2 Lawyers on How the U.S. Can Finally Regulate DeFi - Ep. 604

Transcript

And one of the hallmarks or critical pieces for us in doing this analysis was that we both believe I think that the base layer needs remain critically neutral and permissionless. And so this was really thinking about where you would actually have a very effective regime for financial integrity or combating illicit finance. And if you know, 80% of transactions go through these RPC nodes as a service, then you actually have a really interesting gateway or you know, place to look at whether anything could be done without really turning them into a financial institution that would have to comply with the BSA.

Hi everyone. Welcome to Unchained, your no hype resource for all things crypto. I'm your host Laura Shin, author of The Cryptopians. I started covering crypto eight years ago and as a senior editor of Forbes was the first mainstream media reporter to cover cryptocurrency full-time. This is the February 6th, 2024 episode of Unchained. Polkadot is a leading layer zero blockchain with over 2,000 developers. And the Polkadot 2.0 upgrade will be a massive accelerator for the ecosystem, making it faster, more secure, and adaptable. Perfect for GameFi and DeFi to build, grow, and scale. Join the community at polkadot.network/ecosystem/community.

Streamline your DeFi with VaultCraft, the ultimate on-chain toolkit for deploying custom automated DeFi products on any EVM chain. Join VaultCraft's referral program, unite with the community, and supercharge your crypto. Details on vaultcraft.io. Today's topic is the regulation of DeFi and a new proposal to do it. Here to discuss are Rebecca Rettig, Chief Legal and Policy Officer at Polygon Labs, and Michael Mosier, co-founder of Arcturos. Welcome, Rebecca and Michael. Thanks, Laura. So, you two recently published this paper with Katia Gilman on how to combat illicit finance in DeFi or generally just how to catch bad actors in DeFi.

And obviously this has been a huge topic in crypto for years now and it's popped up repeatedly. Like I don't I feel like the FATF rule was kind of one of the initial ones. I don't even remember what year that was. There was the infrastructure bill, the Tornado Cash sanctions. Obviously, recently the Hamas crypto terrorist financing issue. And all of this, to my mind, and you know, you can reframe it if I'm incorrect here, but it centers on this dilemma that regulators have historically targeted regulations at intermediaries and then blockchain technology obviously has this potential to create systems that don't even use intermediaries. So, can you just talk a little bit more about like the problem that you were trying to solve with this paper or, you

know, what the inspiration was for this paper? I think it was twofold and I think you put it really well, Laura, which was that this issue has plagued regulators for a very long time including dating back, you know, a number of years with FATF, other global regulators, and also in the United States more recently. And as Michael can probably speak to a little bit more in depth as well, the current financial integrity regime in the United States is and and elsewhere around the world is really geared towards intermediaries and those who have the tools to stop bad actors.

And those same tools as the Financial Stability Board and the International Monetary Fund have recognized in a paper they put out together don't work in the same way in these peer-to-peer intermediary-less systems. So, I think that of course was one of the impetus is for doing it, but I think given the rise of concern about AML or illicit finance in crypto more generally and also seeing a number of proposals come out at the end of last year about how to come, you know, proposed bills and then the Deputy Treasury Secretary also put out some proposed options. I think Michael and I felt that it was really time to think deeply about these issues both from a legal and a tech perspective and

try to come out with something that we thought would be really effective and also very realistic when put against the law and the tech. So, talk also a little bit about your backgrounds and how they inform this paper. So, I've been a lawyer in the space for quite a long time. I started out as a traditional litigator and regulatory enforcement lawyer doing both financial services and then also some tech early tech cases. I worked on one of the very early peer-to-peer file sharing cases in the music industry. So, I've been thinking about how laws apply to novel systems for quite a while and then I left sort of my big law firm many years ago and took on started

taking on crypto clients and really dedicated a lot of my time to advising software developers about how to think about ways not necessarily to comply with law because we, you know, think we've all talked a lot that many of these laws I don't necessarily apply wholesale or you can't map them one-to-one, but how to think about meeting policy goals given the technology and some of the differences. And so I've been in-house for a long time, but because spent a long time learning about the tech, I just organically started talking to regulators probably a number of years ago about this and trying to sort of educate about DeFi, how it works, and think about the laws as well. So, I really am digging in on the tech side to

think about where and how the laws may apply. I'm sort of the law librarian, not not quite as tech-savvy here, but spent a lot of time in public service around a lot of these issues on the policy side. So, I was at the Department of Justice. I was a federal prosecutor in the money laundering section where I was a deputy chief there. Part of that work was standing up the an early kleptocracy unit that looked at that foreign kleptocrats that were sort of stealing from their own people and how to get it back to them. And then was at OFAC, which is the Office of Foreign Assets Control at Treasury, which administers sanctions programs and was in charge of policy there including exemptions that we would set up to to sort of limit collateral impact from sanctions programs such as

general licenses to allow VPNs to be used provided for people in Iran who were trying to do pro-democracy work and humanitarian aid to get into Iran and Syria and other places like that as well as on the enforcement and compliance side where I was the head of that. And then was at FinCEN, which is the Financial Crimes Enforcement Network. That's the the financial intelligence unit for the US, also part of Treasury. And it's also the administrator of the Bank Secrecy Act across the federal government. And when I was there I was part of developing the 2019 guidance on on sort of cryptocurrency and and also thinking through as part of that, what are the things that we want to proactively say we're not covering as financial institutions.

