Seven Deadly Sins: Managing Legal & Regulatory Risk in DeFi

Transcript

but I don't really use slides for shorter talks anyway all I had was one page with my name on it so it's not a great loss so I see we're starting about 10 minutes late I'll try to finish my talk in about 15 or so minutes and try and leave some time for questions my name is Badri nitrogen I'm a lawyer from London and based in London I do a lot of work with crypto companies and blockchain projects and so on and what I'm going to talk about today is some of the lessons and advice that I give to a lot of my clients and talk about the lessons that blockchain projects can learn and think in terms of legal risk this is based both on my work with my

clients and on what I see in the broader space know my background is very much a traditional finance lawyer finance litigation lawyer I used to work at a big law firm called Clifford chance in London for many years and before that I did a lot of work in technology law I worked at this place called the Electronic Frontier Foundation in the US which does a lot of work on internet law so I've seen this from both sides and in the last couple of years I've started doing a lot of work with blockchain projects in this talk I'm going to divide it into three parts in the first part I'm going to talk about some

overarching principles that I think it's useful for people working on blockchain projects to keep in mind then I'm going to talk a little bit about the kind of legal risks that blockchain projects face and finally I'm going to talk about strategies to mitigate those risks and practical ways in which to think about that risk which are the seven deadly sins which are the things not to do I'm not going to go into too much detail on the technical legal issues they vary a lot between countries and I don't have time anyway but the basic principles apply in any country so the first thing I want to talk about especially for

people here who have an engineering background or who are developers is that the law and developing engineering are really not that different law is basically code that controls the behavior of human beings it's not some kind of alien foreign thing that is difficult to understand or difficult to follow the way I look at a legal contract is pretty much and review a legal contract is very similar to the way someone does a security audit of a smart contract and it's almost exactly the same thing the main point I want to emphasize here is

that the principle of technical debt applies to legal contracts and legal relations just as much as it does to software for people who don't know what technical debt means it's basically the idea that if you take a small shortcut early on in a project because it saves you a little time or saves you a little bit of hassle the cost of fixing the problems that arise from it just balloons over time and after five years 10 yrs there's a huge amount of effort needed to make them to fix the problem if it's fixable at all one of the best examples of that is the y2k bug which someone made a small decision in the 60s

and we ended up with a multinational problem which took hundreds of thousands of coders to solve exactly the same thing applies with legal decisions the decisions you make in the early days of any project will have a lasting impact which will affect you for a long time things like which country you set up operations what corporate structure you use who you go into business with things like that when I was a little kid I had this computer called the ZX Spectrum and I used to code in basic on it when I was about 8 and then when I was a teenager I used to run Linux on the desktop in the

90s and then for some reason I just became a lawyer instead of an engineer and I used to think this was a big shift between being a lawyer and being an engineer but it actually wasn't it's pretty much exactly the same way of thinking only it's applied to people instead of computers so part two what is legal and regulatory risk it's a big word people start or phrase people start thinking and worrying well I'll get into legal trouble or something will happen in the simplest terms it's getting into trouble with the courts or the legal system in a country that's all in terms

of the practical consequences what it means usually is that if you get into legal trouble you'll have to spend a lot of time and money and hassle dealing with it that means you might have to pay a fine in a worst case scenario you might there might be criminal consequences or your business may shut down but what it means is someone there'll be legal proceedings in a court or with the regulator or the government and you have to deal with them now regulatory risk is basically a subset of legal risk it's just getting into trouble with the government or a regulator instead of any other kind of legal risk I don't really have the time to talk about it today

but of course there can be legal risks other than the ones that you get into with the government you could have disputes between founders you could have a former employee who's suing you all kinds of things are possible but for now I'm gonna focus mainly on regulatory risk and government risk now of course any company can get into trouble with the government it doesn't just have to be a blockchain project or a crypto project but blockchain projects tend to be unique because legal systems weren't developed with them in mind so just the existence of a blockchain project can cause legal issues and can cause legal

problems this is what makes most people nervous in that sense it's a lot like the internet was in the ninth 90s for those who remember it there was a time when people thought that the law just didn't apply to the internet which is wrong and I hear people even now saying the law doesn't apply to the blockchain which is also wrong all that happened is that it took time for governments and laws to evolve which took maybe about ten years in the case of the internet from the time it went mainstream in the mid 1990s it'll probably take a few more years with blockchain but it will happen it's

already happening and the process is building a pace and it's something that needs to be planned for but the important thing to keep in mind here is that this is where the opportunity also lies legal uncertainty means there's opportunities for people who are willing to accept that uncertainty and deal with it the important thing is you need to make understanding legal risk and having a plan for dealing with the legal risk a core part of your business model it's not something that you think of as an afterthought it's something you think of from the beginning I saw something on

