Crypto lawyers on the loose

Transcript

is hello do you hear me well ow okay now it works um hi everyone welcome thanks for being here despite this title um my name is fatima here is silke hi guys hi guys yeah okay cool um yeah and so before we delve into the topic just a couple of words about myself my name is fatima as i said i'm a crypto lawyer worked in the space for a couple of years

in various projects i don't know if you want to introduce yourself now yeah i'm silke i'm the general counsel chief legal officer of nurses i've also worked in a space a few years um talking about and advising on how to minimize your risk um in this space cool outline so today we're gonna talk to you about how to mitigate crypto legal risk so we're gonna start by a context you're going to see it's maybe one of my favorite parts of this presentation then we're going to give you some steps on how to do your crypto legal risk

assessment we're going to delve into detail in what we call here the tool of decentralization and we're going to end by giving you some general tools or tips how to mitigate your legal risk um hopefully by the end of this talk you're gonna have a better overview of what projects in the space do why do they make some of the design choices that they make you hopefully be able to recognize what would look like legal strategies from the project and also have these in the corner of your head in case you have your own project that you want to do yes this is not legal advice

i like this meme i made it so um yeah this is not legal advice for many reasons and i think it's really really important to emphasize it now um crypto legal risk is huge and we don't really know what it is right so these protocols or softwares are kind of bound or less boundary-less and apply everywhere many jurisdictions have kind of a reach to these projects or want to regulate them we don't really know how we don't know how the legacy regulations apply uh to some of the software's and we don't know how these regulations are going to change so

there's a lot of uncertainty and the tools we have right now we hope they work we are implementing them in a way for later to help us but we actually have very little clue yeah disclaimer another disclaimer so when we talk here about laws and regulations what we mean is laws and regulations enacted by nation-states this is not to be equal to moral or ethical norms so it's not because you can do something without having any form of enforcement against yourself

that means that you should do it right so please in whatever you do try to abide by the best standards in the industry but also your best judgment and be very ethical sorry i have to say it um if you have ill intentions with your software this presentation is not for you we cannot help you and most likely it will end up being criminal yay fun yeah so now silky is gonna tell you about how to assess your legal risk i'm actually going to stay a bit longer um

on the morals and the ethics so a good way to start assessing your legal risk is to ask yourself whether the protocol or the product you're building is high risk basically i mean are you just going to sell socks i mean normal socks or are you building uh maybe some privacy preserving decks that allows you to do untraceable transactions then perhaps you might have to look into these questions a bit deeper and so every project usually i mean here at the conference everyone

knows what the benefits are of the product we are all idealists so i mean you build it because you think it's going to improve the world usually i mean in this space at least but you ask yourself so what harms can this software cause and to come back um to my privacy preserving decks well the first one of course is oh well my software might be uh buggy and then you know your users lose funds the second one would be well maybe you are enabling um someone to fund a terrorist attack um yeah so you would you would want to think about this um so when you're like you're this

little team may be building this protocol um and you're based in a certain jurisdictions and so now the legal question really becomes so if you are decentralized team is your product regulated or maybe even forbidden in the place where you actually are so maybe so you look into this question you get some lawyers and they're going to tell you well you're based in country x and in your country well we might be able to just publish the code on github if you're lucky you could also deploy it but hosting a end on this thing is not going to be

possible in this jurisdiction or maybe they're going to say well actually you can host your front-end but to do that you'll need all these licenses maybe you need something similar to a banking license or you might have to comply with a license that is not really suitable to your tech so um you are kind of in a gray area not sure well are we doing something wrong or not so the big question here is well do you want to try to submit to being licensed or do you not want to try to submit to being regulated if the answer is yes you're going to try

it you're going to try it in in the jurisdiction where you are based then i mean this talk would end here you're going to get your regulatory lawyers they're going to help you you might even redraft your code rewrite your code to make it nicely compliant but likely i mean there are probably people here you wouldn't want to do this you're like nope maybe that's not a good idea to get this banking license for my untraceable decks so of course we're lawyers we're also going to look at a no you might have just moved to port

portugal lisbon because you don't want to pay taxes on your crypto and now you're wondering well how can we go into a more favorable jurisdiction so likely what that means you have to move bodies to wherever you want to be i mean i'm not we're not going to advise on like setting up some shell company somewhere and then hoping that you'll be safe because that's not that's not the case so you just moved or maybe i mean you might have really good reasons why you don't want to live in berlin anymore well um you might not like the fact that there are no elevators or not many elevators or you don't like the german bureaucracy or the

humorlessness so there are really good reasons for you to move to zuk um in the into the countryside and take your team there or even if you don't want to do that yeah but you'll find some bodies there that will take really important function in your project the other option is the second one is well there might be actually reasons beyond legal why you want to decentralize your project and the important part is beyond legal the third one is you might just be a really good satoshi and the fourth one is you listen to your lawyers twice

