5 Risks the CIT Industry Faces in Crypto Transportation

By Lowers & Associates,

Custody of cryptocurrency in transit or in storage poses some specific risks that differ somewhat from the usual high-value small sized items, like jewelry. Cash in Transit (CIT) service providers will have to adjust security routines to take these differences into account.

By definition, providing transportation or storage of crypto means that it is in “cold” storage, meaning that it is offline — there is an air gap between the crypto and the Internet or some other digital network. Given that cryptocurrencies are always stored in digital files means that access to them is controlled via strongly encrypted “private keys” using 128-bit encryption generated by a “wallet” (a storage file).

Some risks carriers and vaults must take into account for secure custody of crypto include:

1. Items in custody come in small, somewhat fragile packages.

Even if the digital asset is worth millions of dollars, it can reside on a device the size of a thumb drive. The private key may be written on a piece of paper. Obviously, either of these would be easy to slip into a pocket, and neither weighs more than a few ounces. Packaging and handling have to take into account how easily these items can be damaged, as well as maintain an absolute lack of description of the contents to the casual observer.

2. The device is vulnerable.

The digital asset that the CIT or vault provider is responsible for will reside on some kind of electronic device that is capable of memory, and has a way to input the private key. The binary code that describes the asset contains its value, as well as the identity of its private key. Both of these are critical to access the value, and if either is lost, the value is permanently gone—it will be impossible to recover. Devices like this may be vulnerable to electronic or magnetic disruption, either by accident or intention, so CIT services have to be sure the files are not exposed to damaging fields.

3. The identity of the asset owner may be unknown.

Digital currencies were created in the first place to do away with the need for the regulations and controls imposed on fiat currencies like the US dollar. One standard control on ordinary currencies is the Know Your Customer(KYC) requirement. For crypto, where anonymity is a design feature, not a flaw, the custodian has the potentially large liability for criminal or terrorist activity if it does not know something about the identity of the asset owner(s). This information will have to come through procedures, not regulation requirements.

4. The carrier may not know the value of the currency they are responsible for.

Crypto carriers know Anti Money Laundering (AML) requirements, such as suspicious activity reporting, for values of any size. If custodial procedures depend in part on the value of the item, then determining that value is a critical matter. Beyond the ability of an owner to insure the item (whose risks must be known), the custodian is exposed to loss based on the value. This is a precarious situation.

5. Crypto requires unique access procedures that the custodian may need to help facilitate.

Custody of crypto means that there will always be two entities to protect: the digital file containing the currency, and a record of the private key, which may be physical. Since these two items can never be carried or stored in the same place, all of the risks described above apply to two complimentary assets that have to be brought together to access the value in the currency. This in itself creates the need for procedures to coordinate access in a way that ordinary items do not.

 In general, custody of digital currencies takes place outside the financial system framework that regulates business as usual in CIT businesses. For more information about the sources of risks of crypto and policies for addressing them, see our new white paper, Custodial Crypto: Transportation and Storage.

[Slideshow] CIT Carriers: Emerging ITM Program Risks

By Lowers & Associates,

Interactive Teller Machines (ITMs) present a win-win for customers and banks alike. These machines offer new levels of automation, allowing banks to efficiently deliver a wide range of banking services. ITMs free up teller lines for higher level services, allowing customers to take care of basic needs on their own. ITMs bring new levels of convenience for customers who are increasingly comfortable with digital banking services.

ITMs also open up new opportunities for CIT carriers who are able to step up to the demands of servicing a more complex machine. That said, the details of ITM servicing cause concern and complexity. Consider the placement of the ITMs. While convenient for customers, their placements often put carriers at increased risk of attack. Not to mention the time it takes to service an ITM, which is significantly longer than a traditional ATM. These longer service windows also add to a carrier’s risk.

Our latest slideshow resource sheds light on emerging risks CIT carriers face as they look to expand their banking relationships to handle ITM servicing.

Flip through the presentation here:

  Category: Cash In Transit
  Comments: Comments Off on [Slideshow] CIT Carriers: Emerging ITM Program Risks

[Infographic] The State of Violence in the CIT Industry

By Lowers & Associates,

Robberies of armored CIT vehicles are a real risk faced by companies and their drivers. Violent robberies, which involve physical assault, guns, chemical sprays, and even murder, are quite another. Violent robberies are on the rise and have become a prevalent concern for armored carriers, even more so than in banks. The phenomenon is profound: while violent bank robberies occur in only 3.5% of all robberies, 49% of armored car robberies involve a violent act.

Armored car operators and personnel face a dual threat, as both the number of robberies and the presence of violence are on the rise. Strides have been taken to address these safety concerns, including the Hobbs Act, which establishes armored car robbery as a federal crime. However, findings indicate that this legal amendment has failed to deter the most violent criminals.

It is paramount for CIT operators to proactively address this rising threat. In our latest infographic, we present the most up-to-date research on armored car robberies and offer 8 ways to combat the threat of violent robberies.

  Category: Cash In Transit
  Comments: Comments Off on [Infographic] The State of Violence in the CIT Industry

3 Essential Loss Prevention Controls for Cash Service Vendors

By Mark Lowers,

In today’s integrated financial services system, Cash-in-Transit (CIT) service providers face new challenges in theft and fraud prevention. Traditional approaches to internal controls may leave risky gaps where CIT vendors and their banking customers intersect. Upgrading—and redesigning—these controls so that partners interpret outcomes accurately, and in the same way, is necessary to raise the adequacy of protections against theft and fraud risks.

The Office of the Comptroller of the Currency (OCC) has made it clear that banking institutions are ultimately responsible for the risk management performance of the third party cash vendor services they purchase. Banks cannot simply offload risks to vendors when they outsource traditional banking services. … Continue reading

Cash Auditing and Compliance in a New World

By Mark Lowers,

The banking industry has undergone significant and historic change since the financial crisis of 2008. The Dodd Frank Wall Street Reform and Consumer Protection Act created heightened expectations and new regulations for financial institutions.

This, in turn, has created the need for additional levels of oversight within the financial institution itself. However, it isn’t just financial institutions that are feeling the impact. Third party service providers of financial institutions, including armored carriers, are being impacted as well.

Historically, by outsourcing cash vault operations to CIT companies, financial institutions were able to pass along many of their risks and cost burdens. Today, the Office of the Comptroller of the Currency (OCC) makes clear that banks are expected to practice effective risk management “whether the bank performs the activity internally or through a third party” and goes on to say that “A bank’s use of third parties does not diminish the responsibility of its board of directors and senior management to ensure that the activity is performed in a safe and sound manner in compliance with applicable laws.”

Furthermore, the OCC has identified significant potential for gaps in risk mitigation and compliance, which has brought more focus on auditing procedures. … Continue reading