So, have spent time in all of this thinking through what are the things we want to cover, but also what is it important to say both at OFAC and FinCEN, this is not something we mean to collaterally impact. We actually want to make sure that we're promoting and also people in these authoritarian regimes that need equipment for resilience. And so when I left FinCEN, I've worked in the it configurable asset privacy space with a project called Espresso Systems, but then co-founded a a small legal boutique called Arcturos with other former public servants working in this space also helping whistleblowers and and humanitarian aid workers as well as became a partner at X Antea, which is

this which is an early stage fund that's focused entirely on agentic tech that's advancing democratic and personal values very much in this space as well. Oh, interesting. Yeah, so if you were part of FinCEN at the time that FinCEN issued that 2019 guidance, so then now you're kind of on the other side and like seeing how all this plays out. So, why don't we just actually now talk about some of these existing regulations that are coming to bear at the moment in DeFi. So, one of the ones in your paper that you both mentioned is the Bank Secrecy Act and then what you call its progeny. So, you know, for listeners like what's kind of the background regarding that that you think would be

important for them to understand in terms of how it applies to DeFi. Well, I think the I think the biggest thing that people should keep in mind with the Bank Secrecy Act going back to the 70s when it started was it was really fundamentally about addressing the fact that in the traditional finance sector there's a lot of siloed information that's purely within a bank. Nobody else can see it. And at the time there was a lot of organized crime and people would take their money, send it to Switzerland, avoid taxes. Actually, a lot of it wrote out rose out of money laundering, but money laundering related to tax evasion for organized crime. And so the FBI might go to a bank and say, "What's going on? Some of this money looks like

it either came or went from Switzerland." And the bank would say, "I don't know. I don't have anything I don't have any information." And so part of this was like, "Well, actually you need to understand your customers better." And I'm compressing decades of development here, but you need to understand your customers better, need to understand where their money's going when it leaves, and you need to keep these records so that they're accessible. And that's it really started with record keeping requirements so that when law enforcement had an investigation and needed to go to the bank, they knew that you would have the information they they needed. Over time it developed into record keeping and reporting so that people were sort of proactively sending suspicious activity reports or SARs to what became

FinCEN, the financial intelligence unit, when they determined that there was suspicious activity going on. And that that as well was sort of overcoming the fact that, okay, first they weren't recording it, then they weren't keeping it, then they also weren't making accessible because it's so siloed. So all of that are sort of in ways not quite applicable to the decentralized finance world where you have these public ledgers. Everybody out there can see what's happening in some level to see these flows. And so part of that is there isn't the need for the the sort of accessibility because the data is accessible, but there's also not all these intermediaries that are in the middle of it that you can go to for

these records. And so how do we how do we sort of manage that sort of risk in a space that's largely in the way that we're addressing it infrastructure. I think the other thing to add on to it Michael was saying is that the Bank Secrecy Act only applies to a finite set of what are known as financial institutions. They're a special set of intermediaries that we think of in the TradFi world. So banks and broker-dealers and casinos and all sorts of those types of entities that really have the ability to control value or otherwise you know, take in or have custody of user funds although it's not only based on custody. And so it's the type of institutions that can take on these very

high-level very costly types of requirements that come under the BSA. I think the other part that we call out in the paper is that the BSA does not have a concept of know your customer or KYC. And we're all really focused on that when we talk about AML in the crypto world and where's the KYC going to be and our front ends going to KYC and those kinds of things. And I think we wanted to make clear that that is one way that financial institutions implement the requirements under the BSA, but it is not sort of part and parcel of doing any money laundering and sanctions in the United States.

And so you outline also some of the main risks in DeFi that you think need to be accounted for. So why don't we just discuss those and then we can dive into like the meat of the proposal. The reason that we wanted to dive into what where the risks are is because the risks of illicit finance in the DeFi world are very different where from where the risks come from in the TradFi world. So as Michael was saying earlier there's a siloing of information and sort of these honey pots of data and then there's also subjective judgment that goes into setting up these financial institutions and systems. And so that's where a lot of the bad actors can happen and take place. But that's very different in the DeFi world.

We lay out three primary vectors of illicit finance risk. One is cyber risk, right? Where either the code has been programmed improperly or not audited correctly and one where there's a loophole that was not expected. The protocols otherwise functioning as intended, but some bad actor figured out a way to hack or exploit the protocol. The second type is what we call system management risk. It's where you say something's decentralized, but everyone's holding all of the admin keys or something like that. It happens a lot in Web2 the system management risk. It's for things like where you're able to exploit one person who has control over the system or some facet of the system

to otherwise engage in illicit financial activity. Things like social engineering and the like again happens a lot in the Web2 world. And the last part is what we call usage risk. And it's more what I think regulators really identify as using different types of DeFi protocols to engage in the same type of structuring, layering and some integration activity that they see in TradFi. So breaking up your transactions from you know, a hack or an exploit into lots of different wallets and moving them around so it's very hard to trace the money or using privacy preserving technology to make it harder to trace where the illicit funds go and things like that. So those are the three primary sources of risk, but very

different than where you see them in the TradFi institutions or the TradFi world. So now let's talk about the meat of your proposal which begins with a term you introduce called independent control. What is that and how do you determine whether a blockchain system has that? This proposal really isn't about blockchain systems or front ends. It's really just about looking at the protocol layer and and DeFi in particular. So it's not really meant to hit anything else, but the independent control concept comes a little bit because I think we've heard from regulators and even from people in industry like well you say it's decentralized, but it's not really. And we've seen even enforcement actions calling you know, decentralized in name only. And so I really think that Michael

and I wanted to get at something where we could say, okay, well, is what's the litmus test for where we may be able to think about regulation? And as part of our larger literature review of what else is out there on DeFi including things that were put out by regulators, there's this great academic article by Katrin Schuler and Ann-Sophie Cloots and Fabian Schar all of whom are academics and have worked in the space for a long time where they talk it's called on DeFi and on-chain CeFi. And so they really find this way to distinguish between you know, decentralized protocol systems that may have a control person. They don't use that term, but some form of control and they

