USING CYBERSECURITY FAILURES TO CRITIQUE THE SEC'S APPROACH TO CRYPTO REGULATION.

• Author: Goforth, Carol R.

1. INTRODUCTION 434 II. THE RISKS OF INVESTING IN CRYPTO 438 III. WHAT IT MEANS FOR CRYPTO TO BE A SECURITY 445 A. INFORMATION REQUIRED IN AN INITIAL PUBLIC OFFERING 447 B. INFORMATION REQUIRED FOR REG. A 449 C. OFFERING INFORMATION REQUIRED FOR REG. D, RULE 506 451 D. WHO IS THE ISSUER OR REGISTRANT FOR CRYPTO? 454 IV. DO CURRENT DISCLOSURE REQUIREMENTS FAIRLY AND 457 ADEQUATELY PROTECT CRYPTO INVESTORS? V. RECOMMENDATIONS 463 VI. CONCLUSION 466 I. INTRODUCTION

   The Securities and Exchange Commission ("SEC") describes its mission as being "to protect investors; maintain fair, orderly, and efficient markets; and facilitate capital formation. The SEC strives to promote a market environment that is worthy of the public's trust." (1) In recent years, in furtherance of these objectives, the SEC has taken a particularly proactive stance regarding the regulation of transactions involving the sale of cryptoassets. (2)

   The SEC's concern in this area is clear. Crypto is an emerging technology that has captured the public's interest. (3) At the same time, it both involves relatively large amounts of money (4) and has significant potential for fraud and abuse.

   The first warning from the SEC about crypto appeared in mid-2013, when the SEC posted an alert warning investors that some virtual currencies were being used in Ponzi schemes. (5) In May 2014, the SEC published a second alert, warning potential investors about extensive risks associated with investment in bitcoin and other virtual currencies. (6) The SEC continues to warn investors about a wide variety of risks associated with investments in crypto. (7) Given the amount of money involved and the extent of fraudulent activity, it is perhaps not surprising that the SEC has insisted on treating most offerings of crypto as involving the sale of securities. (8)

   While this is an evolving regulatory system, pronouncements from the SEC have not been particularly encouraging to crypto entrepreneurs. (9) For example, in early 2018 SEC Chairman Jay Clayton repeatedly noted that he had not seen an ICO (initial coin offering) that did not involve the sale of securities. (10) This position was moderated somewhat by later remarks to the effect that bitcoin and ether might have ceased to be securities, primarily by virtue of how widely dispersed their ownership has become." Even more recently, the SEC released guidance suggesting that there could be circumstances when other cryptoassets are not securities, (12) accompanied by a no action letter concluding that a proposed sale of tokens by TurnKey Jet would not involve the distribution of a security. (13) While helpful to those interested in compliant innovation in the crypto space, this SEC guidance is far from a panacea, especially given the lack of clarity in the numerous factors listed in the guidance and the extremely unusual facts of the TurnKey situation. (14)

   Classifying crypto as a security under current rules means that issuers are subject to burdensome disclosure and reporting obligations. (15) The securities rules limit to whom cryptoassets may be sold and potentially to whom they may be resold. (16) In fact, compliance is so burdensome that the existing regulatory paradigm runs the risk of stifling desirable innovation. (17) This is especially likely given the regulations imposed by other federal agencies such as the I.R.S. (which classifies crypto as property rather than a security), (18) the Commodities Futures Trading Commission ("CFTC") (which says crypto is a commodity), (19) and the Financial Crimes Enforcement Network ("FinCEN") (which treats crypto as a virtual currency). (20) This does not even consider the involvement of state securities and financial authorities, many of which also regulate crypto. (21)

   This article suggests that the SEC's continuing focus on regulating crypto as a security under current rules is not efficient or effective, given the agency's mission and the actual sources of risk to investors. Part I of this article begins with a brief assessment of the primary risks associated with purchasing cryptoassets, with a particular focus on the consequence of failures of cybersecurity in the crypto ecosystem. Part II considers what it means for crypto to be regulated as a security under the SEC's current disclosure paradigm and examines the kind of information currently required for securities transactions. Part III evaluates the extent to which the current regulations fairly and adequately protect investors from the actual risks of crypto investment. The Conclusion and Recommendations section explains briefly the direction that efforts at reforming the federal securities laws should take.

