How Regulation and Compliance Can Lay the Groundwork for the Ecosystem’s Next Boom

The regulation debate around crypto has become confused, argues Caitlin Barnett, director of regulation and compliance at Chainalysis. Contrary to common perception, there are already plenty of regulations in place for crypto companies, and these rules are firming up and evolving quickly, even if they lag innovation. Along with Chainalysis, executives from Alloy, Guidehouse, and Notabene — all companies with a stake in crypto markets' maturation — agree: Regulation and compliance will play an important role in leading the space out of the "crypto winter." In fact, the broader adoption of compliance and safety solutions creates a huge market opportunity.

"Everyone's trying to point fingers and blame something for what happened, and why it happened," she adds, "but what happened recently is not a crypto problem," says Caitlin Barnett early in our conversation.

New York-based Chainalysis, where she leads regulation and compliance, specializes in providing businesses with data and tools to navigate crypto markets safely. As such, the company has spent plenty of time explaining how allegations of fraud, not regulatory loopholes, was the root cause of the recent FTX collapse.

In fact, Barnett believes that when analysts or journalists paint a picture of crypto markets as a Wild West of finance, they miss important points about the more complicated reality.

And, they also miss an underlying market opportunity.

Regulation, whether crypto-specific or broadly applicable to financial markets, is hardly absent from the space. And, meanwhile, new regulatory frameworks and policies around crypto markets are emerging quickly around the world.

So, what is the way to restore trust in crypto markets?

Barnett sees the answers in broader awareness of this fast-moving regulatory landscape, and adoption of compliance tooling that is in sync with these shifts.

We recently sat down with Barnett to discuss the regulation debate and the landscape of crypto risk management, compliance, and monitoring tools.

Alongside Barnett from Chainalysis, a few other executives in the ecosystem participated in the discussion to offer further perspective.

• Charley Ma, general manager of fintech at Alloy, an identity technology company that helps more than 350 banks and other clients make credit, fraud, and compliance solutions
• Pelle Braendgaard, CEO of Notabene, software that helps companies comply with the multinational FATF (Financial Action Task Force) Travel Rule guidelines
• Alma Angotti and Gregory Schwarz are with Guidehouse, a global consultancy firm. Angotti is a partner in Financial Crime, Fraud and Investigative Services (FFI). Schwarz is associate director in FFI, based in New York.

One hurdle for companies like Chainalysis, Alloy, Notabene, and Guidehouse is keeping pace with innovation in crypto, which is continually throwing up new products and adoption trends, whether it be NFTs or decentralized finance (DeFi).

And, certainly, these emerging categories also challenge regulators.

But within the quickly-evolving regulatory picture, resolving itself by the day, there are opportunities as well.

In fact, far from stifling the crypto economy, regulation could create the groundwork for the ecosystem's next boom.

Broadly speaking, is regulation helping to grow the market for crypto compliance tools?

Caitlin Barnett, Chainalysis: I think so, yes. For example, if regulators come out and say that blockchain analytics are required for anyone who's interacting with cryptocurrency, similar to how you are mandated to have a fiat transaction-monitoring system, that means that you need Chainalysis or a similar service to work with cryptocurrencies. The opportunity is huge, and the more regulatory clarity that comes, the bigger the opportunity will be for us.

Charley Ma, Alloy: I think so as well. Also consider that building compliantly sends a clear message that says, "Hey, we're regulator-approved and this protocol, product, or company that we're building is designed without fraudulent intent."

Pelle Braendgaard, Notabene: Yes, we think there will be a clear shift from a negative view towards regulation to a more positive one. It will become more evident that regulation actually allows crypto to grow and enables businesses to use compliance as a business asset. The companies investing in compliance now will be the ones set up for success as they grow.

Alma Angotti, Guidehouse: It's a form of future-proofing that is very valuable. We tell our clients, implement a good risk-management program, notwithstanding the specific regulatory requirements. Your business will be more successful over the long term and whatever the final regulatory decision is, you will be ready.

Along with regulation, bottom-up trends are always changing the crypto ecosystem. Can you give an example of how industry trends are changing your product offerings?

