Crypto exchanges and the America problem: Is a check-box enough?

Disclaimer: This essay is provided for educational purposes only. It is not intended or offered as legal advice. If you need legal advice, hire a lawyer! Also, these are my opinions only, and aren’t authorized by any past, present or future employer. Also, I might change my mind. I contain multitudes.

If you've been following the news about Bitfinex, Tether and the New York Attorney General's office you know one of the Bitfinex group’s arguments is that the AG lacks jurisdiction because of (1) allegedly insufficient contacts with New York and (2) a requirement that users who register to affirm they aren't New York residents. The Block also recently revealed that any old twerp sitting in New York City can sign up for the service anyway and trade to their heart's delight, check-box affirmation or not.

Why does that matter? Well, for one thing, it’s a basic principle of U.S. law that a court has to have jurisdiction in order to resolve a dispute. If the Court doesn’t have either personal jurisdiction or subject matter jurisdiction, it has to dismiss the case. One factor is whether a defendant was present in the jurisdiction, or if outside it, if they've done anything that would lead them to expect to be dragged into court in the U.S. (I am simplifying -- if you want to read more on the basics of jurisdiction, which I am not going to cover here, I wrote a high level summary a few years ago called Blockchain Jurisdiction which is a fairly quick read).

So here’s the issue in a nutshell: Is it enough for a crypto exchange to rely on a check-box non-residence affirmation? Can the exchange trust the user’s pinky-promise they are not American and look no further? Or does a non-U.S. crypto exchange that does not wish to comply with U.S. law have to do more? Does it have an affirmative obligation to block U.S. customers from accessing or using the exchange's services? And if so, what does that obligation entail? Does the exchange have an obligation to implement stricter controls, including blocking U.S. IP addresses and/or VPN access?

Whether you attempt to block U.S. IP addresses (and whether that's a sound technological approach) it's pretty clear that you can't do nothing. There are plenty of examples here. For example, in the fall of 2018, the U.S. SEC and CFTC sued online trading platform 1Broker and its CEO Patrik Brunner. According to the CFTC's Complaint, 1pool was a Marshall Islands-registered limited liability company. Patrick Brunner is an Austrian citizen. Neither were registered with the CFTC in any capacity. I suspect that they believed that because they were offshore that U.S. regulators would have no interest in them. Turns out that they were wrong.

For several years, the Defendants' website solicited customers to transact in "Contracts for Difference" (CFD), including gold and oil, both of which are commodities under the Commodities Exchange Act. CFD trading allows users to trade on price movement without ownership, delivery or settlement of the underlying asset. CFD trading on the platform was settled in bitcoin. I'm going to avoid getting into the weeds on who is allowed to trade CFDs in the U.S., but suffice it to say it's a pretty limited group and a platform that wants to do this with U.S. customers has to jump through a significant number of hoops.

Of course 1Broker didn't jump through any hoops at all and, in fact, its feet never even left the ground. Per the CFTC, 1pool only "require[d] its customers to provide a username and email address to open a trading account, which is insufficient information to conduct any reasonable inquiry into the true identity of its customers."

Given how easy it was to register, an FBI agent did precisely this -- he logged on and created an account, did some trading and violated the Commodities Exchange Act, the Securities Exchange Act and (though it wasn't charged) probably the Bank Secrecy Act too, for failing to do any AML/KYC. The CFTC and SEC both filed suit and both cases settled quickly, in large part, probably, because they had the defendants dead to rights.

So clearly 1Broker's onboarding process was lacking. But what else should it have done? Should it have simply blocked U.S. users from accessing the site? How about a check-box affirmation that the user wasn't a U.S. citizen?

At least one recent ICO-related case has analyzed the check-box affirmation and in that case found in wanting. At issue in SEC v. PlexCorps, was an SEC enforcement action involving the PlexCoin ICO. The SEC provided the Court a ton of information to show U.S. connection and U.S. buyers including use of U.S. payment servicers that helped the defendants close 14,074 sales, of which 25 percent were to U.S. buyers. Defendants also had two accounts with Kraken, which is based in the U.S., and which received more than $1 million. According to the Court, the SEC provided a sworn statement from PlexCoin's social media manager who "sometimes communicated" with Americans during the sale and who stated that people involved with PlexCoin understand that Americans were purchasing it. The Court also concluded that a trip by the company's principals to the United States was likely related to the project.

