| The U.S. Securities and Exchange Commission is not in the general investor-protection business. If someone comes to you and offers you a can't-lose opportunity to buy Florida swampland, and it turns out they're lying, the SEC will not get involved. If they sell you fake gold coins or forged Picassos, the SEC will not get involved. If they lie to you in the course of selling you complicated commodity futures contracts, the SEC will not get involved. (The Commodity Futures Trading Commission will.) The SEC is in the business of protecting investors in securities. If someone comes to you and offers you a can't-lose opportunity to buy stock in a cannabis company, and it turns out they're lying, then the SEC will get involved. You could imagine a narrow, minimalist SEC approach, one that says something like "if people lie to you while trying to sell you stock in some crazy company, the SEC will go after them, but other than that you're on your own." But in fact that has never been the SEC's approach. For many decades now, the SEC — and U.S. securities law generally — has taken a pretty expansive view of what a "security" is. The famous case is SEC v. W.J. Howey Co., where the Supreme Court almost did rule that a can't-lose investment opportunity in Florida swampland counts as a security. Technically the land was citrus groves, and the land itself wasn't a security, but an "investment contract" where someone else harvested the oranges for you was. All sorts of things in the world might not be securities, but organized investment opportunities in those things will turn out to be securities. Or at least the SEC will argue that they are. "Crypto" is a very broad category of stuff,[1] loosely united by the fact that people mostly buy the stuff hoping that it will go up and make them rich. This does not by itself make everything in crypto a security! Not everything that people buy hoping it will go up is a security subject to SEC jurisdiction. But, you know, most things. Certainly when a brand-new category of stuff appears in the world, and its principal purpose is for people to buy it hoping that it will go up, the SEC is going to take an interest. Here's a speech that SEC Chair Gary Gensler gave yesterday about crypto. It is short and nontechnical and I do not think it says anything new or surprising or even really interesting, but it has gotten a lot of attention because it's Gensler's first real policy statement about crypto. Gensler's most recent job before becoming SEC chair was, like, being a professor of crypto at MIT, so I suppose some people might have expected him to be pro-crypto. But Gensler also has previous experience in government running the CFTC, where he gained a reputation for being very pro-regulatory, so I certainly expected him to be pro-regulation of crypto. (Which, at the SEC, is roughly synonymous with "anti-crypto.") And this speech is very pro-regulation, which means specifically that it very much comes down on the side of concluding that lots of crypto things, things that are in gray areas, things that are not really analogous to any existing categories of traditional securities, are securities. Here is Gensler's overview of the situation: The SEC has a three-part mission — to protect investors, facilitate capital formation, and maintain fair, orderly, and efficient markets in between them. We focus on financial stability as well. But at our core, we're about investor protection. If you want to invest in a digital, scarce, speculative store of value, that's fine. Good-faith actors have been speculating on the value of gold and silver for thousands of years. Right now, we just don't have enough investor protection in crypto. Frankly, at this time, it's more like the Wild West. This asset class is rife with fraud, scams, and abuse in certain applications. There's a great deal of hype and spin about how crypto assets work. In many cases, investors aren't able to get rigorous, balanced, and complete information. If we don't address these issues, I worry a lot of people will be hurt.
