nonplusultradigital

BITTREX, KRAKEN, BINANCE, FTX: Lessons Learnt

looka_production_106714572 — Mon, 22 Jan 2024 07:18:46 GMT

BITTREX, KRAKEN, BINANCE, FTX. LESSONS LEARNT FROM RECENT EXCHANGE DEVELOPMENTS

A lot has been written in the last week about the very high-profile issues that crypto exchanges are facing. We have been writing and talking about this for some time now , so there aren’t too many surprises on our end. But let's go into a little more detail than you might have picked up from the headlines.

BITTREX: A USER’S EXPOSURE TO HIGH-RISK TAKERS

Bittrex announced its decision to wind down its operation last week, with all trading activities ceasing on the 4th of December, 2023. Bittrex was one of the original crypto exchanges, so many will have been surprised by this, but the decision follows a number of regulatory challenges and legal proceedings that the group has faced. Although Bittrex Global was headquartered in Liechtenstein, the decision to cease operations followed the decision to wind down its US-based subsidiary, Bittrex, around nine months ago.

Bittrex filed for Chapter 11 bankruptcy protection in May and reached a settlement with the SEC in August to pay USD 24 million in fines and interest. USD 24 million sounds like a lot of money, and I appreciate that not everyone will read into the details of this settlement. It involved approximately 116,000 instances of apparent violations across multiple sanctions programs (including Sudan, Syria, Iran, and Ukraine between 2014 and 2017), with the total transactions amounting to around USD 263 million, potentially leading to civil liability.

Maybe even less known is the fact that Bittrex also agreed to pay USD 29 million for willful violations of the Bank Secrecy Act in the USA. This investigation by FinCEN found that the exchange had not developed, maintained, or implemented an effective AML program, including monitoring transactions involving sanctioned jurisdictions. I’m not sure if I would have chosen to hold my assets on that exchange if I was fully aware of this, but users who want to gain access to these markets should also ask themselves the same question.

FTX: A USER’S SECURITY IS FAR BEYOND AN EXPOSURE TO COMPLIANCE RISK

When we are talking about the security of exchanges, though, we don’t need to focus purely on ‘AML’ and ‘Sanctions’. The issues go far beyond that. Let's think about the two largest trading platforms in the world over the last few months.

Starting with FTX is easy. In the insolvency proceedings for FTX, there were lots of critical issues identified with what the world had been told was a fully ‘regulated’ exchange (I’ve written separately about ‘ knowing your VASP ’). John J. Ray III, who took over as CEO following the filing for bankruptcy, provided the world with a quote that summarises this quite well:

“Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information as occurred here. From compromised systems integrity and faulty regulatory oversight abroad, to the concentration of control in the hands of a very small group of inexperienced, unsophisticated, and potentially compromised individuals, this situation is unprecedented.”

Why should a user trust a platform to hold its assets where there is simply no proper management of that business in place? Would you take a flight with a group of pilots who were not qualified or trained to fly a plane? Would you put your family on a bus with a 15-year-old driver who did not have a driving license? Would you put your savings onto an unregulated platform with people having control over those assets who simply did not know what they were doing? The FTX platform did not even maintain a list of bank accounts and account signatories or even look at the creditworthiness of the banking partners it was using; they did not maintain properly segregated customer asset accounts from their own balances, and there was no one to oversee and enforce the protection of those assets.

Look at the makeup of the board of Xapo Bank and the independent directors we have to challenge the management and executives of the business, and you would not be able to find a more stark comparison in the world.

BINANCE: IS THERE NOW RISK FOR BINANCE USERS WHO HAVE BEEN SERVICED OUTSIDE OF THE USA?

The Binance group are very different from this. They have agreed to a restriction on public statements and will not contradict their acceptance of the findings against them in the USA, or the facts in the Plea Agreement. The financial penalties they have accepted include the criminal fine of USD 1,805,475,575 (reflecting a 20% discount for partial cooperation and remediation) and an Order of Forfeiture totalling USD 2,520,650,588, which includes fees that they had collected from U.S. persons and proceeds from transactions involving U.S. persons and persons in Iran. What are the implications of this for the Binance group outside of the USA, where there has been no settlement, but we read about the mounting regulatory and licensing pressure on a regular basis. We don’t really need to dive into lots of details around the implications of all of this, but the question is really around whether people are fully informed about the counterpart they are using for their activities. Let me explain another good example of what I mean.

KRAKEN: AN EXAMPLE OF A WELL-KNOWN AND REGULATED GLOBAL EXCHANGE AND THE TERMS ON WHICH THEY SERVICE USERS.

The other large platform that has started to face action in the USA is Kraken, yet another very well-known exchange globally. Obviously, different customers from different parts of the world who are serviced by Kraken have different entities servicing them. Their ‘counterpart’ is almost always different. This is the same with Binance and most large platforms, which many see as the ‘same entity’, but in reality, they are not.

Let's use the example of American and Canadian customers serviced by Kraken. If you read the terms of service of the U.S. platform, you will see that assets are ‘ held by us for you.’ This basically means that Kraken is itself holding, safekeeping, and providing ‘custody’ of those assets for its customers. This is completely different from, say, NASDAQ or any traditional marketplace, which does not offer ‘custody’ of those assets. Why? Because (among other things) they are not regulated to do that.

Now, let's look at the position if you were a Canadian customer with your own separate relationship with ‘Kraken’ (in this case, a separate entity regulated in Canada). Here, the terms of service are quite different. Virtual assets held within your account are, ‘custodied assets and are held by us (Kraken) in trust for your benefit in a designated trust account at a Crypto Custodian or online in ‘hot’ wallets administered by us. Title to all Digital Assets you hold within your account remains with you at all times and does not transfer to us, except as provided herein.’

