FINRA’s Blockchain Lab: Regulation and Innovation For The Future

In this third and final episode in our series covering FINRA's ongoing crypto asset regulatory work, we hear from FINRA's Blockchain Lab, which serves as a central point within FINRA for the development of blockchain-related regulatory initiatives.

Michael Oh, Senior Director of the Blockchain Lab, Brian Huerbsch, a Senior Blockchain Data Analyst, and Jason Foye, Senior Director and head of FINRA's Crypto Hub share how the Lab is supporting and advancing FINRA's regulatory work involving crypto assets.

Resources mentioned in this episode:

Episode 136: An Introduction to FINRA’s Crypto Asset Work and the Crypto Hub

Episode 137: The Crucial Role of FINRA’s CAI Team

Investor Insights: What Is a Blockchain, and Why Should I Care?

FINRA Blog: An Inside Look into FINRA’s Crypto Asset Work

Listen and subscribe to our podcast on Apple Podcasts, Google Podcasts, Spotify or wherever you listen to your podcasts. Below is a transcript of the episode. Transcripts are generated using a combination of speech recognition software and human editors and may contain errors. Please check the corresponding audio before quoting in print. 

FULL TRANSCRIPT

00:00 - 00:30

Intro: No technology is more prominent in discussions about crypto assets than distributed ledger technology, also known as blockchain technology. In this third and final episode in our series covering FINRA's ongoing crypto asset regulatory work, we hear from FINRA's Blockchain Lab, which serves as a central point within FINRA for the development of blockchain-related regulatory initiatives to learn about how the Lab is supporting and advancing FINRA's regulatory work involving crypto assets.

00:30 – 00:40

Intro Music

00:40 - 01:28

Mike Rote: Welcome to FINRA Unscripted. I'm your host, Mike Rote. I'm excited to welcome three guests to today's show for the third and final episode in our three-part series on FINRA's crypto asset regulatory work. On the first episode, we learned about FINRA's enterprise-wide crypto asset strategy and the work of the Crypto Hub. On the last episode, we heard all about the work of the Crypto Asset Investigations Team, or CAI. Today, FINRA's Blockchain Lab will be in the spotlight. Joining us today are Michael Oh, Senior Director of the Blockchain Lab within the Office of Financial Innovation; Brian Huerbsch, a Senior Blockchain Data Analyst with the Blockchain Lab; and once again we have Jason Foye, Senior Director and head of FINRA's Crypto Hub. Michael, Brian, and Jason, welcome to the show.

01:28 - 01:29

Jason Foye: Thanks, Mike.

01:29 - 01:30

Michael Oh: Thank you.

01:30 - 01:36

Mike Rote: To kick us off, can you each introduce yourselves and tell us about your current roles at FINRA and a bit of background about how you got here?

01:37 - 01:53

Jason Foye: Sure thing, Mike. My name is Jason Foye and I serve as the Chief of FINRA's Crypto Hub, and I also lead FINRA's Special Investigations Unit, which is where FINRA houses our Anti-Money Laundering Investigations Unit and our Anti-Fraud Investigation Unit.

01:54 - 01:55

Mike Rote: Thanks, Jason. How about you, Michael?

01:56 - 02:16

Michael Oh: I've been at FINRA for a little over three years. My background is actually in emerging markets. I was an international economist with the government for some time and then moved into the private sector to be a sovereign risk analyst in the fixed income and currency space, and from there jumped from emerging market currencies to cryptocurrencies, joined some startups, did some teaching and then arrived here.

02:16 - 02:18

Mike Rote: Great. And Brian, how about you?

02:18 - 02:41

Brian Huerbsch: I'm a Senior Blockchain Data Analyst at the Blockchain Lab here at FINRA. Prior to joining FINRA, I was at the Treasury Department's Financial Crimes Enforcement Network, better known as FinCEN. And over the years there I wore several different hats. I was in their Enforcement and Compliance Division, I was also in their Intelligence Division, also in their Strategic Operations Division, essentially just working crypto asset-related issues across those three roles.

02:42 - 02:55

Mike Rote: Excellent. Well, thank you all. The third piece of FINRA's enterprise-wide crypto strategy revolves around blockchain. Jason, can you remind us about that piece of the strategy and how it fits in with the other two pieces?

