FTX: Global Comparisons on Crypto Exchange Regulations

Globally, regulation in the world of crypto is in its infancy. Governments are still so far behind the curve that some regulators have yet to settle on basic legal definitions of digital assets. Are cryptocurrencies actually currency? Are they securities? Are crypto exchanges like FTX more closely related to the New York Stock Exchange or to Western Union? What about other kinds of tokens, smart contracts or crypto derivatives? 

Thomas L. Friedman declared in 2005 that the world was flat. Science has repeatedly proven this assertion incorrect, but what about the world of digital assets? Technological advancements in the 20th and early 21st century had provided humanity surprising new levels of globalization and interconnectivity. A more level economic playing field was here, providing opportunities for anyone with an internet connection to participate in global commerce. Now, supporters of Decentralized Finance (DeFi) want to see even more barriers to individual participation brought down. With the numerous and expansive promises of distributed ledger technology, the ability for the average person to make payments, trade assets, enter into contracts and self-govern their pocketbook could be reaching new heights. The latest crypto debacle, however, has proven (again) that despite this bounding enthusiasm for deregulation and an even playing field, the world of digital assets is still quite round. The recent collapse of FTX put a damper on an already depressed crypto economy. The shuttering of the business cast a gloom across the globe as users saw their wallets frozen and their assets erased. The worldwide cries for investigation and remedy must, therefore, prove that we are all riding on a turtle’s back, a flat economic disc. How can we be certain the crypto world is round?  

Shadows

Just like the obelisks in Ptolemaic Egypt, the length of the shadow cast by FTX varies depending on where you stand. Early filings submitted by the interim CEO responsible for navigating the bankruptcy proceedings described FTX as being four large silos of assets and a web of more than 100 corporate entities. While this corporate structure was surely a mechanism to conceal and assist in the perpetration of the alleged fraud, it was also necessary for another purpose.  

For FTX, expanding into new jurisdictions sometimes required acquiring another organization that had already jumped the applicable regulatory hurdles. A new facet of the parent organization would be created to operate in the new sphere. FTX operated in the United States under FTX USA (later FTX US Derivatives), in Japan as FTX Japan, in the European Union under FTX EU and elsewhere using similarly named organizations.  

These FTX subsidiaries are an excellent case study in how various regulatory schemes are working to protect individuals and prevent fraud. With currently available information, before FTX collapsed, the largest portion of FTX.com traffic came from South Korea (~8%) and, in close second, Japan. FTX.com did not include FTX US traffic. Comparing the approaches of South Korea, Japan and the United States offers some insight into how regulators can protect customers looking to dip their toes into owning and trading digital assets through centralized crypto exchanges. 

South Korea

Despite a long history of cryptocurrency use in South Korea and an existing (though patchy) regulatory framework, customers and investors in Korea suffered the most from the collapse of FTX.  
Crypto policy in South Korea is developed and circulated by the Financial Services Commission (FSC), with the Financial Supervisory Service (FSS) responsible for directly supervising and overseeing institutions.  

Prior to FTX, the FSC in 2022 was already creating a new regulatory framework due to the recent collapses of Terra-Luna and Celsius. In February 2023, the FSC published new guidelines for which digital assets will soon fall under the country’s existing capital markets rules. These guidelines are a teaser for the soon-to-be-released Digital Asset Basic Act (DABA), a comprehensive legislative framework for “security tokens”: blockchain-based iterations of traditional securities.  

The FSS was already responsible for cryptocurrency exchange regulation, which requires government registration and monitoring under The Act on Reporting and Use of Certain Financial Transaction Information, which was fully realized in 2021. South Korea was an early advocate for crypto, with exchanges existing in the country as early as 2013. Generally, crypto exchange regulations disallow anonymous account holders and require exchanges to contract with local Korean banks to provide exchange users with Korean currency withdrawal/deposit accounts.  

