A Closer Look at Crypto: The Crucial Role of FINRA’s CAI Team

As the crypto asset space has grown, FINRA has evolved its oversight of the crypto asset activities of FINRA member firms and their associated persons. In this second episode of a three-part series covering FINRA's crypto asset-related regulatory work, we hear from Jamie Udinson, Senior Director of the Crypto Asset Investigations team, Taylor Etzell, a Senior Principal Investigator, and Jason Foye, Senior Director and head of FINRA's Crypto Hub, who provide insight into FINRA's Crypto Asset Investigations Team.

We learn more about this dedicated group of investigators specializing in conducting complex crypto asset investigations and the crucial role it plays in ensuring compliance with existing rules and regulations in the crypto asset space.

Resources mentioned in this episode:

Episode 71: Overlapping Risks, Part 1: Anti-Money Laundering and Cybersecurity

Episode 72: Overlapping Risks, Part 2: Anti-Money Laundering and Elder Exploitation

Episode 117: Membership Application Program

Episode 136: An Introduction to FINRA’s Crypto Asset Work and the Crypto Hub

Rule 3270: Outside Business Activities of Registered Persons

Rule 3280: Private Securities Transactions of an Associated Person

FINRA Blog: An Inside Look into FINRA’s Crypto Asset Work

Listen and subscribe to our podcast on Apple Podcasts, Google Podcasts, Spotify or wherever you listen to your podcasts. Below is a transcript of the episode. Transcripts are generated using a combination of speech recognition software and human editors and may contain errors. Please check the corresponding audio before quoting in print. 

FULL TRANSCRIPT

00:01 - 00:36

Intro: As the crypto asset space has grown, FINRA has evolved its oversight of the crypto asset activities of FINRA member firms and their associated persons. In this second episode of a three-part series covering FINRA's crypto asset-related regulatory work, we hear from FINRA's Crypto Asset Investigations Team, or CAI, a dedicated group of investigators who specialize in conducting complex crypto asset investigations to learn about the crucial role it plays in ensuring compliance with existing rules and regulations in the crypto asset space.

00:36 – 00:45

Intro Music

00:45 - 01:32

Kaitlyn Kiernan: Welcome to FINRA Unscripted. I'm your host, Kaitlyn Kiernan. I'm excited to welcome three guests to today's show for the second episode in a three-part series on FINRA's crypto asset regulatory work. On our last episode, we learned about FINRA's enterprise-wide crypto asset strategy and the work of the Crypto Hub. And today we're going to talk with some of FINRA's dedicated crypto asset specialists about the work of the Crypto Asset Investigations Team, or CAI. Joining us today are Jamie Udinson, Senior Director of the Crypto Asset Investigations team, and Taylor Etzell, a Senior Principal Investigator with CAI. And once again, we also have Jason Foye, Senior Director and head of FINRA's Crypto Hub. Jason, Jamie and Taylor, welcome to the show.

01:32 - 01:32

Jason Foye: Thanks.

01:33 - 01:33

Jamie Udinson: Thank you.

01:33 - 01:45

Kaitlyn Kiernan: So, to kick us off, can you each introduce yourselves and tell us a bit about your current role at FINRA and a bit of background on how you got here? Jason, we just heard from you on our last episode. Maybe we can start with you.

01:46 - 02:03

Jason Foye: I have two roles at FINRA. One is the head of FINRA Special Investigations Unit, which houses our Anti-Money Laundering Investigations team and our Anti-Fraud Investigations team. And for the past eight or so months, I've also had the privilege of serving as the chief of FINRA's Crypto Hub.

02:03 - 02:05

Kaitlyn Kiernan: Thanks, Jason. And Jamie, how about you?

02:06 - 02:26

Jamie Udinson: Jamie Udinson, I am the Senior Director and head of the Crypto Asset Investigations team. I joined the crypto efforts at FINRA last year. I've been at FINRA for many years in various roles across Member Supervision and Enforcement, so I'm really excited to be here today to talk about all of the things that CAI is doing.

02:27 - 02:28

Kaitlyn Kiernan: And Taylor, how about you?