02:55 - 03:57

Jason Foye: As we mentioned on the previous podcasts in the series, FINRA's overall crypto asset strategy involves three core areas. The first is conducting risk-based examinations and investigations of the crypto asset activities being conducted by our member firms and their associated persons. The second involves building for the future and enhancing our capabilities in this area. And the third is engaging in blockchain innovation to support and enhance FINRA's regulatory capabilities across all product types, but also specifically including crypto assets. Now, on the last episode we heard from our Crypto Asset Investigations Unit, or CAI, who are leading FINRA's efforts with respect to that first strategic goal. And in our first episode, we heard about the work of the Crypto Hub and our efforts to build for the future and enhance FINRA's capabilities in this area. And today, we're bringing in some folks from our Blockchain Lab who can shed some additional light on the work being done in that third and final strategic goal engaging in blockchain innovation.

03:58 - 04:05

Mike Rote: Thanks for bringing us up to speed. So, Michael, what is the Blockchain Lab and why was it created?

04:06 - 05:36

Michael Oh: So, as Jason mentioned, we were launched to enhance regulatory capabilities at FINRA. If you think about crypto asset activities, a lot of the activities resemble what we see in traditional financial markets. So, if, for example, someone wants to offer a token through a private placement, all the responsibilities for doing so for that entity still stand regardless of the type of asset that's being issued. But there are some ways in which the activities are fundamentally different because of the technology, and that's where the Blockchain Lab comes in to help enhance certain capabilities. So, if you think, for example, about custody. Custody is not something where a client takes the asset and gives it to their broker and the broker deposits at the DTC, or the Depository Trust Corporation. This is something where the assets reside on the blockchain and entities are able to move the crypto assets around through the safeguarding of private keys, which act as a password, so to speak.

Or if you think of the blockchain itself as a registry of ownership, it's a very different kind of registry insofar as it's a public distributed ledger that everyone can see and has access to. And so, that operates very differently than what we see in traditional financial markets. And so, when there are these gaps, so to speak, the Blockchain Lab comes in to either build new capabilities, so new software, for example, or to bring in outside capabilities and onboard people onto those capabilities or just develop expertise ourselves in terms of emerging issues and things that need to be understood across the organization so that any kind of decisions or actions can be well-informed.

05:37 - 05:45

Mike Rote: So, how is the Blockchain Lab then staffed, and what specialized skill sets do the members of the Blockchain Lab have?

05:46 - 06:58

Michael Oh: So, we are a team of five. There's myself, two analysts and two engineers. I think there are probably two defining characteristics of our team. One is that we are pretty cross-disciplinary in our skill sets, and that's just a function of what the space demands because the crypto asset system, or crypto networks, cross different disciplines, whether finance, for example, public/private markets or economics insofar as a lot of these disintermediated platforms rely on economic incentives for them to work, or law, public policy, cryptography, programming, data engineering. So, there are a lot of skills that are required to have a handle on in this space. And so, we try to check the boxes on all these different capabilities. The second characteristic is that we are heavy on the engineering side. So, as I said before, there are two engineers on the team and that’s just a function of, a.) we are tasked with building things, so we need to be able to develop software capabilities internally or; b.) if we're bringing in blockchain data directly from the blockchain, we need to develop a data architecture or data layer for FINRA staff to be able to use. And it's just good to have these technical capabilities insofar as if we want to understand how, for example, smart contracts work, what are the vulnerabilities, things like that, it's good to be able to get under the hood, understand technically how these things operate.

06:59 - 07:07

Mike Rote: So, the Blockchain Lab is relatively new, as is the Crypto Hub. Jason, how do the two groups then work together?

07:08 - 08:28

Jason Foye: Similar to what we talked about in the last episode with CAI, the Lab has a central role within the Hub and is involved in or helping to lead a range of different critical initiatives that the Hub is overseeing. At a high level, its role within the Hub and broader FINRA includes things like developing and deploying technology solutions that have been built internally; identifying, analyzing, and where needed, assisting in the deployment of third-party solutions that can assist FINRA with its regulatory functions; conducting open source research into crypto asset networks and crypto asset-related activities being conducted in order to identify potentially emerging trends or risk areas; assisting in the development and delivery of crypto asset-related training within FINRA as part of our overall efforts to enhance our capabilities in this space and serving as subject-matter experts internally for FINRA in terms of providing expertise on matters or other regulatory initiatives and blockchain technology; and also serving as subject-matter experts externally where needed—speaking at conferences, other compliance events and participating in things like recording of this podcast. This is really just a brief overview that only scratches the surface of the work that's being done on the Blockchain Lab and the incredible impact they're having.

