ep 10 – Crypto Regulations, Illicit Finance, Privacy, and Beyond

Transcript

[Music] welcome to web3 with Asics and z a show about building the next generation of the internet from the team at Asics and see crypto that includes me your host sonal choxie this show is for anyone seeking to understand and go deeper on all things crypto and web3 whether your Builder a policy maker a Creator anyone one big goal of this show is to provide signal versus noise which you'll hear a lot as a recurring theme and also really help people build and think about how to approach innovation in web3 and obviously that involves everything from addressing security and hacks which we covered last week and also high-level policy principles and moves which we covered in a previous episode but in this week's all new episode we not only

dig into the facts versus the buzz on recent news specifically that the U.S treasury sanctioned tornado cash for allegedly laundering proceeds of cyber crimes and then later that the Dutch fiscal information and investigation service arrested a suspected develop of tornado cash but we then also share an evergreen explainer and primer that goes well beyond recent events to help crypto and other Founders navigate and resource various requirements for compliance and more while still ensuring Innovation since it's a longer than usual episode I wanted to let you know I hope you listen to the whole thing but that you can tune in to just the first third for a deep dive on tornado cash including a ton of analysis that goes also into the broader

backdrop and who the players are as well as teases apart sanctions and National Security laws to enforcement actions criminal liability and money laundering and Bank secrecy act or BSA and anti-money laundering or AML program requirements all of which are different things we then do a brief interlude in between on the difference between privacy preserving Technologies versus obfuscating Technologies and why that matters in the big picture and then the second half of the episode Dives deep into understanding and navigating compliance and legal for Builders and we cover their everything from Frameworks and principles common bits and misconceptions when and how to Resource from tools to hiring a lightning round on the alphabet soup of government

entities relevant to this phase advice for both entrepreneurs and government agencies on engaging with each other and much much more and that's all in the entire second half of this episode as a reminder none of the following is legal business investment or tax advice please see asicsnz.com disclosures for more important information and with that our experts for this week's episode joining me are Michelle Korver head of regulatory at Asics and Z crypto former Federal prosecutor who spent time in both the department of the treasury's financial crimes enforcement Network as their Chief digital currency advisor but also spent time in the U.S Department of Justice where she was the first dedicated subject matter expert in cryptocurrency related prosecutions and

forfeitures and then we have J ramaswamy Chief legal officer at Andrews and Horowitz who oversees legal and compliance he was also formerly Chief risk and compliance officer at Sea Labs which launched the decentralized protocol cello Jay also headed or advised on AML compliance and risk management at Major Banks and previously spent over a decade in government including significant time in the U.S Department of Justice Criminal Division where he focused on cybercrime asset forfeiture and money laundering and so with that we begin with the quick big picture backdrop behind recent sanctions before we go into the specifics and then much more a good way to understand this is to back up a little bit and recognize that there

are different areas of law where you're talking about criminal enforcement civil enforcement the courts you know a bunch of of different powers within the US government sanctions powers are firmly executive branch Powers meaning they're really foreign policy powers and what sanctions represent overall is an exercise of U.S foreign policy against threats to National Security it's done through the financial system because of the role that the US plays in the global economy if the U.S does something it generally has broad impact and others will follow the important issue here is that aipa the international emergency economic

Powers Act is the broad authorizing statute and it was passed several decades ago it's been used in different contexts for example many of the sanctions we think of today such as the Russian sanctions Syrian sanctions Etc emerge from that authorizing law but just under a decade ago the government did something fairly novel it issued an executive order under ayiba that targeted the threat of cyber security and it's actually if folks want to look it up at 13694 you can look it up on the internet it was amended on December 29 2016 so it would have been during the Obama Administration and what's different about this particular executive order is

although sanctions still are and have primarily been focused on financial activity this really put a different spin on the way sanctions are imposed because it really focused on those cyber related activities that potentially were causing National Security harm so then how does it connect a tornado cache specifically and like what's going on right now like why now with respect to tornado cash this particular designation is done under that cyber security order given the threat that the government believes that that poses to National Security because of its Nexus at least from what we publicly understand to North Korean hackers who are monetizing cyber crime

to pay for things in contravention of international law such as its nuclear proliferation program other things yeah I think it's also important to consider the political pressure that agencies may be under in order to find some sort of solution to the aggressive activity being committed by North Korea in the direction of our country and in financial systems I agree with that and the ransomware problem the ransomware problem is a big problem that the government is very very focused on and is worried about in a big way in cyber crime there's been sort of an evolution where if you think about the early day days of cyber crime I'm going to date

myself here but you think of Matthew Broderick you know or get a whopper or whatever the name of that computer was over time cyber crime has really morphed into an illicit underground business that's run by organized crime on the one hand yeah and nation states on the other that basically use their relationship with organized cyber criminal organizations to give themselves some plausible deniability and distance and so a lot of what has happened in the cyberspace over the last several decades has been a move from a sort of primarily criminal prosecution model to almost an interdiction model where you may never get your hands on the person behind the keyboard so how do you work with

criminal prosecution in that context right and so you had a number of tools that were developed to address this the government started forfeiting for example domain names that were associated with cyber criminal activity it began as we have just said using sanctions to identify State actors that were behind some of these threats and that's kind of the context for what this is a simple example of sanctions in the Cyber related activities context could be a state actor group that gains unauthorized access to say Department of Defense or some important military contractor computers not even a hack or a theft but the intrusion alone

accessing very important National Security information or classified details of some weapons system Etc then you would be able to identify assets or property just blocking or freezing so they don't have access to the system but in other cases if the Department of Justice was able to establish a civil forfeiture case against the property itself or a criminal forfeiture case where they actually had a person that was charged then you actually legally could take title of the property money luxury yacht and take those assets away from them

it's important to know that treasury does not have authority to legally forfeit assets that comes from a series of statutes where there has to be evidence to prove that property that's being seized and forfeited had some touch on illegal activity and so blocking is similar to seizing and that the person may not be able to have access to the funds but there is due process before assets can actually be taken again so it's twofold preventing them from accessing the financial system and touching the United States Financial