Quite different! If you scan further through the terms, you will see that a ‘Crypto Custodian’ is defined there as Anchorage Digital Bank, which is a federally chartered trust overseen by the Office of the Comptroller of the Currency, one of the U.S. federal banking regulators. Canadian securities regulators require all crypto exchanges to delegate at least 80% of customer crypto to a third-party custodian and require that the custodian is qualified to offer that service specifically.

I think people should ask themselves whether they are even aware of who their counterpart is when they think they are dealing with a ‘regulated’ exchange and what exactly that means. Go in with your eyes open, and if you are willing to take that risk, then that should be your choice, but why would you want to do that when there are other alternatives available?

A STARK CONTRAST AT XAPO BANK FOR EXPOSURE TO VIRTUAL ASSETS

Again, just to put this into stark contrast, under the Xapo terms, ‘Xapo does not obtain any legal or beneficial right, title or interest in your bitcoins that you store in your Xapo wallet.’ Under the Law and Regulation that applies to Xapo VASP, ‘Custodial assets and monies must be segregated from the [VASPs] own assets and monies.’

There are specific requirements around safeguarding and segregation that require customer assets to be ‘held separately,’ to be ‘clearly designated and easily identifiable,’ and to ‘not represent property of a [VASP] and to be protected from third-party creditors of a [VASP].’

Any custodian relationship would require us to obtain ‘formal acknowledgement that all virtual assets held by the custodian are held in trust and that the custodian is not entitled to combine the amounts with any others or to exercise any right of set-off or counterclaim against such assets in respect of any debt owed to the custodian by the [VASP].’ I’ll go beyond this to explain that Xapo VASP is also required to nominate one of its directors or senior management to be responsible for customer assets, which includes a separate governance requirement.

Xapo’s position is even more unique because even though we are not permitted to have any form of access to customer assets, we still pay 1% interest on up to 5BTC from our own assets , and at our own risk, with zero risk to the member. If you can find another VASP in the world that does this, please do feel free to write to me and let me know!

SUMMARY AROUND THE LESSONS LEARNT AND QUESTIONS THAT USERS SHOULD ASK THEMSELVES

There are lots of things that people who use exchanges to hold and custody their assets should consider:

Is the exchange actually regulated to provide a ‘custody’ service? Just because a platform is regulated as an exchange, or a transactional platform, it does not mean that it is regulated to provide safe custody for your assets.
Who is your actual counterpart, from which part of the world, and what are the rules that apply to that platform?
Does the exchange that you are using to hold your assets have a proper management and governance framework in place? Who are you trusting as the pilot of your plane, and do they actually know how to fly it?

‍

Are there alternatives that bridge the gap, allowing secure asset management in your bank account while interacting with the crypto space ? Yes, there are. We function as a regulated custodian, providing a seamless link between your bank account and crypto exchanges, ensuring your transactions are secure and governed properly.

Bridging between Banking services and Crypto

looka_production_106714572 — Tue, 31 Oct 2023 13:36:52 GMT

Xapo Bank: The Bridge between Banking and Virtual Asset Services

Yesterday's news that JPMorgan’s British retail bank Chase will introduce a ban on crypto transactions is just the latest step in the direction of travel around banks increasing pressure and restrictions around the interactions between the crypto market and the financial services space.

No one will need to be told about the general pressures which have developed on US Banks servicing individuals and regulated businesses from the space, and most will also be aware of the position taken by HSBC in August around the single transaction limits of £2,500 and the 30-day rolling limit of £10,000.

These changes were generally commented on as HSBC ‘ shooting itself in the foot ’, but there are also many other high street banks which have followed the same narrative with far lower thresholds, or simply not permitted payments to be made into or out of the crypto space. In February this year , statements from Alison Rose, CEO of Natwest Group told the House of Commons Committee that the bank was “blocking retail and wealth customers from transferring into crypto assets because of the volatility and stability of the platform.” The Chase announcement is another pointer to the direction of travel. So why has this happened and what are the solutions?

WHY BANKS SHY AWAY FROM CRYPTO

The reasons that these banks tend to cite are the risk of fraud and regulatory standards. Interestingly, most of the executives questioned by the House of Commons Committee saw potential in new rules being proposed by the sector. Charlie Nunn, CEO of Lloyds bank stated that the bank was “very supportive of the regulation and the regulators looking at regulation of crypto, our focus will always be about customer outcomes in that context.”

But arguably, if the objective is really to focus on customer outcomes, banks should be investigating and investing in the technology being used to manage this risk. They should also be seeking to provide their customers with a secure environment to gain exposure to these markets in the right way. Some banks seem to be starting to take those steps. Commerzbank in Germany has been reported as starting its licensing application to offer exchange and crypto asset services. DBS in Singapore already operates its regulated Digital Payment Token Exchange , but these are principally focused on institutional or high-net worth markets. Shouldn’t retail users also be given the same opportunity for secure exposure to the right markets, or even ways of moving the value of their assets from insecure or risky markets to solid and safe banking environments? Should your bank be justified in blocking access to entire markets that you choose to invest in, or providing you the security to exit those markets?

Let’s look at some of the data around how risky these markets are. Chainalysis reported that for 2022, around 0.15% of transactions in the crypto space involved an element of criminality with money laundering accounting for 0.05%. While the number of $8.6 billion relating to laundering activity sounds significant, let’s bear in mind that the United Nations Office on Drugs and Crime (UNODC) estimated around $2 trillion value for the same activity through the traditional finance system — around 232x the volume. Should banks be able to access high-value art markets, foreign property markets, and commodities markets, and completely restrict access based on the assessment of the bank, rather than the individual?

