Hi all đ
First, Iâll be at Fintech Devcon in Denver next week. If youâll be there and want to connect, let me know (via Twitter or fintechtldr@gmail.com)!
Second, @regulatorynerd and I had a blast recording a new Fintech Layer Cake episode with Jareau Wadé, Chief Growth Officer at Finix. He has some incredible insights from his payments pioneer experience. Give a listen!
Substack says your email will clip this edition; click here to read in browser!
Tornado Cash & âPrivacyâ đȘïžÂ
OFAC sanctioned Tornado Cash (Tornado) and 40+ Ethereum and USDC wallets associated with it. Tornado is a crypto mixer, a service that helps users hide the source of funds by intermingling streams of crypto. And itâs a decentralized protocol. Think: open-sourced code run by many, not a single business entity.
The sanction was based on Tornado materially assisting cyber activity that threatens the US, including a North Korean state-sponsored hacking group. Practically, it means Tornado and the relevant wallet addresses were added to the Specially Designated Nationals (SDN) list. And itâs generally illegal for Americans to transact with anyone on the SDN list.Â
This is the first time OFAC has sanctioned a protocol (i.e., smart contract), and has led crypto companies like Circle to blacklist Tornado wallets for their users. And Netherland officials have also arrested at least one Tornado developer for his involvement with the protocol.Â
Some thoughts. đż
First, itâs worth mentioning mixers can be used for legitimate purposes; itâs not all North Korean hackers hiding ill-gotten gains. One example: an employee who gets paid in BTC might not want their employer to view all of their transactions; a mixer lets the employee retain their privacy. Your employer doesnât see what you spend your USD salary on; why should it be different from crypto?Â
This is the crux of policy making: balancing the good and the bad. DDT was a great insecticide, but we banned it because the bad outweighed the benefits. Similarly, having some bad aspects doesnât mean a technology or tool should necessarily be banned.Â
Second, some have pointed out that, yes, centralized actors can help cut off access to Tornado, but thatâs not enough to shut the decentralized protocol down. Itâs a key feature (or bug, depending on your view) of decentralized autonomous orgs: if theyâre truly decentralized, itâs very, very hard to stop them.Â
But thatâs not compelling; itâs impossible to completely shut off criminalsâ access in the traditional finance world, too, especially when research suggests current AML laws donât catch over 99% of criminal proceeds. Adding a terrorist to the SDN list isnât foolproof. But it does add friction. Thatâs the point. In the real world, almost nothing works perfectly. Making it harder for folks to use Tornado at all achieves OFACâs goal, even if imperfect. Itâs not different from traditional finance.Â
Third, lots of folks are up in arms about the sanctions, saying OFAC has gone too far. They argue OFAC is targeting neutral tools, not the bad actors the SDN list is meant for. Others argue it might not even be constitutional; the 9th Circuit has ruled code is constitutionally protected speech and the Supreme Court has said spending money can be, too. So the sanctions impinge upon fundamental rights, they argue.Â
But, of course, Americans donât have an absolute right to free speech; the government can limit it in circumstances, especially where it encourages imminent illegal acts. And you can also argue that Tornado isnât a âneutral tool,â but instead an entity â a DAO â that can be put on the SDN list.1
Fourth, anti-sanction sentiment argues the OFAC move violates privacy rights. Yes, Americans (allegedly) have a right to privacy when you read between the lines of the US Constitution (fun fact: privacy rights arenât explicitly in the US Constitution, but theyâre the first thing in Californiaâs).Â
However.Â
Privacy is not the same as anonymity, especially in financial services.2 Privacy is âthe government canât see my bank transactions (without a warrant).â Anonymity is âno one, including the government, knows this bank account is mine; it wouldnât even matter if the government had a warrant.â3
And in traditional financial services, you have privacy rights, not anonymity rights. Otherwise, KYC wouldnât be a thing.Â
Related thought: in a sense, you can say blockchains like bitcoinâs exchanged privacy for anonymity. Transactions arenât private, but users can be anonymous.4 Contrast that with your bank account where transactions arenât publicly viewable, but have to give your identity to the bank.
None of this is meant to make judgment calls about whether this OFAC move is right or wrong. I just want to call out the nuance thatâs been omitted from the Tornado policy dialogues.