08:29 - 08:36

Mike Rote: Michael, then, why is it so important to focus on this technology—blockchain—in particular?

08:36 - 10:24

Michael Oh: From my perspective, blockchain is at the core of these networks like Bitcoin or Ethereum that are driving some really interesting and, in some cases, disruptive innovations. So, if you think about Bitcoin, for example, the first network to have been introduced some time ago, it was probably the most audacious effort to challenge the notion of what is money, because Bitcoin isn't issued by some government. It doesn't belong to any jurisdiction, but it has certain money-like properties. And for sure no one in the U.S. is using Bitcoin to pay for their coffee, but it has certain store of value properties. And around the world where you have people who may not live in countries where there's a stable currency either because of high inflation or financially repressive policies, something like Bitcoin can be used as an alternative store of value in the same way that they might look to gold or the dollar as an alternative to their home currency.

If you go from Bitcoin to the next generation of blockchain networks, Ethereum, these smart contract networks, then you have something that's really interesting insofar as there are a lot of interesting experiments happening on these smart contract platforms. So, these smart contract platforms operate like a global distributed computer in the same way that you have a computer that runs applications or a mobile phone that has applications, something like Ethereum or a smart contract platform is this global distributed computer and uses these smart contracts to run the logic to run these different applications. And one difference between that and a typical computer is that instead of committing all the information from those transactions or from those smart contracts onto some hard drive, it's committed to the blockchain. And that blockchain is this immutable, reliable source of truth in terms of who owns what, basically when it comes to transaction data. So, there are a lot of really interesting things that are being experimented upon on these smart contract platforms. But the base of it, at the core of it, is this blockchain ledger that's helping to power these networks.

10:25 - 10:30

Mike Rote: So, what is the relevance of blockchain then, for the securities industry?

10:31 - 11:01

Michael Oh: I think a lot of people have taken note that if these smart contract platforms can essentially act as this new sediment layer, then why not reimagine how securities trading can be done on this new set of rails, so to speak? And so, the securities industry is still in an experimental stage exploring this possibility, or, not just using the blockchain as this new sediment layer but using smart contracts for activities on top. A lot of this experimentation is having a more private environment, a little more controlled, but that's what the industry is tinkering with right now, it seems.

11:02 - 11:07

Mike Rote: And how about some of these crypto assets when it comes to the investment space?

11:07 - 11:42

Michael Oh: So, apart from trying to reimagine how security is trading and securities operations can be performed, there's also the assets themselves, and that being an investable opportunity for investors. And so, right now the main opportunity set seems to be through exchange traded products so people can access Bitcoin through a futures fund, for example, or some trust products. And there could be the possibility for other ETPs being issued. There are some assets that are deemed to be securities that can be purchased and that might be a space that grows over time. But in terms of that investable opportunity, crypto assets are becoming something that should be coming into the securities industry more and more.

11:43 - 11:50

Mike Rote: You talked a little bit about the Blockchain Lab. What are the near-term or maybe long-term goals and priorities of the Lab?

11:51 - 14:10

Michael Oh: In terms of near-term priorities, it's really about meeting the needs for existing responsibilities. So, Jason talked about investigations, examinations. You talked to the CAI, Crypto Asset Investigations, before. So, they have responsibilities right now in terms of overseeing existing activity. And so, we're partnering closely with them, for example, for onboarding certain capabilities to understand how to track the movement of funds. So, if there is a case where there's a registrant that has done something that's fraudulent on the blockchain, then we can see that because it's a publicly auditable technology, we can track and trace how the funds have flowed for that particular case. One other priority project has to do with what I mentioned before around custody. So, to the extent that custody is not done through having your broker hold the security for you and where it's about safeguarding the private keys, we have developed a tool internally where we can ask the broker-dealer or the registrant who has custody in crypto assets to verify that they are safeguarding those private keys without their having to reveal those keys to us. And this is all done using cryptographic algorithms.

