Let's stop regulating crypto exchanges like Western Union

[This was published last week at CoinDesk]

The collapse of cryptocurrency exchange FTX has been gut-wrenching for its customers, not only those who used its flagship offshore exchange in the Bahamas but also U.S. customers of Chicago-based FTX US.

But there is a silver lining to the FTX debacle. It may put an end to the way that cryptocurrency exchanges are regulated – or, more accurately, misregulated – in the U.S.

U.S.-based cryptocurrency exchanges including Coinbase, FTX US, and Binance.US are overseen on a state-by-state basis as money transmitters. Money transmitter regulation first emerged in the early 1900s with so-called "immigrant banks." Agents would collect funds from local immigrant communities in places like New York City and forward it by steamship to their families back in Europe and elsewhere.

To protect immigrants from fraudsters, states began to impose licensing requirements on money transmission agents. Each state (except Montana) has evolved its own set of money transmitter laws.

Household names like Western Union and MoneyGram are regulated as money transmitters. Oddly, PayPal was stuffed into this framework in the early 2000s. (It currently boasts money transmitter licenses from 49 states). And then, in the 2010s, crypto exchanges were subsumed under it. (Coinbase has 45 of them.) Later, stablecoins like USD coin were anointed as money transmitters.

In essence, money transmission has become the go-to bin for a motley crew of "new financial things that people are using that we don't know how to regulate."

The problem is that the public protections afforded by money transmitter law are inadequate. Dan Awrey, a professor at Cornell University, has documented some of these failings, which include lax bond security requirements, tiny capital requirements, an insufficient "ring fencing" of customer funds in the case of bankruptcy and an overly permissive list of investments to which transmitters can deploy their customers' funds.

The inclusion of crypto exchanges under the money transmitter framework is particularly perplexing. Exchanges like FTX US and Coinbase offer brokerage services and liquid marketplaces for trading. In many cases, these exchanges store a significant chunk of customer’s life savings, for long periods of time. Brokerage and trading are typically the domain of beefier federal agencies like the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC), which have far stricter rules than money transmission agencies, particularly around custody.

So, to review, crypto exchanges are being regulated in the same manner as the neighborhood money transfer shop, which typically only handles small $200 cash transfers and rarely holds customer funds longer than overnight.

The unfortunate failure of one of these money transmitters, West Realm Shires Services Inc., may be the final straw for this rickety arrangement. West Realm Shires Services is the official name for FTX US, a large spot exchange that serves around 1 million Americans. On its website, FTX US lists the 40 money transmission licenses it has been awarded. For states where it has no licenses, like California, FTX US presumably uses a rent-a-license agreement, whereby it contracts with a third party to ride shotgun under its licenses.

When Sam Bankman-Fried’s 160-company FTX octopus was put into bankruptcy last week, the FTX US spot exchange was one of the entities that found itself on the list. Not only are customers of FTX US embroiled in what could very well become a multiyear bankruptcy process. Thanks to the patchy protection that money transmitter licenses afford to FTX US customers, there is a good chance that when this process finally winds up, customers also won't get their money back.

The bankruptcy status of FTX US stands in sharp contrast to those parts of FTX's U.S. operations that are regulated by the SEC and CFTC. FTX Capital Markets and Embed Clearing, which are both overseen by the SEC, remain solvent and are not listed as debtors in last week's bankruptcy filing. Neither is FTX-owned LedgerX, which offers crypto derivatives and operates under CFTC oversight.

It's too early, to be sure, but it appears that something about these three subsidiaries' SEC and CFTC oversight has afforded them – and their customers – enough protection to stay solvent.

In a different world, one where the FTX US exchange was regulated by the CFTC and SEC, might FTX US and its one million customers have been likewise spared? It's very possible.

Things didn't have to be this way. For two years now, SEC Chair Gary Gensler has been politely asking crypto exchanges like FTX US to submit to SEC oversight. But FTX US didn't listen. Nor did any of FTX US’ competitors. They kept coasting on their money transmitter licenses. And now FTX US customers appear to be in trouble. While exchanges certainly bear part of the blame for not complying, so does Gensler for not pushing hard enough for exchanges to come in and register.

