Overcoming Regulatory Challenges in Global Crypto Markets

Transcript

Our next presenter, Mr. Domo Mativ. Mr. Mat, the floor is yours. Hello everyone. Um, yeah, let me just check that everything works good. Yeah, it's working. Perfect. Uh, hello. I'm Dimmitri and I'm from Ukraine and actually I would like to talk about overcoming regulation challenges in crypto markets globally. So War Mah and and more uh who we are. So first of all we

actually one of the biggest cyber security providers in the world crowdsource security providers. So bounty crowdsource community and we working officially with Athereum Foundation with OKX Hobby Near Metam Mask and many other companies for more than eight years. We also work with banks, governments, protocols exchanges wallets stable coins and uh we actually have more than 45,000 security researchers and they daily have some rewards for finding valuable vulnerabilities.

And why this matters? So as you know u market actually grow from 3.8 billions in 2024 to actually 8 10 uh trillion uh by 2026. And by by actually this time we also have uh total value hacked in web tree uh so far 15 billions and regulators actually they expect not having just label that you did some audits or penetration testing but they also expecting to have continuous security.

So if you take a look at picture you can see that we had only five regulators in 2018 and now we have more than 50. So generally there was uh US market who actually regulated exchanges and tokens and etc. There was actually Japan who was one of the first regulator in crypto market after one of hacked exchange which is called GS and um uh there was al also uh Switzerland who also was working for regulations. Now we have US uh B2C and EF uh ETFs live. We have actually Micah. We have uh more than 40

license for uh in Europe. Yes, we have UA like V and ADM. We have also Asia, Hong Kong, Japan and etc. So uh how actually that happens? So regulations is not only that market actually decided to be regulated you know like money uh they influence on the market but everything was happening like long time ago in uh 2019 as you know coin market cap and coin gecko they were very uh famous aggregators for tokens and other exchanges and uh uh crypto projects. Everyone wanted to be listening there. And uh in early 2019, Coin Gecko decided to

uh implement some kind of rating for exchanges with S.Life and they built those methodology to uh sort somehow those uh exchanges. Then actually they decided that um many scams on the market and they decided to implement new categories in 2022. This is where trust score uh appear on a coin gecko. Now you can actually visit coin gecko website go let's say to coin gecko exchanges and you find out that all exchanges by default is uh sorted by trust score. So at the moment trust score is one of the main indicator at coin gecko where each

uh regulator each company can come and see what kind of stuff exchanges has. So nowadays uh coin gecko has proof of reserve they have actually team engagement they have bug bounty penetration testing etc. And you can actually see how you can implement or how you can interact with some um crypto exchange. So why is this happening right now? Uh first of all, it's about money. Yes. So we have more than 600 millions uh cryptocurrencies uh owners uh on the market and we have actually more than 100 billion crypto ETFs. So uh we have investors where we have investors we

have new projects idea and etc new businesses. So here we also have what taxes. So regulators they try to understand where they can get uh some actually clear rules and also give some have some uh financial stuff but also it's about fines. So officially because we have some unofficial statistics but officially we have 1.2 2 million uh from VA and we have more than uh 4.5 millions for ML and QAC uh fines uh for exchanges like Binance, Coinbase, Bitmax, Kraken and etc. So actually strict compliance

and uh rapid scaling and plus hacks they push industry uh to regulations and to self-regulations. So I actually um tried to take 10 uh regulators in the market and make some kind of map to explain what actually they have kora and what similar approach they advise to market uh for everyone. uh since we we implementing many stuff and helping uh projects to be compliant uh in terms of security uh we actually decided to make some categories for uh so I made a few groups one group is

actually for Dora Mica uh so it's Europe V Singapore another group actually for Bermuda Argentina Japan um Switzerland one more group is actually for US and for Hong Kong and I made a categories to show you how actually they uh similar to some approaches. So for example, if you take a look at some uh cyber security stuff like uh policy or penetration testing or let penetration testing, you can find out that some groups have um not obligatory but let's say even in Japan if you have smart contracts um regulator doesn't say that you need to

do smart contracts audits. it says that you have to protect your project and implement security best practice and etc. So that is why I I mark this as no but actually many regulators required to have uh audits by default and um also um some categories like security assessments, insurance, digital assets and cryptography stuff is also implemented by uh many uh regulators. what actually uh that means uh continuous security. So if you take a look at some frameworks uh so they had let's say penetration testing but what is penetration testing?