2. THE RISKS OF INVESTING IN CRYPTO

   No one disputes that there are risks associated with the decision to buy most forms of crypto. For persons investing in crypto with the hope that they will turn a profit, the biggest risk is probably market volatility and uncertainty. (22) Crypto pricing swings are so great that "four years of volatility in the stock market can be covered in a month of pricing movements in the cryptocurrency markets." (23) It is true that volatility is gradually decreasing, (24) but average daily fluctuations with crypto pricing continue to be the largest in the financial markets. (25) This volatility means that it is incredibly easy to lose money when investing in crypto. In fact, one source suggests that Americans lost $1.7 billion trading bitcoin in 2018 because of market volatility. (26) Even commentators who find volatility to be an important and potentially attractive attribute of the crypto market note that it means crypto is an inherently risky investment. (27)

   While volatility is not synonymous with risk, it contributes to risk in significant ways. (28) In essence, volatility means that there are potentially greater losses but concomitantly there are potentially greater returns. (29) Volatility puts an asset "higher on the risk/reward spectrum." (30)

   The causes of the volatility are unclear. One possible contributing factor is the SEC itself, with its varying pronouncements in regard to crypto. (31) Other potentially confounding factors include uncertainties caused by actions of the community that could lead to forks, (32) the relatively small markets for most forms of crypto, (33) and the possibility of intentional market manipulation. (34) Doubtless, general economic conditions also have an impact on crypto pricing. None of these are in the control of or are particularly predictable by companies involved in the creation and marketing of new cryptoassets. Ironically, the SEC itself is likely to be in the best position to report on likely future regulatory developments and to evaluate and report on widespread market manipulation, given its focus on market integrity. The SEC is also more likely to collect and evaluate such data than any individual crypto business (other than ones that might be engaged in manipulation, who are quite unlikely to disclose that activity). Even if the SEC declines to undertake the responsibility for warning of all of these risks, there is nothing to suggest crypto issuers are a particularly appropriate source of information or warnings involving these risks.

   Another potential risk associated with crypto is caused by con artists who advertise fraudulent offerings when they have no intention of selling a real token or when they falsify existing or planned token characteristics. (33) For example, an ICO that was supposed to raise $1 billion for the world's first "decentralized bank" turned out to be a multi-million dollar scam that was halted by the SEC. (36) A particularly common tactic appears to be marketing tokens by falsely claiming that the SEC or other regulatory authorities have approved the token or offering. For example, the Blockvest ICO was shut down in late 2018 for falsely claiming that it had received regulatory approval from various agencies including the SEC as well as a made-up authority. (37) Other offerings making similar claims have also been halted by SEC action. (38) In addition, the SEC has intervened to stop ICOs because of outright lies about the capabilities of the token or the nature of the offering. (39)

   Note that a disclosure paradigm does not really solve the problems posed by these kinds of offerings any more than it addresses the risks of market volatility. The masterminds behind fraudulent ICOs do not attempt to comply with the mandated disclosures. Instead, they simply make up information that "looks good," such as false claims about regulatory compliance (40) or fictitious rates of return. (41) Mandating any particular disclosure is unlikely to affect this kind of behavior, as it is as easy to make up biographies and market share information as it is to lie about other things.

   Nor are particularized disclosure obligations necessary in order to hold this kind of bad actor liable. Even without specific disclosure mandates, in order to market fraudulent tokens non-compliant issuers still have to create an interest in their product. That means they will be intentionally disseminating false information. In fact, this kind of behavior occurred before it was clear that the SEC would regulate crypto as a security. (42) The problems associated with these fraudulent offerings can be addressed by the SEC actively providing information to the public in the form of advisory notices and warnings, by SEC (or CFTC) (43) intervention when there are fraudulent claims made in connection with sales efforts, and by private causes of action for fraud. (44)

   Aside from losses associated with market volatility and fraudulent offerings, many of the biggest losses associated with bitcoin and other cryptoassets have involved failures of cybersecurity including failure to observe reasonable restrictions on access to data and the presence of bugs or errors in the software protocols underlying particular blockchains that have led to hacking...