Sixth Letter to the Uniform Law Commission

Date: 5/4/2017

From: Peter Van Valkenburgh, Coin Center

Coin Center 718 7th St NW, Washington, DC 20001 peter@coincenter.org

To: Sarah Jane Hughes, Members, and Observers; ULC Regulation of Virtual Currency Businesses Act Committee.

This letter offers Coin Center’s final comments on the ULC’s model Regulation of Virtual Currency Business Act. Due to the context-specific nature of all comments, we are providing the Committee with a red-lined version of the act in the form of an attached annotated PDF. None of our suggestions offer substantive changes to the policy consensus we reached at the recent meeting. However, several of the proposed changes are of critical importance to ensure that Coin Center can fully support the final Act. These changes primarily relate to:

1. Removing errant use of the phrase “virtual currency credentials” from the act in favor of using the defined term “control” of virtual currency wherever necessary. See comments on red-line page 3, lines 18-20; page 4 , line 6; page 34 lines 1-2 (All page numbers refer to the pages of the current draft act, not the PDF pagination.).

2. Removing “change of location” language from the definition of “transfer.” See comment on red-line page 4, lines 2-4.

3. Clarifying the personal use exemption. See comment on red-line page 15, lines 1-3.

4. Crafting de minimis and provisional licensing thresholds calibrated by specific activity (i.e. the defined verbs: store, transfer, exchange, administer) rather than aggregate activities. See comments on red-line page 15, line 8; page 38, lines 18-19.

5. Eliminating technology-specific and impracticable recording requirements from the recordkeeping section. See comment on red-line page 42, lines 9-13.

The first suggested change, removal of the phrase “virtual currency credentials,” is our top priority. We would not be able to support the final act unless this change is made.

Moreover, we believe it was settled in the recent meeting that all mention of virtual currency credentials would be struck from the act. The current definition of “control” is

technology-neutral, and can therefore apply to persons whose possession of a “credential” affords them (as stated in the definition of control) “power to execute unilaterally or prevent indefinitely virtual currency transactions.” Keeping the phrase credentials throughout the act only muddies the waters. The technology-neutral definition of “control” is flexible enough to expand beyond “credential” possession to other forms of power over other persons’ virtual currency, and it avoids an outcome where a license is required from a person that has some part of a credential but not a sufficient part to have control. We understand that the phrase may have been left in the draft by mistake, but we must stress that this is our single most important issue with the language as it stands. We would not be able to offer our support for the final act if mention of credentials remained throughout the text.

The second change, removing “change of location” language from the definition of “transfer,” is also critical for creating greater clarity for innovators in this space. We believe it was settled in the recent meeting that this subsection (C)1 would be struck from the final draft. As discussed, virtual currency does not exist in any geographic location. Therefore, there is no logical way to interpret this section in relation to the actual technology. Transfers between the accounts of the same resident are already covered by subsection (B) immediately preceding this section. We would not be able to support this model act if this section remained.

The third change, clarifying the personal use exemption,2 ensures that all personal uses of the technology are exempted. The current language only covers activities involving “relinquishing” virtual currency. The language should be "obtains or relinquishes." As discussed in the meeting, personal investments or mining activity that involves "buying" should not be covered just as "selling" should not be covered. This is a high priority change for us.

Regarding the fourth change, crafting de minimis and provisional licensing thresholds,3 it was our understanding that in the last meeting it was agreed to break this out into the three types of activities and make the long-term custodial activities "administration" and "storage" have a lower threshold than the mere short term transactional activities "transfer" and "exchange" in order to match the amount of risk they present to end-users. As such we have proposed language for the de minimis exemption that would create a $5,000 threshold for long-term activities (storing and administering) and a $15,000 threshold for short-term transactional activities (transferring and exchanging). Similarly for the provisional license upper-threshold we have proposed $35,000 for long-term activities and $100,000 for short-term activities.

Regarding the fifth change, eliminating technology-specific and impracticable recording requirements from the recordkeeping section,4 the currently specified technology-specific recordkeeping requirements (e.g. IP Addresses, passwords, etc.) are confusing and dangerous. We had understood that this language would be struck from the final version. There is no specific requirement to record this information under federal anti-money laundering

1 See comment on red-line page 4, lines 2-4. 2 See comment on red-line page 15, lines 1-3. 3 See comments on red-line page 15, line 8; page 38, lines 18-19. 4 See comments on red-line page 42, lines 9-13.

obligations so we see no reason to record it here, for consumer protection purposes. This is a high priority change for us. Requiring the recordation of this information in a way not already performed by the provider may create a cybersecurity vulnerability in that passwords and other credentials may be recorded in unsecured media as per the assumed compliance obligations of this act. This would be very bad for end-user security and privacy.

Additionally, in the following subsection,5 rather than requiring personally identifiable information for all “principal” parties to the transaction, we suggest "any parties to the transaction that are customers of the licensee." Other, non-customer parties may not be known to the licensee, and the NY Bitlicense (as well as FinCEN) only requires recordation of information about other parties to the extent practicable. This is a high priority change for us.

Finally, there are several smaller comments and suggestions to be found in our red-line; while none of these changes are critical for Coin Center’s support, we believe they are helpful for clarity and style. Some changes also relate to the reporter’s notes which are, on the whole, excellent, but have a few minor issues regarding characterization of certain technological details. We encourage you to review the red-line PDF, attached to this letter, in full, and once again thank you sincerely for taking such care in the drafting of this important model law.

Thank you for your time and please always feel free to email me at peter@coincenter.org if you have any questions.

Sincerely,

Peter Van Valkenburgh,

Director of Research

5 See comments on red-line page 42, line 12.

The accompanying annotated model act, including redlines, is available in the original PDF.