The stunning New York Times headline read: Crypto-Exchange Says It Can't Pay Investors Because Its C.E.O. Died, and He Had the Passwords. New York Times (Feb. 5, 2019). The article explained that the 30-year-old CEO of the Canadian cryptocurrency exchange, Quadriga CX, had “died suddenly while visiting India.” In court filings, the company announced that it could not pay back at least $250 million to clients, because the CEO was “the only person who knew the security keys and passwords needed to access the funds[,]” which were stored in an offline cold wallet (a physical receptacle). Id. Given the unusual circumstances, some questioned whether the CEO may have faked his own death to pull off some sort of exit scam. Id.

Welcome to the brave new world of cryptocurrency, where the Quadriga story serves as a cautionary tale, warding off the faint of heart from participating in this emerging marketplace.

Still in its relative infancy, the cryptocurrency industry presents exciting and outsized potential for growth. At the same time, however, it has also proven to be fertile ground for fraudsters and a trap for the unwary. Various government agencies claim jurisdiction to regulate at least portions of the space, but cryptocurrencies' unique qualities have presented challenges for comprehensive policing by any single existing agency.

There appears to be general agreement that cryptocurrencies are commodities, and thus properly covered by the Commodity Futures Trading Commission (CFTC). But the Securities Exchange Commission (SEC), too, has asserted jurisdiction over several types of crypto-based investment products, and has taken an active regulatory role over a subset of crypto-related products and service providers. Beyond these two agencies, the Financial Crimes Enforcement Network (FinCEN) has stepped forward, as have state regulators, most notably New York, through both the Department of Financial Services (DFS) and its Attorney General's office.

The most prolific of these agencies, in terms of issuing pronouncements and bringing regulatory and enforcement actions, has been the SEC, which has relied on existing federal securities laws, enacted largely in the 1930s. Whether those laws and the existing regulatory bureaucracy are sufficiently equipped to corral the crypto-markets remains to be seen. At least one Commissioner expressed uncertainty concerning “how existing rules apply in this space and whether a new regulatory framework would work better.” SEC News, Speech, Commissioner Hester M. Peirce, Regulation: A View from Inside the Machine (2019). Nonetheless, at least in the areas of initial coin offerings, crypto-exchanges, and crypto-broker dealers, the federal securities laws appear to offer some potential to bring order to this emerging medium.

This article briefly traces the advent of cryptocurrency and discusses various ways in which the SEC and other regulators have sought to protect investors so far.

The History of Cryptocurrency

The current cryptocurrency market consists of more than 1,500 distinct currencies, several of which are, at this point, fairly broadly traded—bitcoin being the most well-known. In 2009, Satoshi Nakamoto, said to be a pseudonym used by the creator(s) of Bitcoin, published a whitepaper setting forth his vision of a peer-to-peer electronic cash system. See Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2009). Bitcoin is a decentralized digital currency with no single administrator, central authority, or repository. See id. Bitcoin “require[s] minimal structure” without a central bank, in which transactions are “publicly announced.” Id. at 1-2.

Digital currencies like bitcoin exist on a public ledger, known as a blockchain, which records all transactions in that currency in the form of computer code. The cryptocurrency is stored in digital wallets and transferred over the internet. The blockchain was built to be impenetrable and immune to hackers (although recently, some have questioned whether that remains true). Unlike traditional cash, bitcoin exists in purely electronic form, and is produced through a digital computer process known as “mining,” by which complex mathematical problems are solved, typically by employing significant computer processing power. Also unlike Government-issued currency, the total amount of bitcoin (in particular) is capped by the algorithm created by Nakamoto.