system specifically but also depending on the evidence and the circumstances being able to take those assets away from the offending parties very helpful so so far I've heard the context for where these original sanctions came from the shift to cyber that was super helpful and then the third thing I want to just quickly check on now is when it comes to what happened recently what actually then did happen this part is not clear to me so what actually happened to the developer of tornado cash like what is the fact because the narrative out there is like oh my God this is being illegalized and that is being legalized is it a lawsuit is it a sanction is it an action is it a I don't even know what the it is like it's very

lost actually in the murkiness of the narrative out there it's really an action that's brought by the Department of Treasury and it's imposition of economic sanctions under this Authority delegated to the president in labor and the national emergencies act the Nea and in effect what this action did was list or designate both tornado cash as well as a number of wallet addresses associated with tornado cash on What's called the sdn list or the specially designated Nationals list sometimes it's referred as The Blacklist yeah so I

think the important thing to recognize about sanctions is that sanctions block property so in other countries they're sometimes called blocking statutes or embargoes to Michelle's earlier point that is a purely administrative action the U.S doesn't get title to those assets it's blocked in the financial or other institution that has it and they have an obligation to segregate that property in order to know that it exists and the reason for this is if at some point the sanction is lifted the property goes back to the individual so sanctions don't change property rights all they do is you no longer have access to the property and you can't use it financially to do whatever you've been

doing the government May then at that point have sufficient evidence to bring a forfeiture proceeding which is a formal legally recognized proceeding where you go to a court of law and say that this was criminal proceeds Contraband or or the proceeds of a crime and the U.S will then go and Institute a formal Court action to seize that property if they do that then it becomes U.S property under long-standing forfeiture laws that go back to I think the admiralty days but it's important to distinguish between that administrative action which is effectively what treasury is doing with sanctions and a legal action which is what forfeiture is and then if the

justice department chooses to bring a criminal action against an individual because they did something that's a crime that's a separate set of rules so it's important to understand those distinctions and one of the important distinctions that makes this particular action a bit novel is that there aren't individuals that are named so for example there are many people that have stated that the developers were blocked that's not correct what has been blocked is the URL and those ethereum wallet addresses that facilitate the use of this service so there's been no individuals that have

been designated and so the designation is really similar to bank accounts because the wallet addresses are locations or code that facilitate both the holding and the transfer of Assets in this case cryptocurrency Michelle if I remember correctly too it was novel in that for the first time back when ofac designated wallet addresses which I think at the time was considered helpful to the community because it gave people a specific thing that they could look out for on chain as opposed to something a little bit more more nebulous where you had to convert what was on chain with what was off chain exactly and what was interesting about that was that the

wallets in that context were really very similar to what we think about as far as a bank account attached to a person because the wallets were attached to either individuals or group of individuals that had been somehow identified by treasury is involved in illicit Finance or some type of national security threat activity and so then you're just designating those wallets which are going to be in this context akin to a bank account that belongs to particular actors what does ofac stand for can you say that really quick it's the office of foreign assets control and it's an agency well rather it's a section within the department of the

treasury got it I think the other part of the narrative that's been coming up is sdn the specially designated Nationals list you know the quote so-called Blacklist a dozen is entities whether they're people or companies and orgs but it doesn't actually designate code so what is the first time here like is it code that's being sanctioned or is it just the wallet address is it the tornado service like what is happening here and if that's actually new or not so it's new in that the addresses operate in a way that is different than Bitcoin transactions do so we've seen that Bitcoin addresses have been designated

in the past but in designating addresses that operate as smart contracts that's where this is different even though it's still designated an address if that makes sense it's not a wallet address in which there's a private key holder who controls it exactly like there isn't a controlling person behind it and then just the other question on what was novel about tornado cash and what wasn't can you guys give me like a bottom line the not novel part is actions against mixing Services I think the government has foreshadowed for many years that mixing services with a lot of illicit activity going through them is a risk

that they are going to move after the novel thing was the designation of wallet addresses that are smart contract addresses what was novel to me was that the designation wasn't attached to a particular person okay so what actually happened with this arrest in the Netherlands because on one hand we're saying that okay you know people aren't being targeted there's no single owner but then the word is that a developer of tornado cash was arrested in the Netherlands so what's actually going on there yeah that's interesting if you look at the language from the press release that came from the prosecutor's office in the Netherlands it tells you a lot what was reported last week from the

Dutch prosecutor's office is that an individual was arrested in Amsterdam so the individual is identified as a developer of tornado cash right and using tornado cash but what they say is that he is suspected of involvement in concealing criminal Financial flows and facilitating money laundering through the mixing of cryptocurrencies through blah blah blah the site so to me the way I read that as a former prosecutor is that it's incident Channel and I may be wrong but I read it that it's incidental that he happens to perhaps be a contributing developer to this project

that in fact they have charged him with some type of actual money laundering that they have evidence of and that he is alleged either in whole or in part used the service in order to commit that money wandering and I think we'll know a lot more once they actually go forward with court proceedings and some of the charging documents are released okay so to recap so far we've teased apart what's fact versus noise and the narrative out there with this tornado cash situation we also share the broader policy and legal and historical backdrop and before we go into the next section where we really just try to help navigate compliance for startups and others especially as it applies to

crypto like sort of a primer and a how-to let's spend a few more minutes on just similar past actions in this space because I remember you guys mentioned in some internal meetings that there's actually been some interesting past examples as a comparison and a contrast and we can also actually dig into more about what's really novel there or not and also into this question of whether they're really targeting code so to speak but first I actually want you guys to Define what even a mixing service is you guys have both referenced that a few times and I actually don't know what that is and I bet not all of our listeners necessarily do either also we never even actually described what tornado cash does so let's just start there real quick yeah tornado cash is a mixing service that you uses smart

