7 ms·

New York to Bitcoin Startups: Get Permission

64 points by starkness 12y ago

Aerospark 12y ago
Looks like California is about to get a huge influx of bitcoin entrepreneurs...
DickingAround 12y ago
Does anyone else wonder if this is more of a go-for-it-all-and-negotiate-back-to-reasonable sort of attack on bitcoin? He can't really want what he's proposing; banks don't even ask for government approval when they launch new features. So the only thought is that he either doesn't want bitcoin at all or he wants to win control of it in NY by proposing unreasonable things. If he'd wanted real consumer protections, wouldn't he just have asked for them?
- thinkcomp 12y ago
  Lawsky did what makes sense from his perspective: he applied the money transmission framework to Bitcoin. The authors of this post are both biased in favor of Bitcoin, and not particularly careful examiners of the real consumer protection issues at hand.
  - Ryan_Singer 12y ago
    The Money Transmission Framework is a combination of two types of rules: 1. Capital Requirements, licensing and Bonding for people who hold money for consumers who are not banks. These rules are consumer protection laws and make sense for businesses that offer custodial accounts denominated in bitcoin or dollars. These rules could have been applied to Instawallet, Coinbase, Mt. Gox, etc. 2. AML + KYC rules. These require people who help move money into and out of the banking system to find out who their customers are and report them to law enforcement when they do the unexpected. These rules could be applied normally to people doing exchange services, like Expresscoin, BitInstant (RIP), CoInvoice, etc. I've spent years and hundreds of thousands of investor dollars examining the issues here, like you have. Stay tuned for a policy piece describing when these rules make sense and when they don't. Hint: If you are just posting software to github, these rules do not make sense to apply to you.
    - thinkcomp 12y ago
      "These rules could have been applied to" Actually, these rules ARE applied to Coinbase at the very least. Coinbase--and YC, and many YC startups--deliberately choose to ignore them.
      - Ryan_Singer 12y ago
        I've read your lawsuit against coinbase. No comment.
        thinkcomp 12y ago
        Sounds like you don't disagree then.
        rlpb 12y ago
        Sounds like he cannot comment for legal reasons. On the other hand, assuming that you have filed a lawsuit against Coinbase, it sounds like you can no longer pass neutral comment on the matter. Something you seem to have conveniently not mentioned.
        thinkcomp 12y ago
        I've written about the lawsuit often enough on HN that I'm routinely criticized for writing too much. Of course, if I don't bring it up, I must be trying to hide it. In any event, there's no legal reason why he couldn't comment. He's not involved, except to the extent that his own company might also be ignoring the law and thereby breaking it--which I have no idea if it's the case or not. But plenty of startups do.
        wpietri 12y ago
        The bulk of readers are not going to know your history. I didn't. It doesn't take a lot to add "[full disclosure: I'm suing Coinbase]" when you opine on Coinbase. Having somebody else bring it up first definitely reduces your credibility.
  - starkness 12y ago
    Indeed he's attempting to apply an existing regulatory framework to new technology, which rarely works well. The point of the article was not to focus on the consumer protection issues, but instead to point out how it could kill startups in the name of consumer protection. We are both in favor of avoiding another Mt. Gox, and the numerous other cases where user funds were lost, which includes escrow of the funds held for users. I'd be curious to get your thoughts as to what you consider the most pressing consumer protection issues, as we're working on another piece that will focus more on these.
    - thinkcomp 12y ago
      I've written up my thoughts in a comment letter to CFPB. See http://www.thinkcomputer.com/20140214.cfpbcomment.pdf http://www.thinkcomputer.com/20140214.cfpbcomment.pdf. And if you were aware of the existing regulatory framework, how is any of this different or surprising?
    - mbreese 12y ago
      Given the way that some Bitcoin startups have crashed and burned with people's money, I don't think that it's unreasonable to raise the bar significantly in the name of consumer protection. If that eliminates small startups in the space from directly offering services to consumers, so be it.
      - starkness 12y ago
        Part of the problem is that the regulations aren't just seeking to cover companies that hold peoples' funds (aka private keys), but instead any technology touching the ecosystem. New York doesn't have to and shouldn't conflate the two. It makes sense to regulate and, for example, require escrow for companies that are holding user funds in order to avoid the exact situation you point out. It doesn't make sense for a web wallet where the user is storing her own keys client-side.
    - jasonwocky 12y ago
      > Indeed he's attempting to apply an existing regulatory framework to new technology, which rarely works well. I think this sounds more true than it actually is. "Works" is a fairly ambiguous word, but new technology is released into existing regulatory frameworks every day.
