BBW23 – Day 3 – Crypto Compliance & Risk Management

[Music] so really excited I know it's day three so we'll try to keep this as exciting and engaging as possible and I would encourage questions as well throughout the conversation um I suppose one of the things that was interesting to me kind of when I saw the group of folks that was on the panel with here today was just the diverse background I think that everyone brings in a different perspective to the whole ecosystem so maybe set some context I think it'd be helpful for everyone maybe to do a brief introduction so yeah start with you I'm h j uh one of the co-founders and CEO of breach Insurance uh I'm in my 12th year of insurance uh prior to founding breach I spent seven years here in Boston at Liberty Mutual uh building new products entering new markets and then left Liberty in April 2019 to found breach uh in my second winter um so um yeah glad to be here yeah my name is uh Yas barara uh co-founder of State space uh background in uh safety critical uh software simulation and uh engineering um and state space does something smart contract simulation uh for uh technical uh and economic security uh and risk analysis uh so Tom hook Global Chief compliance officer at moonay which is a um non-custodial on andof ramp for crypto as well as nft checkouts um I'm also an adjug press professor at Boston University law school where I teach crypto regulation and payments um my background I'm a recovering attorney um but I've been in the crypto space since 2018 and prior of that was in trafi happy be uh Patrick okain I'm a general partner at rw3 ventures we're a early stage crypto Venture firm um I started my professional career with the intelligence Community I was focusing on counterterrorism financing issues and other National Security objectives in 2012 I went to the doj and started to build out some of the initial crypto investigative strategies at the doj um scaled that for about 6 years then went to KPMG where I helped to build out the crypto Asset Services prct practice and uh there we did everything you could imagine a big four does but it was all geared towards the crypto ecosystem very cool um Mike we should talk there's a lot of stuff iting our Collective backgrounds um so guys just just to start I'm interested just from a risk perspective kind of what what each you kind of dealing with in your kind of day-to-day jobs in terms of you know just risks that you see in in your particular areas and kind of strategies you're deploying to mitigate those so yeah you start um you know for us there I mean the risk is is is quite literally our business and you know there's there's corporate risks that we have to manage and then there's uh outside risks that we assume um on the corporate side just like everybody we're dealing with compliance we're dealing with overall business risk we're dealing with uh cyber security risks um we are uh we are uh we can be under attack just like anybody else can just like a platform Can U so mitigating that um and and compliance is the biggest one right because we're regulated both in the US we have to comply with all uh Department of Insurance Regulators there's 50 plus DC um and then we're we have insurance carrier doile of Bermuda that allows us to do a lot of non- us stuff that we're doing so uh it's hard uh but I think it makes it it makes it um quite defensible um because we do stay compliant on the on the on the operation side um you know we're looking at you know any kind of company that's here and working with with with any kind of company that would be here to ensure things like custody uh ensure things like payments wallets uh exchanges so there there's a there's a wide number uh of risks that we that we encounter in crypto um and you know we have to look at every every single aspect of it from somebody being able to pay to um actually underwriting risk assuming risk and paying claims yeah sir yeah um you know from uh you know I spend a lot of time on the technical side um but that's you know primarily because you know uh in the crypto world and digital asset world you know businesses are making claims about the you know their business what actually they're delivering to their users and clients and uh that's in the crypto blockchain world that's represented in the code so there's an inherent risk know between these two in that you know how can you ensure that the code is actually compliant to the claims uh that are being made by these businesses so ultimately uh there's a whole host of risks that are inherent Within These smart contracts um and in uh you know in the ecosystem uh especially in Defi and then in the broader uh blockchain ecosystem you have a systemic risk around you know code development and that one smart contract is composable with another contract and another contract and another contract and that just means that you have these developers who are writing their own code and they have to understand how it works but they also are able now to connect to other people's code that they did not author and that's an inherently difficult thing to do is to test my own code using code that you know that's included you know that that that has code that I didn't author which also includes code that they didn't author so now you have the systemic risk uh that's brought around the ecosystem and what we're trying to do um specifically is you know how do we quantify that risk and how can we help developers understand what that you know uh kind of like a I don't want to say like a risk score but they need to do they definitely need to understand the behavior of their code and so we're