Ex-BNY Mellon Exec: ‘Vague’ Crypto Security Regulations Are Ideal

Rules to bolster blockchain security critical to crypto adoption, says former head of digital assets technology at BNY Mellon

article-image

vs148/Shutterstock modified by Blockworks

share

Vagueness and ambiguity might not always be the proper recipe to regulate an industry. 

But when it comes to crypto cybersecurity, guidelines that leave room for the self-regulation of an evolving sector is likely the best route, according to the former head of digital assets technology at BNY Mellon.

David Schwed joined blockchain cybersecurity firm Halborn as its chief operating officer in June 2022 after working for a year at BNY Mellon. He had, years earlier, spent time at the bank as a vice president of enterprise threat management. 

Aside from the stints at BNY Mellon, Schwed also formerly worked at traditional finance giants Citi and Merrill Lynch. He became the chief information security officer at Galaxy Digital in 2018.

Certain traditional financial risk management regulations, such as capital reserve requirements for custodians in the Dodd-Frank Act, can be easily ported over to crypto, the executive said.  

“When we get into [cybersecurity], that’s when things get a little bit trickier because, by design, regulations don’t necessarily dictate specific technologies or different tactics,” Schwed told Blockworks in an interview. “It’s meant to be broad enough that it’s changing. What was good today may not be good tomorrow, but you don’t want to keep changing regulation.”

Security is crucial, but what are appropriate guardrails?

Blockchain cybersecurity is crucial to mainstream adoption, Schwed said, as the prevalence of hacks can keep institutions on the sidelines and scare regulators.

But bank-level security for crypto doesn’t exist yet, and crypto’s “bearer asset” status attracts some of the most dangerous cyber crime groups, including North Korea’s Lazarus Group

“You’re not stealing credit card numbers and selling [them] on the black market,” Schwed said. “You steal it, you have it…and the best hackers in the world are now going after that.” 

Schwed pointed to the Gramm–Leach–Bliley Act (GLBA) — enacted in 1999 — as a potential model for blockchain cybersecurity regulation. The law requires financial institutions to safeguard customer data and reveal details to customers about their information-sharing practices.

The GLBA’s broad language around “maintaining appropriate safeguards,” for example, allowed financial companies to continue “raising the bar” around what the industry deemed to be acceptable, Schwed said. 

The same type of legislation with “vague and ambiguous” language could benefit the  crypto-related cybersecurity space, he added.  

“Once you kind of set that bar, you’re giving banking regulators the ability now to come in and maybe start setting that standard through banking examination,” Schwed said. “I don’t think explicit regulation is the way to go, because once you give people a framework and say you must do A, B, C and D, they’re only going to do A, B, C and D.”

States to lead on regulation?

Though there remains a lack of knowledge from regulators, as well as traditional technologists and security professionals, around crypto, “no one disagrees this is where the market’s headed,” Schwed said.

Larry Fink, the CEO of BlackRock, has emphasized the significance of tokenizing securities. This involves enabling the asset class to move on blockchains, and according to Fink, it represents the next generation for markets.

The SEC has launched various enforcement actions in recent months, alleging unregistered securities violations against industry firms. The CFTC has labeled various cryptocurrencies commodities, including ether (ETH) and tether (USDT) and litecoin — signaling a jurisdictional battle that adds another wrinkle to regulatory progress.  

“I believe in my heart of hearts that they want to come out with regulation, but they don’t want to do the wrong thing,” Schwed said. “I think they’re taking the time to figure things out.”

But as US policymakers and the country’s federal regulatory agencies move slowly, states could swoop in to fill in the gaps. 

Schwed called the cybersecurity policy within New York’s BitLicense regulation — implemented by the state’s Department of Financial Services in 2015 — “fairly comprehensive.”

“I think we saw a lot of companies running out of New York because they didn’t want to get the BitLicense, but I think we might start seeing the opposite,” Schwed said. “The BitLicense is a really great standard when it comes to cybersecurity, at least comparably, so maybe you start seeing some states stepping up and addressing where [the federal government’s] not coming in.”


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

recent research

Unlocked Advisory-min.png

Research

This report distills Blockworks Advisory’s research on incentive programs and their analysis, offering a foundation for designing future initiatives and advancing industry-wide standards. By highlighting key lessons and methodologies, we aim to empower protocols to make informed, data-driven decisions.

article-image

Crypto is “really exciting,” former SEC Commissioner Paul Atkins said in a podcast interview last year

article-image

Bitcoin is now the “seventh most valuable asset in the world by market cap, just behind the likes of Google and Amazon,” GSR’s Brian Rudick said

article-image

Many analysts expected bitcoin to top $100K before year-end, though it’s been on a post-election tear

article-image

Will investors take a 10% lower return to get access to a regulated investment wrapper?

article-image

Brian Armstrong called out the hire of Gurbir Grewal, who had been the SEC’s enforcement division director since 2021

article-image

Certain senators will be interested to learn about Atkins’s private sector business interests, specifically those related to crypto