The most important regulatory news from Consensus 2023 will likely go uncovered. In an interview announcing a new product at Consensus, PayPal SVP Jose Fernandez da Ponte said that PayPal currently covers $50,000 of consumer liability for crypto transfers, which is in line with the requirements of the CFPB’s Regulation E.¹

Enforcing Reg E for crypto payments has always been the most natural way for the CFPB to start regulating the crypto market, but the agency has to this date declined to ever do so (to my knowledge). Therefore, I’m always on the lookout for new developments in crypto-Reg E. PayPal’s voluntary semi-compliance is an important development in the state of crypto consumer payments regulation.

These are my independent thoughts and do not necessarily represent the views of my employer.

Background on Regulation E

The CFPB has not yet enforced Reg E for crypto payments.

The key legal question that must be resolved prior to the CFPB enforcing Reg E for crypto is whether cryptocurrencies constitute “funds” under the regulation. Reg E applies to “electronic fund transfers” (EFTs) which means “any transfer of funds that is initiated through (electronic means).”² There are other federal financial regulations where the term “funds” has not been interpreted to mean cryptocurrencies, such as in the SEC’s Custody Rule.³

The CFPB has never resolved the question of whether Reg E applies to crypto payments.⁴ In 2016, when considering whether to apply the requirements of its new Prepaid Accounts Rule (Prepaid Rule) to crypto wallets, the CFPB said only that “application of Regulation E and this final rule to such products and services is outside of the scope of this rulemaking.”⁵ Which is one of the most beautiful ways I’ve seen to not resolve a legal question.

In purely my personal opinion, it seems to me that cryptocurrencies are obviously “funds” under a straightforward reading of Reg E. Therefore, it seems inevitable to me that Reg E will be enforced for crypto payments or need to be amended in some way. To solicit ideas for how to make the rule workable given crypto’s lack of network-determined liability allocation (as exists for cards, ACH, and other fiat networks), the CFPB could publish a narrow request for comment on the matter.

Reg E limits consumer liability for unauthorized transfers.

Reg E requires, among other things, that financial institutions limit consumers’ liability for unauthorized transfers (i.e., refund consumers’ losses) to a level determined by how quickly the consumer reports the unauthorized transfer.⁶ You may have benefited from this protection if your bank account, debit card, or digital wallet has ever been hacked or stolen. For example, a few years ago I noticed $400 had been withdrawn from my bank account through an ATM that I had not visited. I called my bank, and they refunded all of my money — not due to good customer service, presumably, but because of Reg E.

Reg E specifies no maximum amount of reimbursement that may be required from a consumer’s financial institution. If I hold $1m in my bank and I am hacked for $1m, the bank would be responsible for refunding substantially all of my loss provided I reported the hack in a timely manner. Therefore, traditional financial institutions impose transaction limits and delays, or they require additional authorizations/verifications to move larger amounts of money to limit their potential liability. Some crypto companies may do the same, but I can’t think of any off the top of my head.

Liability allocation is the central question for making Reg E workable, and it is very challenging.

Regulation E initially places the responsibility for refunding all of a consumers’ hacked or stolen funds on the consumer’s financial institution only. For example, in the above scenario, the consumer’s financial institution would be solely responsible for refunding $1m. This is obviously a significant business hazard and may also be not right. Maybe the hacker’s financial institution, to which the funds were transferred, knew or should have known that the funds movement was suspicious. Therefore, what happens in practice is that financial institutions trace the unauthorized funds and allocate liability among themselves so that the consumer’s financial institution is not always 100% liable for the refund. This structure helps the consumer because he doesn’t have to negotiate with massive financial institutions on his own. Instead, financial institutions — who are more likely to have equal bargaining power and also have a recurring relationship — can settle out in the course of normal business.

In the traditional finance world, private network rules govern this process. For example, the ACH network has rules written by NACHA, the network’s administrator, and the debit card networks have their own network rules. Regulation E recognizes this reality and uses the existing structures to make its liability limitation requirement workable. It permits financial institutions to contract away liability to other financial institutions (i.e., to have private network rules) provided the consumer is made whole.⁷

In crypto, though, it’s less feasible for network participants to coordinate in the same way because communication is difficult, and additionally, there may not be a way to require participants in a transaction to refund unauthorized fund transfers (in the fiat world, the ACH or debit network can kick out financial institutions that don’t follow the rules). Therefore, if Reg E were applied to crypto payments today, without any supplementary work, it would likely result in an incredibly burdensome and unworkable regulatory regime.⁸

PayPal’s Announcement and its Reg E Coverage

PayPal yesterday announced that the feature it had enabled last year for PayPal customers enabling normal crypto network transfers was now being enabled for Venmo customers. To me, the announcement was pretty mundane, but the PayPal representative did point out that PayPal already offers $50,000 of coverage for EFTs. Looking at PayPal’s cryptocurrency account terms, PayPal says it will “protect you from unauthorized activity involving the purchase or sale of Crypto Assets in your Cryptocurrencies Hub, including for unauthorized sales used to Checkout with Crypto” and will reimburse customers for “up to a maximum lifetime cap of an equivalent of $50,000.00 U.S. dollars over the life of the accountholder.”

To my knowledge, this is the first instance of any company committing to refund consumer losses for unauthorized transfers. Cryptocurrency hacks can be common and expensive, so consumer protection in this space would certainly help consumers.

I thought of a few observations listening to the PayPal representative and reading the Terms, and I’ll go through them now.

PayPal limits lifetime liability to $50k

As discussed above, there is no limit on the liability a financial institution may be required to cover under Reg E. This indicates to me that PayPal is running their program voluntarily.

PayPal says they are covering “purchases” or “sales” of crypto.

Exempted from the definition of “EFT” are “securities and commodities transfers” which means, “any transfer of funds the primary purpose of which is the purchase or sale of a security or commodity” if the security or commodity meets certain conditions.⁹ Bitcoin and Ether may currently meet the conditions if a court would find that the assets themselves are “regulated by the (SEC) or the (CFTC),” but it’s not clear to me that the assets “may be sold by a registered broker-dealer or futures commission merchant.” However, it’s feasible that they will be at some point, so the assets themselves may fit the conditions in the ©(4) exemption.

It’s less convincing to me that all payments made in cryptocurrency constitute a purchase or sale of a cryptocurrency. For example, if you buy a coffee with bitcoin, it seems to me that some English language contortions are required to call that a sale of bitcoin. Yet PayPal characterizes paying for things with crypto as “sales used to Checkout with Crypto.” I suppose you never give up a backup argument if you don’t have to.

PayPal’s voluntary semi-compliance with Reg E mirrors the prepaid industry’s voluntary semi-compliance prior to the promulgation of the Prepaid Rule

Prepaid cards are debit card-like products that are not connected to a checking or other “account” as defined in Reg E.¹⁰ Instead, prepaid cards are pre funded at the time of purchase, and some may be reloaded. Because the cards were not connected to an “account,” they fell outside the scope of Reg E, which only applied to EFTs “that authorize a financial institution to debit or credit a consumer’s account.”¹¹ In 2012, given the growing popularity of prepaid cards and the potential risks for consumers associated with their use, the CFPB issued an Advance Notice of Proposed Rulemaking (ANPR) in which it announced its intention to develop rules to apply Reg E protections to prepaid accounts.¹² The Bureau finalized the Prepaid Rule in 2016.¹³

Prepaid card issuers were already voluntarily providing some Reg E protections prior to the CFPB’s rulemaking. The 2012 ANPR noted, “many GPR card market participants offer contractual protections similar to those provided in Regulation E for payroll cards, though such provisions may vary, and are subject to unilateral change.”¹⁴ Prepaid card issuers figured that, given the similarity between prepaid cards, which were not federally regulated, and debit cards, which were federally regulated, that they should provide similar consumer protections — although perhaps limiting voluntary compliance to the most important protections and with some limits. They likely did this for both business/competitive reasons — consumer protections probably helped build consumer trust and confidence — and for political/regulatory reasons — voluntary compliance demonstrated their commitment to responsible practices. Sound familiar?

PayPal is one of the few non-bank financial institutions subject to CFPB supervision due to its remittance business

The Dodd-Frank Act gave the CFPB statutory authority to supervise depository institutions with assets over $10 billion, payday lenders, and private student lenders.¹⁵ It also authorized the CFPB to conduct a rulemaking to establish supervisory authority over “larger participants” (LPs) in markets which the CFPB regulates.¹⁶

In 2013, the CFPB promulgated a rule defining LPs in the international consumer remittance market. Consumer remittances (i.e., any cross-border payment sent for personal, family, or household purposes) are regulated under the Reg E provisions discussed above, and they are subject to additional rules such as remittance-specific disclosures (e.g., of the foreign exchange rate). The LP rule established a threshold of at least one million international transfers per year for an entity to qualify as a larger participant in this market.¹⁷ PayPal is a larger participant under the rule.

Because PayPal meets the threshold, it is subject to the CFPB’s supervisory authority and may be subject to regular examinations. The kicker, though, is that once the CFPB establishes supervisory authority over an entity for its sale of one consumer financial product or service (e.g., international remittances), it may supervise the entity for its sale of any other consumer financial product or service (e.g., cryptocurrency payments).

I’m not aware of any other crypto company that provides any Reg E-like limitations on liability for unauthorized transfers aside from PayPal. Therefore, the business or competitive motivation for voluntarily offering Reg E protections may not be as compelling. However, given that PayPal is supervised by the CFPB, the political or regulatory motivation seems very compelling. What I think probably happened is that (1) PayPal believed that Reg E would eventually be enforced for crypto payments, despite best attempts to assert the exceptions discussed above, (2) knew it was a high profile consumer payments company subject to CFPB supervision, and (3) figured it should do its best to provide reasonable liability limitation for customers.

