Renegade Pandas: Opportunities for Cross Border Cooperation in Regulation of Digital Assets

Remarks before the SUSS Convergence Forum: Inclusive Blockchain, Finance, and Emerging Technologies

Thank you, Robby [Greene], for that kind intro. I am delighted to see that Robby, once my research assistant, has clearly gone on to bigger and better things. I also am delighted to be here in Singapore, by some accounts the global crypto-hub,[1] and appreciate the hospitality of the Singapore University of Social Sciences. I am particularly grateful for the opportunity to learn about the developments in crypto in Asia, which, as I do not need to tell this audience, is home to a very active part of the crypto community. Before I get too far along in my remarks, I should note that the views I express are my own and not necessarily those of the United States Securities and Exchange Commission or my fellow Commissioners.

One view in which I am undoubtedly alone is my perspective on pandas. Black-and-white pandas are all the rage in the United States. They do look adorable, but I find them a bit pedestrian. Red pandas, the so-called lesser pandas, are much more interesting. Being in Asia brings me closer to red pandas’ natural habitat than I have ever been before, although I believe that the only red pandas in Singapore are residents of River Safari Wildlife Park. We also have red pandas back in Washington, DC at the zoo, and it was one of these red pandas that first sparked my interest in the species. Several years ago, one of our local red pandas, “Rusty,” made a daring break for freedom by climbing up a tree and out of his cage into the wide world beyond the zoo.[2] During his days of freedom, the renegade red panda developed quite a following, particularly after a Twitter account appeared in his name. As it turns out, Rusty was not alone among his brethren in his quest for freedom. A Google search for red panda escapes reveals something of a trend: red pandas have escaped from zoos in Virginia, Washington state, North Dakota, Australia, and Ireland, just to name a few. A few of these red pandas have been on the loose for quite some time. What a contrast red pandas offer to black and white pandas who sit comfortably within the view of the PandaCam[3] looking cute and munching on bamboo. Although I am not advocating zoo breaks, red pandas’ seemingly innate desire to explore the world outside the fences has an inherent appeal as a symbol of human innovation.

Innovators explore the world on the other side of the fences of conventional wisdom and experience by thinking about new ways to solve old problems. They find cheaper, better, safer, and faster ways to get things done. For regulators, such fence-jumping can be unwelcome. It is easier to deal with entities that we know doing things in ways with which we are familiar than to confront new technologies with new players and think about how those technologies and market participants fit within our regulatory scheme. We would rather turn on the PandaCam to get a glimpse of the staid and predictable black-and-white pandas than head into the outside world to see what those adventurous red pandas are up to. Yet, innovation in blockchain and cryptocurrency has forced us to look beyond the PandaCam and challenged us to think about how better to accommodate innovation in general. Because so much of the activity is taking place outside the United States, we have to think about our regulation with a sensitivity for cross-border considerations, cooperation, and what I call co-learning.

The challenges of cross-border regulation are, of course, not new at all, but they have accelerated over the years as technology has facilitated the integration of our world, and with it, the financial markets. Although there have been overseas investors in American markets since the colonial period, more recent innovations in technology—especially the internet—have greatly facilitated the integration of our world. Cross border transactions now occur almost instantaneously, without either party ever leaving its own country’s shores. In 1987, then Acting SEC Chairman Charles Cox testified before a congressional subcommittee, “[a]s a result of a number of factors, including technological advances and the removal of restrictions on foreign participation by many of the world’s securities markets, internationalization is more than a developing trend, it is a present day reality.”[4] A law text from 1991 remarks on the increased globalization of the capital markets facilitated by “fiber optics, the microwave relay, and the satellite[.]”[5]

Today, more than 800 foreign issuers are registered with the SEC. Foreign investors regularly deploy their assets to fund U.S.-listed companies, foreign companies come to the U.S. to raise funds, and U.S. investors proactively seek opportunities for portfolio growth and diversification in markets overseas. Investment advisers, broker-dealers, clearinghouses, and trading venues from outside the U.S. serve clients in the U.S. In addition, our derivatives markets are global; companies using derivatives markets to manage their risk routinely transact with counterparties based in another country. Our regulation of companies based in other jurisdictions has required both the U.S. Congress and the Commission to think through how our rules can and should apply to companies wishing to access our capital markets. In some cases, we have simply required that any company, foreign or domestic, that wants to solicit investment in the U.S. to comply with the same set of rules. This approach is not always appropriate, however, and so we have, in other cases, exempted certain foreign issuers from our registration requirements, as in the case of the exemption available under Regulation S for foreign private issuers, or permitted them to use different standards, as in the case of permitting them to file financial statements using IFRS instead of U.S. GAAP.