XAPO BANK. THE BRIDGE

Xapo Bank has approached this completely differently. We have created the most highly regulated Virtual Asset Service Provider (VASP) entity possible to allow our members to acquire interest in BTC. Better than that, we allow our users to earn a yield on the BTC they hold, at zero risk . Member BTC is completely segregated, we are fully audited, and deploy our own assets (not the member’s assets) to generate the return we provide to our users. There is no other platform in the world that does this.

We have also developed blockchain-based payment rails in USDC and USDT into your Bank account. This is the perfect bridging system between the security of a deposit guarantee insured USD Bank account, and a payment rail into, and out of the crypto space. Do we believe that there are risks in these markets, yes absolutely. But do we believe that there are processes, and systems that allow modern platforms to proportionately manage that risk, yes we do.

People often talk today about CBDC’s and the advantages of blockchain based infrastructure. But we are a bank that already offers this from a practical and modern perspective, for users that are attracted by the idea of a secure, solid infrastructure allowing them access to this developing asset class in the right way.

Federal Reserve Order: Is there a Heightened risk of Stablecoins? What is the impact and what are the solutions?

Tue, 04 Apr 2023 15:14:28 GMT

Federal Reserve Order: Is there a Heightened risk of Stablecoins? What is the impact and what are the solutions?

Shlomit Azgad Tromer and Joey Garcia

The recent order that many people have been examining over the weekend confirmed that the Fed has denied Custodia’s membership application, as well as its application for a master account. However, the order goes quite a way beyond this in an 86-page release , with the Fed detailing the "fundamental concerns" with Custodia's approach, many of which had related to its intent to issue stablecoins affiliated with the bank, and the nature of stablecoins issuance and trading. So what are the implications for stablecoins, stablecoin issuers and the industry more widely.

Among the main criticism points that have massive implications on stablecoins regulation going forward, the following points were highlighted:

● Lack of control for counterparty risks

● Lack of tools for suspicious activity monitoring and SAR issuance

● Lack of risk based approach tools to enforce policy tailored to specific user risk

● Transparency and how it correlates and supports potential runs

There is a question that immediately arises though. In an environment of rapidly evolving technology, are there no realms of ‘compliance innovation’ that would be able to deal with these concerns? Technology can be developed to provide new efficiencies, access to new markets and cross border payments infrastructure, but it can also be developed in the blockchain context to provide ‘on-chain compliance’ along with privacy controls that can easily address the concerns being raised and businesses like Sealance already run operating models of these systems. Focus on privacy and control of your own identify and data has become more and more of a focus point in recent times also. Are there systems that can protect a users data and privacy but allow stablecoin networks and the wider DeFi ecosystem to operate in a compliant and risk mitigated way? The answer is yes.

Summary of the Fed’s report :

Heightened Risk in Stablecoins vs TradFi

The risk factors which are highlighted and identified by the Fed can be briefly summarized as below but for a full review of the order, this is publicly available here .

● The ability to identify users and monitor transactions is central to mitigating ML/TF risks, but crypto-assets often afford their holders significant anonymity. Users may transact through unregulated or less regulated money services businesses in a country lacking a robust AML/Combating Financing of Terror (“CFT”) regime, and financial transparency may be further decreased by crypto-assets held by users in “unhosted wallets.”

● Trading in crypto-assets is often conducted pseudonymously either on a peer-to-peer basis or through facilitation by lightly regulated or unregulated intermediaries.

● Crypto-asset trading can occur globally, and there are few to no limits to Digital Assets. It can be very difficult or impossible to determine who is accessing or in control of the use of cryptocurrencies in an unhosted wallet. Unhosted wallets allow for anonymity and concealment of illicit financial activity.

● While a financial institution can require customer identification information in connection with a customer onboarding process (e.g., with respect to custody customers), it can be very difficult for a financial institution that is an issuer of crypto-assets to identify holders of such assets in circulation, unless holders of the asset are limited to identified customers only.

● A financial institution’s ability to limit the misuse of crypto-assets for ML/TF depends in large part on the internal controls in place at points where crypto-assets interact with the traditional financial system, such as when a crypto-asset is obtained by a user in exchange for national currency. Stablecoins, however, may reduce the need for crypto-asset holders to interact with regulated institution.

● While the financial institution that issued the stablecoin might have information on the transaction flows on the applicable blockchain, it would likely not know the identity of the transactors other than the initial purchaser and the ultimate redeemer.

● Without information about the transactors, it is extremely difficult for financial institutions to comply with AML/CFT requirements to identify suspicious activity and sanctioned parties, especially within mandated reporting periods.

● Payments to validators may include illicit actors or sanctioned entities. validators are pseudonymous and randomly selected, and transactors cannot select particular validators that have been identified or screened for sanctions risks.

Custodia’s Compliance Plans

The compliance plans which had originally been proposed by Custodia are summarised below. However, we cannot make any assumption or offer any guidance on this being a determining factor in the ultimate decision of the Fed as our understanding was in fact that Custodia had retracted the plans to issue its ‘Avits’ stablecoin to deal with any concerns. We are also not commenting on any other part of the order which goes into significant detail over 86 page document (14 time longer than the next longest Fed denial in history).

