CBP Security and Regulatory Issues 2 — Questions and Answers
Question 1: Which U.S. regulatory framework requires cryptocurrency exchanges to implement AML programs?
- Securities Act of 1933
- Bank Secrecy Act (BSA) (Correct answer)
- Gramm-Leach-Bliley Act
- Sarbanes-Oxley Act
Correct answer: Bank Secrecy Act (BSA)
The Bank Secrecy Act requires crypto exchanges classified as Money Services Businesses to maintain AML programs including KYC and suspicious activity reporting.
Question 2: What is a Sybil attack in the context of Bitcoin networks?
- Stealing private keys through phishing
- Creating multiple fake identities to gain disproportionate network influence (Correct answer)
- Flooding the network with spam transactions
- Intercepting transactions between two peers
Correct answer: Creating multiple fake identities to gain disproportionate network influence
A Sybil attack involves one entity creating many fake node identities to manipulate the network's peer-to-peer operations or information propagation.
Question 3: Under FinCEN guidance, which entity type is typically classified as a Money Services Business (MSB)?
- Bitcoin miners who only mine and hold coins
- Peer-to-peer exchangers who buy and sell Bitcoin for others (Correct answer)
- Software developers who write Bitcoin wallets
- Node operators who validate transactions
Correct answer: Peer-to-peer exchangers who buy and sell Bitcoin for others
FinCEN classifies those who exchange virtual currency for others as MSBs, requiring registration and AML compliance, while miners and developers are generally excluded.
Question 4: What security risk does address reuse introduce in Bitcoin?
- It increases transaction fees
- It reduces mining rewards
- It links multiple transactions together, reducing privacy (Correct answer)
- It prevents transactions from being confirmed
Correct answer: It links multiple transactions together, reducing privacy
Reusing Bitcoin addresses allows blockchain analysts to cluster transactions and associate them with a single owner, undermining transaction privacy.
Question 5: Which attack vector exploits the time between transaction broadcast and block confirmation?
- 51% attack
- Race attack (Correct answer)
- Dust attack
- Timejacking
Correct answer: Race attack
A race attack broadcasts two conflicting transactions simultaneously, attempting to spend coins at a merchant before the legitimate transaction is confirmed.
Question 6: The EU's 5th Anti-Money Laundering Directive (5AMLD) extended AML requirements to which entities?
- Only banks holding crypto assets
- Cryptocurrency exchanges and custodian wallet providers (Correct answer)
- Only decentralized exchanges
- Bitcoin node operators across the EU
Correct answer: Cryptocurrency exchanges and custodian wallet providers
5AMLD explicitly brought cryptocurrency exchanges and custodian wallet providers under EU AML/KYC obligations for the first time.
Question 7: What is the primary purpose of a hardware security module (HSM) in Bitcoin custody?
- To speed up transaction signing
- To store and protect private keys in tamper-resistant hardware (Correct answer)
- To validate blocks faster than software nodes
- To encrypt blockchain data at rest
Correct answer: To store and protect private keys in tamper-resistant hardware
HSMs provide a secure, tamper-resistant environment for private key storage and cryptographic operations, preventing key extraction even if the host system is compromised.
CBP Security and Regulatory Issues 2
Which U.S. regulatory framework requires cryptocurrency exchanges to implement AML programs?