contracts to essentially mix assets digital assets cryptocurrencies from different sources if you think about the way that most of these crypto networks record transactions most record transactions in transparent public ledgers as you may have heard that's actually a benefit to law enforcement to Regulators because they can actually Trace proceeds and it's assisted law enforcement in unraveling cases of scams and others where they've been able to identify and at times you know recover proceeds from illicit activity so on the one hand transparency is great on the other hand if you're just a legitimate individual you don't

necessarily want everybody to know everything you've transacted on the blockchain particularly because once you send one you know crypto to somebody else's wallet they know who you are and then they can track and Trace everything that you've done and so mixing Services arose as one way of obfuscating your transaction history so it wouldn't be apparent to everybody on the blockchain and do you remember those drums that people use like in Bingo yeah think of a mixer as that essentially you just throw a bunch of ping pong balls in they're all unmarked you don't know which one you've put in and which one you've taken out but that's in a nutshell that's what mixing is it's just putting a bunch of assets in a single kind of pot so that you can't trace what went in and what came

out in the same way that you can with a transparent public Ledger now you can also see that criminals would find that to be very useful as well and so it has legitimate uses and it has illegitimate uses I think we know even from ofax releases on this that there was a lot of legitimate activity that took place through tornado cash but there was apparently some significant amount of of illicit activity the one thing that it's important to recognize too is that mixing and privacy per se is not money laundering they're not the same thing Jay is exactly right that using a mixing service in and of itself it is not

illegal where we have seen law enforcement look at use of mixing services in the context of say criminal investigations is where the mixing is one part of many steps that individuals have taken in order to conceal assets that they have evidence comes from illegal activity you could have totally clean assets that are being mixed for a variety of illicit reasons you can also have use of the mixing service to conceal or try to somehow make clean or appear to be clean assets that are dirty from the start so that's an important distinction is that use of a mixing

service may show up say as probable cause in an affidavit for a search warrant or for a seizure warrant but you're looking at unlawful activity and illicit funds to begin with and then a prosecutor May rely upon the fact that a mixing service was used as one of many things to circumstantially prove that the person's intending to launder the funds if that makes sense it does make sense and that was very helpful but also defining mixing services so to talk about some of the prior treasury actions against mixing Services we can look to Helix a dark net mixing service and the way it worked is that the individual was actually

advertising money laundering services on darknet markets the individual also had interestingly another kind of attached business which was kind of like a Google for illegal activity kind of like you would have ad clicks what's different about this situation from the Helix action the individual as well as the website being shut down by law enforcement there was an enforcement action and brought by fincen the financial crimes enforcement Network a different Bureau within the treasury than ofac as well as a Department of Justice indictment that was brought for operating an unlicensed money transmitting business and so that that

was different because there was an individual that was identified who was actually operating the website had some level of control over transactions had Financial benefit from transactions that run through the mixing service and then the cherry on top for why he ended up getting charged and had a civil enforce in action brought was that he was advertising money laundering services on the dark net to criminals operating on various darknet marketplaces that many of you have heard about that's great and then you want to do the second example really quick okay blender.io was a mixer and it basically mixed assets from a bunch of different people so you

couldn't tell who had sent money to the mixer and who had received it on the other end but there was active involvement by individuals in that mixer and who controlled keys for example to that mixing service my understanding of blender.io and this came out in the subsequent things that happened I think the reason it caused less consternation within certainly the crypto Community was that there were identifiable individuals there who had set up wallet addresses and they had in a sense custody of those wallet addresses and were actively involved in the mixing of the various assets that was kind of what blender was and it was designated as a

mixing service along with a series of wallet addresses as well as the website but blender was a designation Helix was a slightly different action yeah the difference here is that Helix was a civil enforcement action and a doj CR criminal case that was brought it was not a sanctions case but what's important for understanding the differences between what happened here with the tornado cash sanctioning is that they were both providing mixing services but in very different ways in the sanctions action there has not been any individual that has been

identified as being added to the designation list whereas with the Helix case in the criminal and the Civil enforcement action there was an individual identified as facilitating the activity the kinds of criminal cases and fincen actions that Michelle just mentioned those are brought under the set of laws described as kind of the AML regulations broadly speaking and it's because treasury has taken the position that those services are money service businesses that have AML obligations and so therefore they're open to the kinds of actions that Michelle just mentioned a moment ago

the difficulty here is that those examples were almost all centralized systems not decentralized systems what's distinct here in tornado is that that set of individuals don't exist in terms of administering or getting involved in the mixing of the assets if you will in a very simplistic way all of it is done through smart contracts and it's unclear the extent to which anyone has administrative key access to the assets of those smart contracts and the reason that that's important is that ofac sanctions typically look to property interests and who has the

property interest in that particular asset to determine whether assets should be blocked and so we're a little bit in a novel area here right there are some new things that have to be teased apart in terms of what does this mean what assets are actually being blocked is this mixing service a proxy for an unincorporated set of individuals that are behind this code the code is a service that's run by those individuals in in ofax mind or is it really targeted at the code and it's unclear the construct that ofac has in his mind but those are two very different constructs

a service run by a set of people and a smart contract and code and the open question is were these collateral consequences because there was something bad that treasury just needed to address or did they think through exactly what they were doing and intentionally designated smart contracts addresses they're two separate views of what treasury is doing I think that ofac saw that there was activity that was concerning going through these addresses and the website and they were looking to shut down activity without perhaps having the ability to take an action as

you traditionally would where you've identified an individual that's actually in a central way running a company or a business or financial transactions Etc and perhaps not considering the peripheral effects that such a designation would cause I mean there are two things you need to crypto here one the decentralized nature of it to the composability aspect of it that people mix and match different pieces of code throughout the ecosystem to build things so those are two key considerations and some Uncharted Territory there so given that one point you brought up is the difference between privacy enhancing versus obfuscating things and that there can be very different goals when it comes to that you kind of hinted at this both of you a little earlier but I do

