BBW25 - Day 1 - Navigating Compliance in the Decentralized Economy

products. Okay. Um so um joining us on the stage today is Christina Paladino who's a principal with Wolf & Company. We have Shane Pequard who's the director of compliance with the XDC Foundation. Megan Spalain Quinsey's own partner at Goodwin as well as Will Walrip who is the director of product management with Ava Cloud.

Please join me in welcoming them to the stage. [Music] Hey everyone, we on.

Yeah,

we're good to go. There we go. Nice to see everyone. As Ian said, my name is Megan Spain. I'm a partner in the New York office of Goodman Proctor.

I am a Quinsey native. It's very very pleased to be back here and with all of you. Um I'm sure you're going to hear a lot over the course of the three days about the current regulatory environment as being very very pro- crypto which I think everyone in this room is excited about. Um but there are it's not the wild wild west out there. And I think now more than ever there's a real focus on compliance.

Um, and particularly as we move towards broader adoption and hopefully bringing more institutional investors into the room and more regulated institutions, the backbone of a good compliance program becomes all the more essential. These are the kinds of regulations that have not gone away um that are here to stay. But what we're hoping to get to today with you all is really explaining what the alphabet soup of those regulations are, but more importantly, how that translates into a a reasonable and practical compliance program that seeks to kind of strike the balance between innovation and responsibility in a decentralized environment. Um, so I'm very excited about the panelists that we have here today and I wanted to just kind of go down the horn and give each of them an opportunity to introduce themselves and just tell kind of how their job interacts with this space and and makes them excited to talk about this topic. Uh, so Christina, how about you start?

Hi everyone, my name is Christina. I'm first just going to jump in and say I wouldn't be compliant if I didn't correct Ann. I'm not a principal yet, aspiring principal, regulatory manager at Wolf & Company. Um, I grew up in the banking industry. I know the financial uh industry very well.

I started as a teller, worked my way up to BSA officer. And in the last three to four years, I've spent a lot of time in the fintech and digital asset space to see how we can bridge the gap of compliance from the financial infrastructure into um the digital asset and fintech ecosystem. So I I work a lot with the mass fintech hub, with cubic labs. Um you can find me at the board of the AAM's Greater Boston chapter. I'll be in Vegas next week if anyone's coming and um I'm just happy to be here to talk compliance.

Good afternoon everybody. Thank you Megan. Thank you Ann. Shane Picard with XDC Foundation. Uh the foundation exists to support the XDC network.

My job specifically involves legal and compliance which is why I'm up here. Um the network is is focused on trade finance assets and real world assets. And so our job at the foundation is essentially to try and make it easier to deploy those assets for third parties. Uh so as such I don't necessarily give advice to third parties building on the network but I do try to point them in the right direction when they ask and I certainly try to keep inhouse uh personnel from crossing any of those lines. Very glad to be here today.

Thank you.

Uh so my name is Will Walrip. I'm a senior director of product at Avacloud. Avacloud is a a business division within Ava Labs who supports the Avalanche blockchain. Uh what Avacloud does is we help deploy uh layer ones within the Avalanche ecosystem as well as help businesses who are launching blockchain projects within the ecosystem be successful. So this ranges from managed infrastructure, validators, nodes, those sort of products, as well as wallet as a service, as well as uh privacy solutions is where we're starting to go into.

Uh I'm excited to be here because I usually get to be the one who gives uh legal and compliance a hard time when it comes to certain products. So uh my background, I used to work at financial services, uh banks, as well as regulated money transmitters. So, I have uh you know dealt with some of these components and speak about it with a lot of our clients on a regular basis.

And that that's part of the reason I was excited when we had our prep call with these panelists because not only are all three steeped in blockchain, but they have the traditional financial services backgrounds as well. And this really I I think to be successful in these compliance programs, I think having a little bit of both knowledge and figuring it out how to fuse it together is really a recipe for success. Um so I I don't want to dwell on the alphabet soup of acronyms and various regulatory agencies too much, but I do think in order to set the stage and kind of understand how these components fit together and build a compliance program. Um, I don't know if those guys know all the acronyms out there. Well, maybe we should ask them.

Um, but if you wouldn't mind, Christina, just leaving us through like an overview. We say AML, we say KYC. What are we actually talking about? What regulators are at play and and what are they trying to solve for?