Digital assets in Korea are separated into two buckets for regulation, those that resemble securities and those that do not. Security-like tokens will be regulated under the existing Capital Markets Act (CMA) like all other securities, while the non-securities will see additional regulation from the DABA. Interestingly, taxation of crypto trading profits was slated to begin in 2022 but has been postponed.

Proposed future regulations include partitioning of customer and corporate funds, better management over the issuance and listing of digital assets and more protections for investors.  

Japan 

FTX purchased an existing crypto exchange called Liquid in 2022, co-branding FTX Japan around the already established organization. The purchase was necessary for FTX to access Japanese customers without going through the laborious process of creating a fresh exchange within the Japanese regulatory framework.  

By all accounts, FTX Japan customers seem to have fared the best in the aftermath of FTX. While the entirety of FTX shut down in late 2022, FTX Japan communicated early and often that it maintained a significant amount of customer funds and would be able to return customer assets sometime in the future. While FTX Japan remains under a business suspension order, as of February 21, 2023, withdrawals for FTX Japan customers were once again possible through the Liquid side of the house. Japan’s crypto regulation has proven itself to be robust, with significant safeguards in place to prevent citizens from losing everything. Unfortunately, this was not foresight, but lessons learned the hard way.

Similar to South Korea, Japanese citizens and regulators were friendly to cryptocurrency earlier than most. Early adoption in Japan, however, was marred by some of the more well-known and damaging crypto failures. Two exchanges based in Tokyo, Mt. Gox in 2014 and Coincheck in 2018, were host to dramatic hacking scandals and the loss of significant amounts of customer funds, both in fiat and digital currency. These setbacks led Japan to establish one of the most robust crypto exchange customer protection schemes around.

Established by Japan’s Financial Services Agency, the Crypto Asset Exchange Service rules govern businesses that engage in buying, selling or exchanging cryptocurrencies and specific varieties of tokens. Cryptocurrencies are not treated as securities or as fiat currency but have their own definition and regulatory treatment. Under the Financial Instruments and Exchange Act, digital assets that are more akin to securities are separately regulated and require additional business registration as a financial instruments business. 

Crypto exchanges are required to register with the Japanese Financial Services Agency and are overseen by the Virtual and Crypto Assets Exchange Association. This self-regulating organization requires:

• Association approval before new crypto assets can be traded. 
• Full separation of exchange and user assets in different wallets. 
• 95% of customer’s crypto assets stored in cold (offline) wallets. 
• For the 5% in hot wallets, the user assets in those wallets must be backed by exchange assets in separate, cold wallets. 
• User fiat currency entrusted to the exchange must be entrusted to a third party Japanese institution. 
• Annual audits of fiat currency and crypto assets by an accounting or auditing firm. Adherence to strict regulations on advertising and solicitation. 
• Internal control systems. 

With such stringent rules on crypto exchanges, it is little wonder why FTX customers in Japan aren’t looking at a total loss. Every new bit of information from FTX proceedings suggests that the primary takeaway for customers and regulators was misappropriation of customer funds and a fable on the ills of comingling assets. Whether this strict regulatory environment is a damper on the trading of digital assets more broadly is an interesting question, and likely the kind FTX customers in other countries care little to answer when their balances remain at zero.  

United States

FTX US was launched in 2020 and acquired LedgerX in 2021 to expand its offerings from traditional crypto to crypto futures and options trading. In January 2022, after a round of funding from investors, FTX US claimed it was valued at $8 billion.  

The United States has no formal federal regulatory scheme specifically for digital assets or crypto exchanges. So far, virtually everything crypto related has been carved out by one of several federal agencies and pressed into a previously existing definition or regulatory schema. Since 2013, cryptocurrency exchanges have been designated as money services businesses (MSBs) by the U.S. Financial Crimes Enforcement Network (FinCEN). This designation requires that the exchange verify the identity of customers looking to use the exchange through a variety of means. More recently, the Infrastructure Investment and Jobs Act of 2021 provided that anyone who transfers digital assets on behalf of another person is considered a broker and must file tax forms for each customer with the IRS. Further, exchanges must report transactions involving over $10,000 in digital assets, similar to cash reporting requirements under existing anti-money laundering regulation.  