want to go into that for a couple of minutes and then I'm going to go into then the big picture of just like the why the how the what sure if you think about the way we today comply with AML requirements one of the big things that we always hear about is kyc or know your customer customer due diligence customer identification the basic idea is that a financial institution and doesn't have to be a bank it can be coinbase it can be something in the crypto sphere needs to know who you are before they open an account or a wallet address for you and the way we've typically done that is we collect your ID we collect maybe a utility bill or two that establishes who

you are when you were born where you live basic kind of attributes of who you are as an individual you are you are who you say exactly and on the one hand that obviously allows a bank to do screening against you and figuring out if you're a bad actor or some other reason they wouldn't want an open account for you on the other hand it also produces a Honeypot of information so you now collect this on your millions of customers and you have these databases that become targets for hackers who actually would love to have that honeybot of information because they can monetize it through fraud through phishing through a whole host of other things and the crypto context it's even more dangerous because they might be able to get your private key through a phishing experiment and then take all

your assets and so the thing that we do to protect the system the financial Integrity from the system also creates a vulnerability but you have now constructs within cryptographic techniques like zero knowledge proofs where I don't need all that underlying information I just need to know that you've passed certain tests and that can now be published and tokenized and as a result we both protect privacy meaning we protect my individual identity from being stolen while at the same time giving compliance officers and others in Banks the requisite Comfort they need that I'm not a bad actor and so some of these new technologies can square the circle

whereas before there was a binary choice between revealing all your information therefore overcoming privacy and on the other hand preserving information and not allowing compliance we can now think of of maybe that as a false binary choice and that there's a way of doing this in a better more proactive way and privacy enhancing technology can actually be used to solve some of the AML program requirements the ability to make sure that financial institutions are able to verify their customers and know what's going on in their platforms in order to avoid illicit activity from

occurring there one of the Privacy enhancing Technologies is the concept of digital identity and that an individual could be verified without having to reveal their name and date of birth and all of their information every time that they're touching some platform one of the cool things about the promise of this new technology is that it reaches Way Beyond what we look at from the context of it financial institutions and and financial activity something is simple and I use this analogy sometimes when I'm talking about the idea of tokenized either Identity or data points Etc where say you have to check to make

sure a person is old enough to drink to either buy alcohol or get into a bar you wouldn't have to show a driver's license that has all your information you would just have some verifiable token that actually says this person is old enough to get into the bar or to buy the alcohol one of the things that I think about it maybe this is this is silly but remember the episode with Elaine when she went to I think it was a dermatologist and offended the doctor and then basically her chart followed her with all the doctors so that they all had had put her down as like a bad or offensive person and she either couldn't get an appointment or they were rude to her and that's so funny that you actually like even could control who

gets access to your health records that it's not out there with all of your information for everybody to see but that you could just release certain information I think that that is amazing separate from you know what I primarily focus on and that's the financial activity yeah and I think that becomes really important particularly in a blockchain based world because if you think about it in the earlier World privacy was kind of the default setting information was kept in siled and private ledgers that weren't publicly exposed and then we put a bunch of human controls on them to make sure that nobody could get access of course those have proved vulnerable by cyber criminal but nonetheless privacy is default but

in this new world where information is accessible public on the blockchain you actually need privacy enhancing things to just return us to the default settings that we had in the traditional Financial system right and these technological possibilities now exist where they didn't really exist before and that needs to be explored both by technology folks and developers but candidly by The Regulators who may need to adjust their Frameworks to take into account that there may be better ways of doing what we thought were a good ways in the past right right and just because in Big Picture context around this back in the olden days whenever you needed to like open a bank account you could go to your local person trusted Banker they know your family they know your father's

father and you can operate in trust then we move to a system where we're transacting with strangers But Central authorities are providing that trust that gets to the human controls that Jay talked about now with decentralized systems we are actually enabling people to collaborate and coordinate at unprecedented scale around the world and that obviously requires new ways of having boat transparent information which allows you to do that but also enhancing privacy for certain information so you're not revealing and that's again the pull point of zero knowledge is to be able to prove that something is true or not true without actually revealing the contents of that information itself and that's a very very huge to your point Jay able to help solve some of these like binaries that

we used to have for me I think it's very fascinating because it does enable new forms of coordination because even on the financial level Michelle when you guys are describing the mixing Services I had a reaction to that because at the end of the day it's not just about whether people are in crypto like even just a regular credit card statement all that information reveals so much about you where you go where do you eat what do you buy what do you shop what do you like what do you not like and I think people really discount that there's a lot of information being revealed in that so I just want to make sure I put some big picture context around what we're talking about when we talk about even not revealing one's transactions why that's not a bad thing yeah and I think you raise a really important issue

around our privacy Frameworks most people don't recognize that we have something called the right to financial Privacy Act which actually formally I did not know that formally protects fine Financial privacy was passed in the 70s I believe and the idea was that we actually do think that Financial privacy is important I think what we're finding with all of our privacy Frameworks is that they're breaking down they first broke down to your point so when we moved to an internet-based e-commerce model right where data exploitation was the way that we monetized um platforms and as a result there's a ton of information out there that if anybody looked at they could know exactly who you are and a lot of the

constructs that we've used to maintain that basic privacy because it was really around financial institutions really we don't have a ton of protections around them and so I think we're going to have to think about new technological Frameworks of the kind just discussed a moment ago and maybe new constructs as well from a legal and Regulatory point of view that recognize that these are adequate ways of protecting privacy and it's okay that they're not fully transparent because they still achieve the compliance outcomes we want the one caveat I would put in here is that an important function of some of these regulations is making sure that law enforcement has access to the information if they have appropriate

process whether a search warrant or a subpoena Etc but these Technologies also provide the ability to have selective disclosure with authorization yeah great so going back now to this whole big picture and you know to kind of give a high level framework this is a really helpful framework I'm going to borrow from Dixon which is they're kind of three broad categories like earlier we were talking about concerns of National Security things that are international sanctions and concerns there then there's just following laws that have to do anti-money laundering AML and kyc know your customer and then there's obviously a separate whole bucket of just Securities laws in general we're focusing on the first two in this conversation let's now Focus for Founders on what do they need to know

