At a recent discussion on anti-fraud regulations hosted by the Association of Certified Fraud Examiners, Alexandra Sagaro, chief compliance officer of Skrill, a digital wallet brand, and VP of compliance for North America at its parent company, Paysafe, shared her thoughts on crypto compliance in the US.
Here’s what CFOs should know to help their team set up a framework for crypto compliance.
Sagaro’s remarks have been excerpted from the panel discussion and edited for clarity and length. This is part two of Sagaro’s remarks. Click here for part one.
Cryptic crypto regulators. “I think one of the biggest challenges [in the US] is the ambiguity behind the regulators. What do they want to see? I think they’re still trying to figure that out, quite honestly…I think it takes big events like FTX for them to come in and focus on, what’s the problem, what’s the issue, what do you want to focus on? On the global side and the European side, they’re a little bit more advanced with digital assets and regulatory scrutiny.”
Building crypto compliance. “With a lot of digital assets, you don’t have a prescriptive, finite amount of rules and regulations. What we have are guardrails, and the initial guardrails for most of us are going to be BSA, AML compliance. Then, having industry standard conversations, as well as regulator conversations, are really going to fine-tune the direction we need to travel. How can we implement good strategy but also demonstrate we’ve done enough…and we’re actually checking off boxes for what our risk assessment says for whatever the product and service is. I think that is one of the biggest challenges.”
“A risk assessment is paramount. That’s how you determine what your control framework is going to look like, how you build your policies and then your procedures: Who’s going to do what, when, and what’s the timeline? Are there service-level agreements associated with that? Are there regulatory timelines?”
News built for finance pros
CFO Brew helps finance pros navigate their roles with insights into risk management, compliance, and strategy through our newsletter, virtual events, and digital guides.
“You have to educate yourself on industry standards. So how do you do some of that? Having collaborative sessions like this [panel]. What are other companies doing in the space? What are you seeing? What are the behaviors you’re mining for? How do we put in detection rules; what does that look like?”
“[You need] to understand how your company is using [digital assets]. What are you allowing in? Are you using sponsor banks? What are the sponsor bank’s requirements? In my business, on the money service business side of the house, we rely on a sponsor bank relationship. Those sponsor banks are obviously regulated by the OCC; they pass down their requirements to us on what they want to see. And so you have to build all of that into your compliance structure.”
Regulators vs. shiny object. “In digital assets specifically, we’re really guided [by] what kind of cases are hot for them. As we all know, especially during political seasons, governments change the scope of their policy. So what is a hot button today—it used to be drug trafficking—now, we’re moving on to other things…And with an election, we’re going to have someone [new] sitting in office, they’re going to have their agenda, and that’s going to tell all the federal regulators and law enforcement agencies the direction they need to travel down. We have to adapt to that as well, because what maybe wasn’t important to them before is now important…Change management is a practice; it has to be continuous. One thing I tell all the teams that I work with: ‘Okay, that may have worked yesterday, but it doesn’t work today. So how do we move forward?’”