● Board of Directors compliance committee to report and escalate risks to the Board;

● Customer identification onboarding involving due diligence on purpose and source of wealth;

● Use of vendors to assist with automated customer screening and transaction monitoring;

● Compliance staffing and resources

● The program would include (i) the development and maintenance of comprehensive written policies and procedures that are tailored to its business model; (ii) designation of a compliance officer who has significant commercial bank BSA/AML compliance experience; (iii) ongoing training and education; (iv) independent review and testing; and (v) customer due diligence.

● For screening transactions for sanctions compliance, Custodia has indicated that it will (i) incorporate geolocation tools and IP blocking controls; (ii) implement screening of wallet addresses against those specifically listed by OFAC sanctions; (iii) implement screening of other IP or wallet addresses acquired in the course of the transaction; and (iv) employ blockchain analytics tools to identify and mitigate sanctions risks

● Custodia proposes a phased roll-out of services and would initially limit its offerings to certain customers and certain activities; for example, it does not intend to accept non-U.S. businesses and natural persons to be customers at the outset, in order to allow for the build-out of a program commensurate with associated risks.

● Furthermore, Custodia seeks to rely on blockchain analytics firms and other vendors to mitigate any gaps in traditional AML/OFAC controls

● Custodia has asserted that it will have the ability to freeze and seize its issued stablecoins in response to law enforcement requests and when a stablecoin is held by a “blacklisted” wallet.

Why the Fed believes this is Insufficient Compliance and what are the implications

The examiners identified significant gaps that indicated the bank has not yet established adequate AML and OFAC compliance. The more specific points are highlighted below but the implications of these kinds of determinations are implicitly much wider than Custodia, and are factors that will ultimately need to be considered by Stablecoin issuers and platforms, as well as the wider systems that are integrated with stablecoins.

Summary points:

● Examiners determined that the transaction monitoring systems for high-risk customers are insufficient and that the transaction monitoring processes are not risk-based or aligned with Custodia’s planned operations and risk profile.

● Furthermore, examiners found that Custodia’s policies, procedures, and processes did not allow for timely identification and reporting of suspicious activity

● Users would have the ability to make or accept transactions to or from non-Custodia wallets, which would not have undergone an onboarding process with Custodia

● Counterparty risk: due to the nature of pseudonymous blockchains on which Custodia will enable customers to transact with possibly pseudonymous or even anonymous non-customers. Non-customers will be able to hold its stablecoins and redeem them without undergoing the due diligence required for customer onboarding

Page 40 of the order contains the following quote:

“While these are issues that neither FinCEN nor OFAC has specifically addressed and though Custodia has offered to voluntarily monitor noncustomer transactions and file SARs, such issues do highlight the inherent risks and challenges associated with crypto-assets that need to be mitigated to ensure this activity can be conducted in a safe and sound manner”

So what are the ways that such risks can be mitigated and is this really necessary in an international context or not?

National Bank Permissibility and Risks

The permissibility of the issuance of “stablecoins” for national banks is subject to OCC Interpretive Letters 1174 and 1179. Three types of risks are emphasized in particular:

Counterparty Risks

● OCC Interpretive Letter 1174 states that stablecoin arrangements “should have the capability to obtain and verify the identity of all transacting parties, including for those using unhosted wallets.” Custodia’s proposal for issuing and redeeming stablecoins did not meet this expectation. The first party that receives stablecoins from Custodia and the party that attempts to redeem stablecoins with Custodia would be known to the bank. But any other person or entity, anywhere in the world, would be able to acquire or transfer stablecoins in the secondary markets without being known to Custodia, so long as the wallet to which the transfer is made has not been blacklisted due to sanctions concerns.This is of course, the same as all major stablecoins currently in issuance and circulation.

● Further, and due to the methodology of public blockchain to charge fees, both Custodia and holders of stablecoinss will pay transaction processing fees to unknown transaction validators. Again, this is the same as all major stablecoins.

Transparency and Risks related to Runs

On most public blockchains, the public is able to see tokens moving from one wallet to another, including as they are issued and redeemed. …the public would know when Custodia’s stablecoins are being redeemed in high or higher-than-usual quantities. This redemption transaction visibility could potentially increase the likelihood of a run on Custodia’s stablecoins, other deposit liabilities, or custodied assets (which could affect its fee revenue). While Custodia has said it will manage liquidity risks by keeping all the dollars backing stablecoins in a master account at the Federal Reserve if such an account is granted, history has shown that runs on any bank or financial intermediary have led to panic and contagion that spread to other banks and financial intermediaries.

Consumer Risks

Users could trade stablecoins on

● non-compliant exchanges;

● lend on crypto-lending platforms;

● and invest in decentralized finance protocols.

Each of these poses risks to stablecoin holders, as stablecoin holders engaging with these intermediaries and protocols may not be in a position to understand the risks they are exposed to, given that such intermediaries often do not comply with, or are not subject to, disclosure rules, conflicts of-interest standards, prudential regulation or consumer protection standards.

So how can these Risks be Addressed?

There are exciting new technologies that can provide blockchain-native compliance mechanisms that can be layered on top of any stablecoin. Platforms like Sealance allow for every stablecoin to create a compliant version (e.g., “sealed stablecoin”) that enforces jurisdictional policies while preserving the asset’s economic value and technological capabilities.

Sealance’s technology augments blockchains with additional information about actors’ identity and funds’ provenance, in a privacy-preserving way, and uses this information to automatically enforce regulatory compliance, risk management policies, transaction reporting obligations, and record-keeping policies on the blockchain in real-time. Policies are jurisdiction-specific and can be set by the pertinent government regulators, by self-regulating bodies, or by financial institutions based on their own risk tolerance. Since Sealance’s controls are not only tied to an asset holder but also to an asset itself, sealed stablecoins will always enforce their assigned regulatory and issuer-specific controls throughout their lifecycle independent of current and future asset holders and their jurisdictions, and independent of specific usage patterns.