02:29 - 03:33

Taylor Etzell: Thanks, Kaitlyn. Happy to be here. My name is Taylor and like you said, I'm a Senior Principal Investigator on the Crypto Asset Investigation team. I've spent my career at FINRA so far, and I've had the pleasure of working on a handful of teams within FINRA's Member Supervision department, including the Firm Exam Program, National Cause Program, Jason's AML unit, and now Jamie's Crypto Asset Investigation team. Back in mid-2018, I had the opportunity to join FINRA's non-dedicated Digital Asset specialist group within Member Supervision.

And in that group, we conducted reviews to understand what the members and reps were doing in the crypto asset space at that time.

So again, back in 2018, and I think what was different about that group and what we're doing now with CAI is that the Digital Asset specialist team was a non-dedicated group, which really just meant that the people on that team also maintained our normal roles within Member Supervision. And then we would conduct the crypto-related reviews alongside our dedicated roles. But with CAI now, we are full-time staff members that are solely focused on the crypto-related work that we're doing.

03:33 - 03:52

Kaitlyn Kiernan: And an important reminder that while this new focused effort is newer, looking at crypto generally and digital assets—not so new for FINRA. Today we're here to focus on the Crypto Asset Investigations team. What is this team and why was it created?

03:53 - 05:15

Jason Foye: As Omer mentioned in part one of this series, FINRA's enterprise-wide crypto asset strategy has three core components. One, enforcing current rules and regulations with respect to the crypto asset activities being conducted by our member firms and associated persons, two, building for the future and enhancing our capabilities in this space. And three, engaging in blockchain innovation to support FINRA's regulatory work across all asset classes and certainly including crypto assets. And the Crypto Asset Investigations team, or CAI, as Jamie alluded to earlier, is a critical component of this overall strategy, especially with respect to the first category, where CAI serves as FINRA's dedicated specialist program with respect to crypto assets. And the audience may already be somewhat familiar with other specialist programs at FINRA, such as the Anti-Money Laundering and Anti-Fraud Investigations groups that are part of the Special Investigations Unit that I run, or our Vulnerable Adults and Seniors Team, or cybersecurity and cyber-enabled fraud groups, or high-risk representative team. And CAI is the latest specialist program to be launched at FINRA and it's similar in nature to these other specialist programs, albeit with a dedicated focus on crypto assets specifically.

05:16 - 05:22

Kaitlyn Kiernan: And how does CAI work with the Crypto Hub that we heard about on the last episode?

05:22 - 07:01

Jason Foye: As you'd expect, CAI is a critical, central component of the Hub, both because of the role they are playing in the overall crypto asset strategy that we mentioned, but also because of the significant subject matter expertise within CAI that the Hub can leverage and maximize as we develop and implement strategic initiatives in our efforts to build for the future and enhance our capabilities. Just a few examples of the type of work that CAI has been involved in with respect to the Hub includes, but certainly is not limited to, identifying the relevant risks related to specific crypto asset business lines and the types of effective controls that can assist member firms in mitigating these risks, assessing where crypto asset-related fraud within FINRA's jurisdiction may exist and developing strategies to more effectively detect and investigate potential crypto asset fraud impacting investors and markets, leading or advising on crypto asset-related firm examinations and other investigations across the organization, assisting in the assessment of third-party crypto asset investigative tools and working with the Blockchain Lab on tools that are being either vetted or built by FINRA, assisting in the development of our enterprise-wide crypto asset training plan for FINRA staff and engaging with industry as subject matter experts in the crypto asset space. So, needless to say, that's just a short list of the impact they're having, but they're having a huge impact on FINRA's work and are involved in some form or fashion in almost every initiative that the Hub is working on.

07:02 - 007:16

Kaitlyn Kiernan: So, it sounds like CAI has a pretty broad mandate. So, Taylor hinted that it's a dedicated team which differs from what was done in the past at FINRA. But Jamie, how big is CAI and how has it been staffed?

07:17 - 07:58

Jamie Udinson: CAI right now is six investigators and myself. And the investigative staff in CAI is made up of folks from long FINRA careers and then also people that we brought in from the industry. So, as you heard Taylor talk about the non-dedicated Digital Asset specialist team that we had previously to CAI being formed, Taylor joins us with that experience. We also have staff who has extensive experience in the Anti-Money Laundering specialist group and then we have external people who have joined that had hands-on experience working with crypto asset firms, exchanges and extensive fraud investigation experience.