Still, the defendants said that "in two ways [they] attempted to shield the ICO from United States-based buyers." First, they had to accept terms of service that said U.S. and Quebec residents were not allowed to participate. Second, "PlexCoin used two 'check boxes' [on the website] in order to try to eliminate...potential American buyers." One of the boxes stated "I hereby confirm that I am not a Quebec (Canada) or US citizen resident, not am I acting on behalf of a Quebec (Canada) or US citizen or resident." According to evidence before the Court, however, it remained possible to purchase PlexCoin without checking the box. There was also evidence available to the defendants during the sale process that U.S. persons who were based in the U.S. were buying the token from U.S. IP addresses.

The PlexCorps opinion provides a long and detailed personal jurisdiction analysis, and a part of that looked at the check-box argument, which was a non-starter. The Court said that the SEC had provided evidence that the check-box and terms of service exclusion clause were "at least somewhat ineffective" and that everyone involved with the project knew that Americans were purchasing PlexCoin and took no steps to prevent that from happening. There was also evidence that one of the company's principals wanted to remove the check-box "because he was not getting enough purchases." For this (and some other reasons) the Court said it had personal jurisdiction over the defendants and denied a motion to dismiss. (PlexCorps also said it hadn't implemented any sort of IP block because the technology was, well, complicated).

Several recent cases have specifically looked at IP blocking, though not in the context of crypto trading or ICOs. Still they provide helpful precedent. Plixer Int'l v. Scrutinizer GmbH, 905 F.3d 1 (1st Cir. 2018) is a recent Circuit Court of Appeals case where the absence of IP blocking was a factor in the Court's exercise of jurisdiction over a non-U.S. company.

Scrutinizer is a German corporation that operates an internet-based business that allows companies to improve their software. It has an English website and terms of service with a German forum selection and German choice of law clause. It "maintains no U.S. office, phone number, or agent for service of process; it directs no advertising at the United States; and its employees do not go to the United States on business." During a three-year period at issue in this lawsuit, it sold services to 150 U.S. customers in 30 states.

Plaintiff, a company called Plixer, sued Srutinizer in U.S. federal court for trademark violations. Scrutinizer moved to dismiss, arguing that the court lacked personal jurisdiciton" over it. The trial court denied the motion. It reasoned that "operated a highly interactive website that sold its cloud-based services directly through the website, that it was open to business throughout the world, that it accepted recurrent business from the United States in a substantial amount, and that it did so knowingly." Scrutinizer appealed.

On the one hand, merely making a website available on a passive basis isn't enough without more to establish personal jurisdiction over a defendant. On the other hand, that wasn't the case here. The defendant "it had used [its] website to engage in sizeable and continuing commerce with United States customers." And it had done nothing to restrict access from U.S. customers. It took no steps to note on the website that it wasn't intended for non-U.S. users. It also took no steps to block access to U.S. customers. Here, the court addresses IP blocking technology:

"Scrutinizer says that we should not consider whether a defendant blocks access to its website -- access blocking software is imperfect, developing technology. If a defendant tries to limit U.S. users' ability to access its website, however, that is surely relevant to its intent not to serve the U.S. The converse is true here: Scrutinizer's failure to implement such restrictions, coupled with its substantial U.S. business, provides an objective measure of its intent to serve customers in the U.S. market and thereby profit. And Scrutinizer's warnings about the inefficacy of access-blocking technology are misplaced based on the record before us. Scrutinizer can track where its customers are from -- it provided state-by-state customer information in response to Plixer's discovery request."

In short, the Court found that -- while it was a "close call" -- the German company could have "reasonably anticipated" being sued in a U.S. court and in doing so considered the lack of IP blocking as a factor in reaching this decision. The reasoning is also important -- the defendant had implemented tracking analytics, which are prevalent, and trivial to implement. If you can track website access using analytics, the court reasoned, certainly you use the same technology to block or restrict access.

IP blocking was also an issue in Spanski Enters. v. Telewizja Polska, S.A., 883 F.3d 904, a March 2018 D.C. Circuit copyright infringement case. Plaintiff is a Canadian company that had a license agreement for exclusive rights to perform defendant's Polish language over the internet in North and South America. To protect these rights, Defendant used geo-blocking technology. The Court explains how it worked thus:

"In order to protect Spanski's exclusive rights, TV Polska—which makes its programming publicly available through a video-on-demand feature on its website—employs technology that prevents internet-enabled users in North and South America from accessing TVP Polonia content though its website. Known as geoblocking, this technology allows a website owner to digitally embed territorial access restrictions into uploaded content. When an internet-enabled device attempts to access restricted content, the geoblocking system compares the device's unique internet protocol (IP) address to a third-party database that reveals which IP addresses are associated with which countries. If the device's IP address is associated with a country subject to restricted access, the device cannot access the content."

