Crypto Decrypted: Why crypto compliance begins with data
As firms increasingly integrate digital assets into their operations, how can they ensure their compliance programs can handle crypto-related data and communications?
Written by a human
The cryptocurrency landscape is rapidly evolving, presenting the finance industry with substantial opportunities and substantial challenges – particularly the introduction of advanced platforms, novel terminology, and fast-growing data volumes. With new assets come new considerations, and to keep up, firms must build strong compliance foundations to navigate these complexities.
Don’t discount the data
Cryptocurrency has built tremendous momentum over the past year, with regulators such as the Securities and Exchange Commission (SEC) and Financial Conduct Authority (FCA) reexamining rules and clarifying regulations. As with any evolving technology, firms must adapt their compliance frameworks accordingly to ensure they meet regulatory requirements and innovate responsibly.
The SEC has laid the groundwork for various crypto-focused measures, including the potential to bring crypto under the scope of existing recordkeeping guidelines by modifying rules 17a-3 and 17a-4, which dictate what records firms are expected to keep, in what formats, and for what period. During this modernization, a key priority for teams is reassessing data retention and surveillance strategies to address the intricacies of crypto platforms.
What data complexities do crypto communications present?
While firms may be equipped to capture communications data from messaging channels like Bloomberg and Microsoft Teams, many crypto trading or management platforms also include messaging features. Firms need to ensure communications from these platforms are properly captured to avoid potential risk. In addition, firms must account for other challenges associated with crypto platforms, such as ephemeral messaging and off-chain activity.
- Encrypted and ephemeral channels
Crypto traders favor channels with end-to-end encryption and ephemeral features because of their focus on security. Channels like Telegram and Signal are among the most prevalent, though they pose challenges to compliance teams who must navigate app features that don’t conform with global recordkeeping standards.
Telegram’s “self-destruct” feature deletes messages after a set time, which means they can never be stored or captured again. Even if compliance teams implement policies to capture these channels, their ephemeral nature can pose legal problems for internal or criminal investigations, as evidence can disappear before an investigator’s eyes.
- Social media risk
Social media platforms like X and Reddit are commonly used by the crypto community for real-time discussions, such as information sharing about trading alerts or market insights. Firms can also use social media channels to share investment advice about cryptocurrencies with their audience, though they must be careful not to cross the line into misleading advertising.
In February 2024, the Financial Industry Regulatory Authority (FINRA) published the results of a two-year review examining crypto-related retail communications distributed by broker-dealers. The results illustrated that of the 500 communications, 70% violated Rule 2210, which requires firms to ensure communications with the public are “fair and balanced.”
While U.S. initiatives are increasingly supportive of crypto, FINRA’s study underscored the importance of proper oversight of crypto-related communications to ensure compliant behavior and keep investors safe. Before long, we may also see the SEC’s Marketing Rule applied to crypto firms and misleading advertising.
- On and off-chain activity
A unique challenge associated with crypto communications is distinguishing between on and off-chain platforms. On-chain refers to blockchain-based crypto movement, such as token transfers, whereas off-chain refers to external communications, such as chats or voice calls. This introduces the interesting possibility that a message can be both off-chain and off-channel.
Surveillance teams must “connect the dots” between off-channel and off-chain activities to form a full picture of user behavior. A trader may discuss a crypto pump-and-dump scheme with contacts on Telegram, then execute this plan using on-chain smart contracts across wallets. Firms will need to ensure they capture and analyze both structured blockchain and communications data to manage these risks.
Completing the crypto puzzle: Managing fragmented communications
- Reassessing policies and expanding coverage
An increase in crypto activity means an increase in data volumes – and an increase in how far compliance resources need to stretch. Alongside records of crypto trading and processing data, firms must also capture relevant communications data related to crypto activity. This will lead to an influx of text, image, and audio files containing crypto-specific terminology.
Most importantly, compliance teams must implement surveillance solutions that can support the wider scope of communications channels used to discuss crypto business. By partnering with vendors that offer compliance solutions for encrypted messaging apps and social platforms, firms can ensure they’re taking all steps necessary to manage complexities that come along with crypto landscapes.
- Building up crypto talent
Firms are beginning to recruit staff for digital asset management – and they’re not looking for your traditional compliance officer profile. Alongside existing compliance experts, firms are hiring software engineers and data scientists who can make sense of blockchain. New asset classes bring new challenges, and to prepare, it’s important to have comprehensive compliance programs that cover developing risk areas.
- Considering the benefits of AI-enablement
Since compliance teams need to be familiar with an increasing number of channels, they must contend with balancing resource versus spotting risk. Platforms like Discord and X have a high signal-to-noise ratio, which makes it even harder to separate true risk from irrelevant noise.
Crypto introduces a range of terminology and approaches that fall outside the scope of traditional surveillance lexicons, risk taxonomies, and capabilities. To effectively identify risk in these unknown territories, firms need to consider how artificial intelligence may be able to bolster their current compliance toolkits.
Crypto’s integration into traditional financial environments offers significant opportunities for innovation and accessibility among investors. To maximize this potential, firms must maintain oversight and control of all digital asset data, including communications, to ensure complete compliance.
The crypto landscape is evolving fast. To prepare, firms can implement futureproof capture and monitoring tools to help maintain oversight of crypto data as new channels and platforms become integrated into the financial industry.