You might read all of that and say "sure, fine, but what does this have to do with the SEC?" The SEC is not about "investor protection" broadly; it is about investor protection from scammy securities. If bad-faith actors speculate on the value of gold, the SEC can't really stop them, because gold is not a security. The fact that crypto is rife with scams does not mean that the SEC has to address it; the SEC has to address it only if it is rife with securities scams. Gensler argues — or at least asserts — that it is. But he is biased: He runs a regulatory organization, he is interested in crypto, he doesn't like scams, so he wants to use his regulatory power to crack down on crypto scams. He might be tempted to expand that power, to treat borderline gray-area things as securities and crack down on them, even if they aren't really securities. Now, I should say that, separately, I think that Gensler is right. Most of the things that he worries about are probably securities under existing U.S. law. But I'm biased too; I was trained as a securities lawyer. Certainly there are people who are biased the other way, who think that crypto is an interesting sandbox for financial innovation that is different from existing categories, and that preemptively treating everything as a security and subjecting it to SEC regulation will stifle innovation. Anyway after that introduction Gensler moves on to a list of crypto things that he wants to regulate. He starts with initial coin offerings. It has long been accepted at the SEC that most ICOs are securities. I basically agree. But we have stopped really talking about ICOs around here, because the SEC position that ICOs are securities pretty much meant the end of the ICO market, at least in the U.S. If you want to raise money for a project by offering crypto tokens for cash, the SEC will say that you are doing a securities offering and make you register it and file financial statements and so forth. The ICO market was basically a way to raise money without doing that, and the SEC crackdown kind of ended it. But this is not without controversy. ICO tokens often looked a lot like other forms of corporate currency — frequent-flyer miles, gift cards, etc. — that are obviously not securities. Regulating ICO tokens as securities sometimes felt like a stretch: These things did not really look like securities, and it was not obvious that they were under the SEC's jurisdiction. (In fact SEC Commissioner Hester Peirce argued as much.) On the other hand, tons of them were really scammy. It made sense for the SEC to get involved, as a general investor-protection matter. But that did stretch out the boundaries of what crypto things count as securities. Next Gensler moves on to decentralized finance platforms. I think it's pretty obvious that a lot of DeFi lending platforms, automated market maker contracts, etc., are securities, and I have said that the SEC will come after them. Gensler does not exactly get into the argument, but he clearly has some plans for those platforms: The American public is buying, selling, and lending crypto on these trading, lending, and DeFi platforms, and there are significant gaps in investor protection. Make no mistake: To the extent that there are securities on these trading platforms, under our laws they have to register with the Commission unless they meet an exemption. Make no mistake: If a lending platform is offering securities, it also falls into SEC jurisdiction.
One important point here — not a point made by Gensler, but one that will be important in regulation of lending platforms — is that a lending platform can offer securities even if the underlying cryptocurrency is not a security. So, while many crypto things are arguably securities, Bitcoin itself is not a security. But a lending platform that says "hey put your Bitcoins into this pool and we will give you a 10% return on them" probably is offering a security, or at least that is the position taken by the SEC ( against BitConnect) and New Jersey regulators ( against BlockFi). It is the same basic concept as Howey: Florida orange groves are not a security, but a pooled profit-seeking investment in those groves is a security; Bitcoin is not a security, but a pool of Bitcoins managed by someone seeking profitable investments is. (One other important point, not discussed by Gensler, is whether a pool of Bitcoins managed by a smart contract is a security. I think this is an interesting question! A smart contract that seeks to make money through a transparent, open-sourced trading/lending algorithm arguably isn't the sort of "investment contract" covered by Howey, because investors are not relying on the efforts of a manager to make a profit, but on the deterministic operation of code. Also, even if it is a security, who is selling it? Who do you sue? Here is where I think you get into territory that is genuinely different from existing securities, where you really do have a novel question of whether the SEC has jurisdiction. But my guess is that the SEC will think it does.) Next, stablecoins. A collateralized stablecoin is basically a money market fund, money market funds are regulated by the SEC and their shares are securities, so the SEC naturally wants to treat stablecoins as securities and regulate them. I am less convinced that this view is correct,[2] but it's probably the SEC's view; here is Gensler: These stablecoins also may be securities and investment companies. To the extent they are, we will apply the full investor protections of the Investment Company Act and the other federal securities laws to these products.
What about a non-collateralized, algorithmic stablecoins? These are not pooled investments in commercial paper; they are just digital tokens meant to represent a dollar. Yet there are … obvious investor-protection problems there too? You could take the view "a collateralized stablecoin is a money market fund and therefore a security, while an algorithmic stablecoin is a money market fund with no money in it, and therefore a much worse security."[3] I do not quite know what theory the SEC could use to regulate algorithmic stablecoins, but I look forward to finding out. Etc. The speech is not exhaustive, and I am perhaps wrong in interpreting it to mean "everything in crypto is a security until proven otherwise." But I do think that's the basic thrust of it. Meanwhile not every regulator agrees; after Gensler's speech, Republican CFTC Commissioner Brian Quintenz tweeted: Just so we're all clear here, the SEC has no authority over pure commodities or their trading venues, whether those commodities are wheat, gold, oil….or #crypto assets.
