Surveillance Finance 101 with Seth Hertlein and Michael Mosier

Hey Bankless Nation, I put out a tweet last week that said this. Who can come on Banklist and explain the modern financial surveillance apparatus? FADIFD, FinCEN, AMLKYC, OFAC, the Blacklist, the Graylist. How does it all work? Who makes the rules?

Been in this space for years. I still don't understand these dark corners. That's very much how I felt coming into this episode. Needing the financial surveillance 101. I knew it was an octopus, knew it was this uh multi-headed hydra. I had no idea how deep its roots actually go. And today we unpack this with legal experts. Seth Hurtline from uh he's the VP of Global Policy at Ledger and also Michael Mosier. He actually has spent some time in the belly of the beast at both Finsen and OFAC. Now he's on our

Yeah, and now he's on Team Crypto. So he's got some uh insider baseball that uh he's gonna tell us as we make sense of this. This was a really fantastic episode. I know I want to get your comments on this episode, but before we do, we got a message from our friends and sponsors over at David. I know this episode was was my idea. It's kind of like geeky wonkish stuff, but I felt like it was it was so important, especially on the back of.

Uh developers getting arrested in Tornado Cash. Like, um, what is going on? I I I just realized one day I don't even understand

Right.

uh what what all of these institutions are and what gives the financial uh surveillance system their apparatus. So what did you think of this episode?

Yeah, I definitely would categorize this one as a Ryan episode. I was definitely in in listening mode for the majority of uh this podcast. And I mean, I guess I guess that's what it's like to be a listener. You're in listening mode. So I guess telling listeners to enter listening mode, I guess doesn't help them. Um I I learned a lot. It felt like story, story time, a little bit about American history. One of these episodes that uh that we frequently do on Bankless every now and then, about just like, hey, how did just the state of laws come to be in the way that they are? And how are they downstream from the original American values that this country was founded on? And what about the current settling of the dust around this new player in the world of in this universe called cryptography? How is that disturbing the equilibrium? And how do we need to extend American values uh into this new world? Because if we don't do that, then non-American values will take over. I think that's kind of the the through line that I would uh that will it will anchor bankless listeners is that there's this new field in territory. We can have freedom enter and establish itself legally, or we can have authoritarian enter it enter in that same field. And I mean, I think everyone knows which side that we want to win. Um, we need to actually fight for that. And fighting for that starts with understanding. Uh, and so I think that's why I enjoyed this episode. Is it it helps tell that story.

Yeah, and anytime David says American values, if you're outside the US and you're like American values, just think of um liberal values, like lowercase L values, right? Uh civil liberties, um, you know, freedoms of of citizens to to express themselves and and to transact without the surveillance of the government. That's really what we're talking here. And that's what's at stake. More than anything, I think this episode impressed upon me that unchecked, this is just um an octopus. This is just like a tree structure that will um I don't know, it's kind of

Is a n not an octopus, um slime mold. It will

grow.

Exactly. And it is growing and it has grown since like the 1970s. Anyway, absolutely fantastic episode. Guys, stay tuned for this. But before we do, we want to tell you about our friends over at Bankless Nation. We are super excited to host two legal minds on our show today. Seth Hurtline is the vice president global head of policy at Ledger, and Michael Moser, he's the co founder of a legal boutique called Arcturos, and he is also building X Ante. Um, he's formerly been at FinCEN, the Treasury, Chief Technical Counsel at Chainalysis, so he's think seen a thing or two in the space. Uh, welcome, Michael.

Thanks.

Alright guys, uh so what we're gonna attempt to do on today's episode is uh give kind of the everyman explanation of financial surveillance. I feel like this is an episode, um, maybe for me. It's it's a kind of a selfish episode because I feel like here I am in crypto, and I've heard all of these, you know, four or five-letter agencies, uh, and it's recently started to impact my life with like Tornado Cash. I'm not entirely sure what these agencies are, I'm not entirely sure what's legal and what's not. I'm not entirely sure what powers each of these agencies actually have over my financial life. And I'm looking for like the 101. I'm looking for like the the explainer. When we call talk about FATIF, uh and we're talking about OFAC, we're talking about whitelists and gray lists, and we're talking about, you know, can I use Tornado Cash or not? And I can't because I'm an American. I just don't know what uh what every like what's going on here. So I feel like we need the 101 episode. So if you guys are game to do that, that's what uh that's what we're gonna try to accomplish today. Sound good?

Great. Absolutely.

Well, let's um let's kind of start domestic uh from sort of the US perspective, if we will, and then then go international to kind of the rest of the world. But but I want to start with maybe a working definition. So I'm thinking of this episode as like a financial surveillance 101 episode. And I'm wondering if you guys could sort of describe financial surveillance when I use that term. What does it mean to you? What is kind of happening behind the scenes? Who are some of the main agencies that hold the power? I'll throw this one to you first, Seth.