07:59 - 008:06

Kaitlyn Kiernan: That sounds really helpful, range of experience. And what do you see as the main goals of CAI?

08:07 - 08:44

Jamie Udinson: The three main goals as I see it, and there's others, but I think an overview is conducting complex investigations in the crypto asset space within the brokerage industry. We also want to establish ourselves as FINRA's top experts in crypto, and that means keeping ahead of the evolution of the crypto space and the products and services that are out there. And also, lastly, we really want to not just share what we learn within FINRA's regulatory departments, but also with the industry. And we're going to do that through training, engagement with firms and also helping to formulate Regulatory Notices and guidance.

08:45 - 09:00

Kaitlyn Kiernan: And, of course, joining us here today on the podcast. And how does CAI compare to some of the other specialized investigative teams that Jason mentioned, like AML, VAST, the Vulnerable Adult and Senior Team, at FINRA?

09:01 - 10:17

Jamie Udinson: Like Jason said, we are very similar. We operate very much like the other specialist teams. We conduct exams, investigations, we assist in an advisory capacity on other teams in exams or investigations. We also help to develop investigative and review methods in the crypto asset space, which is an entirely new set of skills for us, data sources, tools, et cetera. So, we also assist with vetting those tools and exploring where we might have opportunities. And crypto asset businesses and distributed ledger technologies is not limited to a particular type of business. We're seeing it across business types. So, where you have Digital Asset specialist group working on exams across the entire Exam program in its previous iteration as that non-dedicated specialist group. Now with the specialist group, we're seeing need to engage with all types of firms. We're seeing opportunities to look at firms who have no real business touchpoint to crypto but tend to have a lot of registered representatives who are engaging in crypto asset business lines. So, there's a need for us to share that information within the vast majority of our regulatory departments and also with industry representatives who span all different kinds of firms and business lines.

10:18 - 10:41

Kaitlyn Kiernan: I'd love to dig into CAI's efforts to assess risk related to crypto asset activities. Like you said, being conducted by either FINRA member firms or associated persons, including potential fraud risk. But before we do that, can you quickly recap the current crypto asset business lines that exist among FINRA member firms for our listeners?

10:41 - 12:44

Jamie Udinson: Absolutely. The various crypto businesses typically fit into one of five categories. The first one is Prop Trading and Market Making, which includes purchases and sales in crypto and crypto derivatives and also mining operations. The next is Customer Facilitation and Cash Management. In simpler terms, customers create crypto trading through an affiliate. In these instances, the account would be funded via a broker-dealer account. The next is Pooled Investment Funds, ICOs, or initial coin offerings, and Private Placements. And this category includes creation and management of, and advisory services for, pooled funds related to crypto assets or participation in an initial or secondary offering of crypto assets. The next is Custody, and we have our very first special purpose broker-dealer for custody of crypto assets. So, I think over time we will see this category grow. This category includes acceptance of crypto from customers and custody or similar arrangements, and the last would cover any Distributed Ledger Technology or Blockchain Services. And that's for creation or management of platforms for secondary trading of crypto or really any clearance or settlement services for crypto.

I'll note here that these business lines are represented in FINRA's membership, both directly and indirectly, meaning some firms, mostly firms operating in an alternative trading system, or ATS, or firms offering crypto private placements, are directly engaged in crypto business activities. So, we see firms indirectly involved in crypto business lines through arrangements with third-parties or affiliates in order to facilitate trading in crypto assets. And in these instances of indirect exposure, we focus on the member firm's part in whatever arrangement is in place. That said, for our members that are directly engaged in ATS business or private placements and customer facilitation, it's really important that they understand the risks unique to those business lines and the controls they need to put into place to mitigate those risks.

12:44 - 13:13

Jason Foye: And one quick note there, Kaitlyn. This includes direct and indirect touchpoints by our member firms. So, in some cases it may be that the firm itself is engaging in some of these activities, or it could be that the firm's affiliate or parent company is engaging in these activities or the firm in that second category in particular, the firm may have an established business relationship with some third-party or affiliate to facilitate trading in certain crypto assets.

