What laws do crypto exchanges need to abide by? So they need to collect personal information on each user most of the time right? But how thorough does this information need to be? Do the exchanges need to check with each government to make sure the information is valid? Or is submitting documents enough?
Do the exchanges need to check with each government to make sure the information is valid? Or is submitting documents enough? They need to understand the (usually very complicated) laws governing financial services and data protection in every jurisdiction where they operate. The specific requirements will vary from one jurisdiction to the next. The usual way of acquiring this understanding is to hire a lawyer (or several).
Note that what is being bought or sold here is actually information about the exploit. Attempting to criminally penalize the transmission of information in the US often runs into First Amendment issues. If a person has good reason to know that information is going to be used to commit a crime, or is likely to be so used, and there is no plausible legitimate use for the information, that person might be charged with complicity or conspiracy for distributing the information. But where there are legitimate uses, that is much less likely. Here the information could be used to defend against the exploit, or to identify and remove software subject to the exploit, or for research into such exploits generally. There may be other legit uses as well. Some years ago the Federal government attempted to prosecute a person for exporting a book describing how to create an encryption program. The courts eventually ruled that this was protected speech. I suspect a similar ruling would be made in the sort of case described in the question, but the details would matter.
No GDPR applies to people (not just citizens) who are in the EU. It has no applicability if both parties are not in the EU.
Your basic regulatory umbrella for anything that stores, transmits or interacts with any private health information or health IT systems is Health Information Privacy | HHS.gov, as well as state authorities. There are severe penalties at the federal and state level for non-compliance and privacy breaches, and many other agencies - such as the DEA, state health departments, insurance companies - would have to be involved in testing and certification of such a App. You will simply not be able to distribute the App on Google or iTunes without their approval, and those distributors will not approve a App that has not been strictly vetted for privacy and HIPAA compliance. In order to distribute such as App - with a TOS that assures personal privacy and shields you from liability (if possible) - you will need to spend hundreds of thousands of dollars on legal representation for compliance. As an example, see ohwilleke's answer to What kind of lawyer should I seek to understand compliance requirements for processing credit cards?
Although crypto space may be little regulated, insurance is in most jurisdictions highly regulated. Any such arrangement would need to comply with current laws on insurance, until and unless modified laws to cover this sort of thing are passed, and then it would need to comply with those. Tax authorities generally allow one to declare &quot;other business income&quot; or &quot;other investment income&quot; without forming a legal entity. I cannot say how such income would be classified in any given jurisdiction. Whether the platform, or some legal entity associated with the platform, would need to be registered will depend on the current laws and regulations governing insurance, and on the way in which teh contracts are structured. A disclaimer cannot prevent one from being sued. The contracts would need to carefully and explicitly state who is liable for what. Programs cannot be held accountable for anything. Legal entities, including operators of programs, can be. If negligence in the creation or operation of a program causes a loss, the operator may well be liable. Programs cannot be sued for anything. Legal entities, including operators of programs, can be. It may well be essential to constitute the &quot;platform&quot; as a legal entity of some sort. Otherwise its operator will be liable for its actions. I cannot be sure. I once encountered a somewhat similar system in which insurance was provided by individuals exchanging contracts, so that in a sense each member insured all the others. There was a company that supervised and provided legal and administrative services to the group of individuals, and collected fees for this. That sounds a bit similar to the suggested platform, but I don't know exactly how that company was organized. The system was called &quot;NJ CURE&quot;. I don't know if it is still in operation.
Yes you would. Bitcoin is a form of property right or asset, just like any other form of wealth. And, income is a positive increase in the sum total of your property rights. You might be able to take deductions in connection with whatever you parted with in order to obtain a bitcoin, depending on the transaction, just as you might be able to take a deduction for inventory expenses associated with income in the form of money.
Paying taxes with cryptocurrency is a potentially taxable event under federal tax law. It is equivalent for federal income tax purposes, for example, to paying taxes in kind with IBM stock. See, e.g., this IRS FAQ. You can owe capital gains taxes on involuntary transfers. For example, if you own a rental property and don't pay property taxes and it is sold at a tax sale, you owe capital gains taxes and depreciation recapture taxes on the amount realized in the tax sale if it exceeds your basis in the rental property (which it usually would since third-parties bid at tax sales).
There is not necessarily a contradiction. Information that they may keep may be: Account information Subscriber information Information on breaches of the Terms of Service or Agreement So yes, they might certainly not keep any logs &ndash; although that claim is doubtful, since they almost certainly keep at least error-level logs of their services &ndash; but that doesn't mean that they have no information to disclose to law enforcement. It's also questionable what "logs" refers to &ndash; would aggregate statistics be considered a log, by law? Would your last known IP address be considered a log, provided they don't keep any other history?