Regulators’ concerns today about the cross-border regulation of digital assets in many ways mirror concerns they have more generally in regulating cross-border market activity. These concerns include the fear that we will not be able to examine foreign entities registered to operate in our markets and, more generally, that our ability to enforce domestic rules will be stymied by our inability to regulate outside our borders. We also think about whether the application of our regulatory framework matches investor expectations. If the investors, the platforms on which they are transacting, and the companies in which they are investing are all operating in one country, the investor knows which country’s rules apply, but things get more complicated when multiple jurisdictions are involved. Another regulatory concern is understanding which assets will be available to meet domestic obligations if a foreign entity fails and what rules will govern the wind-down of the institution and protect any affected investors.

The cross-border regulatory concerns in crypto track these standard concerns, but are magnified for several reasons. First, countries all over the world are still in the early stages of determining how and whether to regulate crypto. Uncertainty about what the rules in any particular country are makes a determination of which country’s rules apply even more difficult. Second, much of the allure of cryptocurrency is the ability to join people from all across the world in common enterprises, which makes pinning down a domicile for these enterprises difficult. Third, the precise nature—currency, commodity, security, derivative—of many of the assets at issue is difficult to determine. Accordingly, academics and regulators are thinking through cross-border questions in the digital asset context.[6]

To address cross-border regulatory concerns, regulators have had to follow the lead of the markets and work with their foreign counterparts. The International Organization of Securities Commissions, a consortium of many of the world’s securities regulators, was formed in the 1980s and provides a forum for national securities regulators to share information and discuss policy goals across international borders.[7] The Organization for Economic Cooperation and Development, which was formed shortly after World War II, has also turned its attention to the implications of cross border regulation in the wake of technological innovation.[8] Since the 2007-2009 financial crisis, the Financial Stability Board has facilitated communication and joint exploration of market and regulatory issues by member countries.[9] These organizations have recently taken up the question of how best to coordinate regulation of digital assets and distributed ledger technology.

International communication and internationalization of markets need not lead to the internationalization of our regulations. Absent an explicit decision by citizens of a jurisdiction to cede their regulatory authority to an international organization, a jurisdiction should determine what rules work best for its investors and markets. We can look to our fellow regulators for shared consideration of difficult issues and coordination, but not for regulatory directives. In the case of the developing realm of digital asset regulation, many countries are working on regulatory frameworks to address the novel challenges these assets present. Although the existence of many jurisdictions can create regulatory friction, it also can create regulatory competition, which is healthy because it enables us to learn from one another.

This competition, and the opportunity to develop multiple regulatory solutions to a single problem, is a feature of the United States’ own system. As a federation of sovereign states, we have fifty states, plus several territories and the District of Columbia, that create their own laws and own regulatory regimes. In the U.S., we often refer to our states as “laboratories of democracy.” Instead of implementing all policy at the federal level, different states try different policies. Policies that prove to be highly effective can serve as models for federal-level policy, and can inform the development of policy by the other states. Sometimes a regime that is effective for a particular state, however, is not as desirable in other parts of the country, because of differences, for example, in culture, demographics, economy, or size. There are difficulties when state laws conflict, and it is burdensome for a cross-border enterprise to comply with several states’ laws. We have seen the difficulty in the digital asset space as companies have to comply with a multiplicity of state money transmission laws. That said, the benefits of our system typically outweigh the costs. When the costs overwhelm the benefits, Congress sometimes preempts state law. Hence, while we have state securities law, their reach is curtailed by preemption, which leaves the SEC’s rules as the only rules in certain contexts.

Just as states take different approaches and learn from one another in the U.S., crypto regulation affords international regulators the opportunity to learn from one another. I often have expressed my concern that the U.S. will fall behind other countries in attracting crypto-related businesses unless we are more forward-leaning in establishing a regulatory regime with discernible parameters. The U.S. SEC can look to our counterparts overseas for ideas in untangling some of our most difficult legal and policy questions in this area. Other countries, the citizens of which are already actively trading and using crypto currencies, are confronting the same questions we are as they create their own regulatory regimes.[10] The resulting regulatory competition will allow us to see what works well and what does not work at all. My fondness for competitive markets extends to regulatory markets.

As I have expressed elsewhere, I would like to see more focused momentum at the U.S. SEC toward finalizing our regulatory regime for digital assets. We have not been sitting idle, however, and I would like to take a few minutes now to outline the steps we have taken. The most basic, but essential, of these steps is our efforts to understand digital asset technology and markets. We established a Strategic Hub for Innovation and Financial Technology, known as FinHub, which coordinates our approach to digital assets. FinHub staff have met with hundreds of market participants to hear what they are working on and where they need regulatory clarity. At the end of May, FinHub held a one-day FinTech Forum to consider issues arising in several key areas of securities law: capital formation, secondary trading and markets, and investment management. The participants explored and provided us with market insight into how initial coin offerings (ICOs) proceed, what issues auditors face in auditing digital assets, how brokers can think about custody, and what investors might consider in deciding to buy digital assets.[11]

One of the peculiarities of the U.S. system is the sheer number of regulators. Not only do we have the state-federal allocation of responsibility that I just mentioned, but we have multiple federal financial regulators. The SEC regulates only securities; other agencies regulate commodities, currencies, many derivatives, and bank products. Even the federal securities space is shared with a quasi-private regulator, the Financial Industry Regulatory Authority (FINRA), which regulates broker-dealers, and with other non-governmental regulators.