Sealance ensures compliance without compromising the financial privacy and security of cryptocurrency users. While identities and other compliance-related information may be recorded on the blockchain ledger, they are cryptographically protected and not publicly visible. Instead, sensitive personal information (direct or derived) is visible only to authorized parties, subject to the predetermined policy.

The technology can absolutely technically permit any stablecoin to enjoy the following as augmented compliance controls on the asset itself:

Tailored risk-based approach

Nuanced risk-based policies that reason about multiple risk indicators particularly tailored for each user. Transaction blocking and alerting can weigh myriad criteria including identity attributes, the source of identity attestations, amount thresholds, past transaction history, activity patterns, and alert/block lists. These policies can reflect the regulatory mandates, augmented with the VASP own risk policies and tolerance, and can use data feeds such as customer records and existing chain analytics.

Suspicious Activity Reports

Compliance policies can also specify the mandatory generation of reports of suspicious or high-risk activity in accordance with FATF Recommendation 20 (SAR/STR), as well as CTR and CMIR reports, or other reports as defined within an organization. Sealance’s protocol ensures report generation in real-time, concurrently with the inclusion of the transaction in the blockchain. The policy determines what is included in these reports, and who can access them, limiting disclosure to authorized personnel only. Triggering conditions can include attributes of the parties, funds provenance, alert lists, and other red flags., such as:

● Abnormal transaction volume, whether within a single transaction or “structured” over multiple transactions. The threshold may be fixed, or dynamic and algorithmically-determined (e.g., relative to the total trading volume in that asset).

● Transaction activity not commensurate with the customer’s character or income (e.g., as ascertained during the KYC process associated with their wallet), or abnormal compared to their past activity (e.g., heavy activity in a previously-dormant account).

● The user’s account is already flagged as suspicious or high-risk, whether by algorithmic rules or at the discretion of authorized parties.

● Complex risk-based reasoning may include heuristics, data analytics, deductions, and machine learning. These decisions may reason about users’ information without revealing it.

Reports are policy-mandated, non-discretionary, and are issued in real-time, concurrently with the inclusion of the transaction in the blockchain. The policy determines what information is included in these reports, and who can access them within the pertinent law enforcement authorities within the jurisdiction.

Moreover, where reporting criteria are themselves sensitive or confidential, they can be protected from scrutiny; the transaction senders remain unaware of these criteria and whether a report has been associated with their transaction.

DeFi and Lending Participation

Solutions like Sealance allow the development of tools that allow asset issuers to continuously monitor and potentially charge transaction fees for client activity over DeFi. DeFi itself on the other hand is completely passive in our model. DeFi participants may rely on global identifiers, attestation and policies for internal risk management processes and regulatory-compliance processes. These policies will include the requisite assurances, such as robustness of identity attestations and ongoing sanction monitoring. However, compliance and policy are enforced by programmable smart contracts without needing to change the underlying protocol, and significantly, without exposure to regulatory SEC risks due to active identification and monitoring of clients.

Transaction Privacy

Critically, the right solutions also integrate privacy-preserving cryptographic protocols to protect transaction and user information. The sender, recipient, asset and amount for every transaction are private, and are only subject to selective disclosure to those authorized compliance agents at the asset issuer or at other specific authorized VASPs. Data, and deductions from it, are revealed only to authorized parties. The integrity of the data, and of mandated actions such as reports, is cryptographically ensured — without reliance on centralized, high-risk repositories of sensitive information.

Summary

The Fed has emphasized the particular enhanced risks presented by stablecoins. However, these risks are not inherent in the technology. The very same technology that allows for blockchain-based payments carries the ability to innovate compliance and financial regulation processes and modernize the current system used by banks. Implementing these innovative technologies, stablecoins can present a safer and more compliant alternative for users, and lead to a new era in blockchain-based financial regulation and secure standards.

Shlomit Azgad-Tromer is the Chief Legal Officer at Sealance, specializing in crypto compliance. She has previously served as General Counsel to Israel’s largest financial services corporation, Meitav Dash. She holds a Ph.D. in Law from Tel Aviv University, and has held research positions at Harvard, UC Berkeley and Columbia University’s schools of Law, working on financial regulation. Her scholarly work has been published in Harvard Business Law Review, NYU Law Review and American University Law Review, among others

Joey Garcia

A New Standard of Market Integrity for Crypto Asset Trading Platforms or Exchanges

Sat, 01 Apr 2023 19:08:15 GMT

A New Virtual Asset Legislation, Defining Standards for Market Integrity

What are the appropriate and highest standards for market integrity? What jurisdictions have followed the recommendations to consider this as a standard, or the IOSCO guidance, or what countries have simply taken existing standards applicable to classic exchanges in the financial services world?

Recognising the diversity of the assets and activities within the virtual asset marketplace we are happy to have managed the working group engaged by the Government of Gibraltar to develop new regulations setting the standard for market integrity in the virtual asset space.

The amending regulations add a 10th Regulatory Principle to Gibraltar’s Financial Services (Distributed Ledger Technology Providers) Regulations, requiring that all DLT Providers operating in Gibraltar conduct themselves in a manner which maintains or enhances the integrity of the markets in which they participate. Simultaneously, and maintaining consistency with the approach to the other 9 Regulatory Principles, the Gibraltar Financial Services Commission (GFSC) has published a Guidance Note which sets out its expectations of DLT Providers in this context. The guidance note can be viewed here: https://bit.ly/3vlKdld

The new regulations and Guidance were drafted by the GFSC and a specialist Market Integrity Working Group which I was happy to co-chair. The Group was made up of a combination of Government representatives and leaders in the blockchain and digital asset space, who were convened for the specific purpose of considering and crafting the legislation and guidance.

