CBP - Certified Bitcoin Professional Security and Regulatory Issues Questions and Answers 1 — Questions and Answers
Question 1: A U.S.-based Bitcoin exchange identifies a series of complex transactions from a single user designed to obscure the source of funds, totaling over $5,000. Under the Bank Secrecy Act (BSA), what is the exchange's primary obligation?
- File a Currency Transaction Report (CTR) with FinCEN.
- Immediately freeze the user's account and report them to the IRS.
- File a Suspicious Activity Report (SAR) with FinCEN. (Correct answer)
- Report the user's capital gains to the Securities and Exchange Commission (SEC).
Correct answer: File a Suspicious Activity Report (SAR) with FinCEN.
Cryptocurrency exchanges are considered Money Services Businesses (MSBs) and are required to file a Suspicious Activity Report (SAR) with the Financial Crimes Enforcement Network (FinCEN) for any suspicious transaction or pattern of transactions involving $2,000 or more. The scenario describes activity designed to hide the source of funds, which is a classic red flag for money laundering and triggers the SAR filing requirement.
Question 2: According to the Internal Revenue Service (IRS) Notice 2014-21, how is Bitcoin treated for U.S. federal tax purposes, and what does this imply for users?
- As property, meaning dispositions like selling or spending it are taxable events subject to capital gains or losses. (Correct answer)
- As a foreign currency, meaning gains and losses are only recognized when converted back to U.S. dollars.
- As a security, requiring all transactions to be reported through a registered broker-dealer.
- As a tax-exempt digital asset, meaning no taxes are due until the total value exceeds a certain lifetime limit.
Correct answer: As property, meaning dispositions like selling or spending it are taxable events subject to capital gains or losses.
The IRS has explicitly stated in Notice 2014-21 that it treats virtual currencies like Bitcoin as property for tax purposes. This classification means that when a user sells, trades, or uses Bitcoin to purchase goods or services, it is a taxable event. The user must calculate the difference between the fair market value at the time of disposition and their cost basis to determine if they have a capital gain or loss.
Question 3: Which of the following represents the most significant and direct capability of an attacker who successfully controls more than 51% of the Bitcoin network's hash rate?
- Change the block reward and create new bitcoins out of thin air.
- Steal bitcoin from other users' wallets by forging their private keys.
- Alter transactions from months or years ago deep within the blockchain.
- Prevent new transactions from being confirmed and reverse their own recent transactions (double-spend). (Correct answer)
Correct answer: Prevent new transactions from being confirmed and reverse their own recent transactions (double-spend).
A 51% attack grants the attacker control over the creation of new blocks. This allows them to create a private version of the blockchain that can eventually overtake the honest chain. With this power, they can choose to ignore certain new transactions (censorship) and, most importantly, reverse their own recent transactions by creating a new chain where those transactions never occurred, allowing them to 'double-spend' the coins. They cannot, however, change fundamental consensus rules like the block reward, steal private keys, or alter deeply confirmed past transactions.
Question 4: A user instructs their Virtual Asset Service Provider (VASP A) in the United States to send $4,000 worth of Bitcoin to another user at VASP B. Under FinCEN's interpretation of the Bank Secrecy Act's 'Travel Rule,' what is VASP A obligated to do?
- Nothing, as the transaction is below the $10,000 Currency Transaction Report threshold.
- Collect and transmit certain originator and beneficiary information to VASP B. (Correct answer)
- Only record the transaction hash on a public ledger for transparency.
- File a report with the IRS detailing the potential capital gain for the sender.
Correct answer: Collect and transmit certain originator and beneficiary information to VASP B.
FinCEN's guidance clarifies that the 'Travel Rule' applies to virtual assets. For transfers at or above $3,000, the originating institution (VASP A) must collect and transmit specific information about the sender (originator) and receiver (beneficiary) to the receiving institution (VASP B). This rule is separate from the $10,000 CTR threshold, which applies to cash transactions.
Question 5: What is the primary motivation behind a 'dusting attack' on Bitcoin users?
- To slow down the Bitcoin network by broadcasting thousands of small, spam transactions.
- To steal small, negligible amounts of bitcoin from thousands of wallets simultaneously.
- To compromise the privacy of users by linking different addresses to a single entity. (Correct answer)
- To test the network's capacity for handling a high volume of microtransactions.
Correct answer: To compromise the privacy of users by linking different addresses to a single entity.
In a dusting attack, an attacker sends tiny, traceable amounts of bitcoin ('dust') to a large number of addresses. The goal is to monitor these dust UTXOs. When the owner of a dusted wallet eventually combines the dust in a transaction with other funds, the attacker can link multiple addresses together, de-anonymizing the user and revealing information about their holdings and transaction patterns.
Question 6: What is the primary regulatory objective for imposing Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements on cryptocurrency exchanges?
- To prevent the use of cryptocurrencies for illicit activities such as money laundering and terrorist financing. (Correct answer)
- To build a government database of all cryptocurrency holders for the purpose of future wealth taxes.
- To protect investors from price volatility by ensuring they meet certain income requirements.
- To guarantee that all exchange users have the technical expertise to manage their own private keys securely.
Correct answer: To prevent the use of cryptocurrencies for illicit activities such as money laundering and terrorist financing.
The core purpose of KYC and AML regulations is to prevent financial systems from being used for illegal purposes. By requiring exchanges to verify the identity of their customers (KYC), regulators aim to make it more difficult for criminals to launder money, finance terrorism, or engage in other financial crimes. This allows for the monitoring and reporting of suspicious activity (AML).
CBP - Certified Bitcoin Professional Security and Regulatory Issues Questions and Answers 1
A U.S.-based Bitcoin exchange identifies a series of complex transactions from a single user designed to obscure the source of funds, totaling over $5,000.
Under the Bank Secrecy Act (BSA), what is the exchange's primary obligation?