[Resolved] MtGox mishandled sensitive AML info.

[uck]

Sounds like a nice little sign on their door at their old place that just says (in Japanese) MtGox has moved. Please forward all deliveries to: ___(new address)___ ... There, problem solved.  Surely the new tenant would appreciate not having to answer the question over and over, "They moved. No, we Don't know where"... so they should appreciate/allow a simple sign on the door.

[1713524042]

1713524042

[1713524042]

1713524042

[1713524042]

1713524042

[1713524042]

1713524042

[repentance]

davout

was not aware of that specific ruling.  Thanks for posting (and translating).  Does this ruling set a precedent for for other county rulings?  Is this the only legal ruling on bitcoin??  

I don't know if there are other rulings, I believe not outside of this series (a couple of preliminary rulings were made prior to this one, but they are all summed up in the one I posted which is the final ruling).

I don't know if this ruling sets a precedent.

What I know is that the legislation is supposed to be consistent accross Europe, Paymium (the company I work for) got some specialized legal advice regarding this matter, and we found that in order to operate the Bitcoin-Central exchange securely (as in secure for our users fiat funds), we had to implement some legal compliance steps that go way beyond implementing some KYC/AML/CTF procedures according to the Payment Services Providers and Electronic Money Services European regulations.

I'm pretty sure Mark has said before that they intend to seek licensing as a money service business in the US but that it's a process which happens at state level and is quite expensive.

I don't believe this to be true, the MSB registration form is fillable online and it's like two pages long. And if Bitinstant did it, and if karpeles threw 10kBTC at the Bitcoin Foundation I really see no excuse for mtgox to at least try it.

If you read the whole court ruling you'll see that at some points karpeles outright lies to the court, so I would take his word with a grain of salt.

Page 7

Qu'à aucun moment un client du site ou la société TIBANNE ne peut effectuer ou initier un paiement sur son compte bancaire

[Macaraja says that] it is not possible for a customer of the [mtgox] website or the TIBANNE company to initiate a payment to its bank account

Oh, and another gem on page 11

Que, de plus, ayant reconnu qu'elle effectuait des placements à court terme avec les sommes reçues des acheteurs de bitcoins, la société ...

That, additionally, having admitted to using the bitcoin buyers funds in short term financial investments, the company ...

In other words mtgox is investing your money.

Whether or not they're currently licensed in the US has no impact on their obligations to comply with Japanese AML/CTF/KYC requirements

Again, these regulations are relevant to licensed financial institutions, and their contractual partners. I have no proof that mtgox is not a contractual partner of a licensed financial institution (absence of proof is obviously not a proof of absence) but I feel that if they did land such a partnership they would have at least bragged about it, and they would be required to include it in their ToS.

If you look at institutions like PayPal, you'll see that they can be licensed very differently from one location to the next - here, they're regulated as an authorised deposit-taking institution and regulated under the Banking Act - and that the restrictions on their operations vary by jurisdiction.

Again, what bothers me here is not that mtgox is unlicensed, it is that they appear to not even try (remember if Bitinstant did it, why would mtgox fail if it tried).

I don't disagree with your points but I don't understand the various types of financial services licences available in the US well enough to judge whether the same kind of licence held by BitInstant would be appropriate for MtGox's financial activities.  I know that in many places once you actually hold user funds you become subject to regulations which don't apply to businesses which merely transmit them (this is why PayPal is required to meet Tier 1 capital requirements - a minimum of $5 million or 5% of total stored value liabilities, whichever is the greater - here in Australia).

I believe that Mark could be far more forthcoming about MtGox's plans for licensing in the US and elsewhere.  MtGox has such a massive market dominance that there's not really anyone currently positioned to force them out of the US market by getting licensed first.  To some extent, it does seem like they're playing the PayPal game and will probably put off becoming licensed for as long as possible and then seek the lowest level of licensing they can get away with - even if they know they'll ultimately have to comply in the long run (as PayPal did), the longer they can delay that inevitability, the lower they keep their immediate overheads.  