Sure but I think we're going to find out that the category of "pure commodities" in crypto is pretty narrow. I don't know, man! My view was that, because Robinhood Markets Inc. sold about 25% of the stock in its initial public offering to its own retail-investor customers, that would likely reduce the volatility of the stock. Robinhood customers make a stock volatile when they all pile into it at once, bidding up the price; by selling stock to customers who wanted it, in an organized offering, at the same price paid by institutions, Robinhood would satisfy that demand and reduce the likelihood of a wild run-up. I was in the minority on this point, and before Robinhood's IPO priced there were lots of articles to the effect of "giving all these shares to Robinhood customers is a recipe for trouble." I didn't get it, but I conceded that I had no real idea and that I would probably be wrong. And then the IPO priced and the stock fell and I felt … okay about my prediction? Not great, because when a stock falls 8% in the day after an IPO then you can't really claim that it avoided volatility. But okay. I felt like I had correctly identified the dynamic that, if you sell stock to all the retail investors who want it in the IPO, then they don't have to go crazy buying it the next day. Robinhood had apparently sold a bit more stock to retail investors than they wanted, so the stock cracked a bit, but broadly speaking I felt like I had a handle on what happened. That was last week though. This week, uh: Robinhood Markets Inc. jumped a whopping 82% on Wednesday after a wave of individual investors joined the likes of Cathie Wood to pile on the zero-fee trading platform. The stock traded as high as $85 earlier in New York before cutting gains roughly in half as the volatility triggered at least three trading halts. The frenzied share buying pushed the company's market value to a peak of $65 billion from $29.1 billion after its debut on Nasdaq last week. Retail investors' participation took off in the past couple of sessions after a lukewarm reception. They bought a net $19.4 million worth of Robinhood shares on Tuesday to make it the sixth-most-purchased stock and 11th-most-traded security on retail platforms, according to data compiled by Vanda Securities Pte.
I … okay … ??? Let me say a few things at random. First of all, one explanation that I have sometimes enjoyed for meme stocks is that you need to seed a meme stock, as it were, with bad news. GameStop Corp. and AMC Entertainment Holdings Inc. became meme stocks because they sold beloved entertainment products in malls and were hit hard by a pandemic. Hertz Global Holdings Inc. became a meme stock because it went bankrupt. This is not an ironclad rule or anything — Tesla Inc. has been a meme stock forever on largely good news — but it is a useful rule of thumb. "The way to become a meme stock is to be bad, then good," I have written. If Robinhood had gone up 15% after its IPO, retail investors might have shrugged and moved on. But it went down, and they — I guess? — leapt to its defense. Second, one important dynamic in meme stocks seems to be "diamond hands": If new retail investors are buying, and existing retail investors are self-consciously not selling and going around exhorting each other to hold forever, then the stock will naturally go up. This is, I think, an overrated dynamic. In the January GameStop frenzy, retail investors seem to have been net sellers. Even during yesterday's Robinhood rally, retail investors were net buyers of $19.4 million of stock — but it traded $4.2 billion yesterday, making those retail net buys about 0.5% of volume, and plenty of retail investors were selling.