Conclusion: still waiting

Applying Reg E for crypto payments in a workable way is a very tough intellectual and legal challenge. I’m thankful that the CFPB hasn’t rushed to enforce Reg E, and admittedly the use of cryptocurrencies for consumer payments is small relative to the total consumer payments market. A prudent and good-faith step to implement Reg E would be to issue an ANPR and seek feedback on the matter (including whether it’s timely and pressing to even begin a rulemaking on the topic) much as the CFPB did when it kicked off the process for writing rules for prepaid cards in 2012.

These are my independent thoughts and do not necessarily represent the views of my employer.

Endnotes

¹ No one reads Terms & Conditions, so that’s why this is news today and not when the T&C were changed.
² 12 CFR 1005.3(b)(1).
³ The Custody Rule currently requires that RIAs hold client “funds or securities” with a qualified custodian. 17 CFR 275.206(4)-2(d)(2). The SEC has proposed to expand the requirement to also include “other positions held in a client’s account” which the proposal says “would expressly include certain assets that may not have previously been categorized as ‘funds’ or ‘securities’ ” such as cryptoassets. See 88 Fed. Reg. 14677 (Mar. 9, 2023).
⁴ In November of 2022, the CFPB disclosed that it was investigating Nexo for alleged violation of Reg E. The CFPB had issued a Civil Investigative Demand (CID) to Nexo requiring testimony, and Nexo petitioned the CFPB to set aside the CID (the petition was denied). This disclosure went unnoticed. We don’t at this point know, however, whether the CFPB is investigating fiat EFTs or crypto EFTs, so in my opinion Reg E has still not been enforced for crypto. Petition here.
⁵ 81 Fed. Reg. 83978 (Nov. 22, 2016).
⁶ 12 CFR 1005.6.
⁷ See 12 CFR 1005.4(d).
⁸ For a glancing discussion of this issue, see Jess Cheng and Amy Caiazza, U.S. Banking Collapse Doesn’t Necessarily Make Crypto Trustworthy, CoinDesk (Mar. 16, 2023), https://www.coindesk.com/consensus-magazine/2023/03/16/us-banking-collapse-doesnt-necessarily-make-crypto-trustworthy/, concluding, “The crypto community might consider developing clear, enforceable legal terms or system rules that leverage this fundamental loss-spreading principle — beyond operational losses and on an industry-wide basis.”

While beyond the scope of this blog, I don’t think this is either an unprecedented or impossible problem to solve. It’s not an unprecedented problem — a similar situation exists now for scam payments, which are authorized (and therefore not subject to Reg E’s protections) but fraudulently induced. I also don’t think it’s impossible to resolve with some combination of on-chain identity, on-shoring of activity, and novel legal frameworks.
⁹ 12 CFR 1005.3(c)(4).
¹⁰ 12 CFR 1005.2(b).
¹¹ 12 CFR 1005.3(a).
¹² 77 Fed. Reg. 30923 (May 24, 2012).
¹³ 81 Fed. Reg. 83934 (Nov. 22, 2016).
¹⁴ Supra note 12, at 30924.
¹⁵ 12 U.S.C. 5514–5516 (2018).
¹⁶ 12 U.S.C. 5514(a)(1)(B) (2018).
¹⁷ 12 CFR 1090.107.

On June 13, 2022, former acting Comptroller of the Currency Brian Brooks and law professor Saule Omarova participated in a panel hosted by the National Community Reinvestment Coalition (NCRC) titled “Discerning a Regulatory Approach to Crypto Currencies and Digital Assets.” Given the panelists, I thought this would be an enlightening conversation. Brian Brooks is a capable and insightful proponent of pro-innovation crypto regulation, and Professor Omarova is a well-respected progressive financial scholar. In particular, it seemed like a useful opportunity to hear an unadulterated, progressive perspective on crypto regulation (i.e., as opposed to political speech from politicians such as Senator Warren).

I was not disappointed. The conversation was a healthy, deep exploration of differing worldviews and policy conclusions. For me, it helped illuminate some of the areas where there are fundamental philosophical differences between traditional pro-crypto types and “anti-crypto” progressives. But more importantly, there seem to be areas in which common ground can likely be found.

My summary/notes from the conversation are below. These notes are tailored for a reader familiar with crypto and financial services policy. While I am certainly biased in favor of Mr. Brooks’ views on most crypto policy, I have done my best to document Professor Omarova’s views in good faith. Please keep in mind that these are written notes of a live conversation. In every instance, I’ve recorded the time stamp of the beginning of each speaker’s segment (relative to the NCRC recording) so that you can listen to his or her views yourself, in context.

These are my independent thoughts and do not necessarily represent the views of my employer.

Omarova (16:44)

The narratives of crypto proponents do not always match reality.
There’s a difference between using technology in finance and changing money itself.
“Money is a political instrument. It’s not just an economic resource.”
Whoever controls money affects people’s lives.
If we “decentralize” control of money, we lose control of it.
Crypto proponents rightly criticize the fact that the use of money today is divorced from the needs of everyday people. I agree. However, I don’t see any evidence that replacing traditional money with crypto money will get us to a better solution.
For example, the price of bitcoin has appreciated greatly over the past 13 years. Did that improve financial inclusion? No.
Cryptography as a technology can’t solve financial inclusion. If it could, crypto would have made gains toward solving financial inclusion by now.
Financial inclusion is a complex, socioeconomic, political matter. It doesn’t have to do with the nature of the US dollar vs. bitcoin but rather the fact that, e.g., people don’t have jobs.
What does crypto do that channels greater amounts of real money & real jobs into the economy?
I haven’t seen much evidence that it does so. Rather, most crypto is used for trading.
What money is used for is not a function of technology per se. Instead, it’s a function of who runs the system, what it is set up for, what the goals of the administrators are, etc.
I would be happy to use the technology in ways that preserve the public’s say in how money is used to raise the real economy.

Brooks (22:51)

I agree with 90% of what Saule said.
Points to make:
The project of crypto isn’t to replace money. It’s to replace banks. Crypto tokens reward users for creating a decentralized financial institution. I sat on the credit committee of a much-reviled bank. People can make mistakes.
On financial inclusion, the rate of black ownership is 50% higher than that of white ownership. Over the last five years, bitcoin has outperformed the S&P by a factor of 5x. (Bitcoin owners) were minority investors who weren’t around to use inherited wealth to take advantage of the IPO boom of the 80s. In 2009, when an asset was available at 0, black people were there and could take advantage of it.

Omarova (25:45)

Discrepancy in ownership showcases desperation (pointing out flaws in existing system). The discrepancy alone does not imply that minorities will benefit from price appreciation. For example, I bet minority borrowers owned a lot of subprime mortgages.
I remember how subprime lenders told a heart-warming story of how an African-American single mother could afford a house.
Inclusion can stand for predation.
The takeaway from discrepancy in ownership should be limited access to financial services for minorities, not the salvation potential of crypto.
Indeed, most crypto investors are affluent white males.

Brooks (28:20)

We have a lot of rules about participation (like accredited investor rule) under the guise of protecting people. If the rule is “only rich people can invest in x,” well rich people aren’t stupid. Excluding people from wealth creation opportunities seems unfair to me.

Omarova (30:00)

I don’t disagree; we shouldn’t exclude people from investments. However, cryptocurrencies are not simply investments. They’re also used as money and come with a payment system embedded. They are very complex financial instruments. We’ve never had that kind of instrument before.
I understand that crypto intends to replace banking. It wants to sit on top of the US dollar without being controlled by the issuer of the US dollar. Banks are basically the agents of the federal government: the government charters a bank and gives the bank the exclusive right to issue private money that is equal to sovereign money. Crypto tries to replace that. Therefore, our question should be the same — can we, as the sovereign public, control those private issuers of private money? Private issuers of money ought not abuse their power like banks are doing right now. Private firms legitimately pursue profit, but money is not a private resource, it is a public resource.

Question from NCRC’s Adam Rust: How do you think stablecoins should be regulated?

Brooks (34:15)

Should be fully reserved, redeemable on demand, and with public audits.
If you meet those conditions, you’re the same as a traveler’s check. Like traveler’s checks, such stablecoins wouldn’t threaten stability. They are a utility that solves for many problems.
There are things that people call stablecoins that are not like the stablecoins I’ve described.
Banks have to interact with stablecoins. I think non-bank issuance is fine. No one worries that, e.g., Bed Bath and Beyond gift cards are not issued by banks.
People say “stablecoins should be issued by banks,” but there are bank charters pending from non-bank stablecoin issuers that are not going to be granted.
More of these issuers should be inside the banking system for all of the reasons you’d think.

Omarova (38:40)

I haven’t made up my mind about stablecoins. Ultimately, I don’t understand the point.
In a way, banks already issue stablecoins. They are electronic, and they’re stable. So why do we need stablecoins on top of bank deposits?
Stablecoins, like casino chips, offer convenience in a narrow ecosystem, but they don’t seem useful more broadly. They are used as trading collateral and as a safe asset in crypto markets (but that’s it).
Do we need banks to be issuing stablecoins for this purpose? It doesn’t seem worth the energy.
But like I said, I am still thinking about these issues.

Brooks (41:50)

In a market economy, who decides the answer about what public benefit there is?
There’s demonstrated demand for stablecoins.
We used to think intranet email was the only good thing, but now we understand internet email is so much better.
You all have Zelle or Venmo. I can’t Zelle all of you $$; I can send you stablecoins. It’s a traveler’s check over the internet.

Omarova (44:45)

Fully interoperable, instant digital money would be great. Best form of that would be such money, publicly-issued.
If privately issued, there could be 1000 different issuers, fragmenting the payments system.
The banking system aligned different financial institution obligations (X bank deposit vs. Y bank deposit) to combat fragmentation.