you kiss them politely fire them and say you only lived once you're going to accept the risk whatever that is whether you calculated it or whether you didn't calculate it and later asked for fall on your knees in front of the regulators and say i'm so sorry well we don't recommend that do you hear me okay um yeah so just a couple of words about the last one um you always have to accept the risk because there's also this part of the

risk that is unknown there's always risk someone told me a couple of days ago if you want to have no legal risk in crypto just don't have any crypto so this is anyway something you have to do but ideally you would mix all of this right path together um and be a very good satoshi i mean this is sorry but almost impossible right to be entirely anonymous this is not recommended because by doing that and if you want to do it thoroughly you will have to breach a lot of laws for example do not like not declare your assets or whatever that is related to that project so do not do this so how decentralized is the project this

is a question you have to ask yourself in order to know where your project falls on this like spectrum of decent or continuum of decentralization um and in order to do this we try to break down decentralization into three different categories although these categories do overlap a lot so um yeah this is not very clear categorization just bear with us software so you wanna decentralize or have a decentralization soft decentralized have a decentralization um as a strategy for your software what does that mean so you want to minimize centralized control over the software if you have any kind of keys

that give you some form of control over the software especially if this control is not governed in a distributed manner you want to minimize that you want to also have a wide distribution of the token um this is pretty well known by everyone right you don't want to have big whales like vc's or the team that has like an outsized control and can basically solely influence the faith of whatever this software does financial benefits is very much linked to the previous point so sometimes we see these softwares that for example will take a fee from users and what do they do with this fee so either they redistribute it in the pool or whatever or they funnel

it to the team of devs or to a foundation or an entity or someone and this direct connection between the fees and the persons kind of put these persons in charge of whatever is happening on the software and and this is kind of a point that needs to to disappear in my opinion um so if you need these fees to be um to be there then maybe you should think of novel ways or not so noble anymore but put them in a dao for example and then have it governed and given to whomever needs to spend them expectation on the core team so um again like you should put some distance

between yourself the core team and the software so that people don't just rely on you for it to work or be maintained ip this is a great point so there's two sides to the ip softwares open source try to open source it have it free software um and also the ip on the developer side so our researcher side so what i've noticed recently in the past like one or two years is that some of the projects do push whomever holds the ip to assign it to an entity and usually these entities are either for example a foundation

or you go offshore you just assign it there and you put distance between yourself as the author and the ip so in case something goes wrong you don't even own that ip i have no idea how valuable this is in practice operations which is traditionally very centralized how to decentralize and engage the community from day zero so have them participate have them permissionlessly participate build grow a very very important it makes your project way much more resilient right have the deployment done by a third

party so in most of the places we see nowadays that software or code is kind of accepted as speech or science or you can you can have it on your github repo deployment is another story so the person who pushes the button and makes it all happen and then run in an autonomous fashion may be liable for it so we do see in the space like if you're a bit curious and you follow some projects that have it all of a sudden deployed um or just like have their legal structure done in a certain way that someone else deploys it and again put some distance between the core team and the deployment and community-run

communication channel so your discord telegram try to have it moderated by the community you can directly engage with them and find moderators or just let it be and someone at some point will take charge obviously there are a lot of trade-offs if you want to radically do any of these points um one last thing before we move to the third category is that um by saying all of this i am not saying or we are not saying that projects should go for radical decentralization so if like you have just this autonomous software and there is no link to you and nothing you can do kind of to influence it this is in my personal opinion a bad idea and it

makes it just not also resilient in face of innovation either on the tech side or on the cultural or legal side so you need to you need to still be careful and pick kind of the points that fit with your project and implement those oh i had more points front ends yes centralized points project run their front ends often the easiest thing is to do is to just go to amazon web services and have it hosted there and oftentimes also the cheapest way to have the aws is to have service in the u.s so this may be problematic because it may create an attachment to

the us jurisdiction and have the regulators there um kind of have a reach over your software so try to pick well if you use a centralized server the jurisdiction in which you want it to be to be stored ideally you do it serverlessly and i mean many projects do that nowadays you can also outsource the front end have many getaways deployed by the community to your to your software and so on governance i'm not going to talk about this um because i mean it's a whole topic in itself but if you want to decentralize you would without having it be entirely immutable or autonomous then you need a form of governance and

have a contingency plan always in case something happens lost change regulators wake up and be able to for example just shut down your entities stop operating knowing that the software will run and the community will take over so the we the third category we um bundle those topics under is fundraising or token issuance so that's very central to most startup well you need to pay somehow for whatever you build and um there are few when you focus on

decentralization those points are overlapping but basically um if you want to um use decentralization as one like legal legal um shield um one thing you should what is i mean often people and this is really good idea to do actually i mean you're a small team you have no funds you go to vc and raise some funds often the vc will get you know you promise to give them some tokens later because that's already what you plan at that point you should probably already be aware that well you want to make sure that this these vcs don't become these massive whales because then again you have a