call this on-chain CeFi. So blockchain-based systems that look a little bit like CeFi. And then they say they call it genuine DeFi which is like neutral infrastructure. And so we wanted to find a way to really work with those distinctions because it's a really well-done paper. And so in order to think about what is on-chain CeFi, we looked at independent control about where the value really gets controlled and ways that you can control people's value in the system. And that really comes from the 2019 FinCEN guidance and a lot of what's behind that as well which I think Michael can speak to a little bit. Yeah, so I think part of what we wanted to do is with a lot of this was tie back that even though there's a feeling at times

in the regulatory space like we need new laws, we need this is so new that we need something drastic or we need to massively expand the way we've defined financial institution to capture far far more activity than we did before at the infrastructure level. Part of this was think looking back at the 2019 guidance from FinCEN and saying they've already spoken to a lot of this including on the control piece. So we're not we're not introducing this new concept that it's going to be strange to anybody or is like creating some major carve out in any way. In fact, we're largely adopting the way FinCEN approached independent control which there was total independent control. And and a lot of the way that was presented

in the 2019 guidance was we were specifically trying to carve out from sort of the collateral impact and the reporting requirements of the BSA certain including actually specifically security related functions and other operational functions that really weren't about being a bank or being control over someone's value in the sense that you're you're an intermediary that passes this this value from here to there. And so the example we gave there was multi-signature wallets where any given person in that may have control in the sense that if Laura refuses to sign or use her key that's that can factor into the

inability to move to move assets in in whatever form. But that doesn't mean that you are now suddenly a bank and a financial institution just because you have some ability to have a measure of control. And so what we said is you need total independent control in the sense that you can sort of deny that transaction indefinitely from happening. Um And the other nuance that we wanted to work in here was the fact that if you're sort of too orthodox in that, then theoretically AWS which underpins a lot of transactions happening ultimately in traditional finance and Web2, Web3, all of it.

When AWS goes down they can stop value from moving like across TradFi and across DeFi all kinds of places. But it doesn't mean that they have total independent control just because they can stop it in some form. And so part of this was like let's do this in a way that's that that creates that sort of one a very it's basically the same test in many ways, but also addresses the nuance here that we're going for. Yeah, I think the other piece of it is certain of the legislative proposals that came out tried to posit new ideas of control. Things like you know, being able to control the software system as the way to determine whether an entity or a person should be a financial institution subject to all of

these BSA requirements. And I think we really wanted to ground the idea of control back into what makes an entity a financial institution, right? Which is as we said earlier the ability to control a third party's value and why you'd have to have certain obligations over it. And one thing I noticed was that you said that even for these on-chain CeFi systems that you didn't think that BSA requirements should automatically attach to people who have control of those systems. So why not?

I mean I think it goes to a little bit what Mike was saying before which is you may be able to control it, but what you're doing may be super limited, right? Like so very narrow multi-signature types of powers that are only used a certain time or confined only doing certain things. You may definitionally fall under the independent control, but what you're doing day-to-day or the level of your activities may not rise to what financial institutions actually do. Um, the Schuler article that we rely on for this on-chain CeFi versus neutral DeFi distinction does say, you know, on-chain CeFi is more likely to have regulation and I think from a broader sense we agree with that, but I don't think it necessarily makes you a

financial institution out of the gate if you have control. Yeah, because just to tag onto that, like if you go back to the original siloing of information, that just isn't here. Even even on-chain CeFi there's an enormous amount of data that's very accessible to law enforcement and and it's not hidden within a within a bank that you've got to go to that that may or may not keep it. And also there are some of these control elements like the multi-sig that we talked about where it may actually have a quite a bit of control in the sense of it's a security override, you know, when everything it's like the full break on the train where the whole train stops. It's like, okay, sure, that is a measure of what might feel like total independent control, but it's not checking each transaction

that's happening and in fact they may not have any ability to impact a specific any one transaction. It may be literally we're stopping the chain and forking it and then every validator afterwards has to get on board with this new chain. So we want to acknowledge that sort of nuance. One that the one of the problems is missing that TradFi has and the other is that there might be elements of control that feel quite total, but are really not about value transfer. And then how do you account for when DAOs have control of such a system or when oracles are relied on? Um, there's the infamous case of Ooki DAO uh, where the CFTC tried to serve the Ooki DAO members their Yeah, yeah, the complaint. So how would you account for

that? Yeah, so I think that uh, DAOs and oracles and governance tokens and things and things like that have been seen as these ability to control or these types of centralization uh, and being really used against DeFi in a way that I'm not sure actually at least in the illicit finance or BSA context really makes sense. And so we do have a part where we really carve those out to say independent control is not meant to capture these things because one of the elements in the independent control test that we lay out is about immediately being able to affect value, right? And unilaterally being able to do it. And I would say even large governance token holders or DAOs themselves typically don't have the ability to have such a unilateral and

immediate impact. So there's usually something like a time lock in DeFi systems, right, before any changes to the system take place. So even if there's a large governance token holder and they have an outsized influence in voting, um, there's likely a 24 to 72-hour time lock before any changes implemented, which means that I have the ability to move my value out of the system before anything happens to me. And so I do think we have to take the mechanisms through which all of these technological systems work into account.

And so the language of the independent control test is very intentional for words like unilateral, immediate, and things like that because it takes into account how much as Michael's really saying, how much control there is over somebody else's value or not. All right, so now let's move on to the second part of your proposal um, where you have something that you call genuine DeFi and you want to label it what you call critical infrastructure or I think actually that's an existing term. Um, so, you know, explain how you're defining genuine DeFi and critical infrastructure. I think genuine DeFi is something that really works autonomously. It doesn't have any sort of form of true uh, independent control in the way that we're thinking about it.