13:14 - 13:23

Kaitlyn Kiernan: Thanks for that. And so, what are some of the risks associated with some of these different business activities, Jamie, that you just mentioned?

13:24 - 14:47

Jamie Udinson: When we think about risks that apply to all of the firms and we're doing our risk assessments, we have the different categories that we would think of for crypto firms. We're not talking about anything extremely out of the ordinary. We have fraud and deception risks that would be elevated depending on businesses and customers and the level of supervision and controls at firms. We have a heightened AML risk and I think that's supported by some of the stories that you would see out there in the news and the industry. And also, operational risks tend to present some challenges. For some of the firms that do have customer exposure, we see a heightened sales risk. And then for custody firms, we're going to have risks related to accuracy of net capital and segregation of customer assets.

So, I really think it's important for firms to either directly or indirectly have some exposure to crypto asset business lines to take a look at their controls to mitigate those risks in this space as we're seeing not necessarily indicative of having the crypto business line. Do you see the risk just automatically skyrocket? But I think if you pay attention to the news, there are some questions about what it means to actually segregate customer assets, what it means to know what your customers are doing and what it means for AML controls when you have crypto assets moving in a way that we're not typically used to seeing.

14:48 - 15:08

Kaitlyn Kiernan: Good to know. And on the last episode we heard that associated persons are also engaged in a wide range of outside business activities and private securities transactions related to crypto assets. Taylor, can you shed some light on the types of activities registered reps are engaging in?

15:09 - 17:00

Taylor Etzell: In a similar sense to what we just heard you say, Kaitlyn and Jamie, on the broad adoption of crypto assets and distributed ledger technology by our member firms, we're also seeing a similar wide array of crypto-related activities that associated persons are conducting through their OBAs and PSTs. So, outside business activities and private securities transactions. These activities include things like working with or for developers in the crypto ecosystem in general. That could include working on ICOs, working with DLT in general, working on establishing decentralized applications, working on web3 projects just in general, and maybe creating or trading NFTs. The list could go on and on, but those are just some examples of where we've observed reps or associated persons that are working with or for the crypto ecosystem.

Another piece that we've seen is reps working with crypto mining companies or even setting up their own mining operations. Next, we've also seen reps or associated persons that work with issuers, or they establish companies themselves that create and sell crypto asset securities to investors. And lastly, we've seen reps and associated persons create funds where the underlying holdings are exposed to the crypto ecosystem in some capacity, whether that's by the funds investing directly in native crypto assets like Bitcoin or Ethereum or NFTs, pick your crypto asset, that's what the fund invests in. Or there's also instances where these funds that are being created invest directly in pre-IPO companies that are in the crypto ecosystem. So, in general, there's lots of applications of crypto-related work that associated persons are doing through their OBAs or PSTs.

17:00 - 17:12

Kaitlyn Kiernan: But it sounds like there are definitely reps out there that are very involved in this space. So, what types of risks are associated with these different outside business activities and PSTs?

17:13 - 19:28

Taylor Etzell: Some risks that can arise with crypto-related or crypto exposed OBAs and PSTs are going to sound similar to risks in outside business activities or selling away just in general, including the risk of a rep or an associated person not adequately or accurately disclosing the nature of their activity. These risks can also include the firm conducting an unreasonable review or going through an unreasonable approval process of the proposed activity or private security transaction. And I think lastly, just for this conversation, there's a risk of inadequate supervision of the OBA or PST by the firm. So, some questions that can be asked to address these risks that I just mentioned include did the associated person disclose the nature of the activity and their role to the firm as required by internal procedures? So, reps and associated persons having a really strong understanding of what their firm requires pursuant to 3270 and 3280. The concern here on the disclosure aspect of an OBA or PST is that the nature of the crypto activity is not fully described, or the extent of the associated persons involvement is not accurately conveyed on the approval request or even on their U4 if the activity is approved, taking time to accurately answer those questions is really helpful there.