Plaintiff discovered that certain content wasn't actually geoblocked and available to North and South American users of defendant's video on-demand service, including a number of episodes registered with the U.S. Copyright Office. Plaintiff sued. After a trial, the Court found defendant liable because the content became available after the defendant's employees deliberately removed geoblocking restrictions. While affirmation of the case by the Court of Appeals didn't turn entirely on the presence of absence of geoblocking, the Court agreed that removal of the blocking was sufficient evidence of willfulness to warrant increased damages under the copyright act.

On the other hand, purely incidental contact with the United States is not enough to give rise to U.S. jurisdiction, and whether or not IP blocking is utilized may not matter in such a case. That was the case in Triple Up, Ltd. v. Youku Tudou, 2018 U.S. App. LEXIS 19699, a 2018 D.C. Circuit case where Plaintiff sued alleging the Defendant, alleging that it had infringed an exclusive license to broadcast three movies in the United States and in so doing violated the copyright and Lanham Acts. The defendant is a Chinese company that "has no offices or employees in the United States, and less than one quarter of one percent of its monthly viewers comes from the United States, not one of whom is alleged to have viewed the videos at issue." The district court dismissed the lawsuit for lack of personal jurisdiction and the court of appeals affirmed.

The Court reasoned that the plaintiff's complaint failed "to allege any plausible basis for personal jurisdiction." The defendant had no offices or employees in the U.S. and had no registered copyright agent in the U.S. "because it does not target its services at United States residents or regularly conduct business in the United States." Furthermore, there was no evidence that any Americans actually did business with the plaintiff. The fact that the plaintiff's lawyer was able to access the streaming service in Washington, D.C. wasn't enough, standing alone to show that a business transaction had been entered into. Another factor weighing against exercise of U.S. jurisdiction was that the plaintiff was a Seychelles corporation, with no business operations in the U.S., that had been harmed by the defendant's conduct.

One of the things a plaintiff will often attempt if the defendant moves to dismiss a case on jurisdictional grounds is to do jurisdictional discovery. Plaintiff tried to do that here, seeking, among other things, information about the defendant's "geo-coding and geo-blocking activities." The court rejected this as a fishing expedition: "Triple Up argues that some English-language advertisements placed by third-party advertising agencies, along with a minuscule percentage of monthly internet views coming from the United States, suffices to establish personal jurisdiction, notwithstanding the absence of any Youku business operations in the United States relevant to the alleged harm. That is not enough to establish the minimum contacts required for personal jurisdiction."

* * *

Now that you've read all of this you may wonder what it all means, and whether these cases can be distilled into some simple rules. You may also wonder whether it means Bitfinex is going to win or lose. There's probably only one clear rule we can distill here, with a lot of gray area otherwise. That clear rule seems to be that you can't take business from U.S. customers and do absolutely nothing, as in the 1Broker case, not if you want to avoid the risk of being dragged into U.S. court. That seems like a no-brainer but apparently not to everyone. What about the gray area? How does one navigate that? Is some form of geo-IP blocking also a requirement for a crypto-exchange that wants to avoid finding itself in U.S. court?

Let's accept that the technology is imperfect, that it also requires blocking known VPN access, and that it may inadvertently block non-Americans. It would certainly be compelling evidence for a court to see that a company has taken active technological measures to block U.S. users from its site. While this is not legal advice, as my disclaimer notes, I'm personally exceptionally skeptical that the check-box disclaimer and terms of service exclusion are going to be sufficient for most courts. Certainly, a rigorous KYC process -- with identity verification would need to accompany check-box verification -- would provide a stronger and more defensible position for a company claiming that it goes out of its way to avoid Americans.

If you have been reading my work for a while you know that I don't generally make predictions about the results of active litigation. So I am not going to tell you who is going to win or lose the Bitfinex fight. I will tell you that I doubt a New York Court presented with evidence of registration by New York consumers is probably not going to be convinced that a check-box affirmation and a terms of service exclusion are going to be enough. This is even more so when it is trivial technologically to see at the time of registration that the user who says they are not in New York actually is. (As a side note, we know that many U.S. based exchanges monitor I.P. addresses, so it’s hardly a novel concept. One alleged user reported two years ago that his account was locked by Coinbase when he traveled to Cuba. So it’s not like this is a novel concept). At the very least, I’d expect some tough questions about why this doesn’t trigger at least another level of immediate review.