Brooks (46:38)

Stablecoins aren’t money; they merely transmit dollars.
Different versions of traveler’s checks were good because they met different market demands.

Omarova (48:20)

Stablecoin issuers wish to create money, just like banks. When a financial institution creates money, it is a monetary institution like a bank and must fulfill similar regulatory obligations.

Adam Rust: Insured depository institutions (IDIs) must comply with the CRA because they get insurance. How would CRA work for an IDI issuing a stablecoin?

Brooks (49:40)

CRA is a bargain. IDIs get special benefits and therefore it’s thought to be just that they give back to their community. In particular, if you raise low-cost deposits from a community, you ought to put the money back into that community. If you’re taking deposits at an artificially low rate, you have a CRA obligation.
If one of the things that stablecoins do is increase the amount of bank deposits and increase money velocity, then pro-community reinvestment types should support those activities of stablecoins. If stablecoins increase demand for and utility of dollars, that’s good.
If someone has an option to put dollars into a bank account or into the stock market, it’s better for community reinvestment if those dollars go into a bank account because the dollars must be reinvested.
Additionally, if you believe stablecoin issuers should be banks, you need to grant bank charters to stablecoin issuers. A stablecoin issuer like Circle does not have a CRA obligation. Its asset custodians may, but Circle does not.

Omarova (52:15)

First, these are the reasons why people believe stablecoins should be limited to banks:
Stability from supervision & FDIC insurance
Keeps Big Tech from issuing a stablecoin because commercial activity is not allowed by banks. No “Amazon Coin” that can cannibalize the USD.
But stablecoin issuers’ activities are not just bank-like. Also similar to an MMMF. Also similar to a central bank inside the crypto ecosystem. Do we want to promote a lot of mini-central banks? Do we have a regulatory approach ready for that?
So the shift between trad money and stablecoins is pretty big, and we don’t have all the answers yet. Until we’re sure, I’m hesitant to condone FDIC insurance behind stablecoin issuers. Maybe I’ll change my mind in the future.

Brooks (57:50)

Even pure-financial companies — not just commercial companies — can’t get OCC charters.
Also, you made the point that we have a bunch of different monies — airline miles, Amazon coin, etc. This is a point on crypto generally: We all have a bunch of different “stranded monies.” We should be able to monetize all of those different monies. One of the projects of crypto is to monetize everything and make it fungible. You created value with your efforts, and you should be able to benefit.

Omarova (59:50)

Not every stranded value should be commodified/needs to be commodified. It’s also not clear that value of our labor always accrues to us (e.g., using Big Tech platforms)
Also, private money challenges sovereign money when there is market power behind the private money, e.g., Amazon coin.
I’m with you about the crypto utopia so long as the market power of the crypto issuers is not growing to the level of a political economy issue.
Keep it private but don’t provide FDIC insurance.
Ultimately: do we want to make it stable and safe (with FDIC insurance)? For me, as I said, the “why” is still missing. I’m not sure.

Adam Rust: CBDC good?

Omarova (1:02:30)

If you take seriously Brian’s arguments about why crypto is better (i.e. email vs snail mail) then CBDC is a good compromise. Public money + great tech. Ensuring inclusion that no private entity can ensure — the public can pursue collective interest even if it’s unprofitable.
Devil is always in the details. Design can differ tremendously.

Brooks (1:06:45)

There are three possible frameworks for financial services:
Lots of gov control
Bank intermediation (what we have today)
Lots of user control
Lots of gov control has problems because of what is happening in China. China has articulated three policy goals: 1) Disintermediate US dollars & require eCNY payments. 2) Get away from US-controlled financial system. 3) Make determinations about settlement, like Canadian truckers.

Interesting tidbit: Brooks says a top-2 bank CEO told him as comptroller they were going to prevent users from using cards to buy guns in the wake of Sandy Hook, but Brooks told him he shouldn’t do that.

We all don’t like the bank-controlled system. Do you want user control or government control?

Omarova (1:12:00)

Governments are not the only ones who can have power that limits choice. Market power also limits choice, sometimes as much as governments.
The Fed already processes payments, but we don’t see abuse. We don’t worry about government control in the USA. We’re not China.
CBDC is about providing public services, not about control.

Audience question: Given the size of national debt, “how stable is the US dollar?”

Brooks (1:15:30)

I would argue we haven’t done things like Canada & the truckers because we have checks against things like that. When we build capabilities that allow that control, we will use those powers.
Eventually, it will happen — and then for the rest of your life.

Audience question: First, we control what poor people do all the time, i.e. how they use food stamps, for example. Separately, my question is: how do you reconcile the idea that crypto replaces banks but you want crypto firms in the banking system?

Brooks (1:18:30)

I don’t think every bank has to carry out all of the functions of a bank. Technology allows financial institutions to unbundle services.
I don’t think it’s a contradiction because I don’t think the banking system will be the same in 50 years.
All of our systems — supervision, risk management — must change.

Audience question: (inaudible). Second, what do you think about Lummis-Gillibrand?

Omarova (1:21:20)

Crypto seemed to like L-G because it didn’t seem too onerous.
Fundamentally, I object to L-G because I don’t believe the crypto system is precisely the same as the traditional system. If it’s the same, sure, we can take the old system and use it for the new system. However, I think there’s a fundamental shift. It’s very difficult to take a crypto-asset and put it into a traditional “box” of financial products. That’s my hesitation.

Brooks (1:24:45)

Any framework is better than no framework at all.
I disagree we need a crypto-specific framework. “Crypto” covers a lot. L-G is imperfect, but it’s a good discussion. Some crypto tokens look like things we already know about so let’s get started there.

(End of conversation.)

The practice (of preserving anonymity) was crucial in the formation of the United States itself, and was arguably as American as apple pie. As cypherpunk historians loved to point out, the model for the Ender’s Game debate may have been the Federalist Papers, with parts written by James Madison, John Jay, and Alexander Hamilton but published under the pseudonym Publius. And when Thomas Paine wrote Common Sense, he originally signed it “An Englishman.” As the Supreme Court would note, “Anonymous pamphlets, leaflets, brochures, and even books have played an important role in the progress of mankind,” a role the Court has sustained in consistent ruling.

Steven Levy in Crypto: How the Code Rebels Beat the Government Saving Privacy in the Digital Age, pg. 222

Before COVID-19, Bitcoin had its own “lab leak” hypothesis. The NSA, the story goes, created Bitcoin, built in a backdoor, mined one million coins, and then released the experiment onto the world to track everyone/preempt the dominance of another country’s currency/fund black ops/etc. While probably untrue, you could be forgiven for finding it plausible: the NSA developed its own version of public key cryptography years before Diffie and Helman published their first research paper. Instead of publishing the idea, though, it kept the technology sequestered inside its secretive lab at Fort Meade.

This anecdote from Steven Levy’s “Crypto: How the Code Rebels Beat the Government Saving Privacy in the Digital Age” is just one of many instances in which the development of consumer-grade internet cryptography — followed by its ubiquitous use now— seems eerily similar to the situation in which cryptocurrency finds itself today. The book is a nonfiction documentation of the public development of public key cryptography, its first commercial implementations, and the US Government’s constant attempts to suppress it. The fact that Levy wrote the book in 2005, three years before the NSA published the Bitcoin White Paper, makes the parallels even more compelling.

See for yourself. Below are select passages from Crypto with some commentary about modern day parallels. All quotes are verbatim, although I’ve disposed of some ellipses for convenience.

These are my independent thoughts and do not necessarily represent the views of my employer.

Ray Ozzie was the lead developer for the Lotus Notes program, one of the first commercial implementations of public key cryptography. Notes users were imagined to be businessmen and women who needed to send messages over the internet that potentially contained highly sensitive trade secrets. The impetus for adding cryptography to Notes was the same for developing Bitcoin:

Ozzie continued to describe the way a traditional computer security system would deal with the problem, that is, via a central authority — essentially, a mandatory hub through which all traffic passed. If the central authority screwed up, turned cooked, or turned you in, the whole system failed. Its very spirit was locked into an age that was destined for the junk heap.

Ozzie saw Notes not only as a pioneering project but also as a seminal example of the networked future, where the masses would have their own computers and not have to check in with some massive digital Big Brother. Like the phone system, communications would be one-to-one, people communicating directly with their peers.

Satoshi said, “the problem with centralized systems is all the trust that is required for it to work.” Reliance on a central intermediary exposes valuable data and sensitive information, and if the intermediary fails, your valuables are suddenly out in the open. It was the same problem in 1984, and Ozzie replaced the intermediary with cryptography, substituting mathematical truth for trust.

— —

Not everyone was on board. Ozzie had to bat down bad proposals.

“We believe this is a bad approach,” wrote Ozzie of the central-authority model. “It changes the distributed nature of the network back into the old ‘centralized data’ approach of mainframes… It also resurrects the problems with the ‘traditional solution,’ that is, trust in people and/or mechanisms that are completely understood.”

Trusted, centralized systems are the model we already have. Public key cryptography and public blockchains are the innovation. Sharing this paragraph with every Fortune 500 CEO could have saved billions in R&D spend over the past decade.

— —

Phil Zimmerman founded PGP, a way to encrypt and authenticate communications, and released it to the public. Levy on Zimmerman…

Zimmerman was also a sophisticated political activist who had twice been dragged off to a holding pen for asserting his opinion. He now understood that in the computer age, government had an extremely powerful tool for monitoring dissent: electronic surveillance. Not only could Big Brother types stick their collective ear into phone conversations, but they could pluck the increasingly popular e-mail messages out of the digital ether and read business plans and shameful secrets to their black, black hearts’ content. While electronic mail was a terrific thing, it actually represented a step backward in privacy: even with relatively insecure physical mail, people had sealed envelopes to protect the privacy of their messages.