So I would say uh, maybe even something with a very very narrow emergency multi-sig, but otherwise is moving and is, you know, as Michael said, the security break of all else fails, you know, would still be in a genuine DeFi type of uh, definition. I think that something like Uniswap certainly would be the protocol itself would be genuine DeFi. Um, and really these autonomous systems that are moving forward totally at users' direction. The critical infrastructure piece, and this is something that Michael is great at talking about, um, there is there is a organization uh, or an agency within the United States that was I think created in the late

1990s maybe? Yeah, late 1990s uh, called the Cyber and Information Security Agency or CISA. It sits right now under the Department of Homeland Security and it oversees 16 sectors of what they call critical infrastructure. Um, I'll let Michael take it because he's really good at talking about what CISA does and then how OSIP, which is sort of a collaborator but the Office of Cybersecurity and Critical Infrastructure Protection, which is in the Treasury Department, really fits into this framework as well. Yeah, so as as Rebecca was saying uh, and and setting up unreasonable expectations to create to explain, but um, CISA so within CISA there are 16 critical infrastructure sectors um, and

and it's very widely, but it fits, you know, when you go through them there's like a chemical sector, there's a commercial facility sector, um, communications is one, critical manufacturing including supply chain, dams is its own sector uh, and defense industrial base, emergency services like if the telephone if the phone grid goes down, you still need to be able to call ambulances and there's all sorts of redundancies and resilience based into that including by the way the way that they have standards for testing these and doing, you know, penetration testing of all of these including the energy sector is one. I won't go through all of them, but one of those when you talk about the trains running or not running. Oh, yeah, yeah.

There's a There's there's a food and agriculture and a and a train uh, a train sector again with transportation so that they're testing these things at all times and making sure that there's uh, communication networks that can that can transmit very quickly threats and risks like you need to know that there's a rail issue suddenly so that you don't have backups and and things like that. Um, so one of these sector of the 16 sectors is called uh, the financial services sector. For a lot of these actually uh, critical infrastructure sectors including the financial services, they have information sharing and analysis centers and those centers are really what they what they say which is it's ways to to

share information in extremely real time that's critical to the functioning of this critical infrastructure. And so um, the uh, they call them ISACs for information sharing and analysis centers, but the FS-ISAC for financial services has like 46 hundred members of it. Some are financial institutions and some are not at all financial institutions because it's really about the infrastructure. Um, and so in order to interface with those with the FS-ISAC, which itself is a private sector, it's an entirely private sector organization um, that's voluntary, the Office of Cybersecurity and Critical Infrastructure Protection at Treasury, because it's the financial services sector, the interfaces with them to

provide these sort of alerts like there's a law enforcement alert that Lazarus Group is going to attack the backbone of Goldman Sachs. OSIP would reach out often to the FS-ISAC to say, we have critical information, let's share this. People come in. There's no regulatory authority, there's no coercion to this uh, when the FS-ISAC calls it it's everybody's excited to come because they're sharing with certainly interested. They're they're they're actually they're very they're excited to prevent a hack. So like they're genuinely excited to come. I've been in these meetings at Treasury and they're they're pretty happy to come in and be told before an attack happens.

And so they come in, there's information sharing, there's no you need to send us a report, there's no come in and register, there's a pathway. It's really just we're here to help you and let's have this information exchange. And that happens really rapidly because you have people connected and it might be the the chief information security officer at Goldman Sachs or somewhere, but it also might be somebody in the Comcast network. You know, it could be someone in the RPC node for traditional finance which goes back to the 70s. So it could be anywhere in there that they're seeing a vulnerability. So it it's not about being defined as a financial institution and it's not about sort of a coercive authority or or doing KYC on everybody.

And this works extremely well because you have everybody sort of working together. Yeah, and there was actually a push a few years ago about whether CISA was going to actually become a regulator and CISA pushed back and there's congressional testimony on it to say we actually wouldn't be able to be as effective if people were afraid of us having regulatory teeth. And so Michael's point I guess they were saying everyone's super excited to work with us because we are so collaborative and helpful uh, and we were going to make sure that all of these sectors sort of keep running at the at the best of their ability. Uh, and so it is a it's a much more collaborative agency than you necessarily have or at least certainly than this industry feels like about how they experience times with regulators.

Yeah, and and one thing I'd just add on that is that is that so while there isn't a requirement to do reporting, a critical function of the information sharing aspect of the ISAC is that people are sharing threat indication information with each other all the time because that's really how you maintain the resilience and the security and that's in a loop with OSIP at Treasury as well who's both getting that threat information and sort of aggregating it across the the information coming in to create new trends and typologies of threats to get it right back out. So they they have this in much the way that FinCEN in receiving stars and suspicious activity reports, they aggregate it from

the financial institutions and then they put out alerts and trends and typologies so that everybody has the information. Basically, the ISAC is doing that with OSIP where they're reporting this information in. There's no you need to do this or there's a penalty. Like everyone's doing it because there's alignment and it's getting those alerts back out to everybody in very much the same way that that FinCEN would. All right. So, in a moment we're going to talk about how it would look for genuine DeFi to be part of critical infrastructure, but first a quick word from the sponsors who make this show possible.

Polkadot is the largest layer zero blockchain with over 2,000 developers. And the anticipated Polkadot 2.0 upgrade will be a massive accelerator for the ecosystem. Upgrading infrastructure with eight times higher transaction throughput and twice as fast block times, perfectly tailored core time for the needs of every protocol, trustless bridges internally and into Ethereum, Cosmos, Near, and Binance parachain. Revised tokenomics and the implementation of a token burn to reduce inflation. Perfect for GameFi and DeFi to build, grow, and scale with one of the most active crypto communities in the space.

Polkadot recently announced a partnership with Mythical Games, bringing top games like NFT Rivals with over 650,000 players and 43 million transactions to pave the way for GameFi in the Polkadot ecosystem. Get your Web3 ideas to market fast with economics that work for you. Think big, build bigger with Polkadot. Join the community at polkadot.network/ecosystem/community. DeFi just got way easier with VaultCraft, a blockchain infrastructure for building, deploying, and monetizing non-custodial yield strategies in a few clicks.

