Swiss Secrecy Redux? Medieval Zug Bets on a Cryptocurrency Future

LAGOS (Capital Markets in Africa) In May a devastating computer virus called WannaCry locked up the systems of carmakers, train operators, and even hospitals. The hackers demanded users pay to get their data back with the digital currency bitcoin. Some did, and when the cyber extortionists needed to swap tens of thousands of dollars worth of bitcoin in August, they turned toShapeShift, a digital currency exchange based in the lakeside town of Zug, Switzerland.

Only part of the money was laundered before the transactions were spotted and shut down. ShapeShift declined to discuss the specifics of the case, but it said in a statement that it’s working with law enforcement and taking steps to ensure nothing similar happens again. Still, the event highlights one of the risks both Zug and Switzerland may face as the town tries to become a hub for the burgeoning cryptocurrency industry. Digital money could help the Swiss rebound from a decade-long assault on bank secrecy, but it also brings back questions about whether the country is luring illicit cash.

China cracked down on cryptocurrency exchanges in September, while the U.S. Securities and Exchange Commission said in July that sales of some new digital currencies would be subject to rules just as equities are. Switzerland’s more hands-off approach has helped Zug attract more than 20 bitcoin asset managers, brokers, and digital currency exchanges. It’s also home to theEthereum Foundation, the developer of an open-source platform used for many newer digital currencies.

With its cobblestone squares and 15th century clock tower, Zug doesn’t scream innovation. But over the years it’s proved savvy, attracting hundreds of companies there with local corporate tax rates that are among Switzerland’s lowest. In May 2015, after a briefing from a bitcoin entrepreneur, Zug Mayor Dolfi Mueller sat down with fellow councilors at a pizzeria to discuss what role the town could play. One suggested Zug begin taking bill payments in bitcoin. Mueller contacted digital asset manager Bitcoin Suisse AG, and within weeks the cashier’s desk at city hall had a system in place to begin accepting payment of utility and other local bills. “It was a message to say, ‘We are open-minded,’ ” Mueller says from his oak-paneled office overlooking the clock tower.

A five-minute walk from the medieval city hall are the headquarters of Bitcoin Suisse. Its 20-plus employees work from a sparse apartment flanked by wall-mounted screens flashing bitcoin prices and bid-offer quotes. Niklas Nikolajsen moved to Zug from his native Denmark in 2013 to set up the company; by 2015, it was doing 13 million Swiss francs ($13.3 million) in trading volume a year. Now it’s closer to 300 million francs a month. That, he says, makes him an indispensable cog in the burgeoning bitcoin economy.

Unlike traditional currencies, bitcoin can be exchanged instantly across international borders without using banks. Transfers of bitcoin are recorded using blockchain, a decentralized ledger distributed across the internet. But to buy bitcoin or turn it into another currency, you still need middlemen such as Bitcoin Suisse. “If you need a quote for $20 million in bitcoin, there’s only one outfit that can do that, and that’s us,” Nikolajsen says. He sports a ponytail and an open-necked white shirt with bitcoin-logo cuff links, and around his neck is a medallion etched with a skull and top hat.

Most of Bitcoin Suisse’s business is in currency trading, but it’s also set up 12 bitcoin ATMs across Switzerland. In addition, the company has a growing side business helping Swiss banks take their first steps in the bitcoin market. One of its pioneering clients is Zurich-based Falcon Private Bank Ltd., which had its Singapore unit shut down over compliance failures tied to the scandal involving the Malaysian investment fund 1MDB. Nikolajsen acknowledges Falcon’s controversial past but says its client screening is now more rigorous. Urs Fehr, a Falcon spokesman, says his bank’s new product has received approval from Finma, the Swiss financial regulator, and describes it as “a very specific, high-risk offering for clients who wish to use their cash holdings to buy bitcoin.”

Bitcoin Suisse says it meticulously screens prospective clients and also relies on the blockchain’s log of past transactions. Each bitcoin produces an address for its owner—a pair of public and private keys made up of randomly generated letters and numbers. That helps the company vet a client’s history. “We can run different checks on bitcoin addresses used to help identify that someone is not about to become the next Silk Road,” Nikolajsen says, referring to the online black market the FBI shut down in 2013.

Bitcoin Suisse is a member of the Financial Services Standards Association, which audits its members to ensure they comply with Swiss anti-money-laundering rules. Bitcoin operators can choose this kind of self-regulation or be directly regulated by Finma. A large majority of cryptocurrency operators have opted for self-regulation, as far as the agency knows, a spokesman says.

Still, sceptics worry that the ease of moving bitcoin attracts bad actors, such as whoever was behind WannaCry. “The infrastructure is not in place to stop history from repeating itself,” says Candid Wueest, a threat researcher in Zurich at Symantec Corp., a cybersecurity company that has analyzed the ShapeShift incident. “I could see it as a potential growth market [for criminals], for sure.” The WannaCry hackers were stymied in their attempt to exchange their bitcoin, because they made one key mistake: falling back on the same generic address for repeated transactions. This triggered an alert in the middle of the night on the phone of Jonathan Levin, co-founder of Chainalysis, a software security company in New York. He picked up the phone and called ShapeShift and then law enforcement investigators in the U.S. and Europe who were monitoring the WannaCry attacks.

Finma announced on Sept. 19 it was shutting down unauthorized cryptocurrency provider E-Coin after the company accepted millions of francs in public deposits without holding a banking license. Ten days later, Finma said it was investigating several initial coin offerings, in which startups raise money by selling their own digital currency, because of concerns some were fraudulent. Chainalysis says almost 10 percent of the $1.6 billion invested to date in ICOs using ethereum has been by cybercriminals. The Ethereum Foundation didn’t respond to a request for comment. A Swiss lawyer who’s worked on digital currency issues says blaming the open platform for the cybercriminals who use it is unfair, like blaming a brickmaker for the collapse of a house with poorly laid bricks.

Oliver Bussmann, president of Crypto Valley, a Zug trade group that uses a nickname for the town, has been vocal about the need for regulation. The Swiss cryptocurrency industry will work with money only where there’s a clear record of who is moving traditional currency to cryptocurrency, he says. In other words, Switzerland can’t go back to letting people bury their financial secrets. “It has to be extremely transparent so that we don’t see another black hole like what happened a decade or two decades ago,” he says.