Articles
Dive deeper into certain concepts and read up on important updates.
How Should We Regulate Crypto/Web3 Cybersecurity?
Cybersecurity is all about the financial incentives. Getting cybersecurity regulation right means using the threat of regulatory fines to align financial incentives so that companies do the right thing. Compared to most existing cybersecurity regulations, however, the financial incentives in cryptocurrency/Web3 are very different. Most existing cybersecurity regulations aim to improve the security of consumer PII and personal information that companies hold. Because the theft (more accurately: copying) of consumer PII by hackers during a data breach does not result in an immediate financial impact to a company's bottom line, companies have historically paid less attention to cybersecurity than they should. Since the free market financial incentives for companies to secure consumer data are poor, regulators have naturally stepped in with a regulatory stick (where the free market carrot has failed). The financial incentives in crypto, however, are very different. With crypto, if you are hacked and your crypto is stolen, you've lost your own assets. That's a huge incentive to do cybersecurity properly. Here are five major takeaways that regulators should consider: For companies self-custodying their own crypto, financial incentives are already 100% aligned. If Company X holds $1 million in cryptocurrency, and a hacker steals it, the company just suffers an immediate financial loss of $1 million. Regulatory fines would not offer any greater financial incentives for Company X to do the right thing. For companies that hold someone else's crypto assets, the financial incentives are not quite so aligned. If a company custodies $100 million, only $1 million of which is their own, and a hacker steals all $100 million, then the company will simply declare bankruptcy and leave their debtors with nothing. An example might be a centralized crypto exchange, or a DeFi service built on top of a smart contract. In these kinds of situations it might be appropriate for regulators to require minimum security controls to protect users. Getting cybersecurity regulations right is hard. The result of cybersecurity regulations in other areas (such as consumer PII or PHI) has been that companies will do the bare minimum to satisfy cybersecurity regulations, and no more. Finding the right balance between creating regulatory financial incentives without unduly stifling innovation becomes a difficult balancing act. Hackers don't care about regulatory compliance. Cyber defenders have to be right every single time, and attackers only have to be right once. Unlike environmental protection regulation, where accidental oil spills or illegal toxic waste dumping is the primary concern, in cybersecurity we are worried about malicious third parties acting outside the reach of the law in countries like North Korea or Russia. There is frequently no legal recourse in the event of a crypto hack. Crypto startups need to front-load security spending. In most startups, the biggest risk is going out of business, not cybersecurity risk. As a result, startups tend to run very insecure for a couple of years until they are financially successful enough to go back and fix things (so-called "tech debt"). However, this approach does not work in the crypto space, where hackers frequently prey on lean, insecure startups that enjoy overnight financial success. Forcing crypto startups to frontload security expenditure from the beginning could be a key lever of effective regulation. Cybersecurity risk in the crypto/Web3 space is high... ... higher than in most other verticals, because we're not talking about the security of information, but about real, fungible, and non-reversible financial assets. The stakes are high and companies in the crypto space take security seriously. Financial incentives to do security properly align much more closely in the crypto space than in almost any other vertical. The alignment is not 100% perfect, but it is close enough that regulators should take a "light touch" approach to crypto cybersecurity regulation.
IRS seeks feedback on definition of NFTs
The U.S. Internal Revenue Service (IRS) announced this week that it is seeking feedback regarding the tax treatment of NFTs as collectibles under tax law that will inform upcoming guidance. Specifically, it is soliciting comments on: The treatment of NFTs as collectibles and other questions such as whether the IRS has accurately defined NFTs; Its use of a look-through analysis to determine whether a digital asset may be taxed as a collectible, as opposed to a capital asset, which is currently the treatment used for sales or exchanges of digital assets; The factors it should use to consider whether an NFT is a collectible for tax purposes; Whether there are any issues with applying the tax treatment for collectibles to individually directed accounts under a qualified plan; and What other guidance related to NFTs would be helpful. Comments are due on June 19, 2023. Importantly, the IRS defines an NFT as "a unique digital identifier that is recorded using distributed ledger technology and may be used to certify authenticity and ownership of an associated right or asset." And it acknowledges that "[o]wnership of an NFT may provide the holder a right with respect to a digital file (such as a digital image, digital music, a digital trading card, or a digital sports moment) that typically is separate from the NFT." (footnote omitted). It also acknowledges that NFTs may provide certain rights, such as attending an event, or proving ownership of a physical item. This helps distinguish NFTs, which are not intended to be financial in nature, from other types of digital assets. In other words, the IRS is taking a step towards a sensible token classification system by expanding on its guidance for digital assets. The notice provides that the proposed treatment of NFTs as collectibles would fall under a provision of the tax code that applies to collectibles held within individual retirement accounts, and the sale or exchange of a collectible held for over one year would be subject to a maximum 28%perc capital gains tax (as opposed to a lower tax rate for capital assets). Per the IRS’ look-through analysis, an NFT would be treated as a collectible for tax purposes if the asset or associated right tied to the NFT also meets the definition of a collectible. The tax laws state that works of art, rugs or antiques, metals or gems, stamps or coins, alcoholic beverages, or certain tangible personal property are considered collectibles. For example, an NFT representing ownership of a stamp would be treated as a collectible. On the other hand, NFTs representing objects outside of this category would not be classified as collectibles. Where further analysis is required is whether a collectible constitutes a “work of art,” an area where the IRS is requesting feedback.