trying to you know what we're doing is solving this problem around how do you solve this idea of you know not just technical security across an ecosystem where there is plenty of risk but also Economic Security where you can manipulate some of these contracts for you know logic that you know these developers may have not even understood actually exist in the first place um so my risks aren't as cool as those U But ultimately as a chief compliance officer I worry about all the risks um all of them which is uh which is fun um but if you bubble them up from my perspective in supporting a business you know I have to it's the risk of losing regulatory licenses right the risk of losing bank Partners right post FTX post you know the banking crisis earlier this year is it related to crypto as well um compliance is supporting our ability as front and center in getting banking relationships which as much as crypto is trying to separate itself from the traditional banking sector many of the companies involved are very much tied to uh traditional Banking and to support the businesses so you know if you if I dive down on those they kind of break into a bunch of different ways I like to break it into two sides I think there's a financial crime risks and then there's kind of core compliance non-financial crime risk which I think of as kind of the silent Killers um Financial crime risk AML counterterrorist financing sanctions fraud these are all kind of the front and center very sexy things that you know are super dangerous in the end right that is what people often you know naysayers think about from crypto is um that it is you know used for financial crime and you know undoubtedly all Finance is used for financial crime in some way shape or form but our job in in an institution is to set up safeguards to prevent folks from getting into those um identify any Bad actors in our institutions and ultimately report those to law enforcement to take action so that's a big part of risk that we need to control in a lot of different ways on the other hand regulations cover a lot of other things consumer protection um cyber security and information security and so making sure that we're building out compliant programs to address customer complaints um to ensure that customers are getting the right disclosures and understand how our processes are working and understand what to do if something goes wrong ultimately regulators and banking Partners frankly are really worried about those sides so we uh I worry about all of them from an investment standpoint uh venture investing you have this ecosystem you have all of the traditional risks that already exist in in just early stage investing it's Tech risk uh there's execution risk there's competition Etc all of those you can get comfortable with uh with the right amount of due diligence you can sort of quantify that risk then there's reg uh regulatory risk uh there's always been regulatory risk in this ecosystem but but in this climate it it seems quite heightened um um there's a a more or less a regulatory induced pause right now and historically when we've seen that with uh other industries that those sort of regul regulatory induced pauses favor the incumbents so what does that mean for startups right now and and how how I look at the ecosystem it it's tough to say maybe it means you look for businesses that can likely be acquired um when one of the incumbents is faced with a buyer building decision so that's that's one thing we're thinking about right now and I think that's what uh Founders should be thinking about then in terms of portfolio construction and and trying to drisk our portfolio in this environment we like to focus on um real real companies that are filling uh very you know present gaps in the ecosystem like insurance for example we we funded ahab's company breach um insurance has always been been a huge gap in this ecosystem uh we fund companies that have real world use cases like healthare with massive Tams um that leverage blockchain technology that greatly enhances um diagnostic tests for example and then um we also look a lot at security companies and companies that are building tools to help governments get insight into the ecosystem an example there is uh we funded a company called called cat labs and they're building a a crypto forensics tool that is geared towards government investigators to identify um illicit cryptocurrencies on seized hard drivve seized cell phones things like that um and I think um plays like that not only will help the ecosystem I think it's really important that um governments have the right tools to police this ecosystem and until they do we won't get favorable regulatory outcomes um it's a somewhat Dr risk because that that's that's clearly needed in this ecosystem uh thanks everyone um some really interesting ones there I think one thing Tom you brought up there and maybe it's not fully appreciated actually is the challenges that a firm operating in the space has simply in getting and maintain a banking account right can you elaborate in that point on some of the challenges that are are associated with that yeah absolutely I mean um if you know if we roll back I think that was you know April I tried to block it out U but I think it was you know roughly April um two of the biggest banks that support you know fintex but in particular crypto companies um saw Bank runs right um we had silvergate bank and Silicon Valley Bank and for a large number of companies right what does that mean what are you using these banks for um twofold right um one you're using them for your corporate accounts so all of your