Coin or token offerings in the U.S. have continually run afoul of securities reporting requirements overseen by the Securities and Exchange Commission (SEC). The SEC has successfully argued in numerous federal jurisdictions that the particular coins or tokens at issue are securities based on legal tests established by the U.S. Supreme Court.  Since there is no legislation categorizing digital assets or specifically outlining what types of digital assets fall under what definitions, the SEC must prove in each case that the specific digital asset is a security. Once the SEC meets that burden, the digital asset is treated as any other security, requiring registration with the SEC and significant regulation and oversight.  

In contrast, the Commodity Futures Trading Commission (CFTC) considers many digital assets or derivatives of crypto to fall under its regulatory domain. The CFTC generally has authority over derivatives, such as swaps, futures, or options, including derivative contracts that reference digital assets. In 2016, the CTFC stated succinctly that “bitcoin and other virtual currencies are encompassed in the definition [of commodity] and properly defined as commodities, and are subject as a commodity [to CFTC regulation].” The CFTC generally handles enforcement actions related to fraud or market manipulation, and only provides oversight or registration requirements when offerings on margin or with leverage are involved. For FTX, these kinds of derivatives on crypto was a big part of their business plan. The purchase of LedgerX was an effort to acquire a CFTC Designed Contract Market, Swap Execution Facility and Derivatives Clearing Organization designation to provide U.S. customers with those kinds of offerings. 

With no overarching regulatory framework and a battle of definitions raging between agencies over digital assets that continue to evolve, the U.S. approach to exchange regulation compares poorly. While there has been progress on forcing exchanges to comply with know-your-customer and anti-money laundering requirements, most crypto related activity is on the enforcement side. Agencies and prosecutors are chasing assets that have long since left customers’ wallets and could ultimately be untouchable and left to rot in closely monitored wallets. While other countries are looking at overhauling or expanding exchange rules to protect customers, the U.S.’s primary focus seems to be on making sure digital asset profits are taxed. 

The Need for Regulation

With the continued expansion of DeFi and distributed ledger technology, calls for and against regulation of cryptocurrencies and other digital assets have similarly grown. Sam Bankman-Fried himself was a vocal proponent of crypto regulation until FTX imploded. During the course of the collapse, messages from the maligned CEO suggested his “effective altruism” and friendliness towards regulators was all a façade, just “PR.”  

The individuals and organizations who suffer losses investing in digital assets certainly want (retroactive) regulation. Even as FTX filed for bankruptcy, individuals who found themselves locked out of the exchange took to social media, questioning why no investigations were being done and why no one was being prosecuted. The fact that these individuals had wired money to a foreign, privately held company operating in a realm popular specifically for its lack of regulation was simply not pertinent. When crypto is booming, the call for oversight dwindles and apparently no one pays taxes on crypto gains. Questions remain on whether governments should be getting involved and bailing customers out when they work so hard to skirt already established regulatory structures. China, for instance, has a standing ban on cryptocurrency, despite significant amounts of cryptocurrency being mined in the country. If governments do step in and regulate the world of crypto to the extent that they regulate traditional banks and exchanges, would crypto survive? 

For fraud examiners, the kaleidoscope of existing and proposed regulation will be a constant source of consternation. Some of the regulations will be very familiar: know-your-customer (KYC) and anti-money laundering (AML) rules, capital reserve requirements, internal auditing requirements and, topically, rules against the comingling of digital assets. The constantly evolving array of coins and tokens, novel legal definitions and new ledger technology, however, could dissuade even the savviest from dipping their toes into crypto investigations. Finding fraud, however, still seems as easy as keeping a pet rock alive.