like kind of give me Frameworks that people should be thinking about how do they even approach this topic because honestly most of our people do not have like expert legal counsel in-house and as much access to the people that we do in our Network including experts like yourselves I would love like a primer from you guys on what these buckets are how they fit together obviously this is not legal advice but let's give some people some ways to think about things I've been thinking about these buckets and I think there's really four so you've got those entities or individuals that may be on the sdn list and those are the designated individuals or entities then you've got what are the obligations and who's obliged for making sure that

you don't have any touch on those listed individuals entities in this case recently while IT addresses and then you have Bank secrecy act obliged entities which could be a whole range of business models most familiar would be financial institutions such as Banks but also exchanges and other types of custodial wallet services and then the last bucket that you have is just money laundering criminal liability which doesn't depend really on if anyone's on a sanctions list or whether or not you're obliged to do any type of reporting or register with anyone or or conduct kyc so those are I

think the four buckets and when you look at companies even if you are not a business model that is a bank secrecy act obliged entity you still need to make sure if you are touching transactions or conducting any type of economic activity that you're not interacting with any of those persons while IT addresses or entities that are actually on ofax estan list that's very helpful Michelle Jay how would you break it down so I would use a slightly different what I would say is that you've got three kind of legal regimes to think about one of the sanctions regimes that we talked

about with respect to tornado cash and the purpose as I mentioned before of of sanctioned regimes is to identify countries entities and individuals that the U.S deems dangerous to some National Security interests and to block their assets so they don't have access to the U.S financial system to conduct illicit activity whatever that is and then you've got the kind of AML compliance regime which is really around a limited number of actors who are essentially intermediaries and largely Financial intermediaries who hold assets on behalf of others and we've put into place something called the bank secrecy act which is actually a series of laws

there's no single Bank secrecy act it's the dirty little secret oh that's actually good to know it sounds like it is it's actually a series of laws that started in the 70s were reformed in the 80s and more recently culminated in The Patriot Act we all know about the notorious Swiss banks in the 70s and how they use customer privacy as a shield to maintain illicit funds in their Banks and the idea of the bank secrecy Act is we're going to require Banks to disclose things about their customers to law enforcement so that they can do appropriate investigations and that's the purpose ensure that law enforcement has access to info information about customers so that they can conduct

investigations about criminal activity and so that's a compliance regime that's imposed on intermediaries and then there's underlying money laundering which is it's illegal to conceal the source of proceeds if they're illicit activity if they arise from illicit activity and so there's independent criminal violations for drug trafficking for child trafficking and trafficking in persons for you name it you know gun trafficking robbery there's an independent set of laws that make it a crime not just to conduct that activity but to also conceal proceeds from that activity and that's what we call money line right washing the money

to make it look like it comes from legitimate things and that doesn't require anything you can be guilty of money laundering without being a financial institution and in fact there's a series of of cases which I think Michelle could even describe in better detail than I where people like money mules don't really know that they're transporting drug proceeds but that's a criminal violation and so if you're an entrepreneur you want to figure out what is your underlying course of risk do you have a fear of bad activity coming through the things you've produced and if so even if you're not a financial institution with like BSA AML obligations you might still have underlying money laundering risk and

then the sanctions risk we talked about before which is attaches to any U.S person and these aren't compliance obligations per se they're just underlying obligations to ensure that you are not dealing in illicit proceeds so that's kind of how I would put the three buckets they overlap significantly with what Michelle said but that's that's the way I would construct it I liked the way he articulated this but what I would flush out a little bit is that when we look at the sanctions bucket and that businesses need to consider their exposure to liability with treasury for this it's not about worrying about going to jail because that requires willful activity but unfortunately the Civil liability for an

enforcement action to be brought if a person interacts with a sanctioned entity is strict liability which means you don't have to prove that you intended to do it you just did now that doesn't mean that the treasury is going to come after and they don't have the ability to come after every single person that potentially might touch whether it's an account or a person or a business that is sanctioned or an individual that is from a sanctioned jurisdiction such as North Korea but it does require that you actually evaluate that risk and that if in fact you determine that that has occurred there is reporting that's required and they're

really really steep fines for a finding that you violated those sanctions but again you know we hear people very very nervous about being charged with sanctions violations and going to jail and that requires willfulness that's a criminal prosecution as opposed to an enforcement action which would be brought Thoughts by the office of foreign assets control relating to strict liability you in fact did have a touch on some sanctioned entity so sorry I just break it down even kind of bottom line it very simply is the difference between the Civil enforcement and the criminal that one is intended and the other is you just did something yes okay that's super helpful and then the BSA and AML requirements

are just compliance that are required because you just have to show that you are following the money essentially that is not like it's attributed people are saying who they are yes it requires you to do something proactive in order to be compliant and it would only apply to those entities that actually are obliged under the law right right the the things that Michelle Drew is important but people should understand also that like even just an ofact violation is a serious thing they're both pretty severe consequences but I think it's important to draw that distinction between a criminal violation which involves potential jail time and money and a kind of administrative violation of ofac which is still serious because it

involves uh significant penalties and reputational risk candidates right you don't you don't really want to be associated with having an ofac finding against you that can cause all sorts of other things and one of the serious repercussions reputationally well it's not really reputationally but you know you could have Banks deciding to sever relationships and not offer you banking services because you have had an ofac action brought against you yeah I'll say from having been in the financial system you won't get a bank account if you have an OPAC violation against you you're pretty much cut off from the financial system at that point you are literally blacklisted in that way too so it's both the really high fines no slap on the