problem of having too many wells in your system and it's not being decentralized enough then i mean from a decentralization point i mean what is there are token issues that are traditional um token sale from 2017 um and there are air drops which in the last two years has become one of the main ways to actually decentralize your community build a community and also basically get around some regulation because token sales tokens issues is probably

now one of the most regulated areas of crypto because of 2017 and airdrops are quite novel so a lot of regulation is still building around it it hasn't been much juice prudence there has been some and i'm going to speak a little bit more about that now um so you could also i mean there has been a lot of discussions on fair launch which is another way to do it via airdrop just you don't pre-mint pre-allocate and then later ask the community you airdropped it to whether they want to give you some payment for what you've done before so this isn't definitely like there are

many more ways to deal with token distributions this is just like some very um novice graph of what is out there and how they compare so when we look at um you have the traditional token sale like you go on you know you have an agreement with coin list and do it there then you might have an initial exchange offering you might have an ido a balancer pool you might fund a balancer or unisport pool then you might realize actually oh man in my jurisdiction i cannot even legally fund the balance or unesco pool so you get a third party to actually do this for you

or you might then think actually it was much better as i just mentioned maybe do some miracle drop with team allocations where the user actually has to claim you know they have to do some activity to actually get the tokens or under like far right here is you have a fair launch with a locked drop where basically you drop tokens on on the users or on some community and those are non-transferable so in all this discussion what's really important and still has been since 2017 as the question whether your token is a security it is a security and if you do the last

or even if it's not a fair launch it's just a drop with a non-transferable what i call here lock drop then you usually get in at least some jurisdiction around the whole issue of securities because likely your tokens not gonna be security and the ones that make it transferable are is i mean the community because you've seen this with some projects we've done this really well one project was for example tornado cache they had first and they dropped first a non-transferable token and then they had organized the dao that was constituted by those people who actually got the tokens to vote on the

transferability of the token so um yeah so you want to think about that and of course it very much also depends on the timing if you've been a team you've been funded by vcs or some somehow differently um you just found it yourself you've worked on your you've worked on your protocol or whatever you're building your software and it is actually ready so in a lot of jurisdictions what's required you have to have a ready protocol you cannot just launch something which you know has no usability because that moment it usually becomes security you don't want to do that then without approval and in a lot of jurisdictions you wouldn't get approvals

other than if you want to do a really like a security offering however like when you look at airdrops it's often the other way around because you might actually want to bootstrap your whole community and the people building on it you want to put strawberry from upside from the whole community so you you have to actually do or you should do the airdrop prior to deployment because what you can do then is you can get your community to deploy it the dow deciding to deploy it and you might even get a third party to deploy it because you're just gonna put it on github and in addition you will have a lot of third parties to work on your protocol so

it's very much depends on the time and where you are you might be doing a few of those but yeah that's basically on token distributions we've prepared a checklist five pages with all these questions on it so if you have more detailed questions it's also on there so just to summarize some lines of defense here we minimize central points of capture you make sure it's not a security i mean we promised nothing or well there is no single creator or operator because actually it's all operated or like by your bootstrap community favor a clean airdrop or fair launch

actually i forgot something to say here so there have been to some jewish prudence in the us which basically suggested that token as airdrops are also token sales or they are unregistered offering of securities if there's a benefit to the issuer so you have in the past one and a half years seen some air drops where you think oh that's totally dumb stupid why why would you incentivize the people like that and in fact often you have a legal argument behind this where basically well this is what's done like that because it's for legal reasoning you don't want to have this connection between the benefit to the easier and

um to make sure that it's not a security or like characterized as a token sale so i see a lot of questions and people like that was really not really intelligent to do that why often you know there are legal reasons why it looks that stupid so this is not an endorsement of these projects not at all i'm not working on any of them however they have had very interesting legal strategies at least for people to have a look at i'm not saying not judging on the tech on the protocol um what it's whether it's good what they've built it's just basically from a legal point

of view they have used very interesting ways to um immunize their projects from or like make its bit more immune from legal risks thanks yeah so now that you got some like specific tools for crypto legal risk mitigation these are like more general tools that do apply to crypto projects but you can also use them for whatever venture you do the first one is a good one clean trail what does that mean um so in case you

run into trouble usually it happens like down the line right one year two years four years after um and then the person who is investigating you or suing you has its own narrative and you have to come up with your own narrative as a defense line right and how do you sustain your narrative you need to have proofs for it so if you have that in mind from the very beginning you also structure kind of your communications especially written communications in a way to leave the trail that you need to leave or that you should leave later so be very mindful also of whatever you say in your telegram or signal chats one-to-one chats like people do screenshot if you have

