Ex-BNY Mellon Exec: ‘Vague’ Crypto Security Regulations Are Ideal

Vagueness and ambiguity might not always be the proper recipe to regulate an industry. 

But when it comes to crypto cybersecurity, guidelines that leave room for the self-regulation of an evolving sector is likely the best route, according to the former head of digital assets technology at BNY Mellon.

David Schwed joined blockchain cybersecurity firm Halborn as its chief operating officer in June 2022 after working for a year at BNY Mellon. He had, years earlier, spent time at the bank as a vice president of enterprise threat management. 

Aside from the stints at BNY Mellon, Schwed also formerly worked at traditional finance giants Citi and Merrill Lynch. He became the chief information security officer at Galaxy Digital in 2018.

Certain traditional financial risk management regulations, such as capital reserve requirements for custodians in the Dodd-Frank Act, can be easily ported over to crypto, the executive said.  

“When we get into [cybersecurity], that’s when things get a little bit trickier because, by design, regulations don’t necessarily dictate specific technologies or different tactics,” Schwed told Blockworks in an interview. “It’s meant to be broad enough that it’s changing. What was good today may not be good tomorrow, but you don’t want to keep changing regulation.”

Security is crucial, but what are appropriate guardrails?

Blockchain cybersecurity is crucial to mainstream adoption, Schwed said, as the prevalence of hacks can keep institutions on the sidelines and scare regulators.

But bank-level security for crypto doesn’t exist yet, and crypto’s “bearer asset” status attracts some of the most dangerous cyber crime groups, including North Korea’s Lazarus Group. 

“You’re not stealing credit card numbers and selling [them] on the black market,” Schwed said. “You steal it, you have it…and the best hackers in the world are now going after that.” 

Schwed pointed to the Gramm–Leach–Bliley Act (GLBA) — enacted in 1999 — as a potential model for blockchain cybersecurity regulation. The law requires financial institutions to safeguard customer data and reveal details to customers about their information-sharing practices.

The GLBA’s broad language around “maintaining appropriate safeguards,” for example, allowed financial companies to continue “raising the bar” around what the industry deemed to be acceptable, Schwed said. 

The same type of legislation with “vague and ambiguous” language could benefit the  crypto-related cybersecurity space, he added.  

“Once you kind of set that bar, you’re giving banking regulators the ability now to come in and maybe start setting that standard through banking examination,” Schwed said. “I don’t think explicit regulation is the way to go, because once you give people a framework and say you must do A, B, C and D, they’re only going to do A, B, C and D.”

States to lead on regulation?

Though there remains a lack of knowledge from regulators, as well as traditional technologists and security professionals, around crypto, “no one disagrees this is where the market’s headed,” Schwed said.

Larry Fink, the CEO of BlackRock, has emphasized the significance of tokenizing securities. This involves enabling the asset class to move on blockchains, and according to Fink, it represents the next generation for markets.

The SEC has launched various enforcement actions in recent months, alleging unregistered securities violations against industry firms. The CFTC has labeled various cryptocurrencies commodities, including ether (ETH) and tether (USDT) and litecoin — signaling a jurisdictional battle that adds another wrinkle to regulatory progress.  

“I believe in my heart of hearts that they want to come out with regulation, but they don’t want to do the wrong thing,” Schwed said. “I think they’re taking the time to figure things out.”

But as US policymakers and the country’s federal regulatory agencies move slowly, states could swoop in to fill in the gaps. 

Schwed called the cybersecurity policy within New York’s BitLicense regulation — implemented by the state’s Department of Financial Services in 2015 — “fairly comprehensive.”

“I think we saw a lot of companies running out of New York because they didn’t want to get the BitLicense, but I think we might start seeing the opposite,” Schwed said. “The BitLicense is a really great standard when it comes to cybersecurity, at least comparably, so maybe you start seeing some states stepping up and addressing where [the federal government’s] not coming in.”

---

Get the news in your inbox. Explore Blockworks newsletters:

• Blockworks Daily: Unpacking crypto and the markets.
• Empire: Crypto news and analysis to start your day.
• Forward Guidance: The intersection of crypto, macro and policy.
• 0xResearch: Alpha directly in your inbox.
• Lightspeed: All things Solana.
• The Drop: Apps, games, memes and more.
• Supply Shock: Bitcoin, bitcoin, bitcoin.