Absolutely. So, first AML, what does that stand for? It's anti-moneyaundering. So, when I think of AML, I think of a comprehensive framework that's designed to keep the bad actors out. We don't want their illicit funds mixed in with our our banking system, whether it's payment rails or traditional finance.

Um, in that framework, there's three core pillars. The three core pillars are KYC, which is know your customer. That's where we're identifying customers identities. We're looking at their behavior patterns, understanding their business, and then assessing a risk profile. How risky is it to do business with that customer?

Transaction monitoring. That's the second pillar. We want to make sure we're seeing those outliers and patterns of behav behaviors. What red flags are out there? What doesn't look like normal activity in in a a wallet or an account in this case?

And then the third pillar is SAR reporting. That's suspicious activity reporting. And that's when you will take that suspicious activi activity that you identified and you'll send that through Fininsson. We're going to talk about Finson in a little later, but um basically reporting it to Finson to make sure that law enforcement is aware of what that suspicious activity was, what what was identified, why it was suspicious. In that, a big uh cornerstone legislation was the Bank Secrecy Act, BSA.

Probably heard that term here and there. um that the bank secrecy act is basically a very fancy way to hold banks responsible for maintaining records and file reports. Once that act was passed, it didn't just stay domestic, it went international global and that's what FADF um the financial action task force they set the international standard. So we have the domestic group and then we have the international group. um Vincent that I mentioned before.

They're the the policy and the intelligence behind all the the infrastructure of um BS BSA AML. We have um the DOJ, which is the Department of Justice, who is enforcing uh criminal enforcement. And I'm sure you guys heard of some of the the wild and crazy stories out there of certain executives being um you know fined or even put behind bars because of not enforcing their AML policies. And then lastly, there's state regulators. So there's an additional layer added on to the DOJ and um Fininsson where states may also have their own set of rules and regulations to follow.

Um what are the consequences? Right? Consequences of non-compliance. There's financial, so they can get fined. We have um a big player, Wells Fargo was fined three billion in that in not following AML protocols.

There's operational non-compliance and what that looks like is mostly consent orders. They may be um not able to do the business activities they really want to do because they're not following certain laws and regulations. And then lastly, there's the criminal prison sentences. Um what's the the ultimate goal, right? The ultimate goal is to keep those bad actors out.

We don't we don't want um we don't want to have these payment rails come through our systems and find out that it's backing human trafficking, drug enforcement. Um and also uh the the biggest one on the drug trafficking is the TD bank enforcement action that's out there. So we're trying to stop, you know, the frontline um accepting some of the solicit money into the the banking system.

Yeah. And I know when I'm advising clients that are building projects, they're always just like, "What do I do to stay out of jail?" So, I don't want to, you know, overindex on going to jail for an AML violation. But, but but it is it just emphasizes the importance of getting this stuff right and kind of operating in good faith.

Um, there's another side of the coin that that is similarly in this compliance bucket in addition to the AML KYC things that you just talked about, and that is OFAC. And and many of you probably may have heard about OFAC in the context of tornado cash for example if you followed that case. Um but but that's where you can really get into trouble and and more of a strict liability regime. And Shane, could you just give us a high level overview of how that fits into the framework of of what a compliance program is and who's who's watching behind the wings to make sure you get that right.

Yeah, sure. So, OFAC um it's funny because you say the acronyms all the time and then wait a second, what does that stand for? OFAC stands for the office of foreign asset control. It's a office in the US Treasury. Uh and they maintain something called the uh specially designated nationals list.

Um it's a list that they publish. Um so a little bit about how that functions. I think it's important to understand first of all it's it's sort of important to to bifurcate the potential bad actors that Christina was talking about. Some of those actors may be here in the United States and typically the FBI will just go pick them up with handcuffs and then other actors, bad actors may be outside the United States are a little more difficult to to get your hands on obviously for law enforcement perspective. So how how does the US deal with that?

How does the US sort of push out its its policy with regard to these foreign bad actors? So the way they do it is they hold accountable people who are here in the country by ensuring that you're not doing business with people who are on this list. So this specially designated um nationals list, the list actually contains natural persons, so John Smith. It could also contain the name of a corporation or business. And it can also uh have the name of a nation.