Over the past decade, cryptocurrency creation, trading, and use has grown rapidly. Bitcoin's market price, in particular, has fluctuated wildly: as late as December 2016, it had never traded much above $1,000 per coin; then it rose rapidly to its all-time high of nearly $20,000 per coin a year later, before plummeting more than 50 percent in a month's time. As of this writing, a bitcoin sells for just under $4,000. With approximately 17.6 billion bitcoins in circulation, bitcoin's market cap is approximately $67 billion. By 2018, major financial institutions like Morgan Stanley announced that they would trade derivatives tied to bitcoin. See Bloomberg, Morgan Stanley Plans to Offer Bitcoin Swap Trading for Clients (2018).

Cryptocurrencies can also be used as tender for purchase and sale of real-world goods and services. Last year, Yahoo Finance reported that more than $3.2 trillion worth of bitcoin payments were processed.

SEC Regulation

In the last year or so, the SEC has taken several steps to attempt to regulate crypto-related business. Notably, these efforts have tended to focus on conduct that most readily fits within existing federal securities statutes and regulations.

(1) Initial Coin Offerings. In 2017 and 2018 alone, billions of dollars have been raised through Initial Coin Offerings (ICOs). As the SEC's Division of Corporation Finance Director William Hinman has declared: “in many cases, the economic substance [of an initial coin offering] is the same as a conventional securities offering” designed to raise capital. SEC, Hinman Speech, Digital Asset Transactions: When Howey Met Gary (Plastic) (2018). But also in 2018, the SEC issued a public warning that many ICOs may be frauds or may “present substantial risks for loss or manipulation, including through hacking, with little recourse for victims after-the-fact.” SEC Alert, Initial Coin Offerings (2018).

The SEC has issued disciplinary sanctions against multiple entities for engaging in unregistered offerings of cryptocurrency tokens in violation of §§5(a) and 5(c) of the Securities Exchange Act of 1934, taking the position that these offerings fall under the definition of “securities.” With few exceptions, the courts have backed the SEC on its view, applying the Supreme Court's “flexible” Howey test from 1946 to determine that the ICOs are investment contracts or securities, that is, whether they are (1) a monetary investment; (2) in a common enterprise; (3) with an expectation of profits; (4) derived from the efforts of a promoter or third-party. See SEC v. W.J. Howey Co., 328 U.S. 293, 298-99 (1946).

In the wake of these decisions, some companies that had engaged in unregistered ICOs chose voluntarily to subject themselves to SEC oversight. For example, last summer, Gladius Network LLC, which raised $12.7 million in an unregistered ICO, self-reported to the SEC and cooperated with an investigation. As a consequence, the company avoided the imposition of civil penalties.

In addition, the SEC has pursued celebrity promoters who touted ICOs without disclosing payments they received, under §17(b) of the Securities Act of 1933. For example, in November 2018, the SEC settled charges against professional boxer Floyd Mayweather Jr., and the musician DJ Khaled, for promoting ICOs without disclosing that they were compensated for their promotional activities. SEC Press Release, Two Celebrities Charged with Unlawfully Touting Coin Offering (2018). Mayweather disgorged $300,000 and paid a further $300,000 penalty, and DJ Khaled disgorged $150,000 and paid a $50,000 penalty. Id.

(2) Exchanges. The SEC has also taken aim at cryptocurrency exchanges and broker-dealers. In November 2018, the SEC settled charges against the founder of EtherDelta, a secondary market trading platform for ERC20 tokens, a blockchain-based crypto-token, for failure to register as a national securities exchange. In an 18-month period, EtherDelta's users had executed more than 3.6 million orders. In settling with the SEC, EtherDelta's founder agreed to pay $300,000 in disgorgement and a $75,000 penalty. SEC Press Release, SEC Charges EtherDelta Founder With Operating an Unregistered Exchange (2018).

(3) Investment Companies. Similarly, the SEC has used the Investment Company Act of 1940 to pursue funds that invest in cryptocurrency, citing that Act's registration, regulatory, and fiduciary requirements. For example, in September 2018, the SEC found that Crypto Asset Management (CAM) engaged in the business of investing, holding, and trading certain digital assets that the SEC deemed to be “investment securities.” Because CAM qualified as an investment company, but failed to register with the SEC, CAM was ordered to pay a $200,000 civil penalty. SEC Release, Order, In the Matter of Crypto Asset Management and Timothy Enneking.