The content provides clear guidelines informed by industry and regulatory experts on the prevention of market manipulation and insider trading together with the creation of disclosure and trading standards.

Minister for Digital and Financial Services, the Hon Albert Isola MP, said, “Gibraltar continues to lead the way in defining standards in the virtual asset sector. As is the case with traditional markets, I have long believed that defining standards of market integrity would be required for the continued development and adoption of this industry. Like any other market, the virtual asset market must operate in a manner that is fair, orderly and efficient, whilst enhancing the levels of trust that firms in the regulated sector currently enjoy. We must ensure that we provide operators with a framework that enables them to maintain the same high standards as operators do in traditional industries. I am most grateful to our panel of experts who have played such an integral role in shaping this new legislation working together with the GFSC and to sector representatives for their invaluable contribution to the industry consultation process.”

Kerry Blight, CEO of the Gibraltar Financial Services Commission commented, “Since the introduction of the DLT regulatory framework in 2018, we have worked with government, specialist advisors and industry to refine our guidance and ensure it is suited to this rapidly developing sector, providing both regulatory certainty to DLT Providers and robust protection to their growing consumer base.

The Market Integrity Principle and Guidance Note further strengthen the framework. They introduce a number of key responsibilities, designed to enable firms to root out insider trading and other forms of market abuse, improve standards around disclosure and transparency, and ultimately safeguard the rights and interests of consumers."

Lee A Schneider, General Counsel at Ava Labs and member of Gibraltar’s Market Integrity working group said, “Market integrity is the next frontier for digital assets regulation, so we naturally see the authorities in Gibraltar taking a leading role in defining the core concepts in a practical fashion that furthers its existing regulatory regime.”

Joey Garcia who co-led the working group commented “It is great to see the standards for regulating the VASP space developing, and to see Gibraltar lead in setting standards, particularly when the FATF have cited market integrity and prudential requirements as factors that jurisdictions should consider when developing regulatory requirements for the space”.

Other members of the Market Integrity working group include: Emma Channing, General Counsel, Satis Group LLC; Joshua Ashley Klayman, Senior Counsel, Linklaters LLP; Roman Beck - Head of European Blockchain Center (University of Copenhagen); Jannah Patchay, Regulatory and Market Structure Advisor, Markets Evolution; Joey Garcia, ISOLAS LLP, Xapo, IOV Labs, Gibraltar; Tongtong Gong, Cofounder of Amberdata; Barbara Halasek, Coinfirm; Nicholas Philpott, Banking Market Structure expert.

Gibraltar’s is the world’s first purpose-built regulatory framework for DLT businesses and sets out a rigorous authorisation and supervisory process in line with Gibraltar’s vision for the highest standards in regulatory adherence. Since it was first introduced in 2018, Gibraltar has cemented itself as a leading jurisdiction for DLT firms who wish to operate in a regulated environment.

The wording from the above post was taken from the Government Press Release around the new legislation introduced.

USDC and Xapo Bank. Stablecoins to Banking and Xapo leading the way in bringing industries together

Wed, 15 Feb 2023 09:01:53 GMT

The Evolution of Technology. Consensus Mechanisms to Global Blockchain Based payment rails

Technology and technological infrastructure has continued to develop since the dawn of time. In the context of blockchain technology and the Bitcoin protocol people often talk about the Internet representing the dawn of the ability to share data and information, an internet of data, to the Bitcoin protocol representing a new ‘internet of value’ allowing for an efficient, cross border, scarce and immutable resource that can be shared and moved digitally and which are not subject to the control of any single or central authority.

But why don’t we also look at the history and ‘development’ of technology in this context quickly? It’s very interesting to think that ‘Consensus’ mechanisms were used by armies to arrange battles, wars, and attacks in ancient times. Cryptography played a critical role in World War 2 with the Enigma machine allowing information to be encoded, transmitted and shared in a new and secure way. We don’t just need to think about data sharing and consensus though. In a banking context, the creation of ATM machines in the late 1960s was revolutionary, and opposed by many who thought that Bank Tellers formed critical parts of a Bank’s relationship with its clients on the basis that they should be the only way for people to deposit or withdraw money from their accounts. Online banking was also opposed by many who thought that the ability to access your bank details through a computer was ludicrous and unnecessary.

What about the music industry? Many opposed the sharing of music files between users through at least a partly decentralised network in the 90s and early 2000s. Others embraced it and brought the unregulated Napster and Pirate Bay models into the ‘regulated’ environments of Spotify, Tidal, Amazon and Apple Music. Have other telecommunications networks remained steady? Not really. Skype brought around the ability for voice and then video communication through the internet, largely outside of legacy telecommunication channels.This has developed into many other platforms and services where we efficiently communicate through Whatsapp, Signal, Wechat, etc with people all over the world.

So what about payment networks? Have these networks and technologies evolved at the same rapid pace? Arguably not. The Fedwire was developed in 1918, while the core bank software FIS was released in 1968. Fiserv was released in 1984 and TSYS in 1983. The SWIFT correspondent messaging was developed and launched around 1973 and you’d have to go back to around 1970 for the CHIPS large value settlement system release. Has payments technology not evolved because it’s simply already so efficient that it doesn’t need to? Or is it because of the weight of those legacy frameworks and the infrastructure that they support simply not being able to adapt?

