Main content

Decentralized Finance: Regulating Cryptocurrency Exchanges

Kristin N. Johnson

Despite federal and state regulators’ warnings and mounting civil and criminal enforcement actions, investors continue to flock to cryptocurrency markets, buying coins and tokens in initial coin offerings (ICOs). At its high-water mark in 2021, exponential growth characterized the trillion-dollar cryptocurrency market. As governments, private stakeholders, and academics cast a spotlight on ICOs, a shadow fell, obscuring nefarious activity on cryptocurrency exchanges.

Simply stated, bad actors swarm secondary market trading in cryptocurrency markets. Consider the case of Bitfinex. Founded in 2012, Bitfinex has survived Ocean’s Eleven-style heists that emptied hundreds of millions of dollars of customer assets from its coffers. Periodic cyberattacks have temporarily paralyzed Bitfinex’s platform, suspending trading and halting customer withdrawals. For cryptocurrency exchanges, however, cybersecurity threats are all too common and only the tip of the iceberg.

Cryptocurrency exchanges navigate this diverse array of risks. The aggregation of these enterprise risks may undermine a firm’s operational integrity and lead to a solvency crisis. In 2013, for example, Mt. Gox—the world’s largest cryptocurrency exchange at the time—declared bankruptcy. Following stunning acts of fraud, theft, and mismanagement, Mt. Gox acknowledged losses of over 850,000 Bitcoins worth nearly than $40 billion today.

Traditional banks may limit the types of accounts available to cryptocurrency exchanges. As a result, cryptocurrency exchanges may rely on unconventional financial transfer practices, financial institutions chartered outside the United States, unchartered financial institutions or “shadow banks.” These arrangements often lack the regulatory oversight and insurance protections available to banking and trading accounts offered by legacy financial institutions. In other words, the exchange platforms and customers’ accounts are vulnerable to internal and external predators. 

Bitfinex, for example, initially routed customer transactions through a Taiwanese bank to Wells Fargo. On April 18, 2017, Wells Fargo began blocking Bitfinex wire transfers. Bitfinex pivoted to a Puerto Rican bank— Noble Bank. On October 1, 2018, Noble Bank lunged toward bankruptcy. Bitfinex transferred $850 million to a Panamanian nonbank payment processing platform — Crypto Capital. Another fleeting solution. Within a year, the Polish government arrested Crypto Capital’s President Ivan Manuel Molina Lee for his role laundering money on behalf of an international drug cartel. Bitfinex shocked the cryptoworld, announcing that the $850 million in customer funds held by Crypto Capital had vanished.

Unfortunately, Bitfinex’s risk-management concerns are not unique. Many exchanges offering cryptocurrency transfer, custody, and exchange services grapple with operational and systemic risks: fake bank accounts, mismanagement of customer funds, blatant theft, garden-variety fraud, and exploitative and abusive trading strategies. Conflicts of interest, woefully deficient compliance controls, anemic consumer protection policies, and remarkably inadequate cybersecurity measures also present endemic challenges.

Stunningly, none of the 300 trading platforms facilitating cryptocurrency secondary market transactions has obtained formal authorization to operate an exchange platform. Regulators have formally prosecuted only a handful of trading platforms. Most troubling, however, are the breadth and depth of these challenges among the small group of actors that has captured the greatest market share in global cryptocurrency secondary trading markets. Why is it that Congress and regulators have yet to impose order in the Wild West of cryptocurrency secondary market trading?

Financial services regulation is complex and growing more complex each day. The innovative creation of cryptocurrency challenges established regulation, prompting reexamination of foundational questions such as what exactly (transactions, activities, or financial instrument characteristics or attributes) gives rise to regulatory intervention. Some argue regulating these “novel” financial products should be a regulatory priority.

Complicated financial products precipitated the financial crisis that began in 2007, and, in the wake of the crisis, many were disillusioned. Many perceived legacy financial institutions and other market participants’ behavior as avaricious, self-serving, and predatory, initiating a polarized debate regarding the federal government’s $700 billion bailout of Wall Street intermediaries. Developers began to imagine a financial services industry without traditional intermediaries — depository banks, investment banks, stock exchanges, brokers, and dealers. Purportedly, peer-to-peer distributed digital ledger technology eliminates legacy financial market intermediaries such as investment banks, depository banks, exchanges, clearinghouses, and broker-dealers.

Financial technology (“fintech”) firms and individual developers began creating protocols that could create alternative financial products and services designed to disrupt conventional financial markets and displace legacy financial institutions. One of their most popular developments — peer-to-peer distributed digital ledger platforms, commonly described as “blockchain” technologies — inspired the creation of Bitcoin. Since the publication of the Bitcoin blockchain White Paper in 2010, markets have witnessed the origination of more than 5,000 cryptocurrencies. In the ensuing decade, regulators have scrambled to keep pace.

