CCA Regulatory Compliance & Reporting 3 — Questions and Answers
Question 1: The IRS treats cryptocurrency as property for tax purposes. Which form is used to report capital gains and losses from crypto disposals?
- Form 1040 Schedule C
- Form 8949 (Correct answer)
- Form 1099-K
- Form 4797
Correct answer: Form 8949
Form 8949 is used to report sales and other dispositions of capital assets, including cryptocurrency, with the totals flowing to Schedule D.
Question 2: A VASP operating in multiple EU member states under MiCA can serve all EU customers via which regulatory concept?
- Mutual recognition
- Passporting (Correct answer)
- Regulatory arbitrage
- Host state supervision
Correct answer: Passporting
MiCA includes a passporting mechanism allowing a CASP authorized in one EU member state to provide services across all EU member states.
Question 3: Under U.S. sanctions law, which agency administers the OFAC Specially Designated Nationals (SDN) list relevant to crypto compliance?
- FinCEN
- SEC
- Department of the Treasury's OFAC (Correct answer)
- CFTC
Correct answer: Department of the Treasury's OFAC
The Office of Foreign Assets Control (OFAC), a division of the U.S. Treasury, administers the SDN list and enforces economic sanctions.
Question 4: Which AML control requires crypto exchanges to verify the identity of customers before allowing them to transact?
- Enhanced Due Diligence (EDD)
- Customer Due Diligence (CDD) / Know Your Customer (KYC) (Correct answer)
- Suspicious Activity Monitoring (SAM)
- Correspondent Banking Checks (CBC)
Correct answer: Customer Due Diligence (CDD) / Know Your Customer (KYC)
CDD/KYC programs require VASPs to identify and verify customers' identities before establishing a business relationship or allowing transactions.
Question 5: Under FATF standards, when should a VASP apply Enhanced Due Diligence (EDD)?
- For all transactions regardless of risk level
- When a customer is classified as higher risk, such as a PEP (Correct answer)
- Only when law enforcement requests it
- For transactions exceeding $1,000
Correct answer: When a customer is classified as higher risk, such as a PEP
EDD must be applied when standard CDD is insufficient, including for politically exposed persons, high-risk countries, or unusual transaction patterns.
Question 6: A cryptocurrency auditor reviewing a DeFi protocol's compliance posture should be aware that FATF guidance suggests these protocols may trigger VASP obligations when:
- They use open-source code
- Owners/operators maintain control or influence over the protocol (Correct answer)
- The protocol operates on a public blockchain
- Smart contracts are deployed on Ethereum
Correct answer: Owners/operators maintain control or influence over the protocol
FATF's updated guidance states that DeFi protocols may be treated as VASPs if an owner or operator retains control or sufficient influence over the protocol.
Question 7: Which document produced during a crypto compliance audit summarizes identified risks, control gaps, and recommended remediation actions?
- Blockchain explorer export
- Audit findings report / management letter (Correct answer)
- Chain-of-custody log
- Transaction monitoring alert file
Correct answer: Audit findings report / management letter
An audit findings report (or management letter) documents deficiencies found during the audit and provides recommendations for management to address.
CCA Regulatory Compliance & Reporting 3
The IRS treats cryptocurrency as property for tax purposes.
Which form is used to report capital gains and losses from crypto disposals?