Do I have to be the one to say it? Transactions on public blockchains right now are a privacy nightmare. All of your on-chain activity is publicly recorded for use and collection by anyone interested enough to try, and it can easily be connected to your real-life profile by anyone who has (or ever obtains) the requisite information, such as your exchange or a merchant. But on-chain privacy is in the same state as our electronic communications were back in the 1990s. Soon, everyone realized that it was imperative to encrypt messages — at least during transmission — and encrypted email is now the default. If crypto financial systems are going to become mainstream tools for everyday commerce and financial activity, privacy-preserving tools and protocols must become mainstream.

Privacy-preserving technologies for crypto assets are needed and legal. The ability to use a mixer, a zero-knowledge protocol, or a privacy coin should be as much of an afterthought as the ability to use email, Signal, or encrypted data storage. When this happens, some law enforcement and bad actors may not be happy, but it doesn’t matter: privacy ought to be our right.

Separately, from a policy and advocacy perspective, I believe we need to move away from the “blockchains are always more traceable” talking point. What happens when blockchains aren’t traceable? The argument can’t be that users on blockchains have no privacy; it must be that we prefer to liberally preserve rights, even if bad actors may sometimes exploit that generosity.

— —

When the public developed public key cryptography, the NSA attempted to shut it down, alleging it was a national security concern. The NSA threatened businesses like Jim Bidzos’ RSA Data Security Inc. (the company formed by Rivest, Shamir, and Adleman to monetize RSA public key cryptography) with all manner of threats in an attempt to stop the proliferation of the technology.

According to Bidzos, the final NSA attempt at sabotaging the deal came when an agency official called (Microsoft CTO Nathan) Myhrvold and said, basically, “Don’t do (the deal with Bidzos).”

Bidzos was furious. As he recollects now, he dialed up the highest ranking person he knew and laid out what he had heard. Then, before his contact could utter a word in reply, he demanded that the official fix the problem and call Microsoft back to tell them that the agency had made a big mistake. “If that doesn’t work, you’re going to answer to the congressman in my district,” he said. “If that doesn’t work, you’re going to answer to a district attorney, because I’m going to file a complaint. If that doesn’t work, I’ll try the New York Times. But one way or another, if you don’t fix this, I’m gonna make you answer for it.” Bidzos more or less expected his contact to deny everything, or at least insist that he knew nothing of the sabotage. Instead, Bidzos claims, the man said, “I’ll call them.” And, according to Bidzos, his contact called Microsoft and recanted.

While I don’t know of any parallel in the ongoing cryptocurrency saga, I like this passage because it showcases Bidzos’ excellent sense of all of the political tools at his disposal. Politics is incredibly complex, and outcomes are not linear (e.g., the president wanted a policy, so that’s what happened). There are thousands of levers to pull to get what you want — Act of Congress, congressional oversight, agency rulemaking, corporate comms, talking to the press, working through political elections, local politics, and many other strategies.

— —

Separately, Zimmerman was promoting PGP.

Zimmermann talked, and generated publicity. He seldom failed to note that Burmese rebels reportedly used PGP to avoid the deadly consequences of being discovered in antigovernment activities in testimony he also noted that he’d received an effusive thank-you from a Latvian patriot. When confronted with the charges from law enforcement agencies that PGP was particularly useful to criminals — in one Sacramanto case, the cops couldn’t read a pedophile’s diary encrypted with Zimmermann’s software — he argued that all technology has trade-offs.

Perhaps the highlight of Zimmerman’s odd celebrity came one day in San Francisco. The young lady lap dancing in proximity to Zimmermann asked casually what he did. (He told her).

The lapdance stopped in midgyration. “You’re Phil Zimmermann?” she asked in awe. “I know all about PGP!”

Rebels abroad; dissident patriots (branded as terrorists); sex workers; and, yes, despicable groups such as pedophiles. The first adopters of cryptography and cryptocurrency.

— —

In a draft of (Senate Bill 266, introduced January 1991, Biden (then the chair of the Senate Judiciary Committee) inserted some new language:

“It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plaintext contents of voice, data, and other communications when appropriately authorized by law.” [Emphasis added].

That sentence was included at the explicit request of the FBI. And what a sentence it was! It plunged a virtual dagger into the heart of the crypto revolution.

To Zimmerman, S. 266 was the ultimate deadline. If he didn’t get PGP out into the world now, the government might prevent its very existence.

Phil Zimmerman and his friends uploaded PGP to the internet, where it spread across the world instantly.

Ironically, Joseph Biden’s offending language, the impetus for Zimmerman’s extraordinary step, met a much less enthusiastic response than PGP did. Senator Biden had been taken by surprise at the huge expression of public outrage (fueled by civil liberties groups) at the stealth antiprivacy language he had introduced. By June, he had quietly withdrawn the clause.

The United States has already debated the validity and merit of privacy-preserving technologies. And? We decided that they are valid and meritorious. The legitimate interest of the people in protecting their communications trumped any government interest in stopping theoretical bad guys, real or not. The same protections ought to extend to our rights to transact. In 1991, it was a strong, coordinated public reaction and political coalition that prevented a harmful US Government stance from developing.

But equally, it required Phil Zimmerman to build and launch a product that people loved and found useful. PGP is still used today. If millions — hopefully billions — of people onboard to crypto products, the public policy case gets a lot easier to make.

— —

Seeking a compromise, the NSA proposed a “Clipper Chip,” a proprietary encryption microchip that would encrypt data for commercial users but featured a backdoor ostensibly only accessible to the NSA. Levy writes,

The very basis for the scheme — a government means by which to flip the “descramble” switch for its own purposes — was offensive to most people. All opponents had to do was use a simple analogy — What if you had to leave a copy of your front door key at the police station? — and even a Joe Sixpack who didn’t know encryption from a forward pass would be an anti-Clipper convert. “The idea that government holds the keys to all our locks, even before anyone has been accused of committing a crime, doesn’t parse with the public,” explained Jerry Berman of the EFF. “It’s not America.”

Call me naïve, but I agree. It took advocacy and hard work to push back, but the Clipper Chip never had a shot. That’s not America.

The government did its best to defend the scheme. (NSA General Counsel) Stewart Baker briefed industry figures… Your view of privacy, he told them, reflects a hopelessly naïve view of the world. “By insisting on having a claim to privacy that is beyond social regulation, we are creating a world in which [crooks and terrorists] will flourish and be able to do more than they can do today,” Baker warned.

Same old same old.

— —

We won, and the Clipper Chip was never implemented. Instead, export control rules regarding commercial cryptography were relaxed by an Act of Congress.

By 1999, an emboldened Congress was finally rallying around the SAFE bill, the three-year-old proposed legislation to relax the export rules.

Given these eerie similarities, perhaps the timeline for cryptography’s acceptance can inform our understanding of where we are in the cryptocurrency policy evolution. Diffie-Hellman key exchange was published in 1976. The NSA immediately took notice and attempted to contain the technology, working behind-the-scenes in the government and directly with private companies. Lotus first attempted to introduce encryption to a major commercial product in 1986. Major legislation concerning cryptography first emerged in 1992, and it took until 2000 to pass a law loosening the export restrictions, 24 years after the first paper on cryptography.

Now cryptocurrency: While other experiments predate Bitcoin, the White Paper was published in 2008. At a high level, I think it is reasonable to say that “broad” adoption of cryptocurrency has only started recently, mostly with stablecoin payments and bitcoin savings serving people around the world. While advocates in Washington have been fighting the good fight for almost a decade, major attempts by the government to regulate cryptocurrency outside of AML and tax exploded in Fall 2021. 24 years after the Bitcoin White Paper is 2032.

While it may not feel like it in the whirlwind of our industry, adoption and regulation take time — a lot of time. That is just one way in which the story of the emergence of commercial encryption can inform our advocacy for cryptocurrency today. It should also firm our resolve on important topics: privacy-preserving technologies have been villainized before; commercial demand for such technologies will emerge; and the United States thoroughly litigated the issue in the past, and we decided for personal liberty.

These are my independent thoughts and do not necessarily represent the views of my employer.

Following tweets on the subject, I was invited to write the following column for Bitcoin Magazine. I think it’s important to explain DC goings-on to cryptonative audiences, so I accepted the invitation. I’ve republished the piece (with my original title, syntax, and conventions) below.

The U.S. Treasury Confirms That We Can Remove "Illicit Activity" From The Bitcoin FUD Dice

These are my independent thoughts and do not necessarily represent the views of my employer.

Bitcoin’s Paltry Use for Illicit Activity is now Indisputable

It’s time to take “illicit activity” off the FUD dice. Earlier this month, the US Treasury Department published reports that said, definitively, the use of bitcoin and other cryptocurrencies for illicit activity is far outstripped by the use of traditional assets. Critics can no longer credibly present the specter of illicit activity to beat back bitcoin; the foremost experts in the world say it is not a major threat.

The Treasury Department published three reports that identified key concerns for money laundering, terrorist financing, and weapons proliferation financing. Here’s what each said about the use of cryptocurrencies:

“(T)he use of virtual assets for money laundering remains far below that of fiat currency and more traditional methods.”

• The 2022 National Money Laundering Risk Assessment, pg. 41

“(T)errorist use of virtual assets appears to remain limited when compared to other financial products and services.”

• The 2022 National Terrorist Financing Risk Assessment, pg. 23

“There is no evidence that a proliferation network has used a virtual asset to procure a specific proliferation-sensitive good or technology…”

• The 2022 National Proliferation Financing Risk Assessment, pg. 29

Case closed! Staff in the US Treasury Department, the authors of the report, are the most knowledgeable and best-equipped investigators and enforcers against illicit financing in the world. Moreover, the reports were reviewed by other US government partners, including the Department of Justice, the Department of Homeland Security, and the FBI. There could not be a more credible source to convey these findings.

