Coverage Division
Monetary Crimes Enforcement Community
P.O. Field 39
Vienna, VA 22183
FinCEN Docket No. FINCEN-2020-0020, RIN 1506-AB47
December 30, 2020
To Whom it Might Concern:
I’m Ben Davenport, an entrepreneur and investor. I beforehand co-founded BitGo, the primary non-custodial multi-sig pockets supplier, and now main supplier of custodial companies for cryptocurrencies. I’m additionally an investor in firms like Kraken, Xapo and Paxos. Right now, I’m a Enterprise Companion at Blockchain Capital, the oldest enterprise fund within the cryptocurrency house. These feedback are my very own, and don’t replicate the opinions of both my present or former employer, or the businesses I’ve invested in.
I recognize the chance to touch upon the proposed rules. Nonetheless, I take critical concern with the method by which these proposed guidelines are being rolled out. Relatively than a extra normal 30- or 60-day remark interval, FinCEN has determined to make use of solely a 15-day remark interval, on the peak of a pandemic, at a time of 12 months when most individuals are having fun with time with their households. It feels unnecessarily rushed, and offers the looks that FinCEN and/or the Secretary try to slide new rules via unopposed, or to easily steamroll via any such opposition. FinCEN owes it to its personal popularity & credibility, in addition to to the American individuals, to right away lengthen the deadline for feedback, in order that extra considerate & various voices will be heard.
I even have critical objections to the substance of the foundations themselves. The brand new guidelines would:
- go far past any present measure of monetary surveillance,
- present little when it comes to new investigatory powers,
- push unhealthy actors to offshore or unregulated venues,
- destroy Individuals’ monetary privateness, and
- put Individuals in actual bodily hazard.
Feedback on CTR Requirement
The principles suggest making use of the prevailing CTR reporting framework to any buyer making a withdrawal or collection of withdrawals over $10,000. On the floor, this may occasionally appear cheap, because the identical guidelines apply to clients withdrawing money from a financial institution or MSB. However beneath I give some vital explanation why that is not an easy analogy, and clarify why the foundations as proposed would create critical dangers for Individuals.
i) The traceability of cryptocurrency means everlasting privateness loss for Individuals.
Whereas Bitcoin and money are each bearer belongings, they’re very totally different when it comes to traceability. Money is successfully untraceable as soon as it has left the financial institution. Then again, Bitcoin and different cryptocurrencies are extremely traceable, and legislation enforcement companies say that they’d a lot favor that criminals use cryptocurrency slightly than money, precisely due to the tracing powers it provides them. In actual fact, transaction historical past on a blockchain lives perpetually, and turns into extra traceable daily, each as new methods evolve, and as extra blanks are crammed in, making it a very unhealthy selection for criminals.
All which means that as soon as FinCEN has a database of each main withdrawal by any buyer, they not solely know the very fact of that withdrawal, however they will watch and hint, in actual time, the circulation of all of these funds on the blockchain. Or, if the transaction is a deposit, FinCEN can look again in time to hint the person’s full prior historical past of transactions regardless of how small or innocuous. In different phrases, the proposed guidelines would violate law-abiding Individuals’ privateness in a means that’s far past the prevailing skill to subpoena financial institution/MSB data, as a result of they function in a broad undiscriminating method, very like mass wiretapping and bulk telephone metadata gathering.
ii) The huge aggregation of knowledge places Individuals in actual, bodily hazard.
The proposed CTR necessities would create a large database at FinCEN/Treasury which might in the end put Individuals in actual bodily hazard. The massive quantity of knowledge would create a honeypot so juicy as to be irresistible to hackers, whether or not state-sponsored or monetarily-motivated. And with the current revelation of main databases at Treasury being hacked and stolen, this threat is much from theoretical.
It’s possible that almost all money withdrawals topic to CTR are usually not taken residence and put below the shopper’s mattress. Relatively, they’re used comparatively quickly thereafter, to make a big buy, to gamble in Las Vegas, or for another transactional objective (whether or not licit or illicit.) Then again, Bitcoin and different cryptocurrencies are largely used as investments. So, a withdrawal to a non-custodial pockets is extra possible than to not be merely an individual deciding to carry his personal belongings with out being topic to counterparty threat.
Which means, whereas a standard CTR report for money shouldn’t be that invaluable to an attacker, because the money is normally lengthy gone, a CTR for cryptocurrency will be extraordinarily invaluable. The report would comprise the topic’s title and bodily tackle and the tackle and quantity of cryptocurrency. The attacker may even see on the general public blockchain whether or not the cash have moved or not, guiding them to the most weak victims to extort. Even a database theft from a single financial institution or MSB could cause innumerable issues for the affected clients. However concentrating the danger on the Federal stage, endangering each American holding greater than a token quantity of cryptocurrency, is just unconscionable.
This level is so essential, I’ll reiterate: Making a centralized repository of particular person homeowners of cryptocurrency places all of them at critical threat, and, removed from decreasing crime, creates the potential for an eventual unprecedented wave of violent crime.
iii) Giant cryptocurrency deposits & withdrawals are much more widespread than with money.