‍

Stablecoins and their role today

In all of this context, one of the most interesting developments of the use of blockchain technology has been in the ability to support ‘Stablecoin’ developments. These are developments that facilitate immediate, efficient, cross-border, secure and almost costless payments networks. Why would I always want to pay a 3-7% fee when I send money to someone just because they are in another country or continent, when there is simple and globally accessible technology, that would allow me to do that from my own mobile phone immediately at almost no cost (regardless of the value of the transaction)? The development of stablecoins facilitates quite a bit beyond that. They are the most relevant medium of exchange in the digital assets and markets space and in the new and developing world of decentralised finance, where direct access to banking support for largely unregulated and software based services can be impossible to achieve. This is essentially what has led to the growth in the market cap of Stablecoins in circulation from around $29 billion in 2021, by around 450%. Why? Well this goes back to the core principles of any market in the world of supply and demand for the technology, infrastructure and networks.

Of course, challenges still exist around the concepts of stablecoins which I will not go into here. Is it the issuer of the stablecoin or the actual asset which is controlled, regulated or subject to standards. How are the reserves of the backing of a stablecoin allowed to be used? Does this fall outside of any standards or requirements to the extent that it is not really known how stable the stablecoin actually is? What are the techniques for stabilisation and are algorithmic based techniques fully understood, audited, collateralised or imperfect enough to put them in the UST risk category?

Xapo Bank and Stablecoins

At Xapo Bank the question of security is fundamental and Xapo went through a comprehensive analysis before beginning to offer the integrated services with the Circle USDC Stablecoin that is operational today. But why did we do this? Well, Xapo Bank was one of the original members of the Diem Association (historically known as Libra) with our Chairman Wences Casares sitting on the Board of that Association. I acted as the Diem Representative for Xapo during that extremely interesting time. Whatever views anyone has on that proposed stablecoin payment network backed originally by Meta (previously known as Facebook), it raised important questions for authorities and policy makers around the world around the technology and how it needs to be considered. It was, at least in part, an accelerator for many regulatory developments around the legal frameworks being designed to deal with stablecoins, and also for the discussions around Central Bank Issued Digital Currencies or CBDC’s.

‍
Stablecoins<>CBDCs. What’s the difference?

Are there any differences between CBDCs and Stablecoins and will Stablecoins come to an abrupt end on the release of CBDCs? I strongly believe that they will not. This paper by our friend Dante Disparte is excellent and highlights a few key differences between the two which are interesting to read if you have the time. Fundamentally stablecoins built on open source can operate to act as a low cost global remittance facilitator and as the key interactive tools between the fiat world (in our case Xapo Bank) and the developing blockchain ecosystem, or Web3 universe. CBDCs will with almost no doubt take advantage of the features of digital and ‘programmable money’ so factor in balance limits (how much currency can anyone hold), geographic scope (will CBDCs be locked to geographic regions, countries or territories?) and what will be the core use cases that they exist to serve? Pure inter-bank efficiencies or retail use? I’m also not particularly convinced that traditional banks will race to provide even simple digital wallet services to allow customers to own and take control of their own CBDC’s anytime soon at all. Nor will they allow for such digital currencies to fully interact with a global developing internet based ecosystem. I could be wrong of course but let’s see.

Xapo Bank. Bringing together the old and the new

Regardless of any of this, there is no question that the world wants to develop and take advantage of the efficiency of developing technology as we have done throughout our entire history. At the same time, there is little doubt that people want to protect and conserve their savings and assets in a secure way, and hundreds of years of the development of banks and credit institutions provide that base layer of protection. So how can the two be married together and will that ever happen? Some like VISA have stated that you should be able to convert between digital tokenised dollars and traditional dollars in the same way that foreign currencies are converted and they have been talking about this since 2021 . But what if this could already happen today, with your own Bank account?

Xapo Bank offers a secure, deposit guarantee scheme protected USD Bank account earning 4.1% interest , linked to your debit card . But did you know it has also developed the USDC rails into that Bank account?

A Bank account that brings together the old layers of security of a credit institution, and the new efficiencies of stablecoins and open blockchain infrastructure. A secure account to hold your assets, but in a way that allows you an on-ramp, and an off-ramp to the developing Web3 and Virtual Asset space without many of the inefficiencies and costs of arguably old and slightly dated payment rails. Add to that the ability to gain access to BTC directly (also interest bearing) through the same application and within one of the most secure and regulated platforms in the world, and this starts to feel and sound like an absolutely unique offering in the world today!

Not All Regulated VASPS are created equal: FTX and the lessons learned

test@looka.com — Wed, 23 Nov 2022 12:12:42 GMT

Why are the ‘Access Points’ to Virtual Assets so important?

We live in very interesting and challenging times. On one side, we have young and innovative people all around the world who are motivated to promote and develop the application and use of new technology, with new efficiencies, and to generate new accessibility options from around the world to new products, services and assets. The ‘democratisation of finance’ is one of the principles around the development of blockchain based virtual assets and infrastructure. However, on the other hand, there are challenges. What are the key ‘access points’ to these new assets and services? How do users around the world gain access to these markets? Is it simply an internet connection? If the access points, in this case a regulated Virtual Asset Service Provider or ‘VASP’ such as FTX, cannot provide safe and secure entry and exit points to this ecosystem, then how will it develop into a wider, global and secure market? This is really where there are such significant differences between Xapo and other platforms and service providers around aiming to act as secure market access points or avenues to these markets.

‍

The Regulated VASP Standard. What does this mean?