operating Capital paying your vendors paying your employees paying your rent for offices you know running your business um the second side is if you are holding customer funds um keeping your customer funds right being able to if a customer comes and asks for their funds Back Being able to give it to them so again an essential part of running what in that sense is kind of a custodial business um without those you're sunk your business kind of shuts down and so what happened at that point was everyone panicked most companies were using one or both both of those but no other Banks so either their funds were Frozen um at silvergate or Silicon Valley because they had nowhere else to put them the thing about opening a bank account for a business in particular a business period is very hard anyone who's tried to do that it's it's not a short process if you're a crypto company it is extremely hard it's not impossible but it takes a long time and so companies who were not thinking ahead to this risk were left out in the wind right whereas other companies had were able to kind of migrate and what we're seeing right now is while we do hear a lot of news about um you know large you know Global National Banks being involved in the space the reality is they don't Bank many companies right um so those are called tier one Banks right those are the crem delrem at least for security standpoints so what you're left with is a lot of regional Banks and so there are many Regional Banks who support the crypto industry which is fantastic but they all are susceptible to this risk that happened back in April so what you have to do is diversify which means people like myself go along with the finance team and do Road shows to explain that our compliance program is really good you should give us a bank account to allow us to kind of control that risk by having options on where we keep our funds um it's something I never thought that I would do as a compliance person yeah it's very cool so yeah kind of bringing some of those points back to you I mean we talked about this regulatory uncertainty and this stuff how how how are these types this landscape or environment kind of influencing decisions you're making yeah it's a good question because we were both conservative yet Progressive at the same time um we remain incredibly conservative from a compliance and regulation standpoint because we comply as any other insurance company would in the US uh we have all the licenses that any MGA managing General agency would have uh because we have uh am best rated primary insurance behind us and and best rated reinsurers that are behind them so we have to we are upheld to the highest of Standards um as an MGA similarly in Bermuda uh who has reciprocity both with all the Department of Insurance Regulators here in the US uh as well as lloy of London those are the three largest Insurance markets in the world we comply with them as well which allows us to I I believe uh be quite Progressive from an insurance risk-taking standpoint we believe that any company that is legally allowed to be registered is insurable right uh and we dictate then whether or not we should deploy capacity into those risks whether it's a payments company or whether it's a custody company whether it's an exchange whether it's a wallet whether it's a platform we get to decide from a business standpoint if this is worthy of deploying Insurance capacity into so I just believe that what what what we've seen a lot of particularly in banking is you see conser conservativity both on the regulation side as well as the business side our perspective being a crypto native insurance is that because we're being ultimately conservative on the regulation front it allows us to be Progressive on the business front but that's just my simplistic view of of the world that we live in interesting I I mean I love that I love the way that you just described that and I think that that's especially post FTX post well post last year let's just say post last year that's how I think companies are ultimately going to be successful is you have to you know you have to abide by the regulations you got to get the licenses you need you got to be conservative and there's a flight I think to you know to Quality in that regard correct but I think it's a really interesting angle that that allows you to take some risk on the other side because and be Progressive and I think that that's you know it resonates it resonates really well both with Regulators as well as the the the business that the industry that we're in because people aren't talking like that right particularly people with coming from these Legacy uh Industries like Banking and insurance Insurance um it's it's hard it's hard I mean even for us we're you know a venture-backed uh startup that's that's domiciled here that's got all the licenses even for us like we had we have to do our own Road shows and and make sure that we maintain tier One banking relationships and we we're fortunate to be to be in that position but a lot of companies that I know of um aren't in that same position a lot of them are in Europe many of them in UK uh but even here in the US it's it's it's a complicated environment being in crypto right now yeah um and I think what you're noticing here is kind of the infrastructural pieces you know like what you have with insurance and you ask you know from a technical perspective how how are some of these kind of things influencing what you're looking at and doing yeah I think um it's very much interconnected and the industry is still very young um and there's a lot of traditional um you know thinking