Of course, Treasury’s reports confirm what industry participants have demonstrated for years. The most recent edition of the Crypto Crime Trends report published by blockchain analysis firm Chainalysis found that just 0.15% of cryptocurrency transaction volume in 2021 was used for illicit purposes. The recent arrest of the alleged Bitfinex hackers — and the simultaneous seizure of nearly 100,000 bitcoin — also demonstrates that moving large sums of money on a public network that can be monitored from a Raspberry Pi isn’t as easy as, well, pie.

But the reports also confirm what we know from common experience: that we use bitcoin far, far, far more frequently for storing wealth and sending money to family members and reducing emissions and making micropayments and fleeing the freaking Taliban than for illicit finance.

After this report, if you are a journalist or a policymaker or a pundit or even an anon on Twitter — it is now irresponsible and flat out wrong to say that crypto is a major vector for money laundering or terrorist financing. The top experts in the world disagree.

Not that they won’t try. The United State’s sanctions on Russia have seemingly generated copious opportunities for bitcoin haters to claim that bitcoin will be used to evade sanctions. All of this despite the release of the Treasury reports and live rebuttals from Treasury and White House officials that say everything is fine. Take this recent Politico article, “Russia’s hidden tool to undermine sanctions,” for instance. The sixth paragraph should lead the piece: “Treasury officials say they aren’t overly worried about crypto.” And really, the story could end there. But the piece accepts speculation from a pundit that cryptoassets like bitcoin could be used for sanctions evasion if they manage to bypass KYC processes. And if my mother had wheels she would have been a bike.

Fortunately, when the facts are on your side, you can put up a pretty good defense. Coin Center Twitter has been ground zero for fighting illicit finance FUD recently, with their staff pointing out that officials at FinCEN, the Treasury Department, the National Security Council, and the White House have all said that there’s no evidence that bitcoin is a threat to US sanctions. Their defense is a good example of how to counter speculation and fear-mongering: return to the facts about bitcoin’s use and to point out the real world examples of how bitcoin is empowering and protecting some of the most vulnerable people in the world.

The Path Forward

The three Treasury reports released this month also discuss the future risk that cryptoassets like bitcoin could pose to the US illicit finance regime. Examining risk is not a bad thing — I want my government to be aware of any risks posed by the proliferation of public blockchains, provided they also maintain a sober assessment of the benefits. For the US Treasury, that certainly seems to be the case. US legislators recognize the same thing; Representative Ritchie Torres (D — NY) said earlier this week, “you should never define any technology by its worst uses… there’s more to crypto than ransomware, just like there’s more to money than money laundering.”

Bitcoin is a global, neutral, and open monetary network. Anyone can use it, and that means sometimes parties we despise may use bitcoin alongside us. When that happens, the protection and promotion of the network — which is premised on freedom, equality, and self-agency — will still be worthwhile. The US Bill of Rights shows that extending freedoms to everyone is far better than constraining freedoms for everyone. Bitcoin’s growth will prove the same; I think it already does.

But the truth right now is that the parties we despise do not use bitcoin, at least as compared to traditional networks. The Treasury reports released earlier this month state this unequivocally. As we continue to fight for this internet freedom money, it will be essential to cite these highly credible sources as proof.

These are my independent thoughts and do not necessarily represent the views of my employer.

If asked to describe who regulates cryptocurrency at the federal level, I suspect most cryptonatives would only be able to name the SEC and the CFTC, and maybe the Fed. In some ways, that’s no surprise because builders are focused on building, and crypto sometimes feels like a whole different world. But the reality is that the US financial regulatory system is much more extensive, and all of the agencies are important. As cryptocurrency mainstreams, each agency is thinking about how to accommodate (or not) the crypto-ecosystem within their existing frameworks. This post guides the cryptonative through the Galaxy of the US financial regulatory structure and explains how each regulator might interact with crypto. [1]

These are my independent thoughts and do not necessarily represent the views of my employer.

Macro Structure

Show this chart to anyone working on financial policy in DC, and I bet they’ll be able to tell you exactly from what report it comes. The US financial regulatory structure is convoluted, complex, and delicate, and many have waded through the above to figure out Who Regulates Whom. For our purposes, though, I think you can intuitively separate agencies into three categories: prudential regulators, regular person-protectors, and Treasury bureaus.

Prudential regulators look out for the safety and soundness of the financial system, i.e., whether it’s going to collapse or not. Generally, this involves supervision of banks: monitoring banks’ capitalization ratios, performing stress tests, double-checking security practices, and conducting other exams.

Regular person-protectors look out for regular people (as opposed to businesses or professionals) in their capacity as something. For example, the SEC protects regular people in their capacity as investors. The CFPB protects regular people in their capacity as financial product consumers. And so on.

Finally, there are various Treasury bureaus that implement other rules and regulations such as anti-money laundering regulations (FinCEN) and tax requirements (the IRS).

There are so many regulators that I think it’s more important to understand the macro structure of financial regulation than the specific authorities and charters of each agency.

Let’s dive in.

Prudential Regulators

Prudential regulators are tasked with preserving the safety of the banking and financial system. This generally means making sure that financial institutions are well-capitalized, appropriately-risked, and operating well. Prudential regulators have examiners that go to banks to watch what they’re doing, review financials, and talk to executives.

The Federal Reserve Board (FRB)

The Federal Reserve is best known for setting monetary policy, but a branch of the Federal Reserve System also serves as an important prudential regulator. The Fed has supervisory jurisdiction over bank holding companies and state-chartered banks that are part of the Federal Reserve System. The Fed also operates key payments systems like Fed Wire/Fed Now and benefits from the expertise of the regional Fed banks. While the structure is convoluted, [2] Fed policy staff are knowledgeable, their resources and authorities are vast, and their leaders are very influential.

A crypto question that could be answered by the Fed: should Wyoming Special Purpose Depository Institutions such as Kraken Bank and Custodia (née Avanti) be allowed access to a Fed Master Account?

The Office of the Comptroller of the Currency (OCC)

The OCC supervises nationally chartered banks. In general, these are the largest consumer banks in the US — the OCC oversees almost twice as many assets as the FDIC and the FRB combined.

A crypto question that could be answered by the OCC: should nationally chartered banks like JP Morgan Chase be allowed to hold crypto assets on their balance sheet, e.g., for trading, or would that threaten the stability of the depository institution?

The Federal Deposit Insurance Corporation (FDIC)

The FDIC supervises state-chartered banks that are not part of the Federal Reserve System and also custodies the FDIC deposit insurance fund. These tend to be smaller banks that focus on a region of the country. It also has nominal backup authority over all banks due to its duty to custody the insurance fund. The FDIC also has resolution authorities in the event of a bank failure.

A crypto question that could be answered by the FDIC: should federal deposit insurance be extended to stablecoin balances?

The National Credit Union Association (NCUA)

The NCUA supervises credit unions. Credit unions are a special type of depository institution that generally have a specific population focus (e.g., employees of the State Department or people living in the Mountain West) and are technically owned by their depositors (called members). Because of this structure, credit unions are supposed to pay more generous interest and make loans at more favorable rates.

The credit union construct is a bit convoluted to unpack, but you can think of the NCUA as similar to the FDIC but due to American Exceptionalism, is somehow not the same thing (🙃). Deposits at credit unions totaled $1.75 tn at the end of Q3 2021 — not as much value as is stored at banks, but a substantial amount nonetheless.

A crypto question that could be answered by the NCUA: should credit unions be allowed to facilitate the buying and selling of crypto assets for their members?

If it’s hard to distinguish between the different prudential regulators, don’t worry. The US financial regulatory system is very fragmented — we’re actually lucky to have just four prudential regulators!

The takeaway point for most people should be that there are four prudential regulators, and each is an independent actor which has significant authority to control the financial system. All four regularly examine their depository institutions and have a significant — effectively, final — say over their institutions’ business decisions and practices.

Regular-Person Protectors

The driving idea of regular-person protection is that regular people either can’t or shouldn’t have to make the same analyses of costs, benefits, and risks as businesses or professionals. For example, in general, you shouldn’t have to worry about whether your bank will arbitrarily steal your money — there one day and gone the next — so there are rules that say banks can’t rug your savings account (paraphrasing). An example from the non-financial world might be even more compelling: if you buy a car, you shouldn’t have to worry whether the seat belt will work or not — or even if it has a seat belt.

The Securities and Exchange Commission (SEC)

The SEC is charged with protecting regular people in their capacity as investors. Most people know about the SEC because it’s been most active in the crypto space, in particular prosecuting ICOs and other crypto products as the unregistered issuance of securities. Investor protection at its most basic is trying to ensure that the people issuing securities don’t exploit asymmetric information about the value of the security.

A crypto question that could be answered by the SEC: is the sale of a certain crypto-token a security, requiring registration or the assertion of an exemption?

The Commodity Futures Trading Commission (CFTC)

The CFTC is charged with protecting regular people in their capacity as futures and derivatives traders. While commodities futures have been… ~funky~ recently, futures and derivatives are usually essential to global commerce because they allow businesses and individuals to efficiently price, buy, and sell risk. The notional value traded in the derivatives markets reaches into the trillions of dollars per year, far eclipsing that in the equities or crypto markets.

A crypto question that could be answered by the CFTC: if a crypto-token is a commodity (like bitcoin), does the CFTC have the authority to regulate its spot trading on venues such as Coinbase?

The Consumer Financial Protection Bureau (CFPB)

The CFPB is charged with protecting regular people in their capacity as consumers of financial products. These are the products most of us use on a daily basis: bank accounts, mortgages, credit cards, and the like. Due to its unique structure, such as receiving funding from the Federal Reserve instead of Congress, and authorities, such as the charge to prosecute unfair, deceptive, and abusive acts and practices (known as UDAAPs), it is a uniquely powerful regulatory agency. The CFPB has been virtually silent when it comes to crypto.