There’s an easy fix. It's time for U.S. crypto exchanges to face the same rules as non-crypto marketplaces and brokers.

There's precedent for this in Canada. After the massive QuadrigaCX failure in 2019, securities regulators forced all Canadian crypto exchanges to register with watchdogs such as the Ontario Securities Commission, the closest thing that Canada has to the SEC. Canadian dollar balances at one exchange, Coinsquare, are even protected by the Canadian Investor Protection Fund (CIPF), the Canadian equivalent of the Securities Investor Protection Corporation (SIPC), which provides insurance to customers of failed broker-dealers.

This new and much more robust framework seems to have kept Canadians safe from a FTX-type failure. FTX International and FTX US, for instance, have been refusing to onboard Canadian customers for over a year now, much to Canadians’ benefit.

Arrayed against the idea of putting crypto exchanges under SEC or CFTC oversight are exchange executives, and you can see why. The local money transmission examiner is never going to be strict as a Federal securities watchdog.

Oddly, some crypto critics are also insisting that crypto exchanges remain unregulated. Economists Stephen Cecchetti and Kermit Schoenholtz, for instance, recently argued that post-FTX, the world should just let crypto burn. To regulate crypto would be to grant it unwarranted legitimacy, they say.

The problem with the let-it-burn view is that crypto has crashed and burned many times. Each time it roars back, only for more retail customers to lose all their funds to the next Mt Gox, Quadriga, or FTX US.

Time to get exchanges like FTX US and its competitors, including Coinbase, under a more appropriate regulatory umbrella before additional damage is done. Exchanges aren’t money transmitters, and shouldn’t be regulated as such. They’re much more than that.

A worthwhile Canadian stablecoin initiative

One interesting thing about stablecoins, the world's newest payments technology, is that they are almost all U.S.-dollar based. More than 99% of the $145 billion worth of stablecoins in circulation are denominated in dollars, the remaining 1% being mostly euro-denominated. 

Even though no significant Canadian dollar stablecoin has emerged to date, the Canadian government is beginning to think about these financial products. A financial sector legislative review of digital currencies -- including stablecoins -- was announced in the government's recent budget. I suspect that a big part of the review will involve trying to answer the question of how to regulate these new instruments.

A few quick thoughts on how we Canadians should regulate stablecoins.

1) There's nothing fundamentally new about stablecoins. All digital Canadian dollar balances are recorded on databases. In the case of a Bank of Montreal account or a PayPal C$ balance, those dollars are instantiated on an internal SQL or Excel database (or whatever database traditional institutions use). Stablecoin issuers opt for a different sort of database to record dollar balances: shared databases like Ethereum, Solana, and Tron. These blockchain-based databases are often described as decentralized, although it is disputable how decentralized they actually are.

But abstracting from the choice of database, stablecoins are just another instance of regular old finance.

Canadian financial regulations should, in principle, be database agnostic. And so in my opinion, all existing financial regulations that are currently applied to issuers of Canadian dollar balances should be passed on to Canadian dollar stablecoins, perhaps with a bit of pruning.

2) In the spirit of the database agnosticism that I set out in 1), OSFI-regulated banks and credit unions should be able to issue blockchain-based Canadian dollar balances (i.e. stablecoins) under all the same rules that they issue SQL-based Canadian dollar balances (i.e. deposits). Those stablecoins would be insured, too, up to $100,000.

Here's where the "pruning" comes in. Some thought will have to go into how to apply deposit insurance to failed stablecoin issuers. For instance, if $10,000 in failed Canadian dollar stablecoin units is locked up in a Uniswap contract, how will deposit insurance be applied? What happens if no one ever withdraws the coins to claim the insurance? How do the smart contracts of a failed stablecoin get turned off? What happens if the decentralized database itself fails?

Because smart contracts can be programmed, I think it's possible to solve most deposit insurance problems. Regulators like OSFI or CDIC might even go so far as to specify the exact code that issuers must include in their smart contracts in order to qualify for insurance.  