So if you do business with any of those entities and you're potentially in trouble and relevant for crypto now there are crypto wallets also added to the list which is really important. Um the Treasury has made it clear that crypto assets don't get an exception. So even though the current administration is big on crypto uh you know there's no wild wild west anymore. Crypto assets are treated just like any other asset. a wallet could be added to the list and um and so then anyone who's sort of doing business with people, companies, nations or wallets without that are listed on the list uh could be held liable.

Um Megan mentioned strict liability which is a little bit scary because strict liability means that if you if you are doing business with someone on that list even though you had no idea because it was just your code operating in the background you're still liable. So you can't claim ignorance. You can't say you didn't know. You have to be checking. And practically speaking, um, in the age that we live in, that means you have to incorporate that check into your code.

There's no way a human could could run all that information. Um, so the process is basically a check, freeze, and report process. So you're required to be checking your transactions against these lists. If you get a red flag, you need to report that and you need to freeze the account. Which brings us to a really interesting question.

what if you're operating a decentralized uh you know protocol. So we'll I think we'll delve into that a little bit more but

yeah. Yeah. And I I think we might we always set a rough agenda but things kind of take their own course and if anyone has any question please feel free to pipe up at any time. Um a lot of the words that you said you know about knowing who your customer is, knowing whether they're on a list. A lot of that on its face seems antithetical to a lot of the reasons that people want to use blockchain with the anonymity aspect of it for example.

Um So in terms of figuring out how to get this right and how to do it from a decentralized way, I think we have to borrow at least some principles from the way traditional banks handle these issues. So what what what can you tell us about that will just at a high level based on your experience and you work with a lot of regulated institutions even today?

Yeah, so I think looking back on my experience working at banks, there's you know the kind of boilerplate programs that a lot of institutions put in place around KYC. So how do they identify the users that are being brought on to your platform? So that's via non-documentaryary and documentary methods. So capturing IDs, doing background checks, those sort of activities to make sure that your users, your client base are on the up and up, so to say. Uh and then you know when we start to delve a little bit closer into you know looking at transactions and that sort of uh side of things it's understanding the flow of funds and this is where you have uh I'm going to mix up some of my acronyms here but you know MTRS CTRs and uh those sort of things where they're checking and looking what is the flow of funds in and out of these accounts do they exceed certain thresholds does this look like potentially suspicious behavior Um and you know they've started to adapt some of these uh protocols that were you know being handled on kind of your core banking system to now being how do we replicate this and have similar checks and balances on uh you know blockchain systems.

So I know working at the bank that I used to work at, we supported various fintech as well as uh blockchain companies and you know part of that process required them to have uh you know be working with tools that did the onchain scanning looking for you know potentially malicious behavior potentially nefarious addresses that were using their platforms. So having those sort of systems in place becomes pretty critical. Um, now we're getting into an interesting space with, you know, clients that we work with, you know, financial institutions or large entities that are in jurisdictions with specific regulatory requirements where there's some other levers that they can pull around, you know, what do what do I need to have from a validator set that uh is confirming uh the transactions on my chain, right? uh what degree of controls can we put in place around who can deploy contracts, who can submit transactions, those sort of items and you know I think we'll dig into that in a few minutes.

Yeah. Um so kind of bringing it you have a framework now and thank you to all the experts for providing it. Now bringing it to what does this mean in 2025? Um of course we have President Trump setting up the crypto task force and things like that. So, it's open season and we're all very excited about the larger institutional adoption.

At the same time, he's articulated worries about human trafficking and drugs and terrorism. And so, obviously, those are all in the eye of the storm of these AML and KYC requirements. Um, so Christina, how can we take the framework that you just gave, which is very much a framework born out of traditional banking that, you know, isn't a perfect fit. It's a little bit of a square peg round hole thing, particularly when you're looking at decentralized protocols. So how should we think about translating KYC for example into a framework that actually makes sense for the way that the blockchain functions?

Absolutely. So going back to those three pillars I mentioned earlier. So KYC the tradially rely on looking at driver's license, utility bills to really identify these customers. They're getting date of births, their you know social security address, name. how can we make that into the blockchain and and really use the KYC theory.

So really knowing your wallet and knowing your transactions. So two more um acronyms KYW and KYT. It's going to be mainly focusing on analyzing wallet addresses and then looking at transaction patterns and onchain behavior. So analyzing all three of those to really identify the transaction and knowing your wallet. So taking that same con concept of understanding the business model, understanding the risk for KYC and then applying it to uh the blockchain using know your wallet, know your transaction.