Caitlin Barnett, Chainalysis: DeFi is a hot topic everyone is talking about right now. We have two new products that I think are worth mentioning in this regard. One is address-screening. It is an automated solution that allows you to customize risk rules to prevent high-risk users from connecting to a platform. DeFi protocols often don't have compliance departments like a centralized exchange or a traditional financial institution, but at a minimum are likely required to screen users to avoid transacting with parties under sanctions. Our product allows them to automate that process. The second product we call "Storyline." This is an investigative tool that allows you to investigate the complex world of smart contracts, NFTs, chain-hopping, and sophisticated protocols. Instead of having to bounce back and forth between these things, our product gives you the holistic picture.

Charley Ma, Alloy: We now offer a case-management system that lets you investigate suspicious activity and complete regulatory filings from one central interface. Separately, wallet screening is a persistent challenge. Wallet screening against a sanctions list isn't always enough since new wallet addresses can be created in a matter of minutes. A holistic approach towards onboarding is necessary to understand the full risk profile of a user onboarding into your ecosystem.

Gregory Schwarz, Guidehouse: An essential step in offering new crypto and DeFi products is for institutions to establish robust anti money-laundering (AML) risk assessments to show that their programs and product controls are risk-based, effective, and reasonably designed. An ill-considered product expansion strategy could create an opportunity for criminals to exploit the new product and put a company uncomfortably near the regulatory crosshairs. Guidehouse has numerous clients that it advises on how to conduct such evaluations and helps them ensure their controls are tailored to their business and operations. "

How can companies get ahead of regulation, and proactively move toward confident and compliant participation in crypto markets?

Caitlin Barnett, Chainalysis: The answer has to be education. Education is a big part of what we do at Chainalysis. You find someone at one of these larger financial institutions who believes in crypto, understands the technology and its nuances, and working with them you can offer education and explain the current regulations around crypto. It's not that scary.
Is crypto associated with darknet markets? Sure. But so is cash. Cash is used to buy drugs all the time — you just can't see it. You can see it with blockchain analytics and crypto, that's the difference. We try to demystify crypto and explain that there is regulation in place. There are compliant ways to interact with crypto, and using our tooling is one of those compliant options.

Charley Ma, Alloy: Crypto companies need to lead with their actions and stay away from regulatory shortcuts that offer a short-term solution, and instead build a compliance program that can pass muster with banks and regulators. Avoiding regulations and cutting corners can seem like a shortcut, but as we've seen recently, has resulted in much larger negative outcomes in crypto.

Pelle Braendgaard, Notabene: It is vital that the industry focus on the safety of customer funds and transactions. When crypto is regulated and deemed safe, then and only then will we see crypto take its rightful position in the everyday economy. In getting there, we have to take advantage of blockchain's key advantages.Virtual assets are quickly coming under the same checks and balances as those in traditional finance, but luckily blockchain tech has many benefits that make it easier to set up the vital compliance programs. Ultimately, virtual asset service providers, or "VASPs," that put compliance — with standards like the FATF Travel Rule — and blockchain analytics at the helm of their operations can provide a better customer experience than traditional providers working in fiat currencies.

It's also essential for the global industry to collaborate, which is why we hold jurisdiction-specific workshops for compliance officers and legal professionals. These events aim to ensure that VASPs in the same jurisdiction meet the same deadlines and requirements, and provide a forum to share challenges and solutions. Then, we are also fostering cross-jurisdictional collaboration, we hope to encourage the exchange of innovative ideas.

We'd like to give the audience an idea of how fast the regulatory landscape is evolving. Are there any major regulatory changes, such as in AML or KYC policy, that you're having to adapt to internally?

Caitlin Barnett, Chainalysis: Sanctions have been the hot topic in compliance over the past few months. In the US, OFAC (Office for Foreign Asset Control) has continued to make designations that impact the crypto ecosystem. We've seen the first decentralized protocol get sanctioned, which raised a host of questions for the industry, so much so that OFAC actually provided some clarification after the designation, which doesn't happen too often. In general, we've been hearing more and more questions about sanction compliance.