Okay. Um,

well, I you know, I think, you know, let's for the purposes of this episode, let's uh, you know, sort of carve out, you know, private sector or sort of corporate surveillance. Um

uh let's let's sort of limit the the scope of today's conversation to

uh to government surveillance. But I you know I think the

uh you know a good working definition could be um you know information that is uh collected by

Or required to be reported to

the federal government or an agency thereof, either by individuals or by service providers, intermediaries that they use for their everyday financial lives.

So just to check that definition, Seth, I hear hearing two parts. One is the legally mandated reporting requirements, which if you don't do it, you get like something like fines and jail. And then there's additional information, which it would seem that the uh powers that be are able to just collect by their own visual uh mechanisms, as in like it's information that's out there and they collect that information because it's available for them to collect. So that's two types of data.

I mean, you know, Mike, I'd be curious your your thoughts on this. I think it sort of converges effectively into more or less the same thing.

So maybe not a need to draw that particular distinction.

Yeah, and I think I think it's a I think it's a collective approach. It sort of um I think for two reasons. One is, you know, some of that will come into play, David, as we're as we think about challenges, including constitutional challenges, um, as courts have have made a distinction between

When you put your trash out, have you relinquished control of it? And if somebody goes through it, they just go through with it, through it, versus somebody coming in your house and going through your papers, which is the sort of genesis of the Fourth Amendment. And I think as Seth's pointing out, we're in a space here with Web One, Two, and now three, where there's tremendous amount that's that's in this gray area between what's public and what isn't. I think even the concept of like what's public information at this point is a lot more of a fine-tuned, uh, fine nuanced issue, uh, including, I should say, like in a way that that also these same government agencies that are that are collecting it for various reasons. I mean, the the mission of all of this, uh, and I think this is important, is something when when I was at FinCEN, we would say to the the people in on the hill making the laws too, sometimes without asking us first, uh, was that the primary mission is countering exploitation here. And so you have to factor into that. Uh, the the fact that this information out there and being collected in any form is also subject to creating greater exploitation. Uh, and that that includes people's, you know, honey pots of people's data that gets hacked, um, some of this recently coming up in FTX and Kroll um coming out of the bankruptcy. Uh, and that's something that that I think.

There's the policymakers and the politicians, and then there's also the the operators out there, including at FinCEN and DOJ, who are saying actually we don't need more cases and more victims. Uh, so can we protect some of this too? It's partly why we brought in privacy experts and did initiatives on zero knowledge proofs and homomorphic encryption at FinCEN. So I do think it's really important that we're that we're talking about that very holistically. There's a lot out there.

So already we're talking about FinCEN and DOD and Treasury and all these kind of institutions. I want to get some working definitions on, but but while we're while we're talking about um this this term financial surveillance, all right, let's just get a grasp of what sort of data is generally being collected and like when? Is this primarily like uh intermediaries that are required to submit this? Because um as a you know uh a citizen of the US, I I don't often have to, I guess I'm not like conscious of times that I'm like filing paperwork with Treasury or FinCEN, but maybe I am through an intermediary and I I just don't know it. So what sort of things are being tracked and uh surveilled and why?

I'm happy to take the first there's run a to uh yeah, I think I mean so it's true you're not, although I will say there's there's uh

There's legislation out there, particularly in the tax space, that would that could make you a reporter, Ryan, whether you like it or not, and whether everyone around you likes it or not. And speaking of honey pots, like you may be collecting and reporting on others. But I think as it as in a traditional stand from the from a FinCEN perspective in the Bank Secrecy Act, you're absolutely right. It would be intermediaries. And in fact, this goes back to some of the constitutional issues that and the third party doctrine that Seth mentioned. But it's really transactional information. And historically, in fact, the we can talk through a little bit if you want the history of the Bank Secrecy Act, but it it it was exactly this. It was around uh reporting requirements, basically, uh coming up through the 70s. Um and basically

At the time it was purely it was basically large cash um law enforcement was seeing large cash deliveries to banks. Um, pretty sure it was organized crime.