The challenge there is we typically can see you know wallet A sending money to wallet B. The challenge is who's controlling those wallets. So that's the question you want to keep in the back of your mind. Who's controlling and who's benefiting from the funds? That's what you should really try to be unraveling when you're you're looking at the wallet itself.

Shane, I know part of your role at the foundation is when various participants your ecosystem come to you and want some guidance on where to turn, what to do, you you know, you don't provide the guidance yourself, but you point them in the right direction. What kind of services are out there that are trying to solve some of the problems that Christina mentioned?

Yeah. Um, do you mind if I just make one comment quickly? Yeah. So, um I I'm just you all can't see this probably behind me. We all know that the uh the tagline here where blockchain meets meets AI.

And as Christine is talking, I I hope a lot of you are thinking, you know, AI is really going to be a a key piece of of solving the issue of how you conduct what's called a riskbased approach on on what she's describing. So, anyway, I just wanted to mention that, but um oh, what do I do? Yeah. So um typically we we will work with third parties to integrate services. So for example, Elliptic or blockchain intelligence group or um you know Merkel Science some company that basically what what their services is they digest the blockchain and then they make it uh easily readable through for third party applications and so as a result the uh the applications are very easily able they're able to easily look at the data that Christina is describing and sort of make these connections between various wallets in a in a way that's efficient.

Um, so that that's all typically when someone has those questions, we just say, "Hey, listen, you need a third party service and let's recommend this one to you or another one that suits your suits your needs." Yeah.

Yeah. And and we were talking on our prep call about this idea of with great power comes great responsibility. I mean, the tools available for blockchain analytics give you far more data than you would ever have in a traditional transaction in a lot of ways. And it it and it seems like, you know, the the regulators are basically wanting companies to avail themselves of those available solutions and really incorporate them into their programs. But this brings us to the burning question, Will, which I'm going to direct to you in the first instance, but is it actually realistic to achieve both of these goals?

We're trying to move towards decentralization in a lot of these platforms and get away from one person having their finger on the red button. And then, you know, we're up here saying how important compliance is and how that's going to be a benchmark of of the future of crypto. H how do you rationalize those two things?

So, I think the interesting part is there's a lot of signals that were moving in the right direction, right? So, I think everyone's been seeing the news with Stripe coming out with their own L1, Circle coming out with their own L1. you know, for me and I look at it, you know, in terms of conversations that we're having with clients, like those are all great signals that some of the right processes and controls are getting put into place. Um, you know, that comes from the balance of do I launch on a public, you know, permissionless blockchain, you know, Ethereum or, you know, Avalanche or, you know, whatever it may be, or do I launch my own chain, my own L2, whatever, uh, you know, whether it fits my use case. And the reason those things come into play is because you start to have different levers at your control, right?

So if you're launching on a a public, you know, permissionless network, you need to take into consideration how are you scanning transactions? How are you incorporating AI into, you know, riskbased approach monitoring what's happening within your protocol? But on the flip side, you can also start to balance it out where if you have your own L1 uh or your own L2, you may be able to balance, okay, particularly on the L1 side, do I limit my validator set, right? Do I have set of trusted uh participants that are maybe still distributed that are validating transactions? You can gate who can access the chain, right?

I can have KYC restrictions. So, you know, we helped to launch uh Nexon who is behind Maple Story, a big gaming uh gaming project out of Korea. And one thing that they had to consider in their launch process is they have strict KYC controls that they needed to implement. So they launched their own L1 and they had controls around okay we had to authorize users who could submit transactions prior to them you know being able to just you know participate. So it wasn't the wild west.

So I think those are some of the things that we're starting to see get implemented um which you know hopefully will bring more and more you know real world use cases.

Christine to give something to add

one more thing to bring it full circle is we mentioned the sanction screening. So not only in the trad ecosystem you're you're relying on namebased screening in the blockchain area you're going to heavily rely on the sanctioned that were mentioned. But two areas to really zone in and and focus on is address clustering, which is when multiple addresses are controlled by one entity. So you want to make sure you can see, you know, who's controlling those addresses and is it the same person sending it back and forth. And then tainted funds is when cryptocurrency is passed through a sanctioned name that might be on that list, the SDN list, the PEP list, watch list that you might be scanning against.