The development of digital assets has marked a transformative moment in the evolution of the financial markets ecosystem. Central banks, national governments, and significant financial institutions increasingly signal an interest in the origination, distribution, and exchange of cryptocurrencies. Indisputably, these coins and tokens have moved from the shadows to center stage.

Yet, careful examination reveals that cryptocurrency issuers and the firms that offer secondary market cryptocurrency trading services have not quite lived up to this promise. Notwithstanding cryptoenthusiasts’ calls for disintermediation, evidence reveals that platforms that facilitate cryptocurrency trading frequently employ the long-adopted intermediation practices of their traditional counterparts. In fact, when emerging technologies fail, crypto-coin and token trading platforms partner with and rely on traditional financial services firms. As a result, these platforms face many of the risk-management threats that have plagued conventional financial institutions as well as a host of underexplored threats. Increasingly, market participants report the integration of automated or algorithmic trading strategies, accelerated high frequency trading tactics, and sophisticated cyber-heists. Each of these threats leaves crypto-investors vulnerable to predatory practices.

Following the Flash Crash in 2010, algorithmic trading is one of the most rapidly expanding and closely monitored financial markets trading strategies in the world. In a quiet revolution, computer-based trading programs are rapidly replacing human traders. As one commentator observes “[t]hese changes mark the end of the era of specialists and physical execution of trades on legacy exchanges.” Moreover, computer- based trading programs have had a significant impact on the volume and speed of securities market transactions.

Due to the efficiencies and reduced costs, algorithmic trading has seized an increasingly dominant role in financial markets. Historically, executing trades required relaying orders to buy or sell a security to an intermediary such as a broker-dealer; the broker-dealer would manually enter the solicited trade and, based on the asset price reflected in the exchange order book, identify a counterparty willing to execute a trade for the solicited asset. 

Today, sophisticated investors may program trading platforms to execute automated trading strategies. These trading bots have the capacity to evaluate vast volumes of data and respond in fractions of a second to the release of information in markets. Algorithmic trading automates trade execution, reducing if not eliminating the role of intermediaries, and calculates market, credit, and other risks of conventional and complex, structured, or leveraged trades. The introduction of artificial intelligence and algorithmic trading strategies has led to even more sophisticated automated trading programs.

Regulators are also concerned that these tactics may also enable insider trading. Insiders may engage in nefarious trading practices such as inundating cryptocurrency exchanges and clearinghouses with fictitious trades to manipulate the price of listed cryptocurrencies. Such manipulative practices may undermine price discovery and price accuracy. Errors or malfunctions arising from market participants’ reliance on automated trading on cryptocurrency exchanges may also lead to rapid but short-lived precipitous declines in the pricing of cryptocurrencies. Furthermore, algorithmic trades often have substantial correlations; thus, shocks that hit a small number of very active high frequency traders may detrimentally affect the entire market.

These changes radically alter the playing field in trading markets, particularly cryptocurrency secondary trading markets. Consequently, this Article rejects the dominant regulatory narrative that prioritizes oversight of primary market transactions. Instead, this Article proposes that regulators introduce formal registration obligations for cryptocurrency intermediaries — the exchange platforms that provide a marketplace for secondary market trading. This Article recommends employing a registration process whereby platforms signal and can subsequently amend registration forms indicating the specific financial product or service they offer and the extent of their reliance on intermediation. Even firms that claim to have achieved disintermediation or decentralization would register to indicate their status. Such an approach creates an immediate pathway to enable regulators to impose order in secondary cryptocurrency markets. This proposal parallels the existing Commodity Futures Trading Commission practice of self-certification. While significant concerns persist including regulatory arbitrage, competition, and regulatory costs, careful construction of the self-designation process and periodic review and assessment may address many of these concerns. 

Having premised so much of financial markets regulation on the presumption of intermediation, it may be useful to consider the need for intervention, market oversight, or enforcement aimed at achieving the longstanding regulatory goals of promoting investor protection, facilitating capital formation by establishing fair and orderly markets, and mitigating risks that disrupt and destabilize markets.

This approach recognizes the dynamic nature of cryptocurrency secondary market actors seeking to achieve disintermediation yet balances these potential benefits with normative regulatory goals— protecting investors from fraud, theft, misconduct, and manipulation; enforcing accountability; preserving market integrity; and addressing enterprise and systemic risk-management concerns. 

— from Decentralized Finance: Regulating Cryptocurrency Exchanges, 62 William & Mary Law Review 1911 (2021)