Now, we're also trying to prepare for emerging responsibilities. FINRA does a lot of cross-market surveillance in the securities space. And so, to the extent that in some future state there is a place for FINRA to be running surveillance in crypto market exchanges, then we're having conversations with Market Regulation on what does the market structure look like in terms of this is a 24/7 market. Liquidity is globally fragmented, trading is happening off chain in terms of the centralized exchanges that we know of, but also on chain in terms of decentralized exchanges. And so, there's interactions between different platforms.

So, there's a lot of different market structure issues. And so, we're partnering with them to understand what those are, as well as bringing the data so we can assess what kind of surveillance we can run. And longer term, we just feel that more and more activity is going to be moving on chain. And we think that a lot of these networks will become more scalable, more secure, and more people will feel comfortable establishing operations on chain. So, if that's the case, and these chains are public databases where we can get the data immediately, then we want to pursue a stance of what's called embedded supervision, where we're bringing in all this data, we don't have to ask any of the registrants for the data, but we have it in-house and we're able to use that data to understand exactly what's going on in these blockchain networks.

14:11 - 14:28

Mike Rote: It's a lot of innovation then, going on, and obviously that requires a lot of coordination. On that subject, how does the Blockchain Lab coordinate with FINRA's regulatory operations or, say, FINRA's Technology Team, to turn business needs into capabilities?

14:28 - 15:26

Michael Oh: It's the core of how we pursue our partnerships with the business. And so, I think the way to characterize our engagement is that our engagement tends to be frontloaded. And so, to the extent that we're working with a member application or Market Regulation or Enforcement, whomever, there's typically an engagement that tries to identify a need, and then we try to develop some kind of solution, whether it's building something in-house and prototyping something or identifying external solutions, or if there's a problem that we need to understand doing that research and teeing it up for others to maybe take and do deeper analysis on.

So, we might partner with the economists and be like, this is an issue that deserves further scrutiny, or, if there's a certain need with any of the business groups, we'll try to prototype some kind of solution. But then at some point, technology in terms of putting these solutions into production is something that we're going to be handing off to them and to the businesses. So again, our involvement tends to be more frontloaded in terms of identifying and prototyping a solution. And then when things go into production, it's often the business or the technology that will take it from there.

15:27 - 15:41

Mike Rote: That's a great segue. Brian, we're going to put you in the hot seat. How is regulatory oversight in crypto, with so much information publicly available on the blockchain, differing from traditional regulatory oversight?

15:42 - 20:58

Brian Huerbsch: Honestly, I think we could talk about this one for ages, so I'll do my best to keep it short. But the fundamental difference between regulatory oversight as it pertains to crypto and as it doesn't pertain to crypto, just in the traditional sense, is blockchain data. And so, this is going to relate to a lot of what Jason and Mike have already talked about or referred to, but essentially, blockchain data is publicly available. Anybody with the right skill set, the right tools, the right set of knowledge can go and access this data. It's there and you can access it. And so, that may not seem like this revolutionary, grand difference between the traditional regulatory oversight world and, of course, as it differs or as it relates to the crypto side. But it really is, and I do think it's hard to appreciate it sometimes, how amazing this quality is. But we've already seen it have a huge impact in the regulatory space and I believe it's going to continue having a really big impact going forward.

So, Mike has alluded to this in some of his answers. A lot of activity is moving from the traditional finance base, as we say, on chain onto these public networks, onto these blockchains. And so, as more activity moves on chain and as more assets move on chain, then it becomes a more important data source for us to access and also have the ability to use and analyze and in certain instances, even interact with. So, maybe it would be helpful to just illustrate these differences a little bit. I'm going to focus on the data, specifically. We just went over blockchain data, traditional information and traditional regulatory oversight. What does that look like? Well, it's a ton of different data types. So, you have legal information, you have open-source intelligence, you have information that may come from a particular legal process, perhaps an exchange was subpoenaed or there was a subpoena sent somewhere to pull information. All these different data types really exist in separate places, and the quality of the data is also going to be variable.

And so, in traditional regulatory oversight, you're tasked with using all of these different data types to make these decisions. But there's friction and there are challenges, and those challenges essentially stem from the quality. And then of course, having to grab all these disparate data points and silos of information and then make sense of them and then of course, do something with that information. And so, human error also goes into it a little bit. If it's not a machine doing something programmatically, well, then people make mistakes. It happens. I think it's just important to recognize these differences because the blockchain, it's available freely to everybody. You don't have to have permission to access it. And then very importantly, it's secure and tamper proof. And even if somebody did try to tamper with it, you could see that because all activity is known on a blockchain. And so, I think these are features of blockchain data in particular that just lend themselves incredibly well to regulatory oversight. And then finally there's the trust factor.