[4] Still I suppose at some margin it matters, at least psychologically; it is nice to feel like you're joining a movement, not just buying stock from someone who got there first and is now getting out. And the Robinhood IPO is particularly set up for diamond hands, in that (1) a lot of retail customers were able to buy stock in the IPO and (2) they can't sell. I mean, they can sell. But if they bought stock through Robinhood's IPO Access platform, they are discouraged from selling for 30 days: If they do, Robinhood will ban them from participating in future IPOs for 60 days. Robinhood has its own diamond-hands policy for its customers who bought in the IPO, and 25% of the shares in the IPO went to them. So a lot of stock is subject to this sort of soft, non-binding lockup; retail investors who like the stock can buy, but retail investors who own the stock and think it's overpriced might hesitate to sell. And Robinhood sold its stock to 300,000 customers; that's a lot of people with diamond-hands-by-default. Third, though, I think that all the people who said "if you sell this stock to retail it's gonna be trouble" were right, and I was wrong. Institutional investors seem to have been unenthused about the Robinhood IPO, partly on valuation and regulatory risks, but also partly because the large retail allocation seemed likely to (and did) take away the IPO pop: If retail investors can buy at the IPO price, they won't have to buy in the market the next day, so a hedge fund that buys at the IPO price won't be able to flip to desperate retail investors at a profit the next day. So from the beginning, you get a stock with a lot of retail interest and not a lot of institutional interest. And it turns out that retail interest is as volatile as everyone expected. If you worked for Bill Hwang's family office Archegos Capital Management and you got a bonus, part of your bonus was automatically invested in Archegos's fund and stayed there until you left the firm. This is standard stuff: If a lot of your money is tied up in the fund, then you will have incentives to work hard to make the fund go up, and not to mess up and make the fund go down. The first set of incentives worked: Employees put "under $50m" of deferred compensation into the fund, and they "saw the value of their deferred bonuses soar to about $500m" by earlier this year, because Archegos was, for a while, really good at making money. The second set did not, because Archegos was also really good at losing money. It blew up in March, and the employees' money appears to be gone: Yet some former employees have not received any of their deferred pay, including the original sums. One person close to the firm told the FT that "the money is gone" with "no pot of gold to pay them from". Another said Archegos employees "are in a difficult position" and "warrant sympathy".
Yes look I do kind of think that if you work at an investment firm and a portion of your bonus has to be invested in the firm's fund, that really is because part of your job is to try to keep the fund from going to zero? Kind of a big part of your job, really? And when the fund then does go to zero you have to be like "well I guess my bonus is gone"? I do not want to be too unsympathetic here, I realize that Hwang seems to have been the decision-maker and the employees could not necessarily have gotten a better outcome, but still. They ran an investment fund that lost all of its money and also inflicted multibillion-dollar losses on its banks. It does seem sort of strange to expect a bonus. A story that you see a lot in the broad financial-technology sector is that some brash startup comes in with some simple business model that relies on (1) building good technology and (2) not worrying too much about the legal and reputational concerns that hold back legacy players. In fact the startup emphasizes its rebelliousness and thumbs its nose at staid confused regulators. And then the brash startup gets in trouble and sheepishly pivots or slinks away, and a second generation of startups arises that learns the technological and user-experience lessons of the first generation but also pays attention to compliance, works with regulators, and generally tries to present itself as a good and reputable business rather than a bunch of wild outlaws. The ransomware industry is not quite like that, in that the entire business is crime. But nor is it quite not like that? Here is a delightful "interview with BlackMatter: A new ransomware group that's learning from the mistakes of DarkSide and REvil" conducted by analyst Dmitry Smilyanets. From the introduction: Named BlackMatter, the gang said it was specifically interested in targeting large companies with annual revenues of more than $100 million. However, the group said some industries were off limits: It would not extort healthcare, critical infrastructure, oil and gas, defense, non-profit, and government organizations.