A crypto question that could be answered by the CFPB: should crypto wallet providers be required to provide refunds to a consumer in the case of a hack or a scam?

The Federal Trade Commission (FTC)

While not strictly a financial regulator, the FTC is an important consumer protection authority, especially in the areas of data security, privacy, and fraud. Similar to the CFPB, it is authorized to prosecute “unfair or deceptive acts or practices in or affecting commerce,” which is a broad authority. It also has antitrust authorities.

A crypto question that could be answered by the FTC: is it permissible for exchanges to permanently track the flow of user funds once they are transferred off of the exchange and to use that information for commercial purposes, like advertising?

Since the Bitcoin white paper — and even before — crypto has promised consumer applications in payments, trading, value storage, and other areas. And now it seems like we may finally be seeing widespread consumer applications develop. As this continues, builders will need to continue paying attention to the rules and policies promulgated by the regular person protectors.

Fortunately, in the United States this often means just making proper disclosures. For the most part, provided a financial institution tells the consumer about the risks, terms, and conditions (and does so fairly and accurately), it is free to offer something to the consumer, who can then choose to use or not use the product. [3]

Treasury Bureaus

The Treasury Department is best known as the cabinet-level agency that coordinates and implements the President’s economic and financial policy. The Treasury Secretary, generally one of the most important cabinet secretaries, also has important foreign affairs and national security responsibilities. But 98% of the Treasury Department’s employees work for its bureaus, semi-independent agencies that are charged with carrying out specific functions. Two Treasury bureaus are particularly important to the crypto-ecosystem: FinCEN and the IRS.

The Financial Crimes Enforcement Network (FinCEN)

FinCEN is responsible for investigating, preventing, and enforcing against illicit finance (often called AML/CFT, short for anti-money laundering and countering the financing of terrorism). In general, this is accomplished by requiring that financial institutions report suspicious activity to FinCEN, which then investigates. The prudential bank regulators supervise banks for AML/CFT compliance, and FinCEN requires non-bank financial institutions to register as federal money services businesses, maintain an AML compliance program, report suspicious activity, and submit to periodic (albeit infrequent, given limited resources) examinations on the sufficiency of their AML program.

A crypto question that could be answered by FinCEN: what reporting are financial institutions obligated to make when a customer sends cryptocurrency to an unhosted wallet?

The Internal Revenue Service (IRS)

As the United States’ tax authority, the IRS is implicated in most activities involving the gain, loss, or movement of value. Tax rules and reporting for cryptocurrency are complicated, and the rules can have serious implications for the crypto-ecosystem.

A crypto question that could be answered by FinCEN: should individuals making transfers of cryptocurrency worth more than $10,000 be required to fill out a lengthy and burdensome §6050I report?

Conclusion

At the end of the Original Trilogy, Luke Skywalker towers over a vulnerable Darth Vader, lightsaber outstretched. The Emperor stalks behind, goading him to strike the killing blow. To do so would be warranted; in their last engagement, Darth Vader severed Luke’s hand, a fact which Luke considers with horror. Ultimately, though, he backs away. Together, Luke and Anakin overthrow the Emperor and free the Galaxy from the Empire.

While perhaps slightly strained, it’s an apt metaphor for the current moment. Crypto has been wronged by some incomplete or ill-considered regulation. But in order for crypto to achieve its maximum impact — if we want to extend to the maximum number of people monetary freedom and politically neutral payments and seizure-resistant stores of value and new forms of digital commerce and on and on and on — then crypto must embrace and help craft sensible regulation in the US. All of the regulators listed now care about crypto. And crypto should care about them. To do so is, fundamentally, to be hopeful and bullish on the industry’s potential and ability. The Galaxy awaits.

Gyges Lydias on Twitter: "If you think the report-writing EO is bad for crypto, doesn't that imply you are long-term bearish?I am bullish. I think crypto solves real problems and is a generational technology shift. I'm frothing at the chance to make our case, and I welcome the scrutiny.Game on. / Twitter"

If you think the report-writing EO is bad for crypto, doesn't that imply you are long-term bearish?I am bullish. I think crypto solves real problems and is a generational technology shift. I'm frothing at the chance to make our case, and I welcome the scrutiny.Game on.

My sincere thanks to Michael Mosier for his review & comments. These are my independent thoughts and do not necessarily represent the views of my employer. Don’t take the graphics too seriously.

Endnotes

[1] This post discusses US federal agencies only. To the audience: be aware that financial regulation happens at the state level, too. See here.

Additionally, this post only discusses financial regulators. Other agencies may in the future regulate the non-financial applications of blockchain and cryptocurrency, although such applications still seem far away to me (if they ever emerge). But see here and also note that the recent Biden Executive Order directs non-financial agencies to examine cryptocurrency and blockchain.

[2] The Federal Reserve Board is part of the Federal Reserve System, which also includes the Federal Reserve Banks and the Federal Open Market Committee. The Federal Reserve Board is the prudential regulator. The Federal Open Market Committee sets the federal funds rate, a component of monetary policy.

[3] This may change — it seems there’s a growing skepticism of a regulatory regime based primarily on disclosure (e.g., for consumer privacy). I think that is one of the top regulatory trends to watch.

For if the people are not equal, they will not have equal things. Rather, from this arises fights and accusations, either when people who are equal have or are distributed unequal things, or when people who are unequal have or are distributed equal things…
Nicomachean Ethics, 1131a, trans. Bartlett and Collins

Jerry Brito on Twitter: "4/ One thing that I still find very amusing is that the way they describe what stablecoins are, and what risks they pose, is identical to how one would describe PayPal or similar. I don't see how they distinguish it, yet there's no legislation recommended for payments apps. pic.twitter.com/nvQk0z0rEU / Twitter"

4/ One thing that I still find very amusing is that the way they describe what stablecoins are, and what risks they pose, is identical to how one would describe PayPal or similar. I don't see how they distinguish it, yet there's no legislation recommended for payments apps. pic.twitter.com/nvQk0z0rEU

Since stablecoins have started to receive scrutiny by US federal regulators, it’s been increasingly popular to compare them to other types of nonbank digital dollars such as PayPal, Cash App, or Venmo balances. This comparison makes intuitive sense because (centralized) stablecoins are a dollar-denominated corporate liability that can be used on a proprietary payments network. If the products are very similar, there exists a nice template for regulation, provided a “like for like” standard is applied. In this post, I compare and contrast PayPal balances with USDC and provide preliminary thoughts on regulatory steps.

These are my independent thoughts and do not necessarily represent the views of my employer.

Similarities

PayPal is a proprietary digital payments network. Consumers buying things and merchants selling things use PayPal to transfer value using Paypal’s internal settlement network. While users can choose to pay with ACH or card, for the purposes of this comparison, we’re primarily interested in situations in which a user makes a transaction using his PayPal balance. A PayPal balance is a liability that PayPal issues to the user, and it is convertible to private bank money at any time. When a user makes a payment, he directs PayPal to transfer dollars from his account to the merchant’s account, a transfer that occurs entirely on PayPal’s internal ledger.

USDC is a stablecoin, which is a tokenized dollar liability that circulates on a public blockchain. Consumers use USDC to transact on public blockchains, whether for trading or other purposes. Users hold USDC in a third-party wallet and then settle USDC transactions on a blockchain such as Ethereum. US consumers that wish to convert their USDC liability to private bank money have a two-step process which involves converting USDC to USD via an exchange (free on Coinbase, at least) then converting the exchange liability to private bank money. USDC issuer Circle does not offer redemption or issuance services to consumers.

Some have pushed back against the idea that a stablecoin such as USDC is just another proprietary payments network such as PayPal, likening one’s choice of stablecoin to one’s choice of email client. Respectfully, I don’t think the analogy holds. Your choice of email client is more analogous to your choice of crypto wallet than it is to your choice of stablecoin. The asset is like the email protocol, and both rely on network effects for value. Wallets and email clients plug into the common network; they are not the network. Email clients can build nice features that allow you to use different email protocols (like using a web service or a desktop client with the same email address), but that would be analogous to a digital wallet allowing you to seamlessly switch between stablecoins (like how FTX treats all stablecoins and US dollar deposits as a single asset). On the backend, though, the clients are switching networks on your behalf.

I likewise think it’s most sensible to think of USDC on different blockchains as separate products. It is possible to transfer USDC across blockchains, but it is a multi-step process, at least for consumers. While the products may be very similar, i.e., because the credit and liquidity risk of Solana USDC vs Ethereum USDC don’t differ significantly, they seem similar to, e.g., PayPal vs Venmo balances. PayPal and Venmo are not natively interoperable, and neither are Solana- and Ethereum-based USDC.

Revenue model

Someone I know is fond of saying about new payments products, “it’s all about the interchange, baby” (this applies to most fintechs, too). Interchange is the fee that the card networks charge merchants for payments using cards. According to research by the Kansas City Fed, merchants in the US pay on average 1.5–2% for the service of accepting card payments. In practice, this figure may be higher because of card processing fees layered on top of interchange costs. Interchange revenue is split between the card networks, card-issuing banks, and other parties involved in the transaction.

Just like the card networks, PayPal’s primary source of revenue is fees on transactions settled via PayPal. While they appear to be pursuing a more diverse revenue base by building out a general purpose financial services experience, 90% of PayPal’s revenue came from transaction fees in Q3 2021. The more people transact on PayPal, the more money PayPal makes.

USDC issuer Circle, by contrast, is not involved in transactions settled with USDC, so they take no transaction fee. Instead, Circle revenue comes primarily from interest earned on reserve custody. Market competition and regulatory scrutiny has pushed Circle into a very conservative investment portfolio, but since it is full reserve, its assets under management is very large. For Circle, the more USDC in circulation, the more money Circle makes. Additional revenue models are available to Circle as well, especially if they can acquire a banking license in the next few years.