Twitter recently I forget who it was but it was a venture capitalist on a panel somewhere and he was quoted as saying something along the lines of defy projects shouldn't worry about legal risks they should just think about growing users and offering a service people want to use don't do this guys really do not do this if I had slides I'd have a picture up of someone sticking their head directly into a hole in the sand because this is exactly the kind of thing that will come back and bite you so anyway moving on I'm going to look at a few specific examples of the kind of risks the dphi

projects face this is this could be a talk by itself so I'm just going to run through it very quickly the first one is sometimes there are just legal barriers which make projects impossible sometimes the legal barriers are really obvious so for example until today when the Indian Supreme Court struck down the ban India did not allow its banks to provide any kind of services to companies in the crypto blockchain space other problems are a lot more subtle so for example it's virtually impossible to have a regulated

Dex in Europe because of certain European regulations those of you who are at a sex talk yesterday you know saw this in a little more detail but that is something you probably won't find out until you do a little more research and get deeper into it the point to emphasize here is when you have what's called a pure legal barrier which makes your project impossible you essentially have three options option one change your product or your business model to be legally compliant option to move to a jurisdiction where you are legally compliant or option three what I call the uber approach ignore the law say

I'll handle the consequences and hope that you grow big enough fast enough and get rich enough that you can fight back that's not necessarily a bad idea I mean uber pulled it off not without consequences but it just needs a lot of very careful planning and very clear understanding of what the risks are and what you are prepared to do next issue defy is a global product anyone in the world who has access to the Internet can access it but regulation is local there are something like 200 countries in the world I think it's 196 countries and in theory a defy project will have to

comply with all of them for all practical purposes this is impossible the main takeaway here is one the most important jurisdiction you have to worry about is your home diction you need to be as careful as possible to be compliant with the laws where the project is based and to the most common consequence of this is that markets tend to fragment most projects make a judgment call on we will be compliant with this country and maybe a few other countries but in certain other countries where we are not compliant either we'll just ignore them and hope they don't come after us or we'll block

access to them this is why in the previous talk all the prediction markets mentioned or most of them had Geographic blocks for different countries depending on where they came down on this spectrum now as a separate issue it is of course impossible to block access to smart contracts directly on the blockchain all most projects can do is block Geographic access to some countries for their front end but that's not something we can really get into in this talk so I'll just move on there's a couple of other things there's consumer protection issues you could get sued because

somebody used your service and lost money or they thought the service wasn't good enough for example I've heard a lot of talk on Twitter about people who want to sue Falcom for the attacks that happened a couple of weeks ago and which you know it's resulted in about a million dollars being lost but finally and most importantly there's a whole category of risks which comes from the tension between centralization and decentralization and where on that spectrum your project lies if you take one thing away from this talk this is the point I want everyone to remember decentralization and centralization it's a spectrum and you have to make a very

conscious choice between the two poles and where you end up on them they both have advantages the short version is that the more centralized you are the easier it is to run your project the better your project is you and respond quickly you can market better you can make decisions quickly you can fix problems more quickly but the less but the more legal risks you also have the more control you have over a project the less you can say I have nothing to do with that it's just some smart contact on the blockchain Vitalik had a fantastic blog post about this idea a couple of months ago and

it's something that I try to emphasize to everyone you make a decision and you take the trade-offs of that decision and it's worth making that decision in a very conscious way this is why the current thinking for a lot of projects is that they'll start off centralized build a community in a user base and then move to being decentralized this is great in theory and there's a very influential a 16z andreessen horowitz a blog post where they set out a strategy for dphi projects to do this it could work we just don't know yet but it's worth trying as a strategy so to give this as

an example something like uni swap which is just a spark contract on the blockchain and the founders don't have much control over it and they don't make any money from it is in relatively good position legally it's not a magic bullet you know you can have a government who's looking for someone to blame just try and come after the developer of the smart contract but it's a pretty good place to start if people started making the the developers of unis pub started making money from it they'd be in a weaker legal position so moving on from there part 3 let's assume you have a defy startup and you're thinking about how to mitigate your

