Cryptocurrency Security and Regulatory Compliance 5 — Questions and Answers
Question 1: What does 'SAR' stand for and when must a crypto business file one?
- Security Audit Report — filed after a protocol exploit
- Suspicious Activity Report — filed when transactions suggest money laundering or other crimes (Correct answer)
- Sanctioned Address Registry — filed when blocking OFAC-listed wallets
- Smart Asset Record — filed for tax reporting of DeFi yields
Correct answer: Suspicious Activity Report — filed when transactions suggest money laundering or other crimes
SARs (Suspicious Activity Reports) must be filed with FinCEN within 30 days when a crypto business detects transactions involving $5,000+ that may involve criminal activity.
Question 2: Which type of crypto scam involves offering guaranteed high returns through a fake investment platform that pays early investors with new investors' funds?
- Exit scam
- Pump and dump scheme
- Ponzi scheme (Correct answer)
- Front-running attack
Correct answer: Ponzi scheme
A crypto Ponzi scheme promises high returns and uses new investor deposits to pay earlier investors until the scheme collapses—BitConnect was a famous example.
Question 3: What security vulnerability does a 'reentrancy attack' exploit in smart contracts?
- It exploits weak random number generation in contract logic
- It calls back into the vulnerable contract before the first execution finishes, draining funds (Correct answer)
- It replays signed messages from previous contract interactions
- It exploits integer overflow in token balance calculations
Correct answer: It calls back into the vulnerable contract before the first execution finishes, draining funds
Reentrancy attacks (famously used in The DAO hack) call a vulnerable function recursively before the contract updates its internal state, allowing repeated fund withdrawals.
Question 4: Under the U.S. Infrastructure Investment and Jobs Act (2021), which parties were controversially designated as 'brokers' required to report crypto transactions to the IRS?
- Only centralized cryptocurrency exchanges
- Broadly defined parties including potentially miners, validators, and wallet developers (Correct answer)
- Only DeFi protocol governance token holders
- Foreign cryptocurrency exchanges with US customers
Correct answer: Broadly defined parties including potentially miners, validators, and wallet developers
The law's broad 'broker' definition sparked controversy as it could apply to miners, validators, and software developers who don't have customer information to report.
Question 5: What is the purpose of a 'crypto mixer' or 'tumbler,' and why is it legally problematic?
- A tool that combines multiple cryptocurrencies into a portfolio—legal but complex
- A service that pools and shuffles transactions to obscure their origin, raising money laundering concerns (Correct answer)
- Software that mixes proof-of-work and proof-of-stake consensus mechanisms
- A protocol for aggregating DEX liquidity across multiple blockchains
Correct answer: A service that pools and shuffles transactions to obscure their origin, raising money laundering concerns
Mixers obscure the blockchain trail between sender and recipient; OFAC sanctioned Tornado Cash in 2022 for facilitating over $7 billion in money laundering.
Question 6: What is 'whaling' in the context of cryptocurrency phishing attacks?
- Attacking whale wallet addresses holding large crypto balances via brute force
- Highly targeted phishing attacks aimed at high-value individuals like executives or large investors (Correct answer)
- Manipulating crypto markets by tracking large 'whale' wallet movements
- A DDoS attack that overwhelms large exchange servers
Correct answer: Highly targeted phishing attacks aimed at high-value individuals like executives or large investors
Whaling is spear-phishing specifically targeting high-value individuals (whales), using highly personalized deception to steal large crypto holdings or compromise organizational systems.
Question 7: What does FATF's 'Travel Rule' Recommendation 16 require of Virtual Asset Service Providers (VASPs)?
- VASPs must verify that customers have not traveled to sanctioned countries
- VASPs must collect and share originator and beneficiary information for transfers above $1,000 (Correct answer)
- VASPs must report all cross-border transfers to the IMF
- VASPs must use licensed courier services for hardware wallet deliveries
Correct answer: VASPs must collect and share originator and beneficiary information for transfers above $1,000
FATF Recommendation 16 requires VASPs to obtain, hold, and transmit originator and beneficiary information with transfers of $1,000 or more to combat money laundering.
Cryptocurrency Security and Regulatory Compliance 5
What does 'SAR' stand for and when must a crypto business file one?