Introducing the Tree of Web3 Wisdom
Introducing the Tree of Web3 Wisdom - 5 branches to guide policymaker thinking The world of Web3 is rapidly evolving, while policymakers keep up with the latest developments to enact effective, sensible regulation that nurtures important technologies and protects consumers. This is a global phenomenon. Japan continues to update its first-in-the-world comprehensive cryptoasset regulation; Singapore regularly iterates on its regulatory regime, as does South Korea and many small Asian jurisdictions. The EU is on the cusp of implementing its Markets in Crypto-Assets Regulation (MiCA), while various US regulatory agencies continue the work assigned to them in the President’s Executive Order from March 2022. The US Congress is also hard at work with hearings and draft bills. Against this backdrop, the Tree of Web3 Wisdom provides a helpful framework for understanding the key aspects of Web3 technology and which first principles are important for regulating it. Let's explore the five branches of the Tree of Web3 Wisdom and their implications for policymakers. The first branch of the tree is to understand the technology. Before regulating Web3, it's essential to have a deep understanding of blockchain technology. Blockchain allows for digital ownership and transfer of value across the internet, with enhanced security, transparency, auditability, programmability, and scale. It also enables users to program on these databases to create applications that are part of a larger tech stack for anything their creativity can imagine. This technology has the potential to empower communities, remove friction, verify credentials, and create new efficiencies in commerce. It's essential for policymakers to understand the capabilities of blockchains and the problems they solve to see the potential benefits and risks involved in its implementation. The second branch of the tree is to beware of misconceptions. Blockchain technology isn't just about financial transactions. It's a new infrastructure for the internet, providing a decentralized system that promotes transparency and security by having no single point of failure, no single source of truth, and no single entity or authority with the power or obligation to change data or transactions. Crypto assets and blockchain are not synonymous. Blockchains facilitate crypto assets, but they also facilitate many other types of activities by allowing data integrity and digital uniqueness through tokenization. Crypto assets are a way to digitally represent something on a blockchain. Decentralized systems promote transparency and security by having no single point of failure, no single source of truth, and no single entity or authority with the power or obligation to change data or transactions. Decentralization does not necessarily mean "permissionless and public," and it is crucial to understand that blockchain technology can be permissioned and private too. DeFi is more than just trading financial instruments–it is an avenue to democratize commercial systems by using blockchains and smart contracts to replace traditional intermediaries with built-in trust mechanisms. NFTs are not just for collectibles and art with revenue streams. An NFT is a type of token that is digitally unique, allowing for more specialized representations regardless of the industry. The third branch of the tree is to classify tokens sensibly. A token is a digital representation of something on a blockchain, such as an asset, item, or bundle of rights. Tokenization allows the item's ownership to be established and transferred globally on one or more blockchain networks. A sensible classification systemrecognizes the nature of a token based on the item or rights it represents, whether it's a physical item, intangible item, a type of service, or simply a native token integral to the functioning of a particular blockchain network. Treating all tokens as financial instruments or the trading of tokens as financial activity will unnecessarily limit their use in commerce, communications, entertainment, recreation, governance, and anywhere else establishing ownership. It's essential to classify tokens sensibly to understand their utilization, valuation, and legal classification and, therefore, their appropriate regulatory treatment. The fourth branch of the tree is to enact context-appropriate regulation. Just like plants need specific care depending on their nature and location, blockchain and crypto require appropriate regulation based on their context. Responsible actors want sensible policies that incentivize growth and good behavior, punish bad actors, and regulate intermediaries. Appropriate laws and regulations traditionally have been determined according to the type of asset or technology and its context, i.e., how it is being used, by whom, and the associated risks. This same approach should apply to blockchains and tokenization, which are just a new way of establishing ownership and transferring value. It's important to note that innovative programs and features on a blockchain are run by autonomously-functioning code, and their role needs to be carefully considered when regulating. In enacting context-appropriate regulation, policymakers must also consider the impact of blockchain and crypto on individuals and society. Finally, the fifth branch of the tree is to think global. This last branch of the Tree of Web3 Wisdom emphasizes the ongoing evolution of blockchain technology and the endless possibilities for its use in various fields. The potential applications of blockchain technology go beyond financial transactions and encompass a wide range of industries, such as healthcare, supply chain management, voting, and identity verification. Just like the internet, blockchains and crypto assets are global and require a coordinated regulatory approach based on certain "first principles," including disclosure, market integrity, disclosure, anti-fraud, privacy, and operational integrity. As blockchain technology continues to mature and evolve, it will likely provide even more benefits, such as greater privacy, scalability, and interoperability. Quality builders, including developers, entrepreneurs, and investors, will play a crucial role in driving innovation and creating new and exciting ways to use blockchain technology. Just look at Lemonade Foundation, as one example. However, this ongoing innovation and growth also requires sensible regulation to strike a balance between fostering innovation and protecting consumers and the broader economy. In conclusion, the Tree of Web3 Wisdom provides policymakers with five critical principles to guide their thinking when considering how to regulate blockchain, tokenization, and Web3. By understanding the technology, avoiding misconceptions, classifying tokens sensibly, enacting context-appropriate regulation, and thinking globally, policymakers can create a regulatory framework that fosters innovation while supporting safety and security for all stakeholders. Read the Tree of Wisdom in full here.