Thread by @msantoriESQ

1/ 🚨🚨🚨 Today, the US Treasury published MASSIVE new guidance on crypto regulation. It has *major* implications for wallets, exchanges, ICO issuers, dApps, DEXes... OH MY 🚨🚨🚨 (um I'm gonna tweet about it)

2/ The best way to understand this official guidance is the following: FinCEN cares deeply about your financial privacy, so long as nothing is private from FinCEN.

3/ Why? FinCEN (Financial Crimes Enforcement Network) is the bureau of the Treasury tasked with preventing terrorist financing, money laundring, and other nasty stuff. They're happy with you living your life as you see fit, so long as they get the data they need to stop bad guys.

4/ FinCEN is a big data agency. They scoop as much transaction data, identifying information, suspicious activity reporting as possible, and use it to stop the bad guys. They've been doing it for crypto, too - since at least 2013!

5/ Let's dive in. First up: Wallets.

Noncustodial wallets are not money transmitters in the US. They are unregulated. Nice to see FinCEN confirm what most commentators have been thinking for a long time.

6/ This is an historic day for @blockchain, @Ledger @BRDHQ , @EdgeWallet and all the rest. I'll confess to personal delight here, too. Advocating for the protection of noncustodial, open-source software publishers has been a personal goal of mine for the better part of a decade

@blockchain @Ledger @BRDHQ @EdgeWallet 7/ Why? Because, even if many crypto users rely on their availability, they do not *control* funds any more than an operating system or a mobile device does. I join the chorus of commentators commending FinCEN for finally committing this approach to writing.

@blockchain @Ledger @BRDHQ @EdgeWallet 8/ Today is also historic because I will break with tradition and link directly to the guidance itself prior to requiring your attention to my self-important tweet storming. Here it is: fincen.gov/sites/default/…

@blockchain @Ledger @BRDHQ @EdgeWallet 9/ Next up: Exchanges. Did you know that, whenever you make a funds transfer, your bank has to send *your* personally identifying information along to any recipient financial institution?

10/ @jony_levin can keep me honest here, but apparently this is mostly for backup purposes, to ensure that FinCEN can get its data even if one of the banks goes bust. FinCEN says crypto exchanges have to do this too...

but, like, how?

@jony_levin 11/ A crypto exchange user requesting a withdrawal just supplies an address. How is the exchange supposed to know whether it is for another FI or just a noncustodial wallet?

You'll be shocked, I'm sure, to hear that our industry has been fighting about this since 2013.

12/ There is no real way to implement this without an interstitial (mandatory?) layer over the core network, just so that FIs can message each other.

Sounds a bit like SWIFT eh?

Anyway, that's a nightmare.

13/ On to crypto ATMS, or "BTMs" or crypto vending machines. FinCEN says those are money transmitters. Cool. I think we all mostly assumed that anyway.

14/ For clarity: They're money transmitters (MTs) regardless of whether they sell from their own inventory or they just transmit user funds to an exchange

15/ Now on to FinCEN's exhaustive analysis on Lightning Nodes. This is a really good one so buckle up.

16/ Heh okay FinCEN didn't say anything at all about lightning nodes. Nor are they going to. It's just silly. Honestly, people, stop with this stuff.

17/ You know what the guidance does talk about, though?

Decentralized Exchanges

~DEX~

Yes, The wave of the future. The crypto thing that is going to change all the other crypto things

And I'm only a little bit shocked that they got it totally right.

18/ DEXes that just post bids and asks without settling the funds - they are unregulated. They don't actually "control" any funds. DEXes that settle trades, though, they both "accept" and "transmit" crypto, making them just as regulated as any other exchange.

19/ I'll note that this outcome is unique to FinCEN, cryptocurency and money transmission. If the DEX is listing a something other than mere virtual currency (like, say, a tokenized security), securities laws kick in too.

20/ The securities laws are much broader and don't require "control". SEC said as much in a recent enforcement action that I hereby direct you, CT people, to immediately link to in a comment to this tweet.

21/ We pause here at 21, this hallowed number, to commemorate the giant on whose shoulders we all stand.

22/ But we continue because satoshi ain't the boss of me.

23/ We're mostly continuing into gross and weird territory though: ICOs, and dApps. FinCEN says ICO sellers could possibly maybe under some circumstances be MTs in the US, but only if they actually transmit money.

24/ FinCEN mostly speaks in jargon here so I'll boil it down:

software development? not regulated.
*deploying* software? still not regulated
deploying software that transmits money? Very much regulated

Not super helpful but as good as their guidance gets.

25/ What about ICOs? This is a tricky one. I'll be grateful if CT can help me to digest it but here goes:

26/ Simply premining and then publicly selling the premined coins (in an ICO or otherwise) *is not* money transmission.

Pre-selling coins to a select group of individuals (whether or not you deliver in the future) *is* money transmission *unless you're selling a security*.

Why?

26/ According to FinCEN, just premining and selling openly isn't really "acceptance and transmission"

Premining and selling to a small group while the developer still controls the network means the developer is really an "issuer" and therefore an MT.

27/ Prelling a security, though, like SAFTS and SAFT+E, etc. is investment activity falling under the securities laws, not the MT laws. We talk about this in the SAFT project whitepaper. Good to see it from FinCEN, too.

28/ OK just a couple more and then we'll call it quits:

Cloud miners: Not regulated unless they host a wallet
Crypto Payment processors: Totes regulated almost always
Tumblers & Mixers: If custodial, def regulated.

29/ What about multisig?

If you have control over sufficient keys to spend, regulated.
If you have sufficient keys to prevent spending, not regulated (wait wut why not?)

Whoops, forked again. Try:

https://twitter.com/msantoriESQ/status/1126550859717009409

30/ There's much, much more, but I'm le tired, so I'll just leave it at this. I hope this thread is helpful. All reg guidance is imperfect but I think FinCEN did an admirable job of learning about a weird, complex topic and giving practical, actionable advice. Cheers!