3) In addition to 2), non-banks should be allowed to issue uninsured stablecoins, perhaps under the emerging payment services provider license that the Bank of Canada will be administering.

There are some caveats. Non-bank stablecoin issuers should only be allowed to invest customer funds in safe short-term assets. They would also have to  keep customer funds ring-fenced in bankruptcy-remote structures, like trusts, so that if the issuer fails, customers will be guaranteed to get their money back rather than being treated like a regular unsecured creditor.

4) Lastly, regulators will have think about stablecoin anti-money laundering issues. 

Right now, popular stablecoin issuers like Tether and Circle only identify people who are redeeming stablecoins for "fiat" money or withdrawing stablecoins by depositing fiat. But the great majority of stablecoin transactions currently occur bilaterally between those who never go through a know-our-customer (KYC) process, much like physical cash. 

This "no-identity" model is a big part of what has made these stablecoins so popular. Users can rapidly deploy stablecoins across multiple decentralized financial protocols without having to go through the frictions of an onboarding process. Exchanges and other financial intermediaries can use stablecoins as a way to replicate U.S. dollar balances for their customers without having to establish formal banking relations.

But this cash-like treatment also makes stablecoins riskier. For instance, I recently wrote about a ponzi scheme called Meta Force which is using Dai stablecoins on the Polygon network for pay-ins and pay-outs. Thanks to the way that the stablecoin smart contracts have been deployed, and the lack of KYC, there is nothing to prevent the scammer who manages Meta Force from openly making use of these safe instruments to con his unwitting customers.

Canadian regulators will have to weigh the usefulness of a no-identity cash-like model against the risks of pseudonymity. 

There is one last risk to consider. Say that regulators choose to tolerate a cash-like model for Canadian dollar balances instantiated on blockchain-based databases like Ethereum and Tron while continuing to require full KYC on Canadian dollar balances instantiated on regular databases. The consequence could be mass regulatory arbitrage as financial institutions migrate over to the former in order to avoid the more onerous requirements of the latter.

Reversibility on Ethereum

[CoinDesk published my article on reversible Ethereum transactions last month. I'm reposting it here for anyone who didn't have a chance to read it.]

Reversibility on Ethereum: The Benefits and Pitfalls

Imagine that one day you absentmindedly fall victim to a crypto phishing scam, the perpetrator stealing 10 ether (ETH) from you. Crypto transactions are final so there's not much that you can do, right?

Well, not so fast.

To ensure that stolen crypto gets returned to its rightful owner, a group of Stanford researchers recently raised the idea of introducing reversible transactions to Ethereum. If such a standard were to be adopted, your stolen 10 ETH could, in theory at least, boomerang back into your wallet, the frustrated thief being left out of pocket.

Reversibility would probably be a popular feature, especially among the risk-averse who have until now refused to adopt Ethereum. But there are costs to consider, too.With any payments system, tweaking one element to solve a particular problem means introducing a new set of problems somewhere else along the network. There's no such thing as a free fix. Let’s dig into what these costs are.

Crypto theft is everywhere, from large-scale exploits to small retail phishing scams. To make the crypto economy safer, Kaili Wang and colleagues have floated the idea of introducing an Ethereum token standard that allows transactions to be temporarily reversible. During that time period, say four days, a victim of a theft could appeal to a decentralized adjudicator to have their stolen crypto returned.

Satoshi Nakamoto, the creator of the Bitcoin blockchain, would be shocked. After all, Nakamoto's white paper can be read as a diatribe against reversible transactions. Financial institutions "cannot avoid mediating disputes," wrote Nakamoto, and as a result merchants must be "wary of their customers, hassling them for more information than they would otherwise need."

But the Stanford researchers don’t intend for Ethereum to be 100% reversible. People who don't like the idea of reversible tokens could continue to limit their interactions to non-reversible tokens. As for those who are intimidated by the high degree of expertise required to safely use Ethereum, reversible tokens could be the extra guardrail that draws them in.

Now the costs.

Welcome, reversal fraud

Payments systems involve many complex trade-offs. Solving one problem means adding another problem. A good way to think about this is in terms of the following too-small-blanket dilemma.