The proportion of money withdrawals or deposits the place one thing nefarious is concerned could also be comparatively substantial (though I don’t know the precise numbers). That is just because in as we speak’s world there are usually not that many kinds of transactions the place money is required or desired, and so illicit makes use of make up a correspondingly greater fraction of the general money transactions. Then again, with cryptocurrencies, that are predominantly held as investments, bigger transactions are merely an on a regular basis incidence. And it is not uncommon knowledge in the neighborhood that trusting exchanges to carry one’s cash for the long run is a really unhealthy concept because of the dangers of cybercrime and/or fraud by the MSB.
Due to this truth, any sign of unhealthy actors acquired by FinCEN can be completely buried within the noise of utterly regular giant withdrawals and deposits. So, with out subtle blockchain analytics choosing out the funds shifting to unhealthy actors, the CTR data are usually not helpful to legislation enforcement. And, if the blockchain analytics software program can determine trails of funds shifting to or from unhealthy actors, then figuring out info for any hyperlink in that chain that touches an change or different MSB can already be simply be gotten via the traditional subpoena course of with out violating the privateness of law-abiding residents. The conclusion is that the mass assortment of CTR data serves solely to create the aforementioned panopticon into the whole lot harmless customers do (or have executed) with their funds.
Feedback on Pockets Verification
The proposed guidelines additionally seem to require that MSBs “confirm” the tackle of consumers when sending or receiving greater than $3000. There are critical issues with this requirement, resulting in important friction for customers and tough make-work for exchanges, whereas offering precisely zero further info helpful to legislation enforcement. My causes are as follows:
i) It’s not possible to show possession of an tackle.
At first, it seems that Bitcoin and different cryptocurrencies make it straightforward to show possession of an tackle. Merely signal a message with the general public key related to an tackle, or make a small transaction again to a specified tackle. However that proves nothing in regards to the possession of stated tackle. All it proves is that the person doing the transaction can get the individual or entity who does management the tackle to leap via these further hoops.
ii) Transactions shouldn’t have a “sending tackle.”
For all UTXO-based cryptocurrencies (comparable to Bitcoin), there isn’t any such factor as a “sending tackle” for a transaction. Thus, whereas verifying an tackle for a withdrawal could also be doable (although meaningless as proven above), verifying the supply of an incoming transaction is basically not possible within the standard case, the place a transaction’s inputs are the outputs of a number of prior transactions. The person can be doubtlessly compelled to leap via hoops to pre-consolidate his funds to a single tackle, which he then verifies with the change, for no actual achieve of knowledge to legislation enforcement.
iii) The proposed requirement supplies no precise new info.
When a person at a regulated MSB makes a deposit or withdrawal, they’re required to have KYC info on that person with a purpose to serve them. So we already know who’s accountable for the deposit or withdrawal, no matter what pockets it got here from or went to: the person who is understood to the MSB. Whether or not a person withdraws on to his personal “verified” tackle after which subsequently sends to a nasty actor, or whether or not the person sends to the unhealthy actor straight from the change makes no distinction to legislation enforcement’s investigatory powers. In actual fact, I consider that legislation enforcement would possible favor that the illicit transaction occur straight on-exchange the place there’s a probability that the change can use its personal blockchain analytics software program to both block or file a suspicious exercise report (SAR). As they stand, all of the proposed guidelines do is drive unhealthy actors to follow higher operational safety.
iv) Legislation enforcement efforts are actively harmed.
As talked about above, the extra hoops that US change customers should soar via, the extra the chance that these customers assume twice earlier than utilizing these exchanges to do their illicit exercise. And it’s precisely the usage of these regulated exchanges that permits legislation enforcement to make arrests and efficiently prosecute unhealthy actors. By pushing illicit exercise to offshore or unregulated exchanges, law-enforcement powers are essentially diminished.
v) New rising makes use of of cryptocurrency are crippled.
There are lots of rising makes use of for cryptocurrency the place the person is depositing from or withdrawing to a sensible contract, slightly than one other MSB or his personal pockets. A wise contract can neither abide by FinCEN steerage (it isn’t a authorized entity and will don’t have any proprietor or controller), nor can it show its identification to an MSB. These functions of sensible contracts (that are at present attracting tons of of hundreds of thousands of {dollars} in enterprise capital) can be crippled, and American competitiveness can be severely broken on this doubtlessly vital rising house.
Conclusion
Given the intense issues raised above, I feel it’s completely incumbent on FinCEN and the Secretary to considerably lengthen the interval for feedback on this proposal, and to start an actual 2-way dialogue with firms and specialists within the business, whereas additionally listening to the considerations of most people. What’s at stake is nothing lower than:
- the privateness and security of hundreds of thousands of Individuals,
- the power for legislation enforcement to do its job successfully, and
- the competitiveness of US firms in an vital rising know-how sector.
Respectfully yours,
Ben Davenport
