On September 11, the Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA) separately announced three “first of their kind” enforcement actions against participants in the digital asset (or “token”) market:
- In the Matter of TokenLot LLC. The SEC took action against a token sale website for operating as an unregistered broker-dealer in violation of the federal securities laws.
- In the Matter of Crypto Asset Management, LP. The SEC entered an order against a digital asset hedge fund manager for failing to register its fund as an investment company and offering and selling its fund’s securities in an unregistered offering.
- Department of Enforcement vs. Timothy Tilton Ayre. In its first disciplinary action involving digital assets, FINRA filed a complaint alleging that a registered person of a member firm violated federal securities laws and FINRA rules in its offering of a blockchain token as an unregistered security.
On September 4, the Innovation Group of the European Parliament’s Committee on Economic and Monetary Affairs met to discuss a proposal presented by the rapporteur Ashley Fox,1 member of the European Parliament, to include a framework for initial coin offerings (ICOs) within the proposed European Union (EU) financial services regulatory regime for crowdfunding2 (see European Commission (Commission) proposal COM(2018) 113 final).3
As part of the public discussion, the Commission, the European Securities and Markets Authority (ESMA), the European Banking Authority (EBA) and the UK Financial Conduct Authority (FCA) were present to provide their thoughts. (more…)
In the months following director William Hinman’s noteworthy speech on whether and when a digital asset is subject to securities laws, U.S. regulators have continued their stern warnings regarding the importance of compliance with the securities laws. This post highlights three important regulatory updates:
- On August 14, 2018, the Securities and Exchange Commission (SEC or Commission) issued an administrative order, In the Matter of Tomahawk Exploration LLC and David Thompson Laurance, taking action against an unregistered and fraudulent initial coin offering (ICO).
- On August 28, the North American Securities Administrators Association (NASAA) released an update on the progress of its ongoing Operation Cryptosweep.
- The Financial Industry Regulatory Authority (FINRA) issued two investor alerts, on July 27 and August 16, regarding blockchain tokens and ICOs.
On September 5, 2018, the new Belgian Data Protection Act implementing the GDPR (the Belgian Act) was published and entered into force. Despite the GDPR being an EU regulation that directly applies to all EU Member States, several provisions of the GDPR explicitly allow, and even require, Member States to enact legislation which implements the law. Member States were expected to have this legislation in place by May 25, 2018, but the majority of Member States (including Belgium) did not meet the deadline. Since December 2017, however, Belgium has had in place a law implementing many of the more procedural provisions of the GDPR, namely the Act on the Establishment of the Supervisory Authority (the SA Act). The SA Act lays down the structure, powers and competence of the new Belgian Supervisory Authority, and also includes rules of procedure applicable to administrative proceedings before the Authority. (more…)
This post summarizes the EDPB’s stated positions on these points and explores the implications for firms providing payment services in the European Economic Area (EEA).
On Friday, August 31, the California legislature unanimously passed a host of “clean-up” amendments to the new California Consumer Privacy Act (CCPA), AB 375, as it set about addressing flaws and other concerns in the state’s groundbreaking data privacy law. These amendments are now awaiting Governor Brown’s signature. (more…)
Vishnu Shankar, an associate in our London office, spoke with DataGuidance at the 2018 IAPP Data Protection Intensive. He discussed his recommendations on regulatory requirements regarding breach notification across several key pieces of legislation, including the GDPR and the NIS Directive, as well as sector-specific requirements.
Companies subject to New York’s Cybersecurity Regulation are acting quickly to finalize their compliance obligations as the fifth “due date,” September 4, 2018, quickly approaches.
By September 4, 2018, Covered Entities must ensure that their cybersecurity programs have in place certain additional safeguards:
- an audit trail that shows detection of and response to material cybersecurity events;
- written security procedures, guidelines, and standards for the development of in-house applications and for the evaluation and testing of externally developed applications;
- data retention policies and procedures for the disposal on a periodic basis of nonpublic information no longer necessary for business operations;
- risk-based policies, procedures, and controls to monitor the activity of authorized users and detect unauthorized access; and security controls, such as encryption, to protect non-public business relations and personal information.
Notably, for this upcoming deadline, Covered Entities that have received a limited exemption must still comply with the regulatory provision regarding data retention policies and procedures for the periodic disposal of nonpublic information. (more…)
The National Association of Insurance Commissioners (NAIC) held its Summer 2018 National Meeting in Boston, Massachusetts, from August 4 to 7, 2018. This post summarizes the highlights from this meeting. (more…)
In a recent speech outlining the Trump Administration’s healthcare regulatory reform efforts, Secretary of Health and Human Services (HHS) Alex Azar announced that the Administration will soon begin considering changes to federal health privacy regulations. (more…)