Um, and they're known illicit companies or entities, right? So, they're tainted. So, that's another area to zone in on and and monitor with the AI and analytics that are out there.

Okay. So, I think one of the themes that has emerged is kind of control what you can and make good faith efforts to comply with some of these things. So, I'm not going to hold any of you to it in terms of a minimum viable AML program, but I mean, how as as a practical matter do you think about responsible innovation for AML for sanctions um particularly with with public blockchains where you can control your UI but you can't necessarily control who accesses your chain through other methods anyone

so I mean I think again it's control what you can right so you know a recent project uh you know app that we launched uh you know we realized that there is some risk to us that we weren't willing to accept cept. And so part of this process is yes, we had smart contracts that were deployed on chain that technically anyone could submit transactions through, but you know, we had certain controls in place where we were able to do the necessary checks. Um, and like those contracts only took a signature from a registered wallet uh where we kind of authorize the transaction. So that way we were able to implement the appropriate checks, still have those be, you know, have consensus done on the transactions that were ultimately submitted, but we were still able to protect ourselves, you know, from a risk mitigation practice. Um, so I think there's kind of different things that you can implement there.

I think I think too there's just a very practical aspect of it, which is don't close a blind eye. So when you see something suspicious happen, you know, if it if it didn't necessarily trigger an alert in your system, but your eyes are looking at it, um Christina mentioned the S the suspicious activity reports, you know, don't just pretend it didn't happen. Like actually take steps because those are the kinds of things regulators like to look at and say, "Okay, well, when it did happen, you took action or when it did happen, you just ignored it." And that can get you into hot water. So don't ignore it.

Well, and I think you know we talked about in our prep meeting the the recent tornado cache case and you know I think yes there was Fininsen guidance that came out in 2019 around hey you can deploy these contracts they're decentralized you know there's some arms length away because it's the code that's governing who can access who can perform certain transactions but then there was you know what ultimately came to be was that because their front and was controlling the user interaction uh with the you know smart contracts deployed on the chain. There's some reliability there's some responsibility that uh you know tornado cache needed to take on and like that's eventually what they kind of got uh you know hit on with the the recent case. So I think it goes to show you you need to have some controls where you have you know some ownership over the user experience. Yeah. And real quickly, um, I'll add, we have a minute left.

Um, real quickly, keep it simple and consistent. So, consistent execution, keep it simple, and then as your business scales, add in the complexity of your program. So, keep it simple and scale as you grow.

And I can just say as a litigator who often um deals with these problems, when something bad happens and a regulator's asking the questions, they're always going to ask, "What is your program consist of?" And if the answer is nothing, you're not in a very good position. But if you're showing some good faith efforts to, for example, control access to your website or the UI that you control and you're doing something legitimate to try to at least solve for sanctions as a baseline and then build from there. I I think regulators are also practical understanding that a day one startup may have a very different compliance program than a company that's been around for two, three, four years. and they will reasonably expect everything to kind of scale along with your growth.

And I think that that should be part of part of your picture in terms of how to demonstrate good faith compliance as well. Any any final thoughts?

No, I think there's a lot of exciting things happening in the space and I think compliance goes handinhand with, you know, all of these innovations that we want to see happen. Um, so I think it's an important topic and something that people need to keep in mind.

Yeah, I just wanted to I like what Christina said, keep it simple because sometimes when you make it too complex, it just gets overwhelming and then it just falls apart. So

yeah, thank you.

The worst thing to have is a complicated compliance program that you can't comply with.

So um, happy to answer any questions afterwards. And oh yes, hi Doug. I've heard a lot of talk about it, but

yeah. Yeah. I I couldn't predict when it I it's coming, right? But I don't know when.

We we talk with people about it. We talk with projects about it. I think there's a lot of protocols that we've seen implemented. I think the challenge is is that you need to have some trusted issuer and it's who is that trusted issuer. Um and then how do you have like the necessary like interoperability between you know a distributed set of networks and those sort of things.

So yeah.

Okay. I think the rest of the questions will have to be at the cocktail hour tonight but hopefully we'll see you there. really appreciate everyone's attention and um thank you Ian and team for putting together such a great program. [Applause]