It's hard to imagine now, but PayPal would never have survived without eBay.  There's nothing equivalent in the Bitcoin world.  MtGox pretty much depends on Bitcoin speculators and volatility.  When the price is stable, people chase high returns elsewhere.  If MtGox is going to require the kind of licence which costs millions of dollars, then they would want to be damned sure that speculation on Bitcoin prices is going to continue for the foreseeable future.

Obviously no Bitcoin business is required to share their thinking with us, but I do think that Mark often puts himself at a disadvantage by not doing so.  

[BCB]

There is a great book called "The Paypal Wars" which details many of the obstacles Paypal had to overcome in launching and maintaining their nascent startup that makes for a facinating read for anyone interested in this subject.  Obstacles like scammers, illicit use and Govt regulations which are not unlike what bitcoin is facing today.  However true to what repentance says paypal would never have become what it did with out first having the ebay market and then being acquired by ebay.   - Bitcoin is still looking for its ebay.

[smoothie]

What mtgox now outsourcing to Inida like Dell does?

Me no speakA any engurish! 

[repentance]

There is a great book called "The Paypal Wars" which details many of the obstacles Paypal had to overcome in launching and maintaining their nascent startup that makes for a facinating read for anyone interested in this subject.  Obstacles like scammers, illicit use and Govt regulations which are not unlike what bitcoin is facing today.  However true to what repentance says paypal would never have become what it did with out first having the ebay market and then being acquired by ebay.   - Bitcoin is still looking for its ebay.

I think it's also something of a cautionary tale.  PayPal is monumentally successful but it hasn't really remained true to Thiel's original vision of becoming the financial payments system of the world or addressing the inequality of wealth distribution. 

[BCB]

Uh Oh!  smoothie found us.  There goes the neighborhood.  It's been nice having a semi-intelligent conversation on bitcointalk.

[ArticMine]

For those who may not be aware MtGox level 3 verification requires a notarized and apostled copy of a government issued ID.  In the US the only entity that can attach an apostle seal is the state government (usually the secretary of the state personally) and thus there is a single office for an entire state.

So the process is:

• Make a photocopy of your government ID (MtGox prohibits blacking out or redacting any info).
• Get it notarized locally.
• Mail it to the state capital.
• Wait a week.
• Have the state mail it back (at your expense).
• Then mail it internationally to Japan.

MtGox website currently reports this is the address for AML documents:
https://mtgox.com/forms/verification  

Mt.Gox AML
Cerulean Tower 15F,
Sakuragaoka-cho 26-1, Shibuya-ku
Tokyo, Japan
150-8512

So I have spent over a $100 and almost two weeks getting this stupid apostled document to them.  Thankfully my AML limit will be raised.  Lets check USPS this morning.  Hopefully the end of a very long, pointless, and expensive process.

USPS reports:

, , US   10/17/2012   2:57 PM   ATTEMPTED DELIVERY ABROAD
, , US   10/17/2012   2:49 PM   ATTEMPTED DELIVERY ABROAD

 That doesn't look good.  My money eating, time wasting docs with sensitive information are taking a joy ride through Tokyo.  Let me check with MtGox support; I am sure they have a good reason.

Hi,

Thank was our old address and I have mentioned below the address to send AML Notarized document's. Please send the documents again to below mentioned address.

Mt.Gox AML
Round Cross Shibuya 5F
11-6 Shibuya 2-Chome, Shibuya-ku
Tokyo, Japan
150-0002

If you have any further enquiries, please do not hesitate to contact Mt.Gox Support either by responding to this email (should the enquiry relate to this ticket) or by using the following support request form:

https://mtgox.zendesk.com/entries/20256702-contact-us.

Thanks,

MtGox.com Team
TICKET MARKED CLOSED/RESOLVED.

I am beyond furious right now.  

Well this is not the only case. I am also in the process of getting trusted status at MTGox. In Canada it is the Federal Government that has to Authenticate the documents and they have a turnover time of 25 business days. This means the documents have to be shipped by courier to Ottawa, ON and then back to me. (in my case a distance of over 8000 km). The cost for the notary and couriers came to close to 200 CAD. I also shipped the documents to:

Mt.Gox AML
Cerulean Tower 15F,
Sakuragaoka-cho 26-1, Shibuya-ku
Tokyo, Japan
150-8512

as per their instructions, and used FedEx. I have contacted FedEx and they confirmed to me that indeed the documents arrived there last Monday. At this point I have a open ticket with MTGox on the matter so until this is settled one way or another there little for me to comment further.