- Ryan_Singer 12y ago
  Banks actually do have to ask for permission for "new lines of business", aka new products. The theory going around is that he asked for a best case scenario for the regulator and the goal of the comment period is to see what the industry cares enough about to push back hard. His goal is to have a regulation come out of the comment period that all of the "Big Bitcoin" startups and VC's like enough to apply instead of sue. He'll probably get what he wants.
- starkness 12y ago
  It certainly is an "ask for the moon" type proposal, which is how regulators often like to start. Part of the problem, though, is that it's so far skewed to one side that getting it back to even somewhat reasonable is going to take a lot of work.
fred_durst 12y ago
>1. Submit fingerprints of all founders (and employees) to the FBI and disclose personal financial information of founders and officers to NY State. >2. Require them to hold an undetermined amount of U.S. dollar funds in bonds or trusts. Startups will not be able to predict the bonding or capitalization requirements until after they apply, making it difficult to project expenses or raise money. >3. Conduct expensive audits and security testing that no small startup could afford. >4. Hand over any untouched user assets to NY State after five years as “abandoned property.” If these four things deter you, please do everyone a favor and do not start any company that handles other peoples money.
- Ryan_Singer 12y ago
  There is a difference between: * Coinbase: A startup that holds millions of dollars worth of bitcoin for mostly consumers * The reddit tip bot: a non-profit community tool that explicitly discourages holding more than a dollar or two * Blockchain: A startup that holds no money for anyone, but writes and serves software that helps people hold their own money online. Do you think all three of these groups should go through this process?
  - nmrm 12y ago
    Professional auditing and security testing should be necessary for any piece of software from which it's possible to drain large sums of money, regardless of who's running the software or holding the money. In fact, I'd argue anything less constitutes an ethical breach on the part of the lead engineer(s). I'm not really sure why that particular regulation is so onerous in any of these situations, since any responsible team would be thinking about security throughout, including and especially post-development. At least in principle (maybe you'd prefer different auditing standards or practices -- that's what I mean by in principle). edit: of course each of these is a different sort of service, and different levels of risk management are appropriate. In particular, the case of Blockchain seems like a real quagmire. I guess it would probably depend heavily on the revenue model. Really my only point is that I would have a really hard time sleeping at night if I had to sign off on not applying state-of-the-art auditing and testing techniques any of these, even Blockchain. Maybe I'm too crotchety and old-school for bitcoin.
DINKDINK 12y ago
These regulations aren't about consumer protections (if they were, companies would be audited and scored on how well they comply, ala health food scores in restaurants). If regulators solely marked businesses with the metaphorical seal of approval, a democratic, economic process would happen in the market place. This is entirely about the state inserting themselves between people, their money, and where they want to spend it. You'd be ignorant to believe that the Feds wouldn't apply the same, transaction-ending, censorship level of force to Bitcoin transactions services ("Oh your users are sending money to Wikileaks? We deem that a risky transaction and now require you to hold 10X funds in dollars and to buy additional bonds. Oh What a coincidence that's outside of your financial situation that we have complete privilage to inspect.")
- DINKDINK 12y ago
  Further more, to quote Greg Brockman: "Second, this model [the Bitcoin ecosystem] unbundles the existing financial system into layers run by independent companies. To see the value of this, contrast with the US mobile carriers, who used to own the entire stack. They owned the handsets, the operating systems, the applications running on the phone, and the service. This meant that most of the stack never had anything pushing it to get very good, and there were even incentives to hold it back in order to preserve legacy revenue-generating facilities like SMS. By enabling competition at individual layers of the financial system, each one should improve." The big banks of NY are threatened by Bitcoin and are working with the same people/regulators they've rubbed elbows for so long. If regulators really cared about protecting consumers they would have prosecuted big banks for the biggest destruction in wealth in human history aka the 2008 financial crash.
lectrick 12y ago
This will only further the ambitious goals of DACs (Distributed Autonomous Corporations). This is all kind of amusing. 1) Government architects Internet in a decentralized fashion so that it survives damage from a nuclear attack. 2) Government tries to control Internet and fails because Internet, being decentralized, routes around control because it is seen as damage. 3) Bitcoin is pure Internet money. The math isn't that hard here. This should be interesting...