even from a technology perspective that's being applied um that won't necessarily carry over so easy so there there are must be some innovation in this space um you we were just talking about quality um and then there's there's this you know and also kind of Regulatory Compliance um and both kind of go hand inand uh and in fact I think um you know Dubai uh put out you I think the the virtual assets and regulation Authority I think a few months ago put out you know kind of their regulation standards and part of that uh part of their compliance requirements um are you know auditable traceable uh understanding of the technical aspects of of the smart underlying smart contracts that enable these businesses so you know how do you document a behavior of your software right that that's something that's kind of new to the industry you know it's not new to safety critical uh company you know companies that are you know developing airplanes right you have one bug in uh an airplane engine you know people die right so they employ very critical um and very restrictive standards on how they develop their software and more importantly how they you know test their software in terms of quality so you know the way that we're you know kind of intertwined here is is that there's this quality piece that you know we can't risk customer funds simply by just some developer writing a code uh a piece of code um ultimately it needs to be secure and honestly when you have you know hundreds of millions if not billions of dollars at stake as we've seen with with the tax you know it's it's uh absolutely critical that you know we enable the developer and developers and the technical community um to be able to understand that behavior and today that's that's all the ultimate Gap is that you know dat have the tools that are available to them to find out what they don't know and there there's this interesting metric I read um in a paper in a academic paper um you know somebody did a study around like you know they took like 127 vulnerabilities or attacks that have occurred in the last year or so equates to about $2 billion and so they took all of the automated tools that exist today to help discern quality of code and how it actually behaves and of that $2 billion approximately 2 to 300 million of it was actually automatically detected with these tools and these are the tools that you know engineers and Auditors that are using themselves so there's leaves this gap of around like well what happens to this other 80 to 90% of funds that you know were hacked how do you how do you effectively detect those um and so you don't know what you don't know and these are all underlying logic errors and you know other things like Oracle manipulation um you know issues but ultimately um where we're focused on is kind of bridging that Gap that 80% of logic errors and you know manipulation errors and understanding systemic risk um is is really where we're driving to and then and the last component is um with all of these regulations that will come down um developers need a way to make sure that their code complies to them so there are certain rules that you you know obviously code but you need to check that they actually exist and behave in the real world such that you know you know somebody who's like whether you know you're ensuring a a policy you can you know ensure that the you know somebody needs to make sure that these compliance and and regulation rules and requirements are embedded into the code so how do you simulate for that before you go to production yeah and I think what you're hearing here is you know just the maturity of the whole ecosystem that's evolving right and I think this check and balance between regulatory oversight and and maturing and the infrastructure that we've come to be used to expect and traditional um areas of the financial system are kind of starting to Mo move more and more into this space right so Patrick you know from an infrastructure perspective where do you still see some of the kind of gaps or you know what are the areas that you're kind of looking at from still opportunity areas for kind of companies in the space infrastructure It's Tricky and I don't think if you if you go down to the foundation so layer one let's talk about that um I don't think anyone really knows what the future holds in terms of layer ones layer twos on eth um and and and anyone that says they they do I think they're they're lying because eth look eth has all of the liquidity still um and l2s are being built on top of it to make it more performant but it does have a lot of tech debt and there are uh there is functionality that eth is not customized for like ZK for example so that's why you know a lot of uh projects opt to build a novel L1 that uh is more performant that more scalable uh allows for more programability more decentralization um and it's custom built for the specific use case um so I think it's too early to tell where the the gaps are in infrastructure and how they're going to be solved um so we construct our portfolio to kind of hedge uh with what with whatever way the the industry takes um so that being said I mean all of these new protocols there there's going to be more composability so I do you think there there is a a space to allow for multiple L l1s and l2s to coexist together and and um developers can pick and choose and have a a wider design space and choices to to develop their applications but it's uh really too early to tell what gaps exist now and how they're going to be solved okay so I tou you on the topic as well from the from the previous panel um we talked a little bit about