Security and Regulatory Compliance Flashcards

A Virtual Asset Service Provider (VASP) is facilitating a transfer of €1,500 in cryptocurrency between two of its customers. According to the Financial Action Task Force (FATF) 'Travel Rule' recommendations, what is the VASP's primary obligation regarding this transaction?

Answer: Obtain, hold, and transmit required originator and beneficiary information to the counterpart VASP.

The FATF's Recommendation 16, known as the 'Travel Rule,' requires VASPs to collect and transmit information about the sender (originator) and recipient (beneficiary) for virtual asset transfers. This information must 'travel' with the transaction to ensure authorities can trace funds and prevent illicit activities like money laundering. While reporting suspicious transactions is an AML obligation, the Travel Rule specifically mandates the sharing of originator/beneficiary data between VASPs.

A DeFi protocol's smart contract has a function that allows users to withdraw their deposited funds. An attacker discovers that the function sends the cryptocurrency *before* updating the user's balance in the contract's state. Which specific vulnerability can the attacker exploit to drain funds from the contract?

Answer: Reentrancy

A reentrancy attack occurs when an external call is made from a smart contract to another contract before the state of the first contract is updated. In this scenario, the attacker's contract can repeatedly call the withdrawal function, re-entering the code before the balance is updated to zero, allowing them to withdraw the same funds multiple times until the contract is drained. This was the vulnerability in the infamous DAO hack.

Which of the following is a primary objective of implementing a Know Your Customer (KYC) program for a cryptocurrency exchange?

Answer: To comply with Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) regulations.

Know Your Customer (KYC) procedures are a critical component of a broader Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) compliance framework. Regulated cryptocurrency exchanges implement KYC to verify the identity of their users, which helps prevent illicit activities such as money laundering, terrorist financing, and fraud by linking pseudonymous blockchain activity to real-world identities.

A US-based cryptocurrency exchange identifies a wallet address on its platform that has been added to the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list. What is the exchange's immediate required action regarding the assets associated with this wallet?

Answer: Immediately block the assets and report the action to OFAC.

U.S. persons and entities, including cryptocurrency exchanges, must comply with OFAC regulations. When they identify property or an interest in property (like cryptocurrency) of a person on the SDN list, they are required to immediately block (freeze) those assets. After blocking the assets, they must report the action to OFAC within 10 days. They cannot allow the sanctioned party to move, trade, or transfer the funds.

A DeFi project team is preparing to launch a new lending protocol. To build trust with potential users and investors, they engage a third-party firm to conduct a thorough review of their smart contract code to identify potential vulnerabilities, logic errors, and security flaws. What is this process called?

Answer: A security audit

A security audit is a comprehensive assessment of a DeFi project's smart contract code conducted by specialized third-party firms. The primary goal is to identify and fix security vulnerabilities, such as reentrancy, integer overflows, and access control issues, before the protocol is deployed. This process is crucial for protecting user funds and building confidence in the project's security.

Services that obscure the transaction trail of cryptocurrencies by pooling and mixing funds from multiple users are often scrutinized by regulators. What are these services commonly called?

Answer: Crypto Mixers or Tumblers

Crypto mixers, also known as tumblers, are services designed to enhance privacy by breaking the on-chain link between a user's original funds and the funds they receive. They do this by pooling transactions from many users and mixing them together. Regulators and law enforcement agencies view them with suspicion because they can be used to launder money and hide the proceeds of illicit activities, leading to sanctions and enforcement actions against some operators.