So, without going into great detail, essentially you just have all of these different entities and groups and people all over the world that are agreeing on certain pieces of information prior to appending them to their respective chains. And so, you do have this degree of trust in the data itself that differs from what we just talked about, where there's just so much more human error that can enter into play in some of the traditional data types and information sources that you would encounter in traditional regulatory oversight. I do think it's important to note, though, that you're always going to be using both, or ideally you should use both. Even though blockchain data has all these amazing qualities, you still need to use all of these other sources of information and data in the regulatory oversight process. And then finally, even if there's perhaps limited human error as it pertains to blockchain data and the analysis of that data, there's obviously a lot of potential for human error when you're analyzing this data and attributing it properly. And so, I'm going to talk about attribution really quickly because it's incredibly important to the regulatory oversight process as it pertains to blockchain data.

Attribution is just simply connecting a real-world identity of a person or entity to a piece of blockchain information. This is a really big challenge in the regulatory space, attribution specifically. And what's interesting to know is we're already working on this to a certain degree here at FINRA, meaning conducting our own attribution, essentially the universe of activity that's done on a blockchain by any specific person or group of people or entities. Once we have that attribution and once we're able to know who's doing what, well then we can identify a lot of interesting, relevant points, such as maybe the source of wealth. Where did the money come from to begin with, or who were the counterparties? Are they risky counterparties, et cetera. It gives us the ability to know so much more. I think potentially the most important difference is blockchain data you can program on top of. There are other forms of data that you can do this with in the traditional sense, but not to the same degree that you can do this with blockchain data. And so, we want to set up mechanisms and create tools and build tools and build methods for us to be able to program on top of some of this data so that it can allow us here at FINRA, wherever you sit in FINRA, to make better decisions as it relates to crypto asset activity.

20:59 - 21:11

Mike Rote: So, what kinds of investigative capabilities and tools are you working to develop, and how are you coordinating with regulatory operations and technology to develop them?

21:12 - 22:04

Brian Huerbsch: I think it's early days still. The short answer is that the Lab is looking into tools that are going to have a meaningful impact here at FINRA. So, these are the investigative tools that allow us to essentially follow the money on blockchains. And so, as far as developing these capabilities, what that means is essentially upskilling. We need folks that can grab any one of these tools and then essentially be able to follow the money or do whatever they need to do with the tool to find the information so that they can make a good decision for the department and then, of course, for FINRA. That's one aspect of this. The other is more macro, where we're looking at tools that are going to allow us once again to proactively try to identify information, identify signals and all this noise of blockchain data that's going to allow us to make a real impact here. And I think the Lab is perfectly placed to lead on this.

22:05 - 22:16

Mike Rote: So, you talked about acquiring tools or building them. For someone who's, say, lesser tech savvy like myself, admittedly, what's the difference between, say, acquiring tools or building them?

22:17 - 23:37

Brian Huerbsch: That's a great question. So, the way I see it is there's a responsibility and it needs to be met. And so, sometimes we don't have the luxury of sitting and thinking through an ideal scenario where we can build something. So, in that sense, it makes sense to really find a tool that exists that will give us the feature set that we need. Now, the main difference between purchasing tools and building them is going to be cost, most often. That's the friction in terms of deciding between whether to buy something or whether to build it. Building takes time. Building also takes resources. And so, in that sense, it does make sense to build when you have the luxury of time and the ability to do this correctly. I do want to point out when you purchase tools, you're working within a very defined set of features and they can be incredible features, but you can't do anything else out of those features. And so, when we're building tools, we get the benefit of choice. We get to decide exactly how we're going to build them and what we're going to build them for. And so, I think that's an important consideration and point. It doesn't always make sense to go buy an expensive tool. And then there are cybersecurity implications as well. Sometimes we want to do things internally on our own network that we wouldn't want to do externally or on a vendor's platform.