sensitive phone calls assume it is recorded these are just like general paranoid tools um that i think everyone should have in mind assess your liability so once you assess your risk it's important to also assess your liability so what if this risk materializes like what do i risk concretely is it just bankruptcy just the entities bankruptcy maybe this is a risk you're happy to take then you like structure the treasury of this entity in a way that if it happens then it's okay um if it's for example jail time for you then the whole story is different and you need to put other things in place um tax advice tax um is

really an annoying point usually because no one knows how cryptos are taxed like tax lawyers or advisor are often lost even the tax authorities don't really necessarily know and and probably when the tax level event happens later it will change and depending on also the size of the taxable event the authorities might have other approaches to it so get tax advice in different jurisdictions in which you operate so if you have a lot of employees in one jurisdiction if you yourself are the missile in another one if your entity is somewhere else get all of the tax advices in these parts that you can then rely on to structure in case something goes bad

you can always show that you got the advice hurry this is very specific to some fields that we know are gonna get regulated so right now regulators are really paying a lot of attention to privacy tech um we don't know what's gonna actually exactly happen and how they're gonna enforce it but we know that they are having a close look at it so we are kind of in these projects um racing against the regulators in some ways so if you deploy before there are any form of regulations you still can like i mean you did it in good faith if you deploy after it's way harder to sustain that point so yeah try to have i mean my personal opinion is try to have something that is

worth being deployed as soon as possible and then you can improve it disclaimers we had many in this talk yeah just use them legal personality so understand how legal personality protects you put layers between yourself for example and whatever you do this is a tool that you can use you just need to to do your own research keep a low profile so you don't have to actually keep a low profile but don't go bragging on twitter about whatever you like whomever is using your protocol or say that like you someone can money launder with your product or whatever maybe it can happen because your software is an infrastructure software and you cannot like block someone from using it but

also like try to keep a low profile don't attract attention where it's not needed legal advice i said it in the tax just get as many as you can that sign off whatever strategy you do this is also important for you to know that you're doing the right thing and and then again this is part of leaving this trail that you need to leave fragment the project is kind of decentralized fragmented even if you have one entity that does for example like you have a foundation in switzerland that would do the community outreach that would do grants that would do i don't know software development try to also fragment those so the more fragmented the harder it is also to pin down

one entity or one person dno insurance so directors and officers insurance try to get one um being investigated cost a lot of money being sued costs defending yourself costs a lot of resources um but oftentimes in crypto projects it's extremely hard to find an insurer who is happy or ready to ensure this risk just because they are kind of hard to to quantify so what you can do alternatively and there may be a lot of other ways for all of these lines that we put on this slide but what you can do for the insurance part is have a pool of money that you segregate from the very beginning with the clear intention to use it in case you need to defend

yourself or to participate in an investigation and so on so once you segregate it and you um give it a clear purpose later on you can use it for for this and yeah put a lot of money in there um legal mitigation legal risk mitigation tools are test tested in prod right so we don't have any kind of perspective on whether or not they work you can only implement them there's no test net for this i mean you can try to get regulators approval beforehand by asking for a ruling but this is in very few cases and very few jurisdictions so usually you just need to go for it and hope it works

i know it's kind of bad practice in tech it is the norm in law yeah do not be a low-hanging fruit be responsible have your best intentions in whatever you build so in good faith later you can tell that you did not wish harm this is your best actually legal defense like you did everything in the best possible way you knew and abiding by the best um industry um standards talk so why are we actually doing this talk is because we realize that there is this crazy bottleneck where having this kind of practical tools or information is really hard to

get so you need to be connected to other projects who already had gone to several lawyers over a long time and expand a lot of money and got all these all these tools or ask your vcs um they are repeat players they have many projects they are very well aware be mindful that they do also have a conflict of interest like what do they want from the success of your project maybe a little bit different than what you want but nevertheless exchange with them you use them they're very very um cooperative usually if you have good ones um and yeah so share this knowledge we're attempting here to kind of not open source it but spread it open the dialogue around these topics and try also to collaborate and coordinate um

around like one maybe global strategy that would work for everyone and the last one innovate with legal tools whatever tools we gave you here are definitely not the best there may be and is probably way better ways to do it that are already done and we're not aware i am not aware of it um and you can also innovate and create novel legal tools please do so do not just compromise and apply these tools because then you end up with like a frankenstein type of project that like you remove the nature of your own project just to be somehow compliant without even knowing if it's gonna work so yeah do your research tailor your strategies

and yes we made a checklist so that kind of summarizes all of this content we give you and that you can use kind of to assess your exposure to these risks and then think of strategies we're gonna post the link on our twitter right yeah so these are our handles it's much more detailed it's much more detailed yeah thank you very much everyone for questions uh we're gonna be outside there are other lawyers in this room i see yes so if you wanna also answer those questions you can join you