Another notable feature of U.S. law is that the definition of what constitutes a security is a bit nebulous. Unlike many other countries, we do not have an exclusive list of what counts as a “security.” The term of course includes stock, bonds, debentures, notes, puts, calls, and other classic “security” instruments, but it also includes “investment contracts.”[12] The courts have defined the investment contract category of securities by considering whether it encompasses particular assets presented in litigation. In the grandfather of these cases, SEC v. Howey, our Supreme Court established a test for determining whether something was an investment contract and therefore a security under our laws. Howey involved interests in an orange grove, so it is clear that an instrument need not look, smell, or taste like a traditional security in order to be deemed one by our laws. Under Howey, something—including something that is a digital asset—is a security if it involves an investment in a common enterprise with an expectation of profits derived solely through the efforts of others.

In July 2017, six months before I joined the Commission, the SEC issued a report on its investigation of the DAO, a decentralized autonomous organization, which had sold digital assets with the intention of using the proceeds of those sales to fund projects, the proceeds of which belonged to token purchasers.[13] The DAO’s Curators would review proposed projects and create a whitelist. Token purchasers could vote to select which of these approved projects should be funded, using the proceeds from previous DAO projects. The Commission concluded that in selling these tokens, the DAO had conducted an unregistered securities offering in violation of our federal securities laws because the tokens were securities under Howey. Subsequent enforcement actions involving unregistered offerings of digital tokens have repeated the reasoning of the DAO report with more serious consequences for the token projects at issue.[14] Other enforcement actions that have focused on fraudulent, rather than simply unregistered, offerings should help the development of the digital asset sector by discouraging people from riding the crypto wave to defraud people.[15]

In April of this year, the staff issued a statement outlining a framework for analyzing whether a digital asset may be an investment contract and thus a security under our law.[16] The framework includes a lot of factors that someone contemplating a token offering can consider in making this determination. Last month, the SEC staff issued a second guidance document, this time joint with FINRA. Whereas the earlier guidance document addressed the question of when a digital asset may be a security, the more recent guidance considers the questions of how digital asset securities can be custodied in accordance with our rules, how customers who own such securities can be adequately protected, what specific challenges secondary trading may present, and how broker-dealers who hold digital asset securities can comply with other regulatory requirements, such as maintaining proper books and records.[17] While many of these questions remain unanswered, the guidance may help to crystalize the outstanding issues for those in the market who are actively pursuing solutions.

The staff has shed some more proactive light on how token offerings can occur within the confines of our existing regulatory framework. Earlier this month, the staff qualified two token offerings under Regulation A+, a streamlined approach to conducting a public offering.[18] The staff also issued two no-action letters, in which the staff pledges not to recommend enforcement action by the Commission in connection with two token offerings.[19] The conditions that constrain this no-action relief are quite restrictive and the relief is specific to the tokens at issue. FINRA, our partner regulator for broker-dealers, recently approved applications for two non-custodial digital asset broker-dealers, and has indicated that additional approvals could come.

The U.S. SEC is not the only regulator tackling these questions. Singapore, as you likely know better than I do, has been at the forefront of much crypto-related activity, which may be attributable to the clarity it has offered to issuers in this market.[20] In a recent paper, Robby Greene and Professor Lee described the link between the clarity of Singapore’s regulatory approach and the leading role Singapore plays as a home to digital asset projects, including notably a relatively high proportion of projects that “have resulted in operational networks or minimum-viable-products.”[21] Elsewhere in Asia, regulators have found paths to drawing digital asset offerings into their countries’ regulatory frameworks. Thailand established a regulatory framework in 2018 specifically for digital assets.[22] This framework designates some digital assets as cryptocurrency and some as digital tokens, which function like securities, depending on how they are used. Those serving as digital asset brokers, exchanges, or dealers must, in general, obtain a license and comply with specific regulatory requirements. Japan has recently passed legislation to bring securities offerings of digital assets within its existing legal framework for securities offerings.[23] This follows its 2017 adoption of a registration regime for cryptocurrency exchanges. In Hong Kong, the Securities and Futures Commission has released guidance stating that security tokens are “likely to be ‘securities’” under Hong Kong securities laws, which is similar to the approach we have taken so far in the U.S. Hong Kong, however, also has issued a circular requiring funds – the virtual currencies of which exceed ten percent of aggregate assets – to be licensed by the SFC, and another which places cryptocurrency trading platforms within a regulatory “sandbox.”[24]