Oh also, one fun quirk: itâs illegal to deal with anyone blocked on the SDN list. But Tornado is a protocol. So you can send crypto into it and specify the wallet funds end up in. So someone sent crypto through Tornado to Coinbaseâs CEO, Jimmy Fallon, Logan Paul and others, effectively exposing them to sanctions risk.Â
Hello Digit, Goodbye âNeverâ
Another piece of fintech news making waves: the CFPB issued a consent order against Hello Digit (Digit). The company offers an app that algorithmically helps you budget, save, and invest. The order is premised on Digit misrepresenting claims related to overdrafts, and says Digit:
Misrepresented its saving algorithm by claiming it would never transfer more than a user could afford,Â
Claimed to offer reimbursement for overdrafts but didnât deliver, andÂ
Told users it wouldnât keep any interest earned on consumer funds after moving to a subscription model, but retained some interest in practice.Â
Two thoughts.Â
First, notice the problem with the above screenshot? You canât say âwe never do X, periodâ and in literally the next sentence say âif X happens, weâll reimburse you.â Those two things arenât consistent.5
Making sure your site and marketing materials arenât misleading or making overly bold claims is one thing a good fintech lawyer will protect you against. Hereâs a free pro-tip (not legal advice, not your lawyer!): donât use words like ânever,â âalways,â and âguarantee.â
Second, Oportun (who acquired Digit) issued a statement about the news, saying overdraft fees only affected 0.008% of members. Some fintech folks have said the order seemed overly harsh. But, again, if you say something never happens and it doesâŠthen youâre factually incorrect, even if theyâre isolated incidents.
Itâs also worth keeping in mind that a single overdraft fee might mean someone doesnât have enough for rent or food for their kids that evening.Â
Third, this tweet (and thread) from Alex Johnson got me thinking:
Alex is right: anyone whoâs read anything the Bureau has put out under Director Rohit Chopra, you will probably tell you the tone is usually, uhh, not Midwest-nice (can you tell Iâm from WI?). Iâve heard others describe the Bureauâs tone as aggressive and hostile. And one key theme of the CFPB under Chopra is using blogs and press releases as a bully pulpit.
Problem: If youâre harsh about everything, are you harsh about anything?
Your ire loses signal and weight if itâs applied to everything. Alexâs tweet got me wondering: does the CFPB have a âboy who cried wolfâ problem now? When a new CFPB release comes out now, Iâm increasingly hearing and seeing lawyers and fintech operators respond with âoh, itâs just the CFPB release with a harsh tone, who knows what it actually means.â
Maybe itâs scaring financial services into better compliance on average. But thereâs a point where folks throw up their arms and shrug because theyâre unsustainably over-complying out of fear. Maybe the Bureau is watering down its bully pulpit powers.
Elsewhere (non-crypto)...
Iâm going to try out a new style for the âElsewhereâ sections: more narrative than bullet list. If you like or dislike it, let me know!Â
The CFPB issued an interpretive rule saying, in effect, tech firms and digital marketing providers are subject to CFPB jurisdiction if they do more than just offer the âtime and placeâ for running ads. This could mean, for example, if a company like Facebook lets advertisers pick the location, gender, etc. of targets, the CFPB can go after them for UDAAP violations (like, say, ads that have discriminatory impact by only advertising to Facebook groups primarily composed of white users). It gives the CFPB another hook to go after big tech, among others.Â
In âletâs protect data betterâ news, the CFPB confirmed that inadequate safeguarding of consumer data may count as an unfair act or practice. Additionally, banking trade groups asked the CFPB to supervise data aggregators (think: Plaid), per Bloomberg.
In BNPL news, CAâs financial regulator settled with BNPL provider Four over providing BNPL services without a license (CA requires BNPL providers to get a license if there are >4 installments, finance charges, and other features). Elsewhere, Rohit Chopra said the CFPB will scrutinize Appleâs expansion into BNPL, including whether the move is anti-competitive, per the FT.Â
Senators Durbin and Marshall introduced a bill that would generally prohibit credit card issuers from restricting the number of card networks transactions can be processed on.Â
Ford applied for an ILC charter, per AmBanker. Itâs not the first time, and could be a bellwether for other non-financial companies to do the same. I wouldnât hold your breath for an approval.Â
For the payments nerds đ€, the Fed finalized guidance for deciding who can access Fed master accounts. Master accounts are required for sending funds over Fed rails (i.e., Fedwire, FedACH, and FedNow). The short version: institutions subject to less regulatory oversight will be more thoroughly vetted by the Fed. Donât get too hyped up for fintech, though; you still need to be a bank to be eligible.Â
Goldman Sachs is being investigated by the CFPB over its credit card billing, payments, advertising, and reporting practices, per its 10Q. Goldman currently only manages a GM co-branded card and the Apple Card.
