Ex-BNY Mellon Exec: ‘Vague’ Crypto Security Regulations Are Ideal

Rules to bolster blockchain security critical to crypto adoption, says former head of digital assets technology at BNY Mellon

article-image

vs148/Shutterstock modified by Blockworks

share

Vagueness and ambiguity might not always be the proper recipe to regulate an industry. 

But when it comes to crypto cybersecurity, guidelines that leave room for the self-regulation of an evolving sector is likely the best route, according to the former head of digital assets technology at BNY Mellon.

David Schwed joined blockchain cybersecurity firm Halborn as its chief operating officer in June 2022 after working for a year at BNY Mellon. He had, years earlier, spent time at the bank as a vice president of enterprise threat management. 

Aside from the stints at BNY Mellon, Schwed also formerly worked at traditional finance giants Citi and Merrill Lynch. He became the chief information security officer at Galaxy Digital in 2018.

Certain traditional financial risk management regulations, such as capital reserve requirements for custodians in the Dodd-Frank Act, can be easily ported over to crypto, the executive said.  

“When we get into [cybersecurity], that’s when things get a little bit trickier because, by design, regulations don’t necessarily dictate specific technologies or different tactics,” Schwed told Blockworks in an interview. “It’s meant to be broad enough that it’s changing. What was good today may not be good tomorrow, but you don’t want to keep changing regulation.”

Security is crucial, but what are appropriate guardrails?

Blockchain cybersecurity is crucial to mainstream adoption, Schwed said, as the prevalence of hacks can keep institutions on the sidelines and scare regulators.

But bank-level security for crypto doesn’t exist yet, and crypto’s “bearer asset” status attracts some of the most dangerous cyber crime groups, including North Korea’s Lazarus Group

“You’re not stealing credit card numbers and selling [them] on the black market,” Schwed said. “You steal it, you have it…and the best hackers in the world are now going after that.” 

Schwed pointed to the Gramm–Leach–Bliley Act (GLBA) — enacted in 1999 — as a potential model for blockchain cybersecurity regulation. The law requires financial institutions to safeguard customer data and reveal details to customers about their information-sharing practices.

The GLBA’s broad language around “maintaining appropriate safeguards,” for example, allowed financial companies to continue “raising the bar” around what the industry deemed to be acceptable, Schwed said. 

The same type of legislation with “vague and ambiguous” language could benefit the  crypto-related cybersecurity space, he added.  

“Once you kind of set that bar, you’re giving banking regulators the ability now to come in and maybe start setting that standard through banking examination,” Schwed said. “I don’t think explicit regulation is the way to go, because once you give people a framework and say you must do A, B, C and D, they’re only going to do A, B, C and D.”

States to lead on regulation?

Though there remains a lack of knowledge from regulators, as well as traditional technologists and security professionals, around crypto, “no one disagrees this is where the market’s headed,” Schwed said.

Larry Fink, the CEO of BlackRock, has emphasized the significance of tokenizing securities. This involves enabling the asset class to move on blockchains, and according to Fink, it represents the next generation for markets.

The SEC has launched various enforcement actions in recent months, alleging unregistered securities violations against industry firms. The CFTC has labeled various cryptocurrencies commodities, including ether (ETH) and tether (USDT) and litecoin — signaling a jurisdictional battle that adds another wrinkle to regulatory progress.  

“I believe in my heart of hearts that they want to come out with regulation, but they don’t want to do the wrong thing,” Schwed said. “I think they’re taking the time to figure things out.”

But as US policymakers and the country’s federal regulatory agencies move slowly, states could swoop in to fill in the gaps. 

Schwed called the cybersecurity policy within New York’s BitLicense regulation — implemented by the state’s Department of Financial Services in 2015 — “fairly comprehensive.”

“I think we saw a lot of companies running out of New York because they didn’t want to get the BitLicense, but I think we might start seeing the opposite,” Schwed said. “The BitLicense is a really great standard when it comes to cybersecurity, at least comparably, so maybe you start seeing some states stepping up and addressing where [the federal government’s] not coming in.”


Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

HYATT REGENCY SALT LAKE CITY

TUES, OCT. 8, 2024

Guided by the expertise of Blockworks Research Analysts team, this one day event will feature senior leaders, entrepreneurs, and developers from across the crypto industry. Attendees will have the opportunity to participate in an immersive experience to explore the latest trends, […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

hivemapper.jpeg

Research

We believe crypto market participants overlook Hivemapper’s fundamental potential due to a poor understanding of both the niche map data market and Hivemapper’s positioning relative to incumbents. Hivemapper’s token model catalyzes both a cost and product advantage via unmatched map freshness and near real-time accuracy, which is its wedge into a market characterized by stale data and high data collection costs. Its current and potential future product suite may represent one of the strongest possibilities for PMF in crypto today.

article-image

👨‍⚖️ SBF’s courtroom sequel: Plus, Coinbase’s legal loss was DeFi’s gain

article-image

Public mining companies have been acquiring sites, refreshing machine fleets and diversifying business models in preparation for the event

article-image

Exploit shows centralization can sometimes be an asset

article-image

The Fidelity Ethereum Fund, like other proposed ETH ETFs, seeks to stake a portion of its assets, according to the firm’s Wednesday registration statement

article-image

The DAO first voted on enabling SAFE transfers over a year ago