hand fines in these circumstances plus reputational risk plus potentially difficulty in actually doing business with the rest of the financial system so going back to the taxonomy you guys both did which I thought was very helpful because the way I read it is that Jay your taxonomy at that sort of just targeted what are the categories more oriented you know high level how does the people who are the lawmakers and policy makers think about these things what I found helpful about Michelle's framing complementing that was it's sort of what you as a person building have to think about it's almost like an inverse so Michelle took it the other way which is a little bit like these are the categories you have to think about as a builder because you're either building something that can touch something

you're building something that you have to protect the information Etc et cetera I would use them both and the reason is I think people will be interested in the high level but I think that they're going to want to know like where does my shoe pinch so I'm sitting here I'm trying to do the right thing I'm trying to build a protocol how does this impact me so along those lines let's actually bottom line it for how does this actually translate into practice for someone who's a builder what should Builders do because honestly that sounds like a lot to track frankly you're trying to build you have a lot of stuff to do you don't even have resources people always talk about how compliance in general is already a heavy-handed thing for small startups to do because you don't even have the

resources to do a lot of these things and you're trying to innovate which is a good thing so what would you say to help people navigate that like how should they think about it what are the questions they should ask and what are the things that they need to do the advice that I always like to give is if you are not operating as a money transmitter or providing Banks or custodial service where you would have a requirement to have a full anti-money laundering program um but you're going to be having transactions that are going to touch your platform you want to consider getting some type of sanctioned screening service to protect you that's the advice that I would generally give because you have that potential liability as an

individual or business operating in the United States regardless similarly I think that's why you see a lot of companies gravitating to like these blockchain analytic companies to just get a risk assessment of should I be worried about what's coming across my platform because if you are running one of these protocols or or you have a project in place that's the thing you need to worry about it's not the kind of compliance issues where it's unclear whether they apply or not and you can probably figure that out it's what's that underlying risk of things actually happening on my platform things like the bank Secrets reactor about a compliance framework and they're intended to control an underlying risk the money

going through the system and so I always want to control for that underlying risk I want to understand what are the touch points what are the things I worry about Bad actors coming across my platform and what can I do to monitor it and if you see a bunch of stuff coming across then you'll have to have that next question which is can I do anything about it what should I do about it but having the visibility that's the thing you should be controlling for and thinking about and the nice thing is is there are so many third-party services both for sanctioned screening and if the risk or your activity Rises to the level that you need to have more compliance so even for smaller companies or earlier developers looking out into the market

to see who provides services is really a good idea and there are lots of choices that's really helpful so far the first level is you need to be aware you need to mitigate the underlying risk I mean you need information to understand it and then you can also have like sanction screening blockchain analytics a combo of these services in order to help you identify that so that's step one what would the next thing be I would say that you could even take different Acts questions and by that what I mean is there may be an ability to have frictionless transfers for example without very many controls below a certain dollar threshold so let's say you're below 300 it's a low risk because you've seen kind of what your risk

characteristics are and you can say you know what I can have different levels of controls and so to make sure that most users are okay maybe below a certain dollar threshold is fine because the risk of money laundering and sanctions of Asian increases with dollar amounts right and maybe as these amounts get higher I can put in place stricter controls but that gives you a differential ability to say yes I can maintain kind of frictionless transaction for really low risk low probability events and for higher risk higher probability events I have more controls in place and can people know that up front or do they need to run the analytics can they like have a position on that before they go in as builders you might but you just have to be open to the possibility that

your priorities may be wrong so you might think oh well this is really low risk who's going to want to use my platform and it's really targeted I have good intentions and it's targeted to you know helping to disenfranchised so I don't need to worry about this stuff but without the data it's just hard to know criminals are really smart at the end of the day yeah these are all really facts and circumstances based evaluations in the same way that the government when they're looking at how they're going to classify business or whether to bring an enforcement action companies also need to really look at their facts and circumstances because anytime that you have a transfer of value you have the potential that your platform could be

used for money laundering that said there are certainly going to be certain types of either activities because of the types of people that may be interacting or as Jay mentioned the threshold amounts that are being used that would actually make it a very low risk that you would have any illicit activity touching your platform and I would add that the government recognizes in all of these contexts that what we're engaged in when you're talking about the transfer of financial value and illicit Finance is a risk management exercise there is not an assumption that we're going to eliminate illicit Financial transactions to zero absolutely not because you could do that in the same way that you could prevent cyber crime

by completely disconnecting all computers you're never going to stop people from engaging in fraud no matter what the method is it's a matter of being responsible in the ecosystem in order to try to reduce it to the best of your ability and I always put it in this construct if somebody from the government called do I have a credible response to say Hey you know I was doing something and understanding the risk and these are credible and reasonable steps to take it doesn't have to be Draconian it doesn't have to shut down your business but these were credible reasonable stats to take and then we can disagree about what the level or anything else but that's a conversation

I'd rather have than saying oh yeah I knew there was kind of a risk but I didn't really do anything I didn't think it was my obligation to do anything about it those are just two postures it's a practical piece of advice if I had to have one of those two postures I think I'd rather have the former than the latter the former is an easier conversation and you'll find that people understand that this is risk mitigation not risk elimination and that's what entrepreneurs do all the time right that's what they do for a living I want to actually flip that because entrepreneurs it's interesting because entrepreneurs come at a position with a more proactive like let me change the world into what I want it to be reshape it into some new vision versus a defensive position of protect and

preserve it's more you're actually disruptive by Nature means you kind of have to I don't want to say break the rules but you're breaking conventional Wiz wisdom in many cases which is honestly how much and most innovation has happened so along those lines just to kind of mentally flip that model for a moment how would you talk to entrepreneurs about why bother Beyond legal reasons and compliance reasons look I think systems that have higher levels of financial Integrity generally are more trustworthy and if you think about the thing that we're trying to establish in this ecosystem it's trust I'll give you a example there are some jurisdictions in Africa that we used to