Forget spending months of R&D, capital, and human resources when you can now instantly launch your crypto fund with VaultCraft on any EVM chain. From wallets and institutional service providers to anon DeFi degens, VaultCraft supercharges your crypto assets by enabling instant cross-chain yield strategies that you can deploy in 1 minute. Now anyone can supercharge their crypto portfolios with custom-tailored DeFi strategies. Join VaultCraft's referral program, unite with the community, and supercharge your crypto. Details on vaultcraft.io.

Back to my conversation with Rebecca and Michael. So, in your description, you know, I I understand this is like much more collaborative. It's like a very different kind of you know, relationship that would exist, but like I kind of can't picture. So, would there be any actors within these DeFi systems that would be regulated or like who is it that the agencies would interact with? Yeah, that's a great question. Actually, one I've just got very recently, which is that's great, but if you're selling us that nobody runs this, then who do we call, right, when something happens?

And I I think what you know, when Michael was talking about, oh, well, they'd call the CISO of the big banks if they saw an incoming Lazarus threat, it's just not going to look like that with critical infrastructure. I think there are a few things that they that CISA plus OSIP do, one of which the industry has been calling for in a very widespread way, which is having cyber standards generally and best practices for cyber. I think there have been some industry efforts to do that, but I'm not sure we've got it there. I think also cyber audits is something that OSIP looks at you know, for financial institutions, but also for the financial services sector more generally. The information sharing is really important. So, I think there's

actually and we sort of allude to this at the end of the section, some of what OSIP does has been bubbling up in the industry here and there. This would really turbocharge these efforts. I think for something like incoming Lazarus threat to you know, DeFi protocol X, I mean, maybe they'd call the DevCo, but then you know, I think and Michael can speak to this maybe a little bit, but a lot of times in law enforcement calls, the answer is, well, there's nobody here to do anything. Now, I don't think that's always going to be the answer when there are incoming threats, not just because there are system control persons or things like that, but really because there's a lot the industry can do in many different ways that doesn't look like shutting down a part of your system or doing something like that. I

think that because this the technology is emerging and the way the industry works is emerging, there are going to be a lot of new ways that OSIP can work with it, but I think there are things they can do literally out of the gate today that would be so effective in DeFi, especially on preventing things on the cyber risk side and on the system management risk side. Okay, but I don't know if you fully answered the question of like who they would call. So, there there would be these standards. Sure, I think it depends. I think you could call all the the auditors in. I think you could talk to DevCos more generally who are developing this. I think having standards out there that DevCos could abide by, right? Like

I don't think you I don't think OSIP always has to call people in. I think they can also push information out. And when you look a lot of what CISA does, they put out a lot of information as to these kinds of things that we're talking about, which is why when we really looked at it, it's not just about calling people in. I know Michael's had that experience and maybe you do that, right? Like, oh, well, DeFi protocol X is deployed on this L2, so we're going to call all the DevCos for them and see what's going on. Maybe they can do nothing or maybe there is something they can do, right? Maybe they host a front end that's centralized or something and you you may not be able to do anything. I'm just saying that I think they'd probably still call DevCos, but there the answer may not for

something like genuine DeFi, maybe nothing can happen, but I just don't think that's even the most important thing that they could do at the outset, more of which is you know, making sure that the way the industry operates is at a certain level of protection. And then who determines whether any of these DeFi protocols would rise to that level of being called critical infrastructure? I mean, that's a great question. I think some of that, as we say in the paper, still really needs to be examined because I don't think, you know, brand new DeFi protocol XYZ that has very little in total value locked may necessarily rise to that level, but I do think that there are other long-standing

um very well-regarded and well-tested DeFi protocols that do underpin much of the industry that, you know, it seems unlikely that they'd necessarily qualify today, but some of them could if there's really interest in bringing DeFi, you know, within the arms of where we are today. Yeah, and and just I mean, a lot of this really tracks with the 16 critical infrastructure sectors and the ISACs that you would have for those. Like even within the transportation sector, there there might be a local light rail that's probably not a member of the ISAC necessarily or considered like the piece member of the critical infrastructure,

but rails themselves might and Amtrak is and other certain there's certain thresholds that you would reach that like, okay, now you're really part of the critical infrastructure and you really might be part of the the ISAC. And so I think there's a pretty natural analog to this across the other critical infrastructure sectors that would probably tie into the way the ISAC is is populated in the way that like the FSISAC is 4,600 members and some are different levels of technology versus actual financial institutions. And not everybody that just has a thing that has something financial is going to be a member of that. There's a there's an element of threshold to that even if it's even if some of that is sort of just amongst the members and deciding

that and working with OSIP around that. And so I think I see my assumption at some level as Rebecca and I were thinking through this is there would be certainly thresholds as she as Rebecca described and some of that would be pretty organic in that early protocols that that, you know, it might be open source contributors from all over, but it's pretty clear that this is very early. They're just out of a test net or or whatever versus like the Uniswap protocol where regardless of who it is, there's enough going on that somebody is in the community in whatever form is likely to say, I would love to be part of a crypto ISAC and get this information and I and love to be there getting like

an alert before Lazarus attacks so that we can fix a bug or something like that. All right. So, the last part of your paper has a suggestion that there be new laws for businesses that are used to transmit communications about DeFi such that they are not subject to the Bank Secrecy Act. So, talk a little bit about what you think that should look like. Sure. So, we call these critical communications transmitters or CCTs. One of the things that Michael and I went down a little bit of a rabbit hole on when we were really looking at the history of the Bank Secrecy Act is that telegraphs were included as financial institutions. And you know, where telegraphs have evolved

and where technology has evolved, we certainly don't make any part of you know, the tech stack FIs right now, financial institutions. And we really don't, to the extent we can, regulate just through software. And not just in the financial services sector, but sort of more widely. I think that is sort of in a a more long-term goal. But obviously, the ways that information about transactions are communicated to blockchain have evolved in many ways, one of which is through these businesses, which we call RPC node as a service. People call Most people in the industry can call them that. Um that I would say the majority of communications

actually flow through to um blockchain technology. And one of the hallmarks or critical pieces for us in doing this analysis was that we both believe I think that the base layer needs to remain critically neutral uh and permissionless. And so, this was really thinking about um where you would actually have a very effective regime for financial integrity or combating illicit finance. And if, you know, 80% uh of transactions go through these RPC nodes as a service, then you actually have a really interesting gateway or, you know, place to look at whether anything could be done without really turning them into a financial institution that had that would have to comply with the BSA. They also don't it

