CBP Security and Regulatory Issues 3 — Questions and Answers
Question 1: What does the FATF 'Travel Rule' require of virtual asset service providers (VASPs)?
- VASPs must report all transactions over $1,000 to tax authorities
- VASPs must share originator and beneficiary information with counterpart VASPs for transfers above a threshold (Correct answer)
- VASPs must physically verify customer identity in person
- VASPs must hold reserve assets equal to customer balances
Correct answer: VASPs must share originator and beneficiary information with counterpart VASPs for transfers above a threshold
The FATF Travel Rule requires VASPs to collect and transmit customer identifying information alongside crypto transfers, mirroring traditional wire transfer rules.
Question 2: Which Bitcoin security practice involves generating keys on a device that has never connected to the internet?
- Cold storage (Correct answer)
- Hot wallet generation
- Deterministic key derivation
- Multisig setup
Correct answer: Cold storage
Cold storage means generating and keeping private keys entirely offline, eliminating remote attack vectors that target internet-connected systems.
Question 3: How does a 51% attack threaten Bitcoin network security?
- It encrypts nodes and demands ransom
- It allows the attacker to rewrite recent transaction history and double-spend coins (Correct answer)
- It permanently destroys the private keys of all users
- It prevents any new blocks from being mined indefinitely
Correct answer: It allows the attacker to rewrite recent transaction history and double-spend coins
Controlling over half the network hashrate lets an attacker mine a private chain longer than the honest chain, enabling double spends by replacing confirmed transactions.
Question 4: What is 'dusting' in the context of Bitcoin privacy attacks?
- Sending tiny amounts of BTC to many addresses to trace wallet ownership (Correct answer)
- Mining very small transaction fees to front-run others
- Clearing transaction history from a wallet
- Fragmenting large UTXOs into many small ones
Correct answer: Sending tiny amounts of BTC to many addresses to trace wallet ownership
A dusting attack sends tiny, unusable amounts of Bitcoin to target addresses so that when those 'dust' UTXOs are spent, they reveal address clustering and potentially wallet ownership.
Question 5: Under U.S. law, how does the IRS currently treat Bitcoin and other cryptocurrencies?
- As foreign currency subject to forex reporting rules
- As property, making each disposal a taxable event (Correct answer)
- As securities regulated by the SEC
- As commodities exempt from capital gains tax
Correct answer: As property, making each disposal a taxable event
IRS Notice 2014-21 and subsequent guidance classify cryptocurrency as property, so selling, trading, or spending it triggers capital gains or loss recognition.
Question 6: What is the role of a 'watch-only' wallet in a secure Bitcoin custody setup?
- It holds private keys encrypted with a watch password
- It monitors balances and transaction history without holding private keys (Correct answer)
- It automatically sweeps funds to cold storage
- It watches for double-spend attempts on outgoing transactions
Correct answer: It monitors balances and transaction history without holding private keys
A watch-only wallet imports public keys or addresses to track balances and history without exposing private keys, keeping signing capability completely offline.
Question 7: Which regulatory body in the U.S. has claimed jurisdiction over Bitcoin as a commodity?
- Securities and Exchange Commission (SEC)
- Financial Crimes Enforcement Network (FinCEN)
- Commodity Futures Trading Commission (CFTC) (Correct answer)
- Office of the Comptroller of the Currency (OCC)
Correct answer: Commodity Futures Trading Commission (CFTC)
The CFTC has asserted that Bitcoin is a commodity under the Commodity Exchange Act, giving it enforcement authority over Bitcoin derivatives and fraud in spot markets.
CBP Security and Regulatory Issues 3
What does the FATF 'Travel Rule' require of virtual asset service providers (VASPs)?