So how is that the case? Most people understand that a large percentage of the world’s access to the virtual assets space are through regulated VASPs. But what does that mean and what does it mean to be ‘regulated’? Well, one of the core objectives of regulation, and of running a regulated business should be to protect and benefit people and to create secure economic environments for businesses to flourish. However, in reality, many countries have only aimed to introduce ‘VASP regulation or registration’ regimes that basically focus on questions of AML and KYC compliance. Unfortunately this does not always lead to a ‘regulated VASP’ being managed and operated in any way like a traditional regulated financial services business. While consumers almost always have a good degree of ‘trust’ in a regulated Bank for example, should they have the same level of trust in a regulated VASP? Are all ‘regulated VASPs’ built or structured taking into account the core principle of consumer protection? Are all regulated VASPs required to comply with basic principles of risk management, internal controls, resilience, capital adequacy, insurance, customer care and consumer protection, honesty and integrity? No, they are not. Are all regulated VASPs subject to the proper prudential supervision of a regulatory authority? No, unfortunately this is not yet the case in most jurisdictions in the world. It is, however, absolutely the case for Xapo which is regulated in Gibraltar to the highest global standards that exist for any VASP.

Why is this so important today? Well, when we look at the FTX issue, a “regulated VASP”, it simply cannot have been the case that they were complying with these principles. You would not need to take this from me, but take it from the newly appointed CEO of FTX John Ray in his declaration in support of FTX’s bankruptcy filings:

“Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information as occurred here. From compromised systems integrity and faulty regulatory oversight abroad, to the concentration of control in the hands of a very small group of inexperienced, unsophisticated and potentially compromised individuals, this situation is unprecedented[1]"

‍

Gaps and the ultimate cost to Consumers

This really highlights the significant gaps that existed in the regulation and oversight of FTX, and the lack of the application of core principles of security and regulation. Perhaps most importantly, the segregation and protection of client assets. How could a regulated platform like FTX be allowed, or not be sufficiently well monitored to restrict, access or use of customer assets for the purposes they have been allegedly used? How could the FTX token, FTT, be structured under arrangements where the tokens were being bought back by profits of the FTX platform, which arguably links the value of the asset to the performance of an exchange? Worse, how could the FTT assets then allegedly be used as collateral by Alameda to fund its own activity? We don’t need to talk about appropriate conflicts management between FTX and Alameda, or even basic corporate governance principles, but if all of this activity falls under the purview of a head of risk management who has less that 2 years of experience (so we are informed), no one can honestly be too surprised that this can happen.

Everyone should be even less surprised that this could happen when the CEO of the same business could make such core errors in (public) statements that the platform had plenty of liquidity to facilitate redemptions. It would have been of little comfort to the world to read this being corrected by the same CEO then stating that ‘he couldn’t have got it more wrong.’ But how could he have got it so wrong? FTX’s business in perpetual futures allowed traders to trade crypto derivatives which could naturally be significantly leveraged. Was that not understood by the CEO of the business or will it become clear that this was also an issue beyond that?

‍

N ot All VASPs are Created Equal: Trust, Governance, Balance sheets and Experience

Unfortunately, consumers do not typically understand the difference between ‘regulated VASPs’ on the basis of where or how they are regulated. I would also not expect an average consumer to conduct due diligence on a VASP before opening an account. However, how a VASP is regulated is extremely important and in that context, Xapo expects to be a core pillar of the flight to safety and security. Why?

Having a USD account at Xapo Bank means that your interest-bearing USD balances are held at a fully regulated and capitalised Bank, and automatically fall within the protection of a statutory deposit guarantee scheme, held at a fully regulated and capitalised credit institution and Bank.
Holding BTC at the Xapo VASP does not expose you to any form of trading, lending or leveraged activity. The regulated standards which apply to Xapo simply do not allow it access to member BTC, as these must be maintained in a segregated account. Xapo VASP is regulated in Gibraltar, and under the applicable ‘Protection of Client Assets’ Guidance and regulatory principle, Xapo is required to have effective arrangements in place for the protection of client assets. It is also required to have taken precautions and established corporate controls to protect customer assets and monies against any eventualities and threats, as well as to maintain custodial assets, completely segregated from the VASP’s own assets and monies.
Xapo has been involved in the crypto space since 2013. We have evolved over time from a Bitcoin wallet, to a custodian, to an e-money institution, to a Bank. We understood from day one that building trust through regulation, security and a strong balance sheet were key. Our balance sheet has 26,000BTC that we use as a first loss protection layer for you, so you can rest assured your money is safe with us. This simply does not exist with any other VASP in the world.
There are separate capital requirements that apply to the Xapo VASP beyond the protection of client assets, and separate and specific risk management, resilience and business continuity plans that the company is required to maintain and report on to the regulatory authority.
There are separate governance requirements that apply to each of the Xapo regulated entities and we are proud to maintain a heavyweight board and management team which is assessed based on its composition, the balance of skills, experience and knowledge of the products and services being offered.

It will be too detailed to provide a forensic analysis of the comparison between the Gibraltar DLT/VASP Framework and other simple ‘registration’ regimes that exist around the world in this one article. However, there are extremely substantive differences which we are happy and proud to comply with, in the interests of our members. We will cover these in a future write up, so please keep up with us on our social pages - LinkedIn, Twitter, Facebook and Instagram. You can also contact us with any specific questions you might have. .

Our objective is to ensure that we can provide the most secure, stable and trustworthy access points to BTC and USD in the world , as well as other emerging and modern units of value moving forward. These principles are completely unaffected and remain completely unchanged as we continue to develop and service our members around the world.

‍

[1] https://www.documentcloud.org/documents/23310509-john-ray-declaration