In oopsies news đ€Š: For ~3 weeks this year, Equifax sent incorrect credit scores to lenders, affecting millions, per WSJ. Also đ€Š: The CFPB issued a consent order, including a $37.5M penalty, against US Bank after employees opened lines of credit and deposit accounts for consumers without their knowledge, among other issues, due in part to a sales rewards system that incentivized opening such accounts. Gotta wonder how long this kind of account opening will remain de rigueur among big banks. đ€
Last oopsie: NYâs financial regulator fined Robinhood $30M for violating AML and cybersecurity regulations, thanks in part to the company experiencing high growth without adding sufficiently mature compliance guardrails, per CoinDesk. Maybe they should have listened to the Fintech Layer Cake episode on building a compliance function?
Elsewhere (in crypto)...
The FDIC isnât happy about crypto. đĄ First, they sent a cease and desist to Voyager, demanding the company stop claiming they themselves were insured (vs. their partner bank), all funds at Voyager were insured, and that the FDIC would insure against Voyagerâs failure itself.
Second, the FDIC also released a fact sheet and advisory covering crypto companiesâ claims of FDIC insurance. Spoiler: crypto isnât FDIC-insured, and companies shouldnât mislead users about it. Third, the FDIC is apparently pressuring banks not to service crypto companies, and Sen. Toomey wants them to back off, per AmBanker.
Speaking of Voyager: a bankruptcy court rules that customer USD deposits at its partner bank werenât part of Voyagerâs assets for bankruptcy purposes, reinforcing the importance of using FBO accounts, per WSJ.
In âmaybe regulators will regulate crypto via regulation instead of enforcementâ news, Fed. Governor Bowman said the Fed is working on guidance for bankâs interested in crypto activities like custody services, purchases/sales, collateralized loans, and stablecoin issuance. And the Fed released guidance saying banks that want to engage in crypto activities need to determine if the activities are legal and notify the Fed beforehand. This mirrors similar guidance from the OCC.
Lots of Coinbase news. The DOJ brought an insider trading case against a former Coinbase manager who allegedly gave tips on which assets the platform would list in the future. The key news from that case: DOJ claims at least 9 of 25 crypto assets involved were securities. Also, Coinbase itself is being probed by the SEC over whether it listed seven tokens that should have been registered as securities, per Bloomberg. Lastly, a proposed class action against Coinbase alleged they had insufficient cybersecurity practices that let accounts be drained by hackers and scams, per Bloomberg.Â
In other âcrypto exchanges in hot waterâ news, Kraken is under investigation for allegedly violating sanctions by letting users in Iran and other prohibited countries use the exchange, per the New York Times.Â
Sui Generis (Fun Finds)
The Financial Times issued an amazing apology:
Hi. Iâm Reggie. Iâm a fintech product lawyer at Lithic.
Reach out (email or Twitter) if youâre interested in any of the following:
Sponsoring the newsletter
Early stage fintech looking to raise
Collaborating
Just want to say hey!
Any views expressed are my own (well, sort of? I mean, theyâre based on laws and regulations, so theyâre not really âmineâ?). Nothing here is legal or financial advice. Donât get your legal advice from Substack, duh.Â
See, for example, how Consensys defines a DAO as a âcommunity-led entity.â Though you can argue itâs not an entity and take ethereum.orgâs framing that itâs a âcommunity.â But then weâre going down a semantic rabbit-hole arguing over whether a community counts as an entity, etc.
Credit where credit is due: this phrasing came from whip-smart colleagues of mine at Privacy.com (though not in the crypto context). I canât claim credit for it, but I do love it.
I recognize crypto advocates argue that this is the point, anonymity protects you against illegitimate government actions masquerading as legitimate. Iâm not making judgment calls here, just calling out the under-discussed difference between privacy and anonymity rights.
Though, of course, a userâs identity can be inferred from their transaction history, and all you need is one tie to a user to identify them.
You can get into semantics about what âaffordâ means in their claims, but it seems reasonable to say triggering overdraft means a user couldnât afford a transaction.