deal with when I was at cello where you would think that the reason that kyc is required you know your customer rules are required is because the government is saying it but what we found was that in some of these jurisdictions because the level of Fraud and scams had been so high if you didn't have that in place a lot of customers just didn't trust you they didn't actually want to use your platform because they they had been victimized before and so as you're thinking of how you improve trust in the system as we go more mainstream part of that is making sure that these systems aren't being used by Bad actors where people can be victimized in various ways so it's trust creation that's the way

this should be thought about is forget about The Regulators forget about everything else but how do you get people to adopt this stuff and trust that they can use it without adverse consequences and I would say that that's should be a one of the guiding principles and to our previous conversation you can actually use some of these Technologies to do it in a better way so where people can push the envelopes is to see things as not necessarily as purely legal or compliance obligations but engineering problems that can increase trust in an ecosystem that's an exciting problem to solve one note on this frictionless comment you know earlier in its anecdote about how sometimes it's about figuring out a

tearing of things like you want things to be frictionless for the users because just to be very clear that's about building things that are easy to use because people are never going to use a product that's too complex it's a ducknell for a product so there are things to think about there to make things frictionless but from the internal point of view like when should they start building for these things and how should they embed it at a product level should a startup's first hire be a chief compliance person like when should this kind of Staffing come in there's two different questions there but I want to answer both of them yeah many people do not need a compliance Department because of what they do so I don't think that's going to be your first Focus your first focus is probably talking to good lawyers who are

familiar with the regulations in the regulatory environment that are going to apply to the type of activity that you're engaged in and so it may not be that you need a general counsel right away but certainly Consulting with outside counsel that has expertise in the area of activity that your business is going to address that may have some regulatory requirements I was going to add a very small caveat which is when you're in riskier more nuanced areas you may want to it's not necessarily your first hire but you may want to prioritize the higher ring of an experienced in-house person but it depends on the business that you're in the riskier you are the earlier you're going to want to maybe bring somebody in the house agreed and the risk is it

proportional to the amount of value flowing through or is it proportional to the type of business you are the type of business is the most important thing because that determines the types of money flows it's not the volume of money it's the types of money flows that you're involved in right and then the last question along those lines how much should or shouldn't that be built into the product decisions and I know this is really a builder decision but have you guys seen different models for how people embed this like do they build in this type of thing at the product level is it an after add-on I think having these consultations while the products being developed is probably a great idea because again if certain things are not anticipated during the design and the build it may be harder to

go back and change it later as much as you want to you know build without the interference of attorneys saying no don't do that it really actually is going to be better from a financial perspective particularly if it's something that has to change the product or the way you deliver the product drastically later you can save a lot of worry and likely money by actually having those conversations early during the build phase yeah agree 100 and this is where I think expertise not just in like what we're talking about in the substance but you know advice on when is the right time to bring in counsel who are the right people because I think it matters like you can have lawyers who

are constructive and those that are not so oftentimes the Personnel decision is the important decision it's not whether to it's getting the right person who understands how to work within a commercial environment right in a collaborative way versus adversarial that's right and that's something that folks whether they're good Venture capitalists without other people in their Network identify the right people to play those roles because not every lawyer is equal and some are more sensitive and nuanced and understand how to make a decision that helps the business develop whereas others can be a little bit more resistant to novel approaches and ideas and so really choosing the right people from whom

you're getting that advice is key entrepreneurs should rely on their networks and on people who are knowledgeable about these sorts of things to make sure they're hiring the right types of people for these circumstances are there just common myths and misconceptions just in general when it comes to Founders navigating these topics the one thing I would say is the government is not a monolith and I think that there's a assumption that there's the government especially in the U.S there are multiple agencies with multiple competing missions and that's the important thing is each of them is empowered to follow their mission sometimes the exclusion of others oftentimes they're working across purposes with one another and you just have to understand who you're dealing

with in order to be able to navigate appropriately can you give me a quick alphabet soup like what are the agencies involved with sanctions what are the agencies involved with kyc AML who should people know when they hear the acronyms what do they sort of cover just kind of give me like a very high level start off with ofac okay so yeah so the office of foreign assets control referred to as ofak it falls under the under Secretary of terrorism and financial intelligence you know it sits as an office within the department of the treasury and interestingly it started in some other format with a different name during the War of 1812 related to I believe protection of some Sailors against the

British government and there was also mention of some type of sanctioning against the Confederacy relating to Civil War assets so this has been an entity that's been around for a while and evolved in many ways yeah it administers and enforces economic sanctions programs primarily against countries and groups of individuals and all U.S persons must comply with ofac regulation including all U.S citizens and permanent residents regardless of where they are located is there any other big agencies people should know of when it comes to this whole sanctions dialogue as related to tornado cash and anything like that well any action that's broad is done in consultation

with the Department of State so the U.S state department and criminal prosecution for violation of sanctions is brought by the Department of Justice got it okay that was sanctions and National Security related now AML and kyc what are the main entities and players that we should be aware of here the bureau within the department of the treasury responsible for administering the series of laws called the bank secrecy act which sets forth the requirements for a risk-based approach and all of the AML blah blah blah is the financial crimes enforcement Network referred to as fincen for short the Department of Justice prosecutes

violations relating to AML compliance deficiencies I have a really hard time believing it's just one because I feel like is that really like it weren't there more people to worry about we've got state agencies there are some state requirements related to money transmitting laws in addition some of the other Regulatory Agencies require the companies that they supervise to have certain AML compliance requirements in place so an AML violation or deficiency could be raised in the context of say the OCC the officer of the Comptroller of the currency in the context of their supervision of say a bank I think it's

less important for the crypto although for banks or anybody who has a bank Charter the fed and the OCC are the big gorillas in the room like they're the ones who right examine you and bring deficiencies against you and then doj comes in if there's a criminal violation so those are the three that you typically deal with at Banks and that's where the ones the crypto companies that have Bank Charters but for everyone else they probably engage the most Jensen that's right yes because they'd be considered money transmitters if they are BSA obliged got it and is there anyone else I mean this is just we're just talking about the domestic Authority certainly there are equivalent authorities internationally that depending on the countries handle these things very similarly to the Department

