of this Directive within HSI. The Special Agents in Charge are responsible for implementing the provisions of the Directive within their respective areas of responsibility. Special Agents (SAs) are responsible for complying with the provisions of this Directive. The United States Marshals Service (USMS) provides “cold” storage for Bitcoins.

The Fines, Penalties and Forfeitures Office (FPFO) is responsible for processing seized and forfeitable cryptocurrency and “cold” storage of altcoins. Seized Property Specialists (SPSs) are responsible for the temporary storage of seized and forfeitable cryptocurrency. _____________________________________________________________________________________________ Seizure and Forfeiture of Cryptocurrency 8 Legal Status be documented on an in ”). Altcoins obtained through abandonment should status code. and use the SAs must contact their local CBP FPFO to initiate the Administrative Forfeiture process Altcoins obtained through abandonment using DHS Form 4607, Notice of Abandonment and Assent to Forfeiture of Prohibited or Seized Merchandise, must also undergo the Administrative Forfeiture process administered by CBP FPFO. SAs are responsible for coordinating cases among the AUSA, the local FPFO, and OPLA.

Upon forfeiture of altcoins, SAs supporting documentation deemed applicable. with a forfeiture order and any other the liquidation of forfeited altcoins held by USMS in cold storage. USMS will conduct periodic auctions to sell altcoins. Proceeds from the sale of altcoins will be deposited into the TFF and credit applied to HSI. 5.6.

Returning Altcoins to Defendant or Claimant. In the event that altcoins are to be returned to a defendant or a claimant, the SA will transfer the altcoins to the defendant’s or claimant’s wallet. Altcoins held by USMS will be transferred back to HSI. The SA must then transfer the altcoins to the defendant’s and/or the claimant’s wallet.

In both instances, the SA must provide the following information: 1) Incident number; 2) Authorizing document; 3) Associated USMS public key; 4) Exact number of altcoins to be returned; 5) Public Key of agency wallet where the altcoins are to be transferred; and 6) The date of return. 5.7. Local Liquidation of Seized Cryptocurrency. local liquidation of altcoins held in cold storage by CBP FPFO (for example, in accordance with a pre- forfeiture court ordered sale or consent to liquidate). Local liquidation, conversion of cryptocurrency and/or use of alternate disposal methods (such as the use of a cryptocurrency exchange platforms) must be approved by the AFU Unit Chief.

Proceeds from the sale of locally liquidated altcoins will be deposited into the TFF and credit applied to HSI. _____________________________________________________________________________________________ Seizure and Forfeiture of Cryptocurrency (b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)(b) (7)(E)