23:38 - 23:52

Mike Rote: It makes a lot of sense and it's great for FINRA and the Blockchain Lab to have both the capability and the flexibility to do both when needed, which is fantastic. How does the Blockchain Lab work with people and organizations outside of FINRA?

23:53 - 24:34

Brian Huerbsch: In my experience so far, the Lab is always looking for new and interesting perspectives and research in this space, and we have prior relationships with folks working on crypto asset-related issues at different regulatory agencies. So, whether it's SEC or the Treasury or CFTC, we have these relationships that already exist and in some instances we're creating new relationships. And so, there's the public aspect where we work with our fellow regulators, and then there's the other side, which is that there are a lot of incredible thought leaders in this space. And it just makes sense to really learn where you need to learn from somebody else or to engage in dialogue or conversation and build those relationships out as well.

24:34 - 25:22

Michael Oh: To build upon what Brian was saying, we are very active in collaborating and working with other agencies and there are a few different goals for that. One is just to be able to share notes in terms of what they're doing, what they're seeing, what the emerging issues are, the emerging risks, what are the capabilities that they're building. And so, some things that we've done here at FINRA is a few months ago, we hosted a cross-agency crypto asset conference where we brought a dozen or so agencies together and we were able to do that—share perspectives, form a network so that our efforts could be a little more cohesive. Then every December we bring the agencies together also for another opportunity to share notes, perspectives and things like that. So, it is an important part of what we do. It's also important to note that we are active in trying to engage the industry in terms of understanding what is being built on the technology front and to understand the market issues.

25:23 - 25:56

Brian Huerbsch: It's important to note that a lot of the challenges faced by FINRA are going to be challenges faced across this fragmented regulatory landscape that Mike was talking about. So, whether it's the SEC, CFTC, whether it's Treasury, it could even be not even in the regulatory landscape. A lot of the issues and challenges are actually the same. And so, in solving some of that here in-house or when other regulators saw them in house as well, then there are benefits to that, to the broader regulatory community rather than just one single organization.

25:57 - 26:04

Mike Rote: Great. So, obviously a lot going on with the Blockchain Lab, but how do you see the Blockchain Lab evolving from here?

26:05 - 26:54

Michael Oh: I think I see the Blockchain Lab evolving in a few ways. One is that there's going to be a lot of attention on regulating intermediaries. So, if you think of exchanges or lending platforms, things like that, what are the ways in which there can be oversight that makes these activities safe? Further out, there's probably going to be more attention on decentralized platforms. And these are platforms where it's really code, smart contracts that are delivering the same kind of logic that you see in traditional financial services. It's different kinds of risks that we have to be aware of and perhaps different modes of regulation that have to be adopted. And in that space also much of the regulation will happen on chain. So, I think that's a longer-term trend. But I think in the shorter term, a lot of the focus is going to be on intermediaries that we have oversight responsibilities over.

26:55 - 27:13

Brian Huerbsch: At the end of the day, we're here to protect investors and ensure market integrity. And some of that is already touching the blockchain space and has touched on the blockchain space. And so, I think the Lab is uniquely positioned to make an impact here, and I'm really excited to be a part of that and build out, where necessary, some of these solutions internally.

27:13 - 27:53

Mike Rote: We have a lot to look forward to. Well, that's it for today's episode of FINRA Unscripted. And that's it for our three-part series on FINRA's crypto asset regulatory work. Mike, Brian, Jason, thank you so much for joining me to talk about the Blockchain Lab. Listeners, if you don't already, be sure to subscribe to FINRA wherever you listen to podcasts to stay up to date on all our latest episodes. While this was our last episode in this three-part series, I'm sure it is not the last we'll be hearing about this topic. Today's episode was produced by Kaitlyn Kiernan, engineered by John Williams and coordinated by Hannah Krobock. Until next time.

27:53 – 27:58

Outro Music

27:58 - 28:25

Disclaimer: Please note FINRA podcasts are the sole property of FINRA and the information provided is for informational and educational purposes only. The content of the podcast does not constitute any FINRA Rule or amendment or interpretation to such rules. Compliance with any recommended conduct presented does not mean that a firm or person has complied with the full extent of their obligations under FINRA Rules, the rules of any other SRO or securities laws. This podcast is provided as is. FINRA and its affiliates are not responsible for any human or mechanical errors or omissions. Parties may not reproduce these podcasts in any form without the express written consent of FINRA.