Another question that can be considered regarding the review and the approval of these activities is did the firm, once it received the OBA or PST request from the associated person, conduct a review that met the requirements of FINRA Rules 3270 and 3280? So, did the firm really get an understanding of the proposed activity or securities transaction? Did the firm consider whether certain conditions or limitations on the activity should be imposed? And did the firm memorialize its review of the proposed OBA or PST? And then lastly, for the PST perspective here, there's a risk that the PST was not supervised pursuant to the requirements of FINRA Rule 3280. So, taking time to really understand the associated person's role in whatever transaction they are requesting approval to engage in and then supervising it appropriately is going to be important.

19:29 - 19:35

Kaitlyn Kiernan: That's good to know. What are some of the areas of focus for CAI from a fraud perspective?

19:36 - 22:35

Taylor Etzell: From a fraud risk perspective, CAI is always focused on and will always be focused on reviewing for various fraud risks, including specifically related to crypto asset fraud rug pull scams, which are and have been a significant concern in the crypto ecosystem for some time now. A rug pull in one of the branches of that typology will look similar to a pump and dump scheme, but just in general, a high-level definition of a rug pull scam would be a crypto scam in which a developer or a platform is attracting investors but is pulling out the rug from underneath them before the project is complete, which leaves investors with worthless assets. For this risk, this fraud typology can arise through potentially OBAs or PSTs that I just talked about and could also arise through offerings that are sold by member firms. CAI will also look at and continue to look at the risk of misappropriation of assets, which in the case of crypto assets, this risk can and does look different than tradfi because with crypto, if, for example, an investor invests crypto assets through a rep or a firm offering, there is a risk that those funds could be gone immediately with little to no recourse due to the nature of crypto transactions.

So, I think some controls to consider with this misappropriation of asset risk with crypto assets specifically are to get a strong understanding of who has access to the private keys used in offerings, establish strong cyber and operational controls to govern how and when crypto assets are being accepted, stored and accessed. So, just a couple examples there. And then lastly, another area of focus from a fraud perspective for CAI is misrepresentations and omissions of material facts regarding crypto assets or the crypto asset exposure that's being offered or provided by a firm or a rep to customers. So, considering crypto-specific risks and ensuring those risks are balanced with the discussion that's happening on potential rewards of an offering or of a service that's being offered, for example, and then also ensuring that a review of some sort is conducted to assess whether statements appear to be exaggerated or unwarranted, for example. I think we do want to acknowledge that these fraud risks probably sound familiar to other more traditional business lines. But I do think that when crypto is involved, some aspects are unique because crypto assets have different features than tradfi. And when I say tradfi I just mean traditional finance.

Additionally, the communication methods and terminology used in the crypto ecosystem can be unique. And lastly, and I think very importantly, there is that immediacy and finality of crypto transactions which leads to being extremely difficult for investors to track and claw back funds or crypto assets in the event of fraud.

22:36 - 22:42

Kaitlyn Kiernan: So, Jamie, how does CAI work with other departments throughout this process?

22:43 - 24:55

Jamie Udinson: We're very collaborative. As Jason described, we work closely with the Hub on a regular basis in the execution of the crypto strategy for FINRA. So, we're very much meeting to discuss all aspects of development in our programs related to crypto assets. But we also work very closely with the Blockchain Lab. And as we're developing our crypto market surveillance capabilities, we're sharing information, sharing our experiences and helping to navigate the options available to us to continue to develop our own skills in the space. We are very collaborative with Exam staff. We assist and execute exam work where needed, and we're speaking with Risk Monitoring on a fairly regular basis to help drive conversations around crypto assets, answer their questions and identify where there might be risks related to crypto assets or even if a firm is talking about developing distributed ledger technology for use in their business. We assist with Membership Application Program's member applications, and that's either in an advisory capacity or in an effort to better understand where a firm may need supervisory review in the future.

Having that collaboration helps us to come into those meetings and really have good conversation with firms about what they're doing. It really helps to prepare us. We also work closely with the Corporate Finance Department and with Advertising Regulation in that, Corporate Finance is reviewing private placement filings that are submitted to FINRA and Advertising Regulation is reviewing communications. I think there's some discussion previously about Advertising Reg's sweep related to crypto asset communications, and so that very much impacts us and their findings will impact what we're doing in the future. So, we keep a close eye on what they are doing in that space and just try really at all times to help other departments as we learn new things.