In Europe, Malta, a relatively early adopter of crypto regulation, passed legislation in 2018 that separates digital assets into unregulated virtual tokens and regulated Virtual Financial Assets.[25] Switzerland also acted early; it provided preliminary guidance for ICOs in 2017 and issued more detailed guidance in 2018.[26] France recently announced a new licensing regime for initial coin offerings and digital asset service providers.[27] This regime is optional for some activity, but mandatory for providers of digital asset custody services to third parties.[28]

Bermuda is one of the only jurisdictions to address the custody question in detail. In conjunction with a regulatory regime for digital asset businesses, the island also released draft guidance for crypto custodial services, which addresses such difficulties as how to store private keys for hot and cold storage while preserving necessary liquidity, what safeguards should be in place to prevent unauthorized access, and how to frame internal audit of transactions to ensure their integrity.[29]

These “laboratories of regulation” operated by our international counterparts have me thinking about possible paths for the U.S. to become more welcoming of crypto innovation. After all, we need some red pandas in the United States too! I look forward, for example, to learning more about Bermuda’s custody framework to see if we can draw from it as we think about how our custody rules apply in the crypto context. Motivated in part by the approach taken by Singapore, which does not treat every token offering as a securities offering, I would support the creation of a non-exclusive safe harbor for the offer and sale of certain tokens. As the SEC’s Director of the Division of Corporate Finance, Bill Hinman, pointed out in a speech in June 2018, if a token network were to become sufficiently decentralized, tokens that were issued as securities might then become non-securities “utility” tokens.[30] It is not clear, however, how this transition could happen if the tokens were initially offered as securities. How could decentralization be accomplished? For tokens that are designed to serve as an alternative method of payment online or as utility tokens, deeming every sale of a token, including transactions in which tokens are used to compensate developers, to be a transfer of a security would almost surely eliminate the possibility that a transformation to a functioning network could occur. As Greene and his coauthors point out, “[o]pen digital token offerings facilitate participation in open-source software development and create a sense of empowerment and ownership, thus mobilising programmers to test and improve underlying software.”[31] That kind of empowerment is difficult when token distribution is constrained by the securities laws.

A non-exclusive safe harbor would permit issuers to offer tokens under an alternative regime with robust requirements. The relief could be time-limited to guard against reliance on the safe harbor by projects without a workable plan to build operational networks. The requirements would be tailored to the needs of purchasers digital assets in a way that our current regulations are not. Trading to get tokens in and out of the hands of developers and users would be permitted. Disclosures important to purchasers of tokens intended for use in open-source networks are likely to differ from disclosures important to purchasers of common stock. Professor Chris Brummer, among others, has pointed out that the information that token purchasers want is not necessarily the same as the information the securities laws would give them.[32] Legislative proposals to exempt token offerings from the securities laws also recognize that the securities framework may not be the appropriate one for all tokens.[33]

A token offering made in reliance on the safe harbor would have to comply with certain requirements—for example, providing clear disclosure of the assets’ functionality, including the mechanisms for changing holders’ rights and explaining how funds are to be used—before the issuer could use the safe harbor. At the SEC staff’s recent FinTech Forum, one of the participants explained the types of disclosures that are particularly relevant in the digital asset context: how many tokens have been issued, what the process is for issuing more, and how to address inconsistencies between a plain English description of the tokens’ functionality and the functionality as written in the code.[34] Such a safe harbor would be non-exclusive, meaning that an offering that did not meet its requirements might still comply with other of our rules, such as our private placement exemption. This concept is very preliminary and needs a lot more work, but it might be a way to ensure that the legal regime does not inadvertently choke token networks off before they get off the ground.

Whatever direction we go in the United States, continued communication among the world’s financial regulators will be important. While I believe a single global regulatory framework would be unwise, regulators can create a healthy environment for this new market to grow by sharing information that will smooth cross-border transactions while stamping out fraud and other harmful activity. We also can continue to learn from one another to fill the gaps in our own regulation and borrow, when appropriate, from frameworks developed and tested in other places.

Thank you all for being here today to think through some of the issues surrounding recent technological innovations. Having the opportunity to meet with innovators has been one of the highlights of this job. Indeed, just yesterday, I met with a number of crypto projects here in Singapore and with regulators and innovators from the region thinking about how to regulate and use blockchain technology. I welcome others to visit me in Washington, D.C. I greatly enjoy hearing about the work of traditional market participants, but the red pandas—the people who are constantly hopping outside the fences of conventional thinking—make the life of a regulator especially interesting.