risks so these are the seven things not to do the seven sins the first sin oh and by the way some of these sound a bit contradictory because they're more like principles which apply in different ways in different contexts okay I've got about five minutes I'll run through it quickly the first sin ignorant is not bliss you need to be proactive and have a plan this is the first sin because it is the most important one there's no excuse for a failure to plan and prepare for contingencies now that said there are no guarantees you know as Mike Tyson said everyone has a plan until they get

punched in the face but it's still better than nothing take telegram for example they actually tried to be as legally compliant as possible when they did their ico it didn't prevent them from getting into trouble with the SEC and getting into a big legal battle that's going on now but it's still better than nothing they'd have been much worse off if they'd hadn't done that managing legal risk is a core part of the project second sin don't go to the other extreme you can't ignore your business that is the most important thing unless the legal risk is a bet the company risk or

the legal risk means you might go to jail in which case well that comes first I think it's Nassim Taleb who said in order to prosper you must first survive the third sin this this is the thing I most often have to explain to my clients because a lot of people come to me and say what is the law and expect that there's this kind of fixed yes or no answer I can give I mean how many people here have spoken to lawyers or listen to lawyers and thought I can't get a straight answer yeah almost everyone or anyway this is the reason there's a misunderstanding about what the law

means the law is basically an opinion if you come to me and say what's the law I'll tell you in effect my opinion is that the law is this that's true even if the government and that is true even of regulators if they come after you they have an opinion the only time a law is binding is when a court rules saying this is the law as applicable to you not even as applicable to someone else as applicable to you to put it in other words any opinion about the law is an expression of a particular risk tolerance and you can find justification for that anywhere so a lot of cases are so the takeaway from this is there is

the law is not an absolute it's a question in a lot of cases about what level of risk you are willing to take this is of course true in a frontier space like defy if you murder someone I'm telling you now it's definitely illegal but in a space like this with so many gray areas a lot of it is just an opinion so don't take it as this kind of edict handed down from heaven because it's not the fourth sin on the other hand you shouldn't drift or play it safe because it's easier to drift along and just keep running your project and not have any idea what's happening on the

legal side bad idea the fifth cent not engaging in forum shopping what this means is basically that it's worth thinking if it's feasible for you about moving to a jurisdiction that's more friendly because so many of your legal risks and the consequences come from where you're based it's not possible for everyone but I know people who have done it and it's definitely worth thinking about the sixth sin forgetting the regulators and the government are people it's easy to be just really nervous or really scared or really hostile to regulators or the government and think they're trying to stop us innovating

they're trying to stop all of these good things and that's justified to an extent but really regulators are just people trying to do their jobs they're the law they can't ignore it we can't ignore it and they're just trying to enforce it it won't always work but in a lot of cases it's very possible to reach an agreement with them if you can communicate with them and educate them and it's important not to forget that and with that I am done thank you thank you questions regarding front-end and J blocking do

you recommend projects launch maybe on ipfs sir the whole problem goes away the problem doesn't go away because okay the short answer is the problem won't go with a government can still come after the person who put it on ipfs but it's better than it's better than nothing you know you the project will stay up because it's on ipfs it won't stop the developer from getting into trouble but it's probably a good idea to launch north EFS it will make the project more resilient yes let me put it another way the fact that it's on ipfs doesn't

change the legal equation it means it's harder for someone to enforce a legal ruling but the if you are in trouble for putting something online you'll be in trouble for putting something online someone there or you can just shout there we go got it so when you're talking about centralization and decentralization is it a bit of a false fallacy that just because something is decentralized that there is less legal risk to your previous points as well

there is less regal that is less legal risk if something is decentralized that is true it's not no legal risk you know in the previous talk it looks like to me that several prediction markets are basing their legal strategy on well we are decentralized there's no legal risk that's not true there is still legal risk but there's less legal risk and also less in terms of obligations it's easier to argue that you don't have to do things like AML okay why see if you're more decentralized but it's also just harder to run your project if you have a time lock and you need a vote of a dhow and so on but there's no such

thing there's no legal risk and it's a question of what risk tolerance you want okay thank you [Applause]