RPC nodes as a service don't ever take custody. They don't ever transmit value. They just transmit communications because RPC stands for remote procedure call, as Michael alluded to. This is just a computer language uh that allows computer networks to talk to each other. It's been around since the 1970s. Um and so, this computer language now allows, you know, DeFi protocols to speak to blockchains. Uh and so, uh because so much goes through, um you'd be able to do a couple of things. And, you know, Michael's talked a lot about the transparency uh blockchains at this point and how much they can be used by law enforcement. But, the other way they can be used is to really gather a lot of information in a very quick way about wallets. It doesn't necessarily tag, you

know, you, Laura, or me to a certain wallet, but it certainly can tag wallets to hacks, um other exploits, um and that's a lot of what the blockchain analytics companies have done with a lot of the on-chain data is to really look at where these high-risk wallets um and they have a number of different pieces of software that look at that. And I can say from my own experience, right, when wallets get both when I was in private practice and even now, when there is an hack or an exploit, you can find out which wallets are associated with that hack or exploit maybe, you know, very shortly after it. And you can watch in the, you know, short immediacy after a hack, the the initial wallet move it out to 14 or 15 wallets. So, you know the addresses and you can do the online

tracing and then really look at where these illicit funds or bad actors, what wallets are they associated with. And so, if they're using RPC nodes, which most of them probably are, I haven't talked to them, but um you can run your own, but I'm not quite sure that most a lot of people actually run their own RPC nodes. Um just like not everybody runs their own validator node. Um then this is where you can catch sort of these wallets that have the illicit funds um before they ever get to the blockchain, right? So, there are these two concepts in blockchain liveness and finality. And this RPC node is part of the liveness, right? I'm live bringing the transaction through and then the blockchain network is really the finality. Uh and so, by blocking off these high these

transactions, these communications from high-risk wallets, you'd really be able to block a lot of the uh more illicit actors from being able to finalize their transactions on a blockchain network. And so, is that like a concept that has been discussed a lot? Like I'm not sure how people would feel about wallets being scored on risk and then potentially blocked based on that. Is that something where, you know, you know what the temperature of the community is on that? Well, first of all, it's already happening, right? There's a lot of There's programs already from the blockchain analytics companies that do this. And I think that some of the larger players in the space who are already registered as money services

business use some of this technology already. Um what I do think if you do need new laws, I think we'd have to figure out, probably through notice comment and rulemaking, how you determine what you're saying about what sort of the risk of the wallet. I don't think we could just go based on whatever um you know, the blockchain analytics companies decide today. Some of it may be um RPC nodes would have to, you know, figure out how to do the configurations. But, I think you'd still probably need to have some guidance out there on how to decide what constitutes a high-risk wallet. But, I think in writing this, we're really contemplating things like proximity to a hack or trace, you know, hack funds have been traced to blockchain analytics companies are doing

all of that already, anyway. Yeah, and just to be clear, like this is not proposing any sort of like social credit scoring for wallets or something. This is all very much in the critical infrastructure space. So, much of the sort of risk screening of interactions is happening already, including in TradFi or in Web2 at the cyber level. So, like lot AWS itself probably uses Cloudflare, like most websites use Cloudflare uh and other and other cybersecurity tools and proxy checks and other things that are looking for DDoS attempts and other cyber-related high-risk um activity coming at them to sort of attack them,

much like financial services front ends of the the Bank of America website is constantly having risk indicators sensing, you know, what's coming at it, what bots are coming at it, DDoS's and things like that. And so, it I think it's important to make sure that we're clear that this is very much in the cybersecurity and in there with someone like Lazarus Group that has certain trends in typologies and in the way that they do attacks, some of which might be a classic Cloudflare type cyber method that they would detect. Others it would come through proxy check because it's a high-risk proxy. Um and we're not talking about blocking blocking VPNs. I mean, like actual this is a proxy known as one that that Lazarus uses, which bank front ends use,

AWS uses it probably, Amazon for their e-commerce. And and I don't think there's a lot of resistance even in Web3 of saying we'd rather not be DDoS'd and taken down by Lazarus. As you get farther out into the sort of like sanctions lists and things like that or whatever, that's where you need to have a conversation, you know, on the more political ones. But, we're really looking to reach alignment on the critical infrastructure pieces of this. And like Rebecca said, set thresholds. Like this is critical infrastructure, it's critical infrastructure attacks.

This isn't turning anything into a financial institution by any means. It's really we're just trying to say in what a lot of websites themselves in Web2 do, this is critical infrastructure as well. So, it's not into the sort of political piece of it. Yeah, I mean, cuz like immediately I was thinking even if the blockchain analytics providers are already doing this, then it's a question of, you know, like which governments are they doing it for or, you know, who's determining what is considered like a risky wallet, you know, like the situation in the Middle East right now is one of those ones where nobody wants to name a or should maybe phrase it the other way.

