Ex-BNY Mellon Exec: ‘Vague’ Crypto Security Regulations Are Ideal

Rules to bolster blockchain security critical to crypto adoption, says former head of digital assets technology at BNY Mellon


vs148/Shutterstock modified by Blockworks


Vagueness and ambiguity might not always be the proper recipe to regulate an industry. 

But when it comes to crypto cybersecurity, guidelines that leave room for the self-regulation of an evolving sector is likely the best route, according to the former head of digital assets technology at BNY Mellon.

David Schwed joined blockchain cybersecurity firm Halborn as its chief operating officer in June 2022 after working for a year at BNY Mellon. He had, years earlier, spent time at the bank as a vice president of enterprise threat management. 

Aside from the stints at BNY Mellon, Schwed also formerly worked at traditional finance giants Citi and Merrill Lynch. He became the chief information security officer at Galaxy Digital in 2018.

Certain traditional financial risk management regulations, such as capital reserve requirements for custodians in the Dodd-Frank Act, can be easily ported over to crypto, the executive said.  

“When we get into [cybersecurity], that’s when things get a little bit trickier because, by design, regulations don’t necessarily dictate specific technologies or different tactics,” Schwed told Blockworks in an interview. “It’s meant to be broad enough that it’s changing. What was good today may not be good tomorrow, but you don’t want to keep changing regulation.”

Security is crucial, but what are appropriate guardrails?

Blockchain cybersecurity is crucial to mainstream adoption, Schwed said, as the prevalence of hacks can keep institutions on the sidelines and scare regulators.

But bank-level security for crypto doesn’t exist yet, and crypto’s “bearer asset” status attracts some of the most dangerous cyber crime groups, including North Korea’s Lazarus Group

“You’re not stealing credit card numbers and selling [them] on the black market,” Schwed said. “You steal it, you have it…and the best hackers in the world are now going after that.” 

Schwed pointed to the Gramm–Leach–Bliley Act (GLBA) — enacted in 1999 — as a potential model for blockchain cybersecurity regulation. The law requires financial institutions to safeguard customer data and reveal details to customers about their information-sharing practices.

The GLBA’s broad language around “maintaining appropriate safeguards,” for example, allowed financial companies to continue “raising the bar” around what the industry deemed to be acceptable, Schwed said. 

The same type of legislation with “vague and ambiguous” language could benefit the  crypto-related cybersecurity space, he added.  

“Once you kind of set that bar, you’re giving banking regulators the ability now to come in and maybe start setting that standard through banking examination,” Schwed said. “I don’t think explicit regulation is the way to go, because once you give people a framework and say you must do A, B, C and D, they’re only going to do A, B, C and D.”

States to lead on regulation?

Though there remains a lack of knowledge from regulators, as well as traditional technologists and security professionals, around crypto, “no one disagrees this is where the market’s headed,” Schwed said.

Larry Fink, the CEO of BlackRock, has emphasized the significance of tokenizing securities. This involves enabling the asset class to move on blockchains, and according to Fink, it represents the next generation for markets.

The SEC has launched various enforcement actions in recent months, alleging unregistered securities violations against industry firms. The CFTC has labeled various cryptocurrencies commodities, including ether (ETH) and tether (USDT) and litecoin — signaling a jurisdictional battle that adds another wrinkle to regulatory progress.  

“I believe in my heart of hearts that they want to come out with regulation, but they don’t want to do the wrong thing,” Schwed said. “I think they’re taking the time to figure things out.”

But as US policymakers and the country’s federal regulatory agencies move slowly, states could swoop in to fill in the gaps. 

Schwed called the cybersecurity policy within New York’s BitLicense regulation — implemented by the state’s Department of Financial Services in 2015 — “fairly comprehensive.”

“I think we saw a lot of companies running out of New York because they didn’t want to get the BitLicense, but I think we might start seeing the opposite,” Schwed said. “The BitLicense is a really great standard when it comes to cybersecurity, at least comparably, so maybe you start seeing some states stepping up and addressing where [the federal government’s] not coming in.”

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

Mon - Wed, March 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience: Attend expert-led panel discussions and fireside chats Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts.

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Top Icon.png


Osmosis thrived in H2 2023 on the back of increased DeFi activity deriving from recently launched Cosmos-related projects and better market conditions. With new value accrual mechanisms for the native token, Osmosis is well-positioned to continue its strong performance in 2024.



Though the opposing flow trend is likely to slow over time, industry watchers note, bitcoin fund assets could one day eclipse the $90 billion gold ETF space


Celestia had the first mover advantage. EigenDA has staked ether. What sets Avail apart?


Bitcoin moved 1% higher Monday morning in New York, Matrixport analysts say $62,000 could happen next month


It’s hard to believe right now that crypto — even with all of its flexibility and massive capabilities — could ever be like cash on the internet


Michael Saylor announced Monday morning that MicroStrategy bought 3k more bitcoin after the X account was compromised over the weekend


Plus, Pudgy Penguins grows its brand and a group of Autoglyphs sell for $14.5 million