In the article says: Following the collapse of FTX, Paul MacIntosh, EY’s US financial services crypto co-leader, said on LinkedIn that proof of reserves reports do not assess companies’ internal controls, “which ultimately was the downfall of FTX”.
This is misleading. FTX, either referring to the specific the company or the whole network of companies, did not. What was referred to as the “WRS Silo” in the bankruptcy proceedings, which includes FTX.US, did.
The “Dotcom Silo”, which includes FTX-the-specific-company, had an audit, too, but by Prager Metis not Armanino, which, in contrast to Armanino’s known status, the post-SBF CEO handling the FTX bankruptcy describes in the bankruptcy papers as a firm with which I am not familiar and whose website indicates that they are the “first-ever CPA firm to officially open its Metaverse headquarters in the metaverse platform Decentraland.”
The other silos, including the Alameda Silo (which naturally includes Alameda Research) had no audited financials.
Armanino is to Mazars as Raspberry Pi is to Apple. They are not even close in stature.
That's why I should have gone with "one of the top 25" firms. Nonetheless, "a top firm" is still applicable here, not "the top firm".
Their own website touts their spot in the top 25, and Accounting Today's 2021 revenue ranking further confirms this by placing them at number 21. While Mazars are 26th on the same list. (https://www.accountingtoday.com/the-2021-top-100-firms-data)
Evidently, this firm have audited billions and supposedly assured investors! But also I am more concerned about the lost savings of innocent people! Like Ontario Teachers', Canadian pension funds!
I've never heard of this Armanino company. They're not even top 10 worldwide, they claim to be top 25 in the US, they don't have a Wikipedia page, even.
Plus, was that audit even finished and an opinion given? Anything else is worthless.
I've routinely joked to my wife that her life would be much easier if they fired their auditors and went with BDO or some smaller auditing that they could bully around. The thing is, that's exactly how companies with weak accounting think, and FTX proves that point.
All the big 4 have been caught turning a blind eye over the last few years to win big contracts. Wirecard, Carillion and NMC Health all spring to mind for me in Europe. If i have 3 committed to memory there are many more.
All the "audit" firms are corrupt, regulation has utterly failed.
The complaint however is that the regulations that have been proposed are trying to pidgeonhole the different parts of digital assets and decentralised finance (not defi but decentralised financial services as a whole) into existing categories that they don't cleanly fit in.
Cryptocurrency for example isn't a commodity (representation of a resource) or a security(representation of ownership/control in an organisation/system). It can never fit cleanly under one definition or the other. Some tokens would fit cleanly under the definition of a security, some under the definition of a commodity, and some cleanly under neither.
Likewise, node, relay, and validator operators for networks don't really fit cleanly under any given existing set of regulatory guidelines. Regulations for Money Service Businesses for example are overly restrictive and essentially outlaw any existing cryptocurrency operator from even attempting to operate in the US. It's not that the stated goals are impossible to comply with but rather that the specifics of the regulations are. Conversely, some of the much laxer proposed regulations wouldn't adequately cover operators and would leave the door open to abuses.
AML and KYC regulations are particularly problematic. They mean well and the spirit of the regulations should be adhered to but they have not been written in a way that is compatible with this tech. Networks with privacy preserving transactions can comply with AML & KYC. Projects on those networks can as well. It won't however be in a way compliant with the direct reporting of user identities. Even if you wanted to comply with KYC & AML, you physically couldn't. Instead you can build infrastructure to comply KYC and AML via DIDs, ZK-proofs, and conditional release of private information (via functional encryption and a number of other techniques).
There's a multitude of ways to handle the regulatory complexity without legally crippling privacy preserving & decentralised tech. It just requires that regulators actually work with the communities that have been trying to do things proper and kosher. Instead regulators have essentially ignored the industry's requests & proposals in whole, claimed to have heard nothing, and plowed forward with pushing regulations that would cripple the legitimately useful technology in the space.
SBF even admitted that his insistence on regulation was just a front.
Binance, FTX, Coinbase, Kraken, CoinEx, etc are all just traditional financial exchanges and should be forced to comply with existing regulations because they can. They can do traditional KYC and AML in addition to the controls you mentioned because they are centralised services that directly interact with traditional financial services (banking, wire transfer, etc) The only real open question for those services is asset classification.
If those services wanted to comply with regulations, they could do so voluntarily but they aren't actually interested in that like you mentioned.
The issue is that any time regulations come around, they end up misclassifying the network and decentralised projects in the process.
TLDR: Agreed on all accounts with regards to centralised exchanges. My main complaint is that so far the suggested regulations have not fit well onto the rest of the space.
I'm not an expert but I don't think "traditional financial exchanges" hold assets to be traded on behalf of customers. I think they are just meeting points for traders, and they host the public order book.
Cryptocurrency is designed for, and has a major selling point, that it makes it easier for people to get away with actions which are socially considered bad and evade controls designed to detect, prevent, and reverse such actions.
To the extent that design works, it doesn't just protect the benign little-guy against malign authorities.