Asset backing

The reserve allocation (and counterparty credit risk) of stablecoin issuers has received a lot of attention in the past year, perhaps because of Tether’s missteps in the past. In February 2021, as part of its settlement with the New York Attorney General, Tether agreed to provide a breakdown of its reserve composition. The result, first published in May 2021 was… disappointing, revealing that just 5.1% of Tether was backed by cash or US treasuries. In response, Circle expanded its May 2021 reserve attestation to include a breakdown of its reserve allocation. No good deed went unpunished. Competitor Paxos came out with a blog post that blasted Circle for being purportedly “unregulated” and backed by shoddy reserves. Next, a Bloomberg article in August 2021 pointed out that Coinbase’ claim that USDC was backed 1:1 by dollars “in a bank account” was not true. Soon after, Circle announced that the entire USDC reserve would be held in cash and short-term treasuries, which remains the case today. This reserve mix, arrived at due to market competition (and, perhaps, a fear of regulatory scrutiny), is safer than what is required by Circle’s state money transmitter licenses.

PayPal also operates under a state money transmission license but has not been subject to the same level of public scrutiny or competitive pressure regarding reserve reinvestment. According to industry participants, nationwide money transmitters conventionally follow the liquidity and credit risk guidelines of the strictest state, apparently Texas, which requires that 50% of account holders’ assets be held in “permissible investments” [1]. The result is that PayPal likely uses a higher yielding, more risky asset allocation than what Circle maintains. PayPal does not disclose its reserve allocation, but it is a public company subject to public reporting and independent audits.

Usage Metrics

As I pointed out in November, USDC recently passed PayPal in two significant, and roughly comparable, usage metrics. In Q3 2021, PayPal’s Total Payment Volume was $310b while USDC users settled $348b of transactions in the same period. Additionally, at the end of Q3 2021, PayPal reported $37.8b in outstanding consumer balances, and USDC had approximately $38b in total supply at the same time. [2]

Of course, the use of PayPal vs. USDC may be different. Consumers regularly use PayPal for everyday purchases, and PayPal reported an Average Purchase Value of $63 at the end of Q3 2021. Meanwhile, the average transfer value for USDC was $96,665 (the median transfer value was $2,079). [3] And PayPal certainly has a bigger network: as of Q3 2021, PayPal reported 416mm accounts worldwide whereas ~0.5mm addresses had USDC balances in excess of $10. [4]

Differences

The comparison of USDC with PayPal balances is apt because both are assets that establish proprietary payments networks. However, the networks do differ in two important ways which, in my opinion, reveal the new paradigm created by public blockchains. First, use of USDC is permissionless whereas all users wishing to use PayPal must register. Second, the services required for consumers to use USDC are disaggregated whereas in PayPal they are consolidated.

Public blockchains are so named because they are publicly readable and writable by anyone, with no prior qualification. USDC, therefore, can be used by anyone in a permissionless way, whether as a consumer or merchant or developer. This contrasts with PayPal, which requires account registration prior to any use of its platform. Additionally, some PayPal privileges, such as the ability to authorize transactions on behalf of another party, are restricted to paid customers. Finally, PayPal implements US KYC and AML regulations which require network participants to provide sensitive identifying information, subject funds to withholding or audit, and increase UX friction.

The second important difference is that the service stack to facilitate USDC use is disaggregated whereas for PayPal it is wholly contained. Circle issues USDC, but wallet services and transaction validation are provided by third parties. In contrast, PayPal serves as the issuer, wallet, network, and custodian for all PayPal funds. Wallet services is a good example of the different ecosystems: Circle CEO Jeremy Allaire reported recently that 223 digital wallets on iOS and Android support USDC. For PayPal, there is just one digital wallet, and it is the PayPal app.

The cumulative effect of permissionless access and disaggregated services is that innovation built on top of USDC thrives. New PayPal features must be created by PayPal, and developers must work within the confines of PayPal’s API. Consumers, businesses, and developers working with USDC, on the other hand, are free to use USDC in any way that they can imagine and make work technically. The burden to experiment is lower because potential network participants don’t have to go through a lengthy onboarding and vetting process. And public blockchains’ internet native, cross-border nature allows wide discussion & collaboration with “strangers” that people have only met on Twitter, Telegram, or Discord. Finally, because USDC implementation is open source, anyone can fork the contract and improve the service if they believe there is a substantive improvement to be achieved and significant market demand to meet.

Regulatory Implications

If two products are the same, they should be regulated the same. And if they are different, they should be regulated differently. This is not just equal treatment under the law but also an intuitive conception of what is right, as Aristotle explained in the Ethics. Based on the similarities and differences between PayPal balances and USDC, then, there seem to me to be some clear regulatory implications.

First, USDC issuance should not be confined to depository institutions. PayPal is not a depository institution, yet it has the same quantity of customer liabilities as Circle does (or it did; USDC supply has grown an additional $12b since the end of Q3 2021). In fact, because USDC issuance is limited to businesses — which generally require fewer protections than consumers — PayPal balances could be considered more risky than USDC.

Second, the federal consumer protection regulations that PayPal follows should be followed by financial institutions working with USDC. For example, CFPB regulations require PayPal to refund consumers when they are hacked or defrauded. Likewise, custodial digital wallets facilitating USDC transactions should probably follow these regulations as well. As I explained above, because the USDC service stack is disaggregated, Circle only issues USDC, and this particular regulation likely does not apply to them.

I don’t think there are any regulatory implications for reserve requirements. Both Circle and PayPal follow state money transmission guidelines, which require at least 50% of customer liabilities to be held in very safe, very liquid assets. It doesn’t seem particularly compelling to require a full asset reserve, either. Separately, though, if there is market competition that demands a full reserve of low-risk assets, that seems perfectly reasonable to me.

The last point I’ll make is that the primary federal regulator of PayPal is the CFPB, not the SEC or the CFTC or one of the banking agencies. The CFPB implements consumer financial protection regulations; for example, the regulations that require refunds for defrauded or scammed consumers. So far, the CFPB has not made any moves in crypto, but it looks like that may change under its ambitious new Director.

Want to know more about what the CFPB could do in crypto? Subscribe, I’m writing about that next.

These are my independent thoughts and do not necessarily represent the views of my employer.

[1] If anyone who has helped companies set this up wants to weigh in on reserve management requirements & common market practices, please DM or comment! I am not an expert on this.

[2] Data from Coin Metrics/The Block and PayPal earnings. PayPal TPV is a headline figure reported in a number of places. For PayPal customer balances, I’m using the “funds payable and amounts due to customers” liability on pg. 8 of its earnings release.

[3] Data from Glassnode, retrieved 1/30/22: https://i.imgur.com/IN1N9qk.png. 90 day simple moving average.

[4] Data from Coin Metrics, https://coinmetrics.substack.com/p/coin-metrics-state-of-the-network-a0e. I’m not sure what the best, comparable figure for “accounts” would be for USDC, so I just use what Coin Metrics reports in their free weekly update. If anyone has any thoughts on what would be better, please leave a comment or send me a DM on Twitter.

These are my independent thoughts and do not necessarily represent the views of my employer.

Earlier today, the Federal Reserve Board released its much-anticipated discussion paper on central bank digital currency. To be frank, little was new: Chair Powell has already said that the Fed will not develop or deploy a US CBDC without congressional approval. And Fed staff and governors have already done a good job explaining some of the pros, cons, and potential for a US CBDC. Perhaps the most novel announcement was a concrete outline of the Fed’s vision for a CBDC, which it said would most effectively be “privacy-protected, intermediated, widely transferable, and identity-verified.”

Overall, I think the best analysis of the potential for a US CBDC can be found in former Fed Governor Waller’s August 5th, 2021 speech on the subject. Titled “CBDC: A Solution in Search of a Problem?”, he clearly outlined all of the best arguments for why the Fed should develop a CBDC then rebutted them. Because his analysis was so cogent and powerful, I don’t want to spend too much time repeating it when you can just read what he had to say. In the table below, I’ve listed a short summary of arguments for a US CBDC and the flaws I see in those arguments. [1]

As you can tell, I’m skeptical that the development and deployment of a US CBDC is an imperative task for the Federal Reserve System. It seems like the “blockchain, not Bitcoin” talking point, but for stablecoins. Crypto and blockchain are still powerful, alluring concepts for people, and there’s an impulse to do something with “the underlying technology,” fit to traditional structures. But “blockchain, not Bitcoin” was wrong. And “CBDC, not stablecoins” is also wrong. Stablecoins are dollars usable on public blockchains; CBDCs are not. Certainly, US payments infrastructure (and the payments market) would benefit from modernization, but a US CBDC would offer little that cannot be provided through upgrades to traditional systems that are ongoing.

I’m sure that CBDCs will continue to be a talking point and a will they/won’t they guessing game for at least the next few years. Because of the development of Libra and cryptocurrency and stablecoins, the Fed has been forced into consideration of a US CBDC. But my prediction is that the Fed will never launch a US CBDC. And I, for one, am thankful for that.

These are my independent thoughts and do not necessarily represent the views of my employer.

[1] Another excellent analysis of the features of a CBDC is this paper by Paul Wong (FRB) and Jesse Maniff (KC Fed). The CBDC imagined in today’s discussion paper is the “hybrid CBDC” model described by Wong and Maniff. As you can see, the “hybrid CBDC” model offers only marginal improvements over the “RTGS+” system, what is essentially Fed Now. Wong currently leads the FRB’s Tech Lab, the FRB office that seems to have drafted the discussion paper.

ed. June 2024: I wrote this pseudonymously when I worked at the CFPB, hence some of the disclaimers that may seem weird now (which were required by my agreement with my agency’s ethics office). Everything here still reflects my views though!