And when they would go to a bank, the bank would say, I don't know. I don't know why um Bugsy Seagull dropped off uh a hundred million dollars. Uh and so

The other piece of that was that there was foreign Swiss banks at the time. And so this was the foreign transactions reporting piece of it too, that had Swiss bank, Swiss secrecy, bank secrecy, which is where this Bank Secrecy Act comes from. And so the US would say, okay, well, we'll go to Switzerland where some of this money is getting sent from the bank that was brought in in cash. And they'd go to the Swiss and say, okay, you tell me about what's going on here. And they would say, There's nothing we can say. There's a secret, there's bank secrecy here. And so part of it was going to the US banks and saying, we need you to collect more information. At the time, it was really just information of like who's collecting it. Um, give me their basically their their bank opening information. Where do they live? What's their phone number? What's their um

What's their occupation? What's their source of income? That sort of thing. It evolved over time to suspicious activity reports, which is much more, I think, what you're thinking through, which is okay, now a bank is making a determination. Seth came in the other day. He didn't just drop off a bunch of cash. He's he's making anomalous uh deposits that don't make sense to us. Uh this seems suspicious. He he said he was uh he said he was a reporter, but he makes a million dollars a day. Um, what's going on here? And so they would file a suspicious activity report that would lay out who is it, what did he say he it came from, um, and what is it that's suspicious about it.

And I and I should say like, you know, back in the day that would have been he brought in a bag of cash. Um net then it would evolve to checks and check numbers, then it would evolve to trans uh wire transfers and the wire transfer information about every piece of that transaction, who the correspondent bank was.

In the crypto space, that could be all sorts of things. What wallet address was connected, what time, uh, if it's a if it's a public ledger like Ethereum or Bitcoin, that might be here's a graph of everything that that wallet touched historically. Uh, depending on what the platform is, they may collect the IP address, even the device identifier that Seth used to connect. Um, so there's a tremendous amount of data and metadata that could be collected in that information.

Can we Michael, so can we go back to kind of the history here uh with you guys to make sure I understand it? So there wasn't and we're still domestic, so we're still talking about the US and we'll expand international after this. So um prior to like the nineteen seventies, uh am I right to say there wasn't much financial surveillance? And then in the nine nineteen seventies, is that is that correct? Yeah.

Yeah, okay, so that's correct. And then in the 1970s, basically to kind of fight crime, maybe organized crime, you know, the mafia was is sort of one uh one organization that was in the crosshairs, uh, the US came out with a Bank Secrecy Act. And this started sort of the the financial surveillance uh apparatus. And and so this is this the reason basically for AML KYC, which is like I have to be identified before I can like, you know, with a government ID, let's say, before I can open a bank account. And this is the reason when I go to like transfer money or take out a large deposit from my bank, uh, the bank teller will say, What are you doing with that? Like, how are you using that money? They ask these questions. I'm always like, Why do you need to know this? Uh, you know, and it's almost couched as if, well, we want to protect you from frauds and scams. You know, maybe that's part of it. It seems like more of it is is is kind of this financial surveillance apparatus. So that's why I have to present an ID. That is why they are asking questions like, What are you doing with the money? And can you tell me more about uh the source of the funds? These are all questions I'm I I know many of bankless listeners have have seen from their banks. And it all all emanated from this legislation from the the 1970s and the Bank Secrecy Act. Is that is this correct?

Yeah, so it it started uh the Bank Secrecy Act was enacted in in 1970. Um and you know it at that time it was uh you know a much smaller version uh you know than it is now.

Uh right. So in 1970, it had two uh two core provisions, Title I, Title II. Title I basically said banks have to um record the transactions of their customers. They have to keep an internal log of all the transactions their customers make.

Title II said banks have to report uh transactions over a certain size to the Treasury Department.

And in 1970, that that threshold was set at 10,000 US dollars. Um and so that created um one of these forms that uh the reports get made on called a CTR or currency transaction report.

Uh importantly, the uh that threshold, that $10,000, uh hasn't ever been adjusted.

Right? So if you if you go back and you adjust the the CTR threshold.

Uh back to to 1970, it's the equivalent of about $79,000 today.

Wow.

And what that amounts, yeah, what amounts that amounts to is uh you know a gradual but constant tightening of the noose of uh transaction reporting of

uh uh on the American people.

Uh and you know, and so that's where it started. Um, you know, but you know, both as as sort of Mike and and Ryan, your your your comments alluded to, there's this sort of creeping nature of it where it all it just expands. Right. So first it was just the CTRs and the record keeping.

You know, now it's uh SARS or suspicious activity ports that were added in 1992.

Um there was a a a vast expansion of the scope of the types of transactions in the types

It just really quick, SARS, so suspicious activities report. Is that basically incumbent on sort of the bank teller or bank employee to be like, hey, there's something fishy about this transaction and I'm gonna report it up? Is that right?

exactly. Exactly.

That is okay.

Um and

um, you know, so interesting stat on on suspicious activity reports. Um somewhere north of two million SARS get filed with Vincent every year.

Um uh you know, and again, curious for your for your insider take on this, Mike. But uh, you know, testimony uh presented to Congress is that FinCEN reviews less than 1% of the SARS that are actually filed.

Um

and you know, and and there are you know way more CTRs filed than SARS filed. So, you know, most of this information goes into uh, you know, basically just a government database and sits there waiting to be queried.