So you actually take your code or you take radio application come to some some third party providers they review your code they give you a paper certificate that everything good works and then you disappear for one year and this problems was appeared few years ago when many exchanges did some kind of penetration testing but then disappear. So that is why regulators implement more monitoring stuff like let's say um they do prove reserve some of them required to have two pro reserves per year like uh for example VA in Dubai some of them required to have daily monitoring um but doesn't specify like you know strict

stricter rules so um some of them is required to have penetration testing but some of them bug bounty so bug bounty is Then you hold the time listing your projects at crowdsource platform and then uh security researchers come and submit reports and um so right now uh regulators more going to uh monitoring and implementing uh uh security uh rules where everything is controlling all the time.

Um let's take a look at one case was happening with uh by bit. So you know by bit actually they got license uh in Europe um and uh we were part of this uh history. So we actually helped them to get this license and um you can take a look that probably almost whole scope was related to security. So uh license actually required to have smart contract logic uh not an infrastructure wallet security API and actually incident response and uh started they in uh early 2024 when they opened uh office in Vienna. So this is was the beginning uh

and then they started to implement uh license faster in February as you know by was hacked for 1.3 billion uh this year and uh so they started to make fast proof reserve and all stuff around security and implementation of license and they got license in four months uh in May 2025. So what I actually they did also it's a full team and resources. So they separated uh operations, they separated entity and etc. Uh but if you back to uh what I show before uh and if you would

like to scale and do more stuff around uh uh regulators, if you implement the main stuff for each regulators like u uh penetration testing, legal entity, if you implement smart contracts, audits and etc. You can actually easily scale to any regulators because they have similar approach and if you take a look at new changes of regulators uh they are going to be almost similar to each of other and also about budget so I like they we don't have official information so far but actually um community they calculated and about 40% of budget for getting a license go to security 30% for

legal and 34 operations. Um also um since we talking and working with some regulators um many of them requires to have compliance dashboard and they have so they testing. So uh mainly they asking for risk assessments for realtime monitoring compliance insurance and uh security stuff regulatory arrangement and actually they have individual dashboards. So they try to implement some stuff like daily monitoring see what is happening with proof reserve did company active did they response to um let's say some providers for example you have exchange

you host uh exchange exchange of some bounty platform and the platform for example specify that you as secure as a company doesn't reply for hackers uh um request for one week or one month and what is happening that actually coin gecko for example delete your trust score uh at the platform then actually you have um like notification for regulators and etc. So in this way everything is related to uh security uh also about uh upcoming regulatory

mile milestones. So as you see um you micica they actually uh started uh in December 2024 but actually they have those grace period by July 2026. So companies actually they try to implement um licenses they try to build their local uh entity and etc to be fully compliant with Micah Dora same so actually uh uh first mandatory uh uh TPT so the uh penetration testing that I mentioned before you can find uh here uh now it's going to be very particularly uh was for fedora Now it's going to be

uh mandatory. Yes. So it's something that is coming soon. Also uh Dubai they actually do more uh strict marketing rules as well because you know like crypto is about making some good marketing uh run token get money and disappear. So they don't don't want to make this spam around crypto projects and um yes so they have strict rules. Uh, of course, Hong Kong uh, compliance full full actually VATP compliance uh, also is coming. Japan as you hear before uh, you you're going to be uh, also more stricter for the security itself and US. in US as you know right now um much easier to do

business with a crypto and at the same time they try to regulate it make clear rules especially for stable coins and uh yeah so actually some kind of checklist for compliance uh first of all you need to understand what's the activities uh for uh regulators uh you need to implement continuous security because as I mentioned And continuous security is actually main stuff for almost whole regulators. Um evidence spec so actually understand what is your KPI for business. Uh policy vendors governments with whom are you going to work and localization so it's very important to understand how

business works uh what is rules uh what is travel rules and etc. Um yeah and a few takes away from me. Uh first of all if you going to work with regulators so first of all regulation coverage is still building. So it's influent you but not so much as security because even if you're not regulated by regulator someone can steal your money. And um actually compliance um allows you to partner with some local uh companies faster because if you know that someone is have license at least they are not

scammers. At least they can build some uh build build business with you together. And yeah if you have any questions please uh feel free to uh write me. Uh yeah, thank you. Thank you for attention. And they missed out. Thank you very