Facebook made a splash in October 2021 when it rebranded itself to Meta and announced an investment of $10 billion to create its own metaverse project. But the tech giant is just a drop in a larger ocean. It is estimated that over 160 companies, including Apple and Google, are also plunging into the current craze. New technologies foster new opportunities – a circumstance well known to criminals.

Metaverse cryptocurrencies

In the metaverse, users assume an avatar of their creation and are placed in an online 3D world shared with thousands of other individuals where they can build, create, sell, and trade as if living in a real-world economy. These economies are fuelled by the games’ own cryptocurrencies (such as Decentraland’s MANA and The Sandbox’s SAND) which can be traded for fiat money through popular crypto exchanges such as Binance or Coinbase.

Non-fungible tokens (NFTs) are the primary revenue model for metaverse games and include any in-game items created by the users – from vehicles, to skins, to even property.

Metaverse platforms such as The Sandbox and Decentraland have already garnered an impressive number of members. In 2021, the top 10 virtual platforms amassed roughly 470 million monthly active users with Roblox taking the first spot with 200 million monthly participants. According to Statista, the metaverse market size for 2021 was at $38.85 billion while Bloomberg predicts that it could reach a global revenue of $800 billion by 2024.

Metaverse virtual platform

These unregulated virtual worlds are prone to a variety of crimes such as fraud, money laundering, and identity theft, amongst others. As the industry keeps growing, so is the risk of illegal activity.

Top 5 industries investing in the metaverse

How will NFTs be used for money laundering in the metaverse?

In February 2022, The U.S. Treasury Department published a study detailing how NFTs present a potential money laundering challenge. The lack of geographic distance and the ease with which one can purchase a digital item is what makes this new art form attractive to criminals. The metaverse, with its complex financial systems, could add a veil of obscurity to illicit NFT transactions.

Metaverse transactions

The relationship between financial crime and online games is well documented. In 2013, cybercrime analyst Jean-Loup Richet released a study where he demonstrated how microtransactions in online games are attractive to crooks due to their discreet nature. This is because detection systems used to flag suspicious transactions usually skim over smaller flows of money in favor of larger ones.

The danger of the metaverse is that criminals could inject their ill-gotten funds into the games to buy/sell small NFTs, such as clothes or accessories, through repeated microtransactions. This form of self-laundering, also noted in the study of the U.S. Treasury Department for NFTs in the art world, would require no cost of travel, shipping, or other financial expenses that instead would incur with real-world items.

Property, such as houses and buildings, are also considered as NFTs within the games. According to MetaMetric Solutions, sales of metaverse real estate topped $500 million in 2021 and could reach $1 billion in 2022. In December 2021, a player acquired a virtual land plot in The Sandbox for a staggering price of $4.3 million.

Metaverse housing and property
That same month, China’s People’s Daily newspaper warned how metaverse property sales mirrored “product financialization” prone to fraud and money laundering. Criminals would not need to dabble with the complexities of purchasing real estate through lawyers and notaries. All they would need is a computer and an internet connection that could allow them to enact classic real estate money laundering schemes with just a few clicks or touches.

Can theft be carried out in the metaverse?

Metaverse cybersecurity
Theft in online games can lead to a variety of financial crimes, including fraud, extortion, and scams. Cybersecurity giant Kaspersky and market research company Savanta reported in their 2020 “Generation Game” that out of the 5,031 gamers that were surveyed worldwide, 12% had their identity stolen through an online game and 18% reported stolen in-game valuables.

When it comes to metaverse platforms, the situation is no better. In 2021, metaverse companies encountered 40% more human attacks and 80% more bot attacks than any other type of business, according to cybersecurity firm Arkose Labs.

The theft of a user’s identity or NFTs can lead to, but is not limited to, loss of personal information (including physical addresses, phone numbers, email, crypto wallet information, etc.) that can result in impersonation, loss of cryptocurrencies, ransom of in-game items, property, and avatar, and use of avatar for money laundering or fraud purposes.

Metaverse personal information theft

In a report titled “The Future of Financial Crimes in Metaverse Report 2022,” blockchain analysis provider Elliptic found that at the moment 99.5% of illicit activity linked to MANA and SAND involved crypto asset thefts.

Arkose Labs state that, “With highly persistent attackers and high stakes, companies investing in the metaverse must put a premium value on trust & safety at login, registration, and in-platform actions to protect digital identities in their virtual worlds.”

Hackers in the metaverse

How could terrorist financing happen in the metaverse?

In a speech published in December 2021 in China’s Caixin newspaper, Gou Wenjun, director of the Anti-Money Laundering Monitoring and Analysis Center in the People’s Bank of China, listed terrorist financing as one of the major threats that digital assets pose in the metaverse.