Like everybody thinks the other side is the bad guys, right? So, Yeah. But, I think that's a really important point. Uh and that's probably what Rebecca mentioned, the the importance of base layer neutrality and how how really central to this that is. And it's really important why we're talking at a cyber critical infrastructure level here that nobody wants to be DDoS'd, whatever jurisdiction you're in. That's not about the politics of sanctions in a certain jurisdiction. And so, what we're proposing is we say a crawl-walk-run approach. Like there should be we should be going for the natural alignment of DDoS type Lazarus attacks that are very cyber and critical infrastructure. And so, that there's a is a really starting

at a global consensus-driven foundation. And this This comes up in cloud service providers in Web2 all the time right now, where there might be fragmentation of regulation of them across jurisdictions. And it's a huge problem because it has to be a global internet. And so, what we're saying is in the same way that Web2 needs to be a global internet, but there are baseline cybersecurity around DDoS'ing and attacks, that's where where this should start at a very much a crawl that everybody agrees with. Like you said, Laura, like you can't have this fracturing across jurisdictions. And so, keeping it global, not jurisdictional.

Yeah, and just to to put another piece on that, I don't think high-risk wallet means is anything political. I think of it very much like how we think about illicit finance risk even in TradFi, right? Like, are you associated with illicit funds? Um now, maybe your point would be like, well, both sides think there were illicit funds or something like that. Um but, I think this is very much like, was there an exploit? And is this wallet, you know, directly involved in this exploit? Then it, you know, probably has a risk score or something like that. I really don't think the political part comes into play, but you're right. I mean, I think those are things that have to still be worked out.

But, as I said, I do think that's sort of that even if FinCEN is given this new authority, I think that there still has to be notice comment rulemaking and regs put out to really actually operationalize it. That's the next paper Michael's going to write. Thanks Rebecca. Um so, let's talk a little bit about how this kind of proposal would apply to something like a Tornado Cash. Obviously, that was probably uh one of the biggest um you know, uh debates where this type of regulation or not this type, but uh you know, traditional regulation bumped up against the crypto world. So, walk us through, you know, what you think that would look like.

So, let's talk about the Tornado Cash protocol on its own uh in its current iteration. So, I think there were, you know, earlier iterations of the Tornado Cash protocol. But, as it exists today, it has no administrative key. The DAO can't do anything to it. Token holders can't make any changes to it. Um and it is just a piece of autonomous software that is going to run on Ethereum in perpetuity um with little to no changes, you know, um in terms of how it works. Uh that on its own is genuine DeFi. Now, I think from what we've learned, there are systems that have been built up on top of or around Tornado Cash. Um and I think those would come under the analysis and the first

part is is there a system control person and if so, what are they doing, right? We know there was a system that related to the front end and relayers and the torn token where they had to stake weight the the governance token in order to be the chosen relayer. Um I don't think we've put Well, we've put a lot of time into this paper. I don't think we've put the time in to really doing a full analysis of where the additional part of that system for Tornado Cash may actually fall under the system control person, but that's how I see the divide around what happens there that the protocol itself is really critical infrastructure. Then you have to look at whether the system around it um has a system control person that otherwise has facts and circumstances that would make it into a money into a

financial institution. Yeah, no, I'll just add on the DAO piece cuz we touched on this earlier. I mean, part of the reason that we included this this clarity around the DAOs of not being by default any sort of controlling element it is is is what you see in the Tornado Cash space with the DAO there um that there's a lot of nuance about limit a lot of limits on what they could possibly do. And I think it's also important to tie that back because since you're talking about the Tornado Cash case without getting into the case itself, that this is consonant with the way OFAC has approached unincorporated associations for many many many years.

It's not new to them like certainly they designate, you know, dirty banks abroad and things like that and corporations that are laundering, but they also have designations against Los Zetas, Sinaloa Cartel, uh Russian organized crime that are not corporations, but the test for that is not just it's everybody's got a token or something like that, you know, it's it's like you it's a group of people under a head who are financially and actively proactively aligned in achieving a common mission which is not maybe the token goes up. I mean, it's like hey everybody, let's go out, create a a trafficking line, and potentially kill anybody who might squeal on us, you

know, like these are these are extremely aligned proactive groups that are accomplishing a very definite mission together and having been at OFAC and in in fact been part of writing packages for some of those, it's a pretty substantial legal test to show that when there's not an otherwise clear membership among people, that there's sufficient alignment of interest that you could say this person is actually a member of Los Zetas. It's not that like they were there in the town once and they paid they had to pay somebody off, so they've given money to Los Zetas. It's like no, you're a part you're actually a part of it. And but what about um how North Korea, you know, laundered a significant amount of money

through Tornado Cash? Like how would this setup prevent that? The CCTs would block off the wallets. So, they'd never the transactions would from Tornado Cash could never get executed. The way that you transfer from one wallet to another typically requires you to go through the CCTs as well. So, this is it's like this is sort of part of the effectiveness point, right? Like you can't even get your transaction through um unless you're hosting your RPC node. And I think, you know, people will say like oh, well, isn't that a flaw in it? But, you know, just like there are flaws in the way the system works in Tornado Cash now and I think Michael uh and I felt very strongly about making clear that both of BSA and the sanctions regime in the United