Say that you want to go to sleep but your blanket doesn't cover your toes. You pull it down, but now your neck is uncovered. You rotate the blanket to cover both your toes and neck, but now your shoulders are exposed. There is no perfect fix. You need to pick and choose what part of your body to cover and what part to leave exposed.

The same goes for payments. While reversibility may help reduce theft, the too-small-blanket dilemma dictates that it could open the network up to new problems, in particular forms of reversal fraud.

Credit card systems provide a good idea of what to expect.

Credit card owners can dispute card payments and have them “charged back,” or reversed. While this feature protects honest users from card theft, fraudsters take advantage of this feature by making purchases and then disputing the charge, falsely claiming they have not received the item or service. Merchants lose billions of dollars every year to credit card chargeback fraud.

Or take the example of PayPal. For risk-averse shoppers, the ability to dispute and reverse PayPal transactions is a helpful feature. But it has given rise to all sorts of PayPal fraud. In a PayPal overpayment scam, for instance, a scammer takes advantage of PayPal's dispute system to overpay a seller for something, then asks the seller for a refund of the excess. After the overpayment is returned, the scammer asks PayPal to reverse the original transaction. The seller effectively loses the overpayment amount.

PayPal or Visa could do away with overpayment scams and chargeback fraud by making all transactions non-reversible. But then their systems would become less friendly for risk-averse buyers, and adoption would suffer. It's the too-small-blanket problem.

So the price to pay for reversible Ethereum transactions is an inevitable wave of reversal fraud. The decentralized judicial system the Stanford researchers envisaged would quickly be flooded with scammers trying to take advantage of that very reversibility. Weeding out these scams would increase the judges’ overall adjudicating costs.

Providing a degree of protection from theft may very well be worth the hassles of reversal fraud. But the point to remember is this: There is a price to pay for introducing new features. Nothing is free

Not so fungible

Introducing reversibility to Ethereum would also have implications for fungibility. When something is fungible, assets are perfectly interchangeable. Fungibility is an attractive feature of a payment system. If all dollars are interchangeable, then it makes the dollar payments system easier to use.

Reversibility would split the Ethereum network in half. Rather than swapping reversible tokens with each other, sophisticated traders would mostly stick to non-reversible tokens. The prospect of having one's $10 million trade unwound because of an appeal by a previous owner for a reverse is just too risky.

But not-so-sophisticated users would probably choose the peace-of-mind of reversible tokens.

Splitting the network in half wouldn't be a big deal if the two token types traded on a 1:1 basis. Alas, they probably wouldn't.

Imagine that Jack owes 100 stablecoins to Jill. There are two ways that Jack can pay Jill, with reversible stablecoins or non-reversible ones. Jill will prefer the non-reversible ones. Reversible ones introduce the risk that a transaction will be unwound, leaving her out of pocket. And so she’ll tell Jack that he can either pay her 100 worth of non-reversible stablecoin or 105 in reversible ones. That’s non-fungibility.

As the four-day reversibility window comes to a close and the danger of a reverse ends, reversible stablecoins would move back to par with regular non-reversible stablecoins. But until then there would be two different prices for the same instrument.

It's another instance of the too-small-blanket dilemma. By adding a new layer of protection, an extra layer of confusion has been introduced.

The Ethereum network would still be usable. Much of the extra burden of non-fungibility would probably be borne by specialist risk appraisers, or brokers, who profit by buying consumers' reversible tokens at a discount (in exchange for non-reversible tokens), and holding them to maturity. As Satoshi suggested, these intermediaries may have to “hassle customers” for extra information in order to protect against reversals.

Even after considering the twin costs of non-fungibility and new types of Ethereum-based fraud, reversible transactions may still be worth it. While non-reversibility may be great for traders, corporations and the tech elite, the enduring popularity of PayPal and credit cards demonstrate that what regular folks want is safety. An opt-in reversible standard would create a warmer and fuzzier Ethereum, one that is more inclusive and attracts a wider range of users.

My gut feeling is, go for it.