Charley Ma, Alloy: US regulation is almost certainly incoming in the next 6-24 months. We predict that the Digital Asset Money Laundering Act is the first of what will be many regulations around KYC and AML compliance in crypto. To prepare for the future, we advise companies to proactively integrate identity verification and fraud prevention into their platforms to avoid being caught unawares by new laws.

Pelle Braendgaard, Notabene: Some in the industry have been surprised at recent fines due to sanctions violations. These fines indicate that address-checking on its own is not enough for an effective sanctions-screening program as it does not really help you check names. In the context of Travel Rule compliance, it is essential to properly screen not only a company's own customers around sanctions, but also the ultimate counterparty or customer of a transaction regardless of whether the context is custodial or self-hosted. As we advance, regulators will require VASPs to allocate more resources toward maintaining strong sanctions-compliance controls.

Alma Angotti, Guidehouse: Cryptocurrency players are currently regulated by US states as money-services businesses but regulations like the Digital Asset Anti-Money Laundering Act, which Charley mentioned, and agency responses to Executive Order 14067, signal potentially more federal oversight given to the federal agencies such as the US Commodity Futures Trading Commission (CFTC) and the US Securities and Exchange Commission (SEC). As such, it is important that cryptocurrency players consider scaling their compliance programs in a manner consistent with the expectations of these federal regulators. We've seen more mature exchanges voluntarily implement some of the controls and risk-management frameworks before they are specifically required.

What is your general view on the direction regulations are taking?

Caitlin Barnett, Chainalysis: Depending on the topic, we definitely have views, but our priority is to make sure the ecosystem continues to grow and foster innovation.

Charley Ma, Alloy: There are still a lot of unknowns, but all of this stuff isn't novel! There are existing frameworks to review and understand where regulation might go in crypto. Regulation that was designed for commodities and securities doesn't apply neatly to crypto — it's possible that an entirely new regulatory body will be created. Self-regulation is another interesting possibility. An organization akin to FINRA (the private nonprofit that regulates broker-dealers) could emerge in the next year or so.

Gregory Schwarz, Guidehouse: Believe it or not, major cryptocurrency players have long been engaged in a process to substantially beef up their Bank Secrecy Act and Anti-Money Laundering or AML controls—and many are on par with first-class banks or broker-dealers. While financial crimes compliance is important, compliance professionals should expand their knowledge base to future issues of potential regulatory focus. After the recent events related to the demise of FTX, we see an increased compliance focus on transparency, risk management, and investor-protection issues.

Despite the downturn, numerous VCs have said that crypto tooling, security, and compliance will continue to be a major focus in coming years. With so many new entries, how do you continue to differentiate yourself in a crowded space?

Caitlin Barnett, Chainalysis: We are constantly trying to iterate what we're good at, which is data. Our data set is the most comprehensive and the most reliable. I would also point to our longevity. We're the longest-standing analytics provider in the ecosystem, which is important because it means we have the richest data set.

Our data has actually been used in successful criminal prosecution. We continue to stay on top of the curve and develop data-based products as we see fit based on industry trends.

Charley Ma, Alloy: Our product gives you a comprehensive view of a crypto user by leveraging on-chain data in combination with traditional financial data sources in a single platform. This data is available for both onboarding and ongoing transactions, and helps clients verify if a potential or current customer is fraudulent. The need to "trust" a regulator to audit a financial institution should shift to trusting code and on-chain data for auditing purposes.

Pelle Braendgaard, Notabene: Our team is constantly working to standardize best practices across the industry. One of the core aspects of Notabene's product design is "embedded global compliance." Because Travel Rule requirements vary by jurisdiction, we integrate Travel Rule requirements directly into our product, which ensures that VASPs can comply with the jurisdiction-specific requirements of each transaction. To support the efficient adoption of new requirements, we have made it a priority to educate compliance teams on evolving regulations worldwide.

Gregory Schwarz, Guidehouse: We have a breadth of experience with new client types and compliance technologies, so we can effectively address emerging risk and regulatory issues and provide our clients the most salient advice possible.

Reprinted with permission from the March 7, 2023, edition from Blockdata. All rights reserved. Further duplication without permission is prohibited.