We have talked before about the compliance function at ransomware firms: If you make ransomware, you want it to be used to hack big companies that can pay big ransoms, but you don't want it to be used on hacks that are too big, because then you will attract unwanted attention and bring down the full force of the U.S. government on you. You have to vet your targets carefully. And ransomware seems to work largely on a franchising model, where groups like BlackMatter mostly build software that is then deployed by independent licensees, so you have to vet your clients carefully too. You want to provide your software to criminals, sure, but you need to screen the criminals to make sure that they are competent and ambitious, but not too ambitious. It is all sort of like a normal company. And sort of not. Anyway the interview spends a lot of time on these sorts of compliance-function questions: [Dmitry Smilyanets]: Most recently, the largest groups—DarkSide, REvil, Avaddon, BABUK—have disappeared from the scene. Many researchers believe that this was due to the attention of the top leadership of the United States and Russia to the situation with ransomware attacks. Is it true? Do you think your product will have the same fate? [BlackMatter]: Yes, we believe that to a large extent their exit from the market was associated with the geopolitical situation on the world stage. First of all, this is the fear of the United States and its planning of offensive cyber operations, as well as a bilateral working group on cyber extortion. We are monitoring the political situation, as well as receiving information from other sources. When designing our infrastructure, we took into account all these factors and we can say that we can withstand the offensive cyber capabilities of the United States. For how long? Time will tell. For now, we are focusing on long-term work. We also moderate the targets and will not allow our project to be used to encrypt critical infrastructure, which will attract unwanted attention to us. ... DS: I have already seen several recruiting announcements for your team. How many penetration testers would you like to recruit? Is it easier to work with a small but strong team, or with an army of script kiddies? BM: We are geared at strong, self-sufficient teams with experience, their own technical solutions, and a real desire to make money, not someone who wants to try the business out. We usually filter out script kiddies before they get access to our admin panel. … DS: What do you think about the attacks carried out against Colonial Pipeline's infrastructure or JBS? Does it make sense to attack such large networks? BM: We think that this was a key factor for the closure of REvil and DarkSide, we have forbidden that type of targeting and we see no sense in attacking them.
But there is also a certain amount on just the nuts and bolts of ransomware design: DS: Are you planning to add new features to the product, following the example of StealBit? BM: Yes, the software is constantly being improved, in terms of the new functions that will appear in the near future—printing the text of the note on all available printers. We also watch our competitors and always implement what we consider promising and in demand by our clients.
If you seize control of a company's computers and encrypt all of its files, you have to tell the company that you've done that. A pop-up message on every screen saying "hahaha we locked your files, send us Bitcoin" is useful, but printing a similar message on every printer on the network is a good redundancy? I don't know, I am not an expert in ransomware user-experience design, but the point is that these guys are. That is just a thing that you can be an expert in, and there is a competitive market for good ransomware design. Also here's a good question with a good answer: DS: Obviously, there are many talented professionals on your team. Why is it that this talent is aimed at destructive activities? Have you tried legal penetration testing? BM: We do not deny that business is destructive, but if we look deeper—as a result of these problems new technologies are developed and created. If everything was good everywhere there would be no room for new development. There is one life and we take everything from it, our business does not harm individuals and is aimed only at companies, and the company always has the ability to pay funds and restore all its data. We have not been involved in legal pentesting and we believe that this could not bring the proper material reward.
I can't fault the logic. Why do you use your hacking talents for crime, rather than legally helping companies identify and eliminate vulnerabilities? Well, see, crime pays better. "There is one life and we take everything from it." Everything Is a DCF Model. "Businesses are sitting on record amounts of unused credit from U.S. banks." Deal Of The Century: How Michael Dell Turned His Declining PC Business Into A $40 Billion Windfall. Treasury Sees Cutting Quarterly Bond Sales Soon as November. Reddit Crypto Traders Rush for Riches Before Wall Street Invades. Where Are The Robotic Bricklayers? If you'd like to get Money Stuff in handy email form, right in your inbox, please subscribe at this link. Or you can subscribe to Money Stuff and other great Bloomberg newsletters here. Thanks! [1] In general I seem to say "cryptocurrency" more often than "crypto" for the broad category, but I'm not sure that's a good decision. "Cryptocurrency" implies a unit-of-account/payment-mechanism-ish element that is arguably present in, like, Bitcoin or Tether, but arguably not in, like, DeFi automated market-maker contracts or corporate initial coin offerings or whatever. "Crypto" might be a good term for "cryptocurrency, corporate tokens, DeFi lending pools, whatever else you've got." Anyway Gensler seems to use "crypto" for the broad category so I will too. [2] In that there is no expectation of profit, you don't actually own a share of stock, etc. [3] Or, like, a derivative contract on a money market fund? I do not think that this is a very good argument; surely it's a currency derivative and so not a security? I dunno. [4] The Vanda data suggest that total retail volume (buys plus sells) was a bit more than $180 million, meaning on the order of $100 million of retail buying and $80 million of retail selling. |
Post a Comment