24:56 - 25:09

Kaitlyn Kiernan: Sounds like a lot of really good collaboration there. And how does CAI keep track of this ever-evolving space and the types of crypto asset activities that member firms and associated persons are engaged in?

25:10 - 26:45

Jamie Udinson: Well, if you can imagine, the coordination through the Hub is probably the best way that we do that. All of the collaboration I just mentioned with Risk Monitoring and Exam staff and our colleagues in MAP and Corporate Finance and Advertising Regulation, all of those departments are represented. And so it's the best way for us to remain up to date on what's happening and emerging issues that we might put a focus on. Risk Monitoring is in the best position to provide context at the firm level about business lines that are developing or products that we might be seeing. As firms are moving wholesale into the space, and I say wholesale because I've heard so many people talking about the ways that they could compete in the industry with new products and services or that they might be able to improve efficiencies in the way that they conduct their business simply by onboarding these types of technologies.

And so, firms moving into this space is an opportunity for us to collaborate as they go to the Membership Application Program, to explore an application to add those services to their membership. It gives us a great opportunity to keep ahead of what's happening and really prepare for those changes as they start to unravel within our membership. And lastly, I think we really pay close attention to what's happening in other agencies. We are looking to what the states are doing, what federal agencies are doing, what other SROs are doing and what legislation may come. So, we are up to date with all of those changes as we hear about them very frequently.

26:46 - 27:02

Kaitlyn Kiernan: I think this is an area of focus, not just in the United States, but for regulators globally. So, outside of the examination and investigative context, how will CAI continue to engage with the industry?

27:03 - 27:34

Taylor Etzell: Like other specialist groups at FINRA, CAI plans to develop and offer training in the crypto asset area to our member firms. We will also inform the industry of risks, controls and other topics through events that we host or events that we're invited to and also respond to questions directly from firms. We'll be happy to do that and already do that. And lastly, we'll contribute to Regulatory Notices and other guidance that is published as it relates to crypto assets both now and in the future.

27:34 - 27:43

Kaitlyn Kiernan: So, our listeners can stay tuned for more. And Jamie, as we've talked about, this is an evolving space. So, how do you see CAI evolving from here?

27:44 - 28:52

Jamie Udinson: We're very much in the learning and development phase right now. As we've mentioned, FINRA's been in the crypto space for more than just the time that the CAI has been in existence. This has been an evolving landscape for several years now and we're still very much in the beginning part, I believe. But in the future, we will have those best practices to share with the industry. We'll have intelligence on products and services and more information about the different types of architectures that are out there that facilitate crypto asset business, and we'll be able to share that information and remain on the cutting edge of the crypto ecosystem in terms of investigations and examinations and insights. What's important is that we recognize that this is an area of great innovation, and it requires innovative thinking to stay ahead of that curve. So, we want to best support FINRA, and the industry and I see us being in a position to do that simply by being a part of all of these Crypto Hub efforts and working together with our colleagues across the organization.

28:53 - 29:26

Kaitlyn Kiernan: Well, that's it for today's episode of FINRA Unscripted. Jamie, Jason, and Taylor, thank you so much for joining me to talk about the work of the Crypto Asset Investigations team. There's certainly a lot going on. Listeners, if you don't already, be sure to subscribe to FINRA Unscripted wherever you listen to podcasts to make sure you get notified when our third and final episode in this series on our Blockchain Lab posts in just a couple of weeks. Today's episode was produced by me, Kaitlyn Kiernan, engineered by John Williams and coordinated by Hannah Krobock. Until next time.

29:26 – 29:31

Outro Music

29:31 - 29:59

Disclaimer: Please note FINRA podcasts are the sole property of FINRA and the information provided is for informational and educational purposes only. The content of the podcast does not constitute any FINRA Rule or amendment or interpretation to such rules. Compliance with any recommended conduct presented does not mean that a firm or person has complied with the full extent of their obligations under FINRA Rules, the rules of any other SRO or securities laws. This podcast is provided as is. FINRA and its affiliates are not responsible for any human or mechanical errors or omissions. Parties may not reproduce these podcasts in any form without the express written consent of FINRA.