Several prominent crypto firms recently released proposals for how the US government should regulate cryptocurrencies and other related products. [1] While the proposals created buzz on Twitter and traditional media, I think it’s unclear to most people — to put it generously — what the actual effect of such policy proposals will be. In this post, I hope to answer this question and demystify the US federal policymaking process from the perspective of an insider.

I do or did work for a US federal financial regulator. I do or did work in Congress. These are my independent thoughts and do not necessarily represent the views of my employer.

What happens to proposals in Congress

At a high level, Members of Congress and their staff have two main ways to influence policy: (1) passing legislation and (2) applying pressure to Executive Branch agencies. It’s best for one’s policy if it becomes law, but that’s generally a very hard, multi-year process.

The first step that a prudent advocate makes is to get the proposal in front of allies on the Hill. If the party has connections in DC, it will reach out directly, but more common is that the party hires a lobbyist to circulate the materials and offer a meeting if the congressional office has any questions. This contact is almost always at the staff level. To add credibility or publicity to an announcement, parties often announce their proposal with some sort of concurrent event: publication of an op-ed (like Coinbase did), a briefing on the Hill, industry press (this can be a tweet storm in crypto), a request for a meeting, or something else. A good congressional staffer will be on the lookout for this information already, but staff are busy so it never hurts to bring the information to their attention as an FYI.

The goal now is to turn the proposal into policy. It’s not going to happen overnight. If the idea is good, or the proposing party is important, then the Member of Congress might introduce the proposal as a bill. Well-resourced advocates will provide draft legislative text to make this step even easier. Don’t get too excited: thousands of bills get introduced every two years, but few become law. The point is to introduce the bill and constantly build support for it. If the proposing party works with the Member to consistently build support for the bill in and out of Congress, it could be included in a legislative vehicle down the road. [2]

Alternatively, the proposing party can ask the Member of Congress to push for the policy by pressuring the executive branch. This is most likely to be successful when the Member of Congress is in the same political party as the President, but it’s possible to pressure the executive branch without political alignment. Members of Congress can variously: communicate with agency political appointees; use their bully pulpit to highlight a perceived problem and potential policy fix in public (letters, press coverage, floor speeches); ask questions about the issue in congressional hearings; or threaten to obstruct agency wishes in Congress, just to name a few options. While stakeholders should advocate for policy with the Executive Branch themselves (see below), friendly Members of Congress can amplify their message and escalate pressure on issues.

What happens to proposals in the Executive Branch

In the US constitutional system, the singular President is elected democratically, but his power is delegated to thousands of political appointees to implement the vast array of federal laws. Stakeholders can reach these political appointees in much the same way as they work with Members of Congress: by explaining their views and asking for action.

But those without political allies have another avenue for advancement in the executive branch: the career civil service. Because the work of agencies is so technical, complex, and slow-moving, most of an agency’s workforce is made up of apolitical civil servants. These bureaucrats are responsible for the nuts & bolts of detailed policy work: drafting regulations, monitoring industry, providing interpretations of existing rules, and other tasks.

While civil servants ultimately implement the policy direction set by political appointees, they still play an important role, especially in agenda setting. Because political appointees have to make decisions across many policy areas, they rely on career staff to brief the issues and lay out the universe of policy responses (usually with a recommendation). Therefore, experienced outside groups also build relationships with the civil servants that work on their issues. Just like with political contacts, they forward op-eds, schedule check-ins, and flag news developments. They reunite at niche industry events and invite them to speak at conferences and on panels. Then, when an agency begins to consider a policy, the stakeholder is (hopefully) a trusted source of information and feedback.

There’s another quirk of the executive branch that helps ally-less outside groups here — the Administrative Procedure Act (APA). The APA is a technocrats’ wet dream: it requires agencies to submit policy proposals for public comment and then respond to comments received. If a rulemaking process is found to be “arbitrary and capricious,” i.e. not reasonably connected to evidence in the record, a rule can be thrown out by the courts. [3] Therefore, agencies engaged in rulemaking have to listen to stakeholders and incorporate their views; civil servants are the staff tasked with this.

To ensure their rulemakings comply with the APA, agencies will issue a variety of formal requests for comment in the Federal Register. These primarily consist of Requests for Information (RFIs) and Notices of Proposed Rulemaking (NPRMs). These public solicitations are important because responses form the public record that affects policy long into the future. When an agency finally does implement a rule, it must refer to items in the public record that influenced its decision. Just because an idea is out in the wild does not mean that it will be incorporated in the rulemaking process; effective advocates ensure that they respond to agency calls for comments. [4]

Tips for engaging

Now that you know how the legislative and executive branches make policy, here are some suggestions for how to productively advance your views. This is not advice on a specific situation.

Engage early and engage often

• Working with policymakers is just like any other form of networking: only showing up when you need something is not the best look. You’ll be much more effective in advancing your position if you get to know staff before you need their help. So look ahead, engage early, and check in regularly with your contacts. [5] A great way to “check in” (instead of just asking someone “hey can we check in so I can tell you what I want again xD”) is to provide some sort of research or observation from your industry. Identify an important trend or conduct some market research and present that to your contacts. That kind of non-public, industry-insider information is always welcome.

Be honest

• When an industry stakeholder lobbies for his or her interest, it’s pretty obvious to policy staff what that interest is. Don’t try to hide it… that looks way worse. Just be up front about your bias then explain to staff why they should still be persuaded by your position. Additionally, don’t lie about anything. Ever. If you can’t or shouldn’t reveal a particular piece of information about your business, your competitors, the market, whatever, that’s perfectly acceptable. Just say so. But don’t lie.

Remember that staff are busy

• Most staff have more to do than they can handle. This is a limit to be aware of, but it’s also an opportunity! The limit: make targeted, specific asks (for meetings, for policy consideration, etc.) and explain your position concisely and directly. The opportunity: if you can be a valuable resource to staff (see: tips 1 and 2), you can become their go-to resource on a particular policy issue. That’s very valuable.

Seek professional help

• US federal policymaking is almost endlessly complex, and with that complexity comes a lot of inside baseball. In my opinion, unless you’ve worked in government, it’s really, really hard to truly understand how policy is made. Maybe that’s not how it should work, but it’s how it does work. If your firm needs help navigating the DC policymaking process, there’s no shame in getting help. You wouldn’t set up your own Tier IV data center; you just use AWS. There are plenty of excellent advocates in DC that can help your firm or interest group. Reach out. [6]

Getting policy implemented is hard. In some ways, this is good. Policy can have big effects, so it’s important to give issues appropriate consideration. Hopefully you now have a better idea of how policy proposals move through Congress and the executive branch and how you can most effectively advocate for your preferred policy.

The effect of the specific policy proposals cited in endnote 1 is TBD. It depends on what behind-the-scenes coordination, lobbying, and persuasion is ongoing (if any). As you can see, getting your ideas into the public is just the first step of a long process. More on how to think about this process to come. Follow this Medium or follow me on Twitter for more.

I do or did work for a US federal financial regulator. I do or did work in Congress. These are my independent thoughts and do not necessarily represent the views of my employer.

Endnotes:

[1] Coinbase — Digital Asset Policy Proposal: Safeguarding America’s Financial Leadership
Jump Capital — Stablecoins: The Impending Rise of a Multi-Trillion Dollar Market
A16Z — An Agenda for the Future of the Internet
A16Z — Our Proposals to the Senate Banking Committee
FTX — Context on stablecoin regulation
FTX — Policy goals for crypto market regulation
FTX — Areas for Crypto Regulation

[2] A “legislative vehicle” is a euphemism for one of a few must-pass bills each year, often funding or the NDAA, that is ripe for being stuffed with unrelated Member priorities in exchange for a “Yes” vote.

[3] The crypto industry benefited from the procedural protections of the APA in December 2020 when then-Treasury Secretary Mnuchin’s FinCEN proposed a rule to require certain information reporting related to unhosted wallets and other crypto transfers. Following a robust public response (much of which pointed at the unreasonable 15-day comment period), the rule was not implemented. If it had been implemented, it would likely have been challenged on APA grounds given the subject matter and abbreviated process.

[4] Over the summer, the FDIC (banking regulator) and NCUA (credit union regulator) both released RFIs on digital assets. The questions were detailed, nuanced, and complicated — exactly the sort of questions that informed industry participants would be best-equipped to answer. Disappointingly, response from cryptonative firms and organizations was limited to just a few groups (see comments here and here). This was a missed opportunity to open productive engagement with these two important agencies, in my opinion.

[5] I think that checking in every 2–6 months is a good cadence depending on how high-profile your issue is.

[6] Remember that establishing a presence in DC doesn’t necessarily mean doing something on your own! In fact, the best course of action for most firms will probably be joining an ongoing effort. There are already trade groups and nonprofit advocates fighting for crypto in DC. Duplicating ongoing advocacy can inadvertently harm progress, so look into these groups and consider contributing or joining.

I got into crypto because it seemed to combine a new financial system with a unique political energy. I want to see us succeed. For that to happen, I believe we need to work with, or at least mollify, the existing US regulatory apparatus. This will require excellent communication, organization, and political savvy.

Unfortunately, in my experience, crypto is woefully underresourced in Washington. That’s not to say crypto doesn’t have great advocates in DC; we do. But they face long odds and powerful competitors. Take what is perhaps crypto’s greatest adversary - the banking industry - which is one of the most powerful political lobbies in the city. They have well-funded trade organizations, longstanding allies, and widespread political organization. They get to explain how they safeguard friendly fiat dollars for middle class Americans. Our folks get asked why 17-year-olds are buying 256-bit dickbutt jpegs on The Dark Web with dog coins.

I hope I can help us. And I think the best way to do that, given what talents and experience I have, is to try to explain some of the intricacies of the DC world to all of you. Read on. WAGMI.

I do or did work for a US federal financial regulator. This is the result of my independent writing and does not necessarily represent the views of my employer.