Metaverse terrorism

The risk is that metaverse games could turn into virtual factories used by terrorist groups to churn out digital material for profit. NFTs can easily be created and sold to users who are unaware of the destination of the funds. This could also be done with property and land.

While this has yet to spill over to the metaverse, the use of NFTs by terrorists have already been spotted. Kharon, a risk data and software solution company, found that an advocate of the Russian Imperial Movement – a white supremacist group – had listed an NFT for sale on OpenSea to raise crypto for the support of Russian fighters in Ukraine.

The metaverse wouldn’t only offer opportunities for raising funds. The National Counterterrorism Innovation, Technology, and Education Center in Nebraska see a dark side to the metaverse where extremists can use the virtual worlds to exert influence, recruit, threat, coerce, and coordinate attacks for the real world.

Metaverse crime

The Facebook Papers showed that the platform [Meta’s Horizon Worlds metaverse project] can function almost like a turn-key system for extremist recruiters and the metaverse would make it even easier to perpetrate that violence.~ Karen Kornbluh, Director of the German Marshall Fund’s Digital Innovation and Democracy Initiative and former U.S. ambassador to the Organization for Economic Cooperation and Development.

Are metaverse platforms regulated?

There is currently no local or international legislation concerning metaverse worlds. The closest regulatory guidance comes from the FATF in an interpretive note added to Recommendation 15 in June 2019. It describes the notion of a virtual asset service provider (VASP) which is defined as a natural or legal person that conducts business or operations for or on behalf of another natural or legal person, such as the exchange between one or more forms of virtual assets or safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, amongst other activities.

What is a VASP

In July 2022, the European Parliament proposed a series of “compromise amendments” to European money-laundering laws to tackle financial crime targeting cryptocurrencies, NFTs, DeFis, and the metaverse. The draft of the legislation is yet to be voted by lawmakers. The European Parliament has acknowledged that the metaverse “offers new opportunities for criminals who can convert cash acquired through illegal activities into non-traceable currencies to purchase and sell virtual real estate, virtual lands and other high-demand good.”

Most metaverse platforms also don’t have KYC processes of their own and leave the verification of their users to third-party NFT and crypto wallets which are used to store a user’s cryptocurrencies. Other platforms require minimal documentation, such as an IRS form W-9 (for U.S. taxpayers) or W-8 (for non-U.S. taxpayers) in the case of Roblox’s users that want to exchange fiat money for Robux and vice-versa. The Sandbox on the other hand has recently announced that it will introduce KYC authentication for future land sales. There are no details on how the process will be carried out.

What will the metaverse hold for compliance professionals?

Metaverse platforms are currently still in their infancy, but the technology is poised to expand at a rapid pace. Gartner, a technological research and consulting firm, estimates that by 2025 around 25% of people will work, transact, and live in the metaverse for at least one hour per day.

As the industry grows, so will the risk of crime in virtual worlds. Nina Jane Patel, a metaverse researcher and consultant, believes that underground criminal metaverses could become a reality in the future. In an article in Vogue she states that, “much like the internet, there will be dark metaverses, niche metaverses and a wide range of digital spaces for humans to engage.”

However, not everything in the metaverse will be crime-related and most of the activities will be used and enjoyed by common individuals in a legal manner. But just as NFT and crypto industries are currently being scrutinized and regulated, there will come a time when metaverse platforms will face the same destiny.

Metaverse user

This will open a new industry for compliance and AML professionals where their expertise will be needed for financial crime screening, customer due diligence, and other tasks that have been primarily relegated to financial institutions. New technologies don’t only foster new opportunities for criminals, but also for compliance specialists.

Add your comment

Related articles

What is adverse media in AML? Learn what sources can be used to detect negative news and what the future is in store fo...

Know your Customer Sun 31 January 2021

As PEPs are a controversial topic in the banking sector, it is important to conduct enhanced due diligence to minimise t...

Compliance Wed 28 December 2022

How can financial institutions detect coronavirus related financial crimes? Learn tips and tricks to identify scams, fra...

Money Laundering Tue 21 April 2020

Transaction monitoring is a vital component of the internal control measures of obliged entities regarding the preventio...

KYC Mon 16 December 2019
Experts in risk management and regulatory compliance

Pideeco is a consultancy firm providing legal services, business solutions, operational assistance and educational material for professionals in the financial industry.

We are based in Brussels and we specialize in regulatory risk compliance services covering the Eurozone.

Pideeco combines professional Regulatory knowledge and technical expertise to safeguard your business’ reputational and operational risk. Our unique customer-centric approach helps us build strategical and legitimate cost-efficient remedies.

Working with us means reaching out to complementary people, allowing for original thinking and innovative vision.

Our Network Learn more about us