[DoomDumas]

MtGox has a bad history, but still the highest volume exchange.. Last time I logued on MtGox, it was to remove all my funds, because I do not trut this entity anymore.. Bad new, I had to send 2 IDs pic to be able to withdraw all my BTC.. less than 1k.. no U$ involved, I've been unable to get my BTC before sending IDs.. I tought it was really bad, but as I wanted my BTC, I sent IDs..

You can be sure I'll never do business with MtGox again, why ? 

1 - IDs required to withdraw BTC ?? No thanks

2 - Biggest exchange, I vote for less centralisation of exchanges

3 - to many bad story about MtGox

4 - Trading manually or with my "self coded scalp-bot", I've seen too many trade error, trades that should have occur/commit and did not.. 

was my personal story / opinion !

[DeathAndTaxes]

Well I would add it has been 12 hours since MtGox was informed of the wrong address on their site and the website STILL HAS THE wrong address.  

I don't know how much louder they can say  .... "FUCK YOU CUSTOMERS. You exist to give us money and we have no responsibility to you."  

I mean Yankee says it isn't gross incompetence well even if that is true (which I adamantly disagree) it certainly is gross negligence when informed on the negligence and you take no action to correct it.  When someone reports the fact that you have blatantly wrong information on your site which is causing people to send sensitive personal information to a wrong address, get off your lazy ass and at least DELETE THE FUCKING PAGE.  Period.




On edit:  Cleaned up some blatantly bad spelling and grammar (bad even for me)  Typing while infuriated is harder than it seems.  

[Severian]

I don't know how much louder they can say  .... FUCK YOU CUSTOMERS. 

Yep.

I've asked the Bitcoin Foundation for a refund of my lifetime membership fee. I don't wish to associate with or support this kind of behavior from directors of the foundation.

[Yankee (BitInstant)]

I don't know how much louder they can say  .... FUCK YOU CUSTOMERS. 

Yep.

I've asked the Bitcoin Foundation for a refund of my lifetime membership fee. I don't wish to associate with or support this kind of behavior from directors of the foundation.

You mean Director. You used plural Directors.

Thanks.

[repentance]

You could try posting about this on /r/Bitcoin.  For some reason, their staff sometimes respond more quickly over there.

[Severian]

You mean Director. You used plural Directors.

Mark's a director also. Plus you, that makes two directors. Two is plural.

A director of the BF runs the biggest and most fucked up BTC exchange on the net. Another director, you, is covering for his fuck ups by saying "shit happens". You both share corporate seats on the BF's board of directors.

Can you at least admit that you can see why this might reflect poorly?

[FreeMoney]

I am beyond furious right now.  

They just moved to a new office like 2 weeks ago, and probably forgot to update the address on that page of their website.

Although its their fault, I wouldn't be too pissed off because its an easy mistake to overlook and can happen to anyone.

Calling it gross incompetence may be out of line. While your information is extremely sensitive, even you could have made the same mistake if you were in their position.

This is blowing my mind. Of course a private person responsible for only their own stuff could give a wrong shipping address! Why does that matter at all? Beyond that if I a wrong shipping address it 100% automatically falls on me, I don't get my stuff.

Also how can they overlook it? Aren't other people sending documents there? After a month you would think they might go "Huh, we don't get documents now that we moved".

Bleh, we need new business so we can finish putting this one out of our misery.

[picobit]

Bleh, we need new business so we can finish putting this one out of our misery.

Too unfortunate that it is our misery, not their.

May I suggest Bitfloor (although it got a bad start) or Bitstamp.

[The_Duke]

I am beyond furious right now.  

They just moved to a new office like 2 weeks ago, and probably forgot to update the address on that page of their website.

Although its their fault, I wouldn't be too pissed off because its an easy mistake to overlook and can happen to anyone.

Calling it gross incompetence may be out of line. While your information is extremely sensitive, even you could have made the same mistake if you were in their position.

Awww look, it's the TBF incrowd downplaying each other's mistakes!  

[crazy_rabbit]

If Gox