kind of all the regulatory climate and the uncertainty Tom you know wearing your kind of goggles or lens where where do you think things are going to you know how do we see this in Fall we see some bills going through Congress and through the Senate U do you think we're going to get the kind of the clarity we need I mean I'd love to say that I'm optimistic that Congress is going to move quick um but I'm not now I you know I I think eventually we will see something you know um I think if we didn't see something super quick after a collapse like FTX then I think there's still still going to take time and so unfortunately you know I think we're going to be stuck with some of this regulatory uh regulation by enforcement and Regulatory lack of clarity I think I'm hopeful that some of these um these legal actions that the SEC has brought against you know Ripple um coinbase hopefully will fall in a way that provides some clarity to the industry unfortunately through legal decision which isn't fantastic um and so I think that's where we're going to first start to see some clarity to help um and then probably ultimately followed by some congressional action yeah just a general question you know I I find as well you know we're we live in this world of with you know blockchain defi where we never had such so much visibility and transparency in terms of the nature of transactions right and yet the narrative is out there that a lot of this stuff is invisible and and and not transparent I'd love to again to kind of get your thoughts like so for example the FTX one is the prime example right um the movement of C cust deposits without necessarily knowledge I mean it seems like there's still a disconnect right from a the technical capability versus the perception of what regulators and understand have about the whole Space right and I'd love to kind of get your general thoughts on that um you know yes what if you want to yeah I mean you know that's an interesting case right like you know a lot of the rules you know somebody like FDX I mean they broke a lot of rules right there's a lot of you know um you know checks and balances that were not really employed at that company I'm not I'm not a lawyer right so like I can't I don't know all the details but you know you know from my perspective a lot of it you know if you look at you know what blockchain and the ecosystem can actually do is you know employ some of these rules and requirements um and checks and balances in an automated fashion um and ultimately there's a long way to go to get there uh because you know somebody can always manipulate something um so it doesn't always feel so safe so you know ft feels like FTX was all kind of offchain right uh and uh but this idea of bringing something on chain then bringing these rules and regulations together in an automated checks and balances fashion seems like an optimistic approach I I was going to say I think and and Patrick and I were on a panel I don't know a couple years ago um and someone uh someone on the panel with us was an former SEC uh I think he's a commissioner but he said something really interesting I think it relates this like not having the clarity is if you take reasonable steps to do what a a reasonably right thing like separating customer funds from corporate assets like that's you don't really need someone to tell you that that's the right way to do it right and so if you take that approach in this lack of regulatory Clarity more likely than not you're going to be on the right side of the law you may get a foot foul right you may technically not have done something but that's much better than having completely violated the law and so I think that that's an interesting guiding principle kind of in addition to what you're saying of like using the tech I think it's important to keep in mind that FTX was not crypto fraud it was just fraud and illegal stuff it just happened to be in the crypto ecosystem um so and and that sort of thing happens across all Industries and it always will and it it just because it's in the crypto Ecco system doesn't mean that it was specifically a crypto fraud but um but I do think that um the governments still need better tools to uh uh fight onchain fraud and prohibit Bad actors from getting into the space and you know chain analysis exists and trm Labs but um it's it they're they're very manual and the government has limited resources and these companies charge a ton for licenses which actually means it's just mostly Professional Services because they don't have the the manpower to go through the the analysis there so I think it's important to have um more automation for for governments and compliance officers and um and if you look at I went through um the the 2024 fiscal year budget and it was staggering how many agencies across the board uh referenced cryptocurrency or digital Assets in their requests for additional funding so they are the governments are taking it seriously they they recognize that they need more funding better tools more personnel and you know from the legislative perspective there are bipartisan bills being presented um where that falls out it's really uncertain right now we have an election coming up and that's going to kind of change potentially change the the playing field but um I do think something is going to come down the pipeline in a meaningful fashion when that happens unclear well um just quickly before we close I wanted to Trout out the questions anyone great panel thanks thanks everyone um just curious uh I'm wondering how being immersed in compliance in this space has changed your attitude related to Taboo