(4) Exchange Traded Funds. SEC Chairman Jay Clayton has urged caution on the subject of cryptocurrency-linked exchange traded funds (ETFs), commenting in 2018 that there are still “a number of issues that need to be examined and resolved before we permit ETFs and other retail investor-oriented funds to invest in cryptocurrencies,” including “issues around liquidity, valuation and custody of the funds' holdings, as well as creation, redemption and arbitrage in the ETF space.” SEC News, Chairman's Testimony on Virtual Currencies: The Roles of the SEC and CFTC (2018).

Indeed, the SEC has now twice rejected the Winklevoss brothers' proposed bitcoin ETF, concluding that their proposal did not identify how it would comply with §6(b)(5) of the Exchange Act, which requires “that the rules of a national securities exchange be designed to prevent fraudulent and manipulative acts and practices and to protect investors and the public interest.” SEC Release No. 34-83723, Order (July 26, 2018).

And in February 2019, Reality Shares ETF Trusts, a division of Blockforce Capital, withdrew its proposed ETF registration “because the staff are still taking the position that it's not appropriate to file a registered [Investment Company] Act fund with cryptocurrency exposure at this time.” SEC Archives, Letter (Feb. 12, 2019); ETF Tied to Bitcoin Futures Withdrawn After SEC Staff Requests, Coin Desk (Feb. 13, 2019).

Nevertheless, the SEC is currently reviewing additional proposals for bitcoin ETFs, approval of which would allow cryptocurrency-linked ETFs to enter the markets.

Other Government Agencies

As early as 2013, FinCEN issued guidance on virtual currencies, taking the position that their administrators and exchanges are subject to the Bank Secrecy Act. In 2015, FinCEN brought its first civil enforcement action, fining Ripple Labs $700,000 for selling virtual currency without registering with FinCen and failing to implement and maintain an adequate anti-money laundering program.

Under the Commodity Exchange Act, the CFTC has brought enforcement actions against cryptocurrency trading platforms that facilitated the execution of illegal, off-exchange commodity transactions, and/or failed to register as futures commission merchants. See CFTC Press Release No. 7380-16 (June 2, 2016).

And New York's DFS has, among other things, adopted a plan to bestow its stamp of approval on cryptocurrencies it deems to be “price stable,” and issued more than a dozen “virtual currency licenses” or “BitLicenses” to businesses seeking to engage in crypto-related activity. See, e.g., Press Release, NYDFS Announces Approval of First Bitlicense Application from a Virtual Currency (2015); New York Department of Financial Services Issues 14th Bitlicense, Bitcoin Magazine (June 6, 2018).

New York's Attorney General has waded in as well, issuing a Report in September 2018 on a statewide Virtual Markets Integrity Initiative, the stated goal of which is to “address[] areas of particular concern to the transparency, fairness, and security of virtual asset trading platforms, and highlight[] key policies and practices of the [participating] platforms.”

Conclusion

The cryptocurrency space continues to grow rapidly, and multiple federal and state agencies are trying to regulate these evolving markets. It remains unclear which agencies are best suited for the task, and whether existing laws are well designed to protect the public from this market's inherent risks. The disclosure-based federal securities laws would seem to offer little protection to, for example, Quadriga's investors, assuming their losses truly resulted from the inadvertent loss of the access codes. For the mainstream investing public to feel comfortable wading in to the cryptocurrency markets with both feet, the industry may require a dedicated watchdog or oversight committee, rather than a patchwork of oversight from 20th century regulatory agencies.

Jason P.W. Halperin and David Siegal are members of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo's white-collar defense and government investigations group. Both are former federal prosecutors from the U.S. Attorney's Office for the Southern District of New York. Associates Ellen Shapiro and Matthew Novian assisted in the preparation of this article.