of the treasury right but what would you say that Founders should know about that where should they start the most important International bodies tend to be the monetary authority of Singapore which is very forward-leaning in this space and there's quite a bit of crypto activity in Asia and they tend to take the lead in Europe it tends to be the FCA the financial conduct Authority in the UK I would include the European commission as well the European commission has a whole set of Standards around cryptocurrency activity yes and then I would say there's obviously a big standard setting body the fat if the financial action task force which is not a regulator person say but is a standard setting body with teeth it sets

standards for governments to follow and you can be kind of gray listed or blacklisted by them if you don't Implement their recommendations appropriately I would add that you always have to be aware that the circumstances change and you just have to be really aware of the policy environment and something that seems like a really good decision at time a just has to adjust to the reality of the policy and the enforcement environment and the risk that's associated with it I completely agree with that it's a moving part depending on you know changes Administration different Power changes within Congress and people coming in and out of positions of power within the

government you could plan to do things one way and then in a minute it can all change so I think trying to be open to being aware as Jay mentioned and then being ready to be nimble so Michelle you've worked in law enforcement and really helped with major criminal violations and government level things you probably can't talk about a lot of that I'm sure neither of you can Jay you worked at startups before that you've worked in you know you've covered on book compliance side policy side and institutional side Finance system along those Vantage points if you had like a moment when you kind of went from government side to working with startups what were your kind of biggest surprises

or aha moments seeing it on the other side and that you wish entrepreneurs knew about engaging with government agencies and regulators and also the other way around that you wish government regulators and agencies knew about entrepreneurs I want to get a little bit of both of your guys's take on both sides of that equation both from what entrepreneurs should know and what government should know well I was thinking that the big surprise to me in having the opportunity to work with entrepreneurs in this space is the breadth and complexity of various business models in this ecosystem it is just so much more complex and Broad than I realized it would be

and I think that to the extent that time can be carved out to actually talk to folks inside government about this variety and these different types of business models not in the context of compliance or answering you know a request for documents or an enforcement action but just to actually interact so that government folks are being exposed to this just Lush ecosystem I think that would be really helpful as they're making policy decisions many of the people that are working on these issues are just as excited about the technology and The Innovation as they are great and then the other way around I think the second thing would be

to start thinking about things early as you're building because it's a lot easier to build those things in and consider the risks when you first start than to have to figure out a way to Pivot or fix it in some cases later on and I know that's not always possible depending on where people are and at least for the early folks you may not be close to Market but if you think about these things during the development stage it will save you headaches and make it a lot easier later on on the first question on the government side the thing that struck me the most when I first came to the private sector and then even more so when I went to a

startup is one thing to pass a law or a policy you may think it's super easy to implement that policy but it's going to work or fail depending on how operationally complex it is to actually get people to follow it and I was shocked when I went into a bank at the operational complexity of doing something as simple as collecting customer identifying information that seems like a simple thing to do right all I need to do is take your information and write it down but as one of my bosses said to me if you can't get that summer intern who's working as a teller part-time for three months to do this properly it won't work and that's

even more so in a startup where you're trying to understand the customer experience and I don't think the government understands fully the operational complexity involved with trying to implement some of the things that have good intentions mostly but they're just blind to the operational complexity that it takes to do it yeah yeah and just to be clear just so it's not like a case of like people complaining about that complexity this is literally the difference between why more dynamism and startup creation versus like incumbents and Regulatory capture precisely because like bigger players will always have more resources to tackle that operational complexity they can throw more bodies at the problem more money at the problem

whereas for star startups you cannot do that at all it would literally take your entire funding in fact if not more of it so I think it's really important to sort of the law of unintended consequences is that some of these things are meant to help you know protect individuals and but in the end they actually only entrench the interest sometimes of the big players and so I just want to make sure we underscore that yes okay last Bottom Line If I Were a Founder I would feel very much in an uncertain regulatory environment and hearing a lot of news very flown about because you get a lot of mixed signals we talk about signal versus noise it is really hard to know what to pay attention to and what not to so from that perspective and I know this might actually even vary by

company because very specific to every individual company and their unique circumstance and what they're building but I'd be very frustrated if I were operating in this environment so what would you say to that group I would go back to what I said before which is put the regulations aside honestly for the moment and go to First principles which is I think what Founders like to do right let's not just do things the way we've done them before and the things that I would want to make sure is that my users my customers have a good experience and that good experience is about trust and is about having a system with Integrity in it and that's ultimately what all of these laws are trying to do you and so make sure you're

managing the customer experience some of that is going to be whether they're coming into contact with illicit actors that degrades the customer experience in a really practical way and just focus on mitigating and managing that risk if you do that well and you can use some of the newer tools some of the newer Technologies as I said think of it as as an engineering problem to be solved not as a barrier preventing you from developing a business the compliance issues I don't want to say they take care of themselves but they reduce in importance because all of the compliance Frameworks are just trying to manage that underlying risk and so focus on that as a builder as an entrepreneur I

just want to thank you guys so much for joining this episode this is super helpful very enlightening I learned a lot and I think a lot of our listeners will learn a lot and it's going to be really interesting to see how this space plays out I'm really glad that we have some of the best experts on these topics here with us to shed some light on what's going on thank you Michelle Korver and Jay ramaswamy it was a pleasure speaking with you thanks sonal thank you guys listening to web3 with A6 and Z you can find show notes with links to resources books or papers discussed transcripts and more at asicsncrypto.com this episode was produced and edited by sonal troxy that's me the episode was

technically edited by our audio editor Justin golden with seven Morris credit also to moonshot design for the art and all thanks to support from Asics and Z crypto to follow more of our work and get updates resources from us and from others be sure to subscribe to our web 3 Weekly Newsletter you can find it on our website at asicsandccrypto.com thank you for listening and for subscribing let's go [Music]