States is not zero tolerance cuz it can't be, right? Like it's just it doesn't work like that um and we can't achieve that no matter how much we all aspire to. And so, you know, I think the CCTs are the most effective way and almost to immediately start blocking off some of this more illicit activity. And I you know, I'd say while we don't know everything about the way Lazarus works in crypto and Michael may be able to speak to this more, we know a lot. We know what wallets they have. Um we know wallets that they've never moved crypto from. Um and I think that there's been a lot of work done to identify sort of their movements. And so, even at the, you know, the outset of a hack, people look at the activity within the first hour

hour and a half and say whether they think it's Lazarus or not. So, this is where the CCTs would work because maybe if they hack some other protocol, then they try to move it to Tornado, they'd never be able to because the CCTs would be blocking it off. Yeah, and I'll just add one other piece to that cuz Laura, it's a good question in terms of prevention. Like I also think part of the prevention if you have like a crypto ISAC that's having this sort of threat typology information sharing going on and you have touchpoints for the, you know, whoever it is. It could be an open source contributor that that that is good at fixing code. If you have this OSIP and F and sort of crypto ISAC setup, then as Lazarus is preparing attacks and there's

information they're preparing attacks. And here's the new attack vector they're going and this is how they're doing it now cuz they're constantly evolving and that's something that obviously the national security um system is looking at, they would be sharing that with whoever can have any impact whether it's the CCTs or whoever it is in the ecosystem to do whatever they can do or improving code somewhere, you know, that sort of thing. So, you'd be preventing it in that sense. Um and one other last point is just, you know, cuz I think it's it's it's true like as you mentioned the amount of Lazarus funds that were that that were not prevented in part because maybe there wasn't a crypto ISAC, I don't know.

But um I think, you know, that led to the sanctions and and there that will play out in the courts how it works, but if if hundreds of millions of dollars going through an entity was the justification to sanction it no matter what the collateral impact, I think it was like 880 million dollars of Sinaloa and Norte de Valle uh cartel money went through HSBC and it was prosecuted, it wasn't sanctioned. Uh and part of the reason it wasn't sanctioned even though there were sanctions because both those cartels were sanctioned is because the collateral impact on innocent people would just be too much. And I think that's the that's the balance that is a a substantial tension in the in the Tornado Cash uh designation in part

because there are a lot of innocent people. In fact, we know that seven at least 70% of the users were not identified with any illicit activity. And so, I think however the case comes out, it's it's just important for us to note that we don't want to jump to this sort of sanctions tool with that kind of collateral impact in the same way that we don't do it with other financial infrastructure. And I just understand the critical communications transmitters, these CCTs, are they like mostly front ends or No, they're literally an RPC as a service.

Um Oh. So, if you've heard of Infura or Alchemy, things like that, they're they're literally this totally separate thing. They're not this this proposal is really meant to sort of pivot off of this focus on KYCing front ends and turning validators into financial institutions. I think both of which we think may not be the most effective way to achieve our policy goals um for financial integrity in DeFi and really think like where are we going to do something that will be effective. And they're not uh front ends at all. And I think there are two parts that one of which is the substantial amount uh right that a substantial amount of the communications go through. Um the communications don't go through front ends. They go through, you know, they start at your wallet um and they the front ends may allow you to communicate,

but they don't they you don't the front ends don't do the communication. The RPC nodes do. And so, we were very very intentional and surgical about the CCT definition um because we didn't want to over capture different parts of the tech stack. Yeah, and and also just to underline like we're not also not saying the CCTs are financial institutions in any form. This fits with the sort of the way we think about AWS now and and and Microsoft Cloud, Google Cloud. Those are the There's all these services out there that are underpinning that are critical cuz if they go down, it impacts a lot of financial services, but they're not banks, they're not doing KYC on every transaction that goes through AWS or or Google Cloud. And they are already using

Cloudflare and doing other sort of detection. And by the way, they're also they're absolutely sharing information probably through the FS-ISAC because they underpin so much financial infrastructure. Hm. All right. So, now that this paper's out, what's next? You know, how do you get this made into something that uh applies in the real world? Well, I think what's next is uh that, you know, Michael and I were really intentional about seeing this as the beginning of a conversation about how to combat illicit in finance in DeFi. I don't think we think this is by any means the only proposal that can work. Uh and I think that we do want to see this as a really collaborative

effort to move this forward both with industry and with uh regulators and policy makers uh in the US for sure. Uh we've already in the first three days gotten great feedback and questions from both industry and uh on the policy uh regulator side of things um and are just excited to engage in a number of conversations uh on both sides both industry and regulators policy makers uh and to think about what is next. I do think we can say that there's a lot of interest in on the hill generally in thinking about AML and what they can do with crypto. And so I do think we're going to see more bills coming out, whether anything incorporates this, you know, I think this is pretty novel and it's different than what the

conversation has been to date. So I do think there's going to be some time to socialize it and talk about it. And Michael, since you, you know, have that background in FinCEN and such, like you know, what do you feel are the best kind of ways to get this considered seriously? Yeah, thanks Laura. I think I think it's really like Rebecca said, it's having the conversations. Like it's a it's it's admittedly a bit dense, but it's a but part of it was to really create a resource and a foundation for these conversations. And so part of it is hopefully going into FinCEN, Treasury, OFAC, Department of Justice, wherever, and having these conversations of here's why

we said it this way or this is why we see it this way. And here's why we think that there's actually at a core starting spot, like a lot of natural alignment on creating accessible and resilient financial infrastructure that that doesn't have to be turning everything into a bank. All right. Well, thank you so much for explaining your ideas. Where can people learn more about you to view in your work? I'm on Twitter and LinkedIn. Michael? I'm on Twitter and not LinkedIn. And your firm website. Oh yeah, we've got websites for website for Xantus and website for Arcturus for sure.

All right. Well, we will put all the links to that in the show notes. Thank you both for so much for coming on Unchained. Thanks Laura. Thanks Laura. Thanks so much for joining us today. To learn more about Rebecca and Michael's recently released paper on regulating DeFi, check out the show notes for this episode. Unchained is produced by me, Laura Shin, with help from Nelson Wong, Matt Pilchard, Juan Aranovich, Megan Gavis, Shashank, and Margaret Caria. Thanks for listening. Unchained is now a part of the CoinDesk Podcast Network. For the latest in digital assets, check out Markets Daily five days a week with host Noel Acheson.

Follow the CoinDesk Podcast Network for some of the best shows in crypto.