topics in trafi so in particular there are so many parallels between the crypto space and the Cannabis space it's unbelievable um and my opinion is since The Regulators are treating our industry like and they don't have much respect for the Cannabis industry either are any of you looking at things differently and just as an example tier one financial institutions are still screening potential employees for weed um it's legal in Massachusetts I know it's not legal nationally but I'm I'm wondering does misery love company if these are two industries that are being battered by The Regulators do you see any um kind of symbiotic relationship or Karma between the two and and would you encourage a new thought in relation to Taboo topics I mean who wants to take that one I'm happy to talk about it a little bit I I think you know ultimately yes like working in the space has made me as a compliance professional right you start out as you know relatively conservative um but working in this space I think makes you think outside the box makes you be creative and problem solve some of these things and so I think there is like a recognition that there are other Industries um I think realistically I have a tough enough time getting Bank relationships as a crypto company if I'm a crypto company that's like focused on you know cannabis that's like two strikes before you've even walked in the door right um so I think there is you know I think there's obviously symbiotic relationships right there's a movement of value between you know in this industry that can support industries that are unbanked um I think there's still some forces that you know it's hard to get out from the thumb of those you got one more question um I had a question on I guess acquiring um I guess Banks to make you have an account um for like smaller businesses how do you like acquire an account is it based off I guess your reputation or cuz obviously you want more funds Diversified around different banks so I was wondering how like smaller Banks or smaller businesses sorry are able to like get accounts from multiple Banks wants to I'll talk to you afterwards yeah it's I mean it's it's possible it's hard right you know you got to get your ducks in a row you got to probably take a couple losses before you get a win um but it is you know having a defined plan having you know you got to make them believe in the business that you know it's going to be successful and it's going to be safe um you know I think that's a big I'd say also walk into the conversation like you are underwriting your business so you may not want to tell them everything not to say you have to hide things but you want like acknowledging that a certain Bank wants to do business with you but can't can't participate in certain activities or doesn't want their clients to participate in certain activities you have to acknowledge that and maybe you punt that part of your business for two years down the road until you have a track record and you're doing something very very basic like hey right now like when I first started I was an insure Tech that's it right I didn't need it was too much information to be like hey we're doing crypto and like it it wasn't that yet right it was we were just focusing on building novel emerging C Insurance Solutions regulated and that was really it that's all they needed to know and it's not that I was lying it's not that I was misrepresenting my business it's it's where we were at that time so contemplate that and if that makes sense try to take that approach and then and then as you get further down the road then you've got a little a little bit of you know hopefully success to be able to say hey now you might want to I'm I'm exploring this other thing um and get out in front of it don't hide it until they find out get out in front of it and then and then and then manage manage your business ver that way I think I think that's a really good point um labeling in this industry is is really terrible um so how you frame what you're doing I think is very important needs to mature in our industry for example icos it's it's an I you know it's a play on the IPO which the SEC clearly regulates so um whether that would have changed anything with the outcome for those icos um probably not but why give this industry more scrutiny because you're putting um scary labels on things and it and it always strikes me when um at some point you know we're very early still and uh everything you know we we look at blockchain companies and crypto companies and eventually those labels are going to kind of fall away and it's just going to be a company you know traditional companies using traditional Tech don't pitch their company saying yeah we Ed tcpip protocol and aw or an AWS cloud-based solution no the that's just the backend Tech that allows all of this work and really the the consumer doesn't need to know the rails and I think once we mature a little bit um the the blockchain and all of this lingo that we use that kind of scares people right now will hopefully go away and it will just be very mainstream uh uh technology and you don't even have to talk about the underlying Tack and infrastructure I think that's a great Point um you know like it's we've made the technology the center of the conversation like when you run your MasterCard you question what technology they're using right you trust it works and I think we're we're hitting that Evolution right we're going through that transition so it's really exciting um I think we're out of time I want to thank my panelists great conversation so thank you um and thanks everyone for your [Music] time