64 points by starkness 12y ago

Looks like California is about to get a huge influx of bitcoin entrepreneurs...

Does anyone else wonder if this is more of a go-for-it-all-and-negotiate-back-to-reasonable sort of attack on bitcoin? He can't really want what he's proposing; banks don't even ask for government approval when they launch new features. So the only thought is that he either doesn't want bitcoin at all or he wants to win control of it in NY by proposing unreasonable things. If he'd wanted real consumer protections, wouldn't he just have asked for them?

thinkcomp 12y ago
Lawsky did what makes sense from his perspective: he applied the money transmission framework to Bitcoin. The authors of this post are both biased in favor of Bitcoin, and not particularly careful examiners of the real consumer protection issues at hand.
- Ryan_Singer 12y ago
  The Money Transmission Framework is a combination of two types of rules: 1. Capital Requirements, licensing and Bonding for people who hold money for consumers who are not banks. These rules are consumer protection laws and make sense for businesses that offer custodial accounts denominated in bitcoin or dollars. These rules could have been applied to Instawallet, Coinbase, Mt. Gox, etc. 2. AML + KYC rules. These require people who help move money into and out of the banking system to find out who their customers are and report them to law enforcement when they do the unexpected. These rules could be applied normally to people doing exchange services, like Expresscoin, BitInstant (RIP), CoInvoice, etc. I've spent years and hundreds of thousands of investor dollars examining the issues here, like you have. Stay tuned for a policy piece describing when these rules make sense and when they don't. Hint: If you are just posting software to github, these rules do not make sense to apply to you.
  - thinkcomp 12y ago
    "These rules could have been applied to" Actually, these rules ARE applied to Coinbase at the very least. Coinbase--and YC, and many YC startups--deliberately choose to ignore them.
    - Ryan_Singer 12y ago
      I've read your lawsuit against coinbase. No comment.
      - thinkcomp 12y ago
        Sounds like you don't disagree then.
        rlpb 12y ago
        Sounds like he cannot comment for legal reasons. On the other hand, assuming that you have filed a lawsuit against Coinbase, it sounds like you can no longer pass neutral comment on the matter. Something you seem to have conveniently not mentioned.
        thinkcomp 12y ago
        I've written about the lawsuit often enough on HN that I'm routinely criticized for writing too much. Of course, if I don't bring it up, I must be trying to hide it. In any event, there's no legal reason why he couldn't comment. He's not involved, except to the extent that his own company might also be ignoring the law and thereby breaking it--which I have no idea if it's the case or not. But plenty of startups do.
        wpietri 12y ago
        The bulk of readers are not going to know your history. I didn't. It doesn't take a lot to add "[full disclosure: I'm suing Coinbase]" when you opine on Coinbase. Having somebody else bring it up first definitely reduces your credibility.
- starkness 12y ago
  Indeed he's attempting to apply an existing regulatory framework to new technology, which rarely works well. The point of the article was not to focus on the consumer protection issues, but instead to point out how it could kill startups in the name of consumer protection. We are both in favor of avoiding another Mt. Gox, and the numerous other cases where user funds were lost, which includes escrow of the funds held for users. I'd be curious to get your thoughts as to what you consider the most pressing consumer protection issues, as we're working on another piece that will focus more on these.
  - thinkcomp 12y ago
    I've written up my thoughts in a comment letter to CFPB. See http://www.thinkcomputer.com/20140214.cfpbcomment.pdf http://www.thinkcomputer.com/20140214.cfpbcomment.pdf. And if you were aware of the existing regulatory framework, how is any of this different or surprising?
  - mbreese 12y ago
    Given the way that some Bitcoin startups have crashed and burned with people's money, I don't think that it's unreasonable to raise the bar significantly in the name of consumer protection. If that eliminates small startups in the space from directly offering services to consumers, so be it.
    - starkness 12y ago
      Part of the problem is that the regulations aren't just seeking to cover companies that hold peoples' funds (aka private keys), but instead any technology touching the ecosystem. New York doesn't have to and shouldn't conflate the two. It makes sense to regulate and, for example, require escrow for companies that are holding user funds in order to avoid the exact situation you point out. It doesn't make sense for a web wallet where the user is storing her own keys client-side.
  - jasonwocky 12y ago
    > Indeed he's attempting to apply an existing regulatory framework to new technology, which rarely works well. I think this sounds more true than it actually is. "Works" is a fairly ambiguous word, but new technology is released into existing regulatory frameworks every day.
Ryan_Singer 12y ago
Banks actually do have to ask for permission for "new lines of business", aka new products. The theory going around is that he asked for a best case scenario for the regulator and the goal of the comment period is to see what the industry cares enough about to push back hard. His goal is to have a regulation come out of the comment period that all of the "Big Bitcoin" startups and VC's like enough to apply instead of sue. He'll probably get what he wants.
starkness 12y ago
It certainly is an "ask for the moon" type proposal, which is how regulators often like to start. Part of the problem, though, is that it's so far skewed to one side that getting it back to even somewhat reasonable is going to take a lot of work.

fred_durst 12y ago

>1. Submit fingerprints of all founders (and employees) to the FBI and disclose personal financial information of founders and officers to NY State. >2. Require them to hold an undetermined amount of U.S. dollar funds in bonds or trusts. Startups will not be able to predict the bonding or capitalization requirements until after they apply, making it difficult to project expenses or raise money. >3. Conduct expensive audits and security testing that no small startup could afford. >4. Hand over any untouched user assets to NY State after five years as “abandoned property.” If these four things deter you, please do everyone a favor and do not start any company that handles other peoples money.

Ryan_Singer 12y ago
There is a difference between: * Coinbase: A startup that holds millions of dollars worth of bitcoin for mostly consumers * The reddit tip bot: a non-profit community tool that explicitly discourages holding more than a dollar or two * Blockchain: A startup that holds no money for anyone, but writes and serves software that helps people hold their own money online. Do you think all three of these groups should go through this process?
- nmrm 12y ago
  Professional auditing and security testing should be necessary for any piece of software from which it's possible to drain large sums of money, regardless of who's running the software or holding the money. In fact, I'd argue anything less constitutes an ethical breach on the part of the lead engineer(s). I'm not really sure why that particular regulation is so onerous in any of these situations, since any responsible team would be thinking about security throughout, including and especially post-development. At least in principle (maybe you'd prefer different auditing standards or practices -- that's what I mean by in principle). edit: of course each of these is a different sort of service, and different levels of risk management are appropriate. In particular, the case of Blockchain seems like a real quagmire. I guess it would probably depend heavily on the revenue model. Really my only point is that I would have a really hard time sleeping at night if I had to sign off on not applying state-of-the-art auditing and testing techniques any of these, even Blockchain. Maybe I'm too crotchety and old-school for bitcoin.

DINKDINK 12y ago

These regulations aren't about consumer protections (if they were, companies would be audited and scored on how well they comply, ala health food scores in restaurants). If regulators solely marked businesses with the metaphorical seal of approval, a democratic, economic process would happen in the market place. This is entirely about the state inserting themselves between people, their money, and where they want to spend it. You'd be ignorant to believe that the Feds wouldn't apply the same, transaction-ending, censorship level of force to Bitcoin transactions services ("Oh your users are sending money to Wikileaks? We deem that a risky transaction and now require you to hold 10X funds in dollars and to buy additional bonds. Oh What a coincidence that's outside of your financial situation that we have complete privilage to inspect.")

DINKDINK 12y ago
Further more, to quote Greg Brockman: "Second, this model [the Bitcoin ecosystem] unbundles the existing financial system into layers run by independent companies. To see the value of this, contrast with the US mobile carriers, who used to own the entire stack. They owned the handsets, the operating systems, the applications running on the phone, and the service. This meant that most of the stack never had anything pushing it to get very good, and there were even incentives to hold it back in order to preserve legacy revenue-generating facilities like SMS. By enabling competition at individual layers of the financial system, each one should improve." The big banks of NY are threatened by Bitcoin and are working with the same people/regulators they've rubbed elbows for so long. If regulators really cared about protecting consumers they would have prosecuted big banks for the biggest destruction in wealth in human history aka the 2008 financial crash.

lectrick 12y ago

This will only further the ambitious goals of DACs (Distributed Autonomous Corporations). This is all kind of amusing. 1) Government architects Internet in a decentralized fashion so that it survives damage from a nuclear attack. 2) Government tries to control Internet and fails because Internet, being decentralized, routes around control because it is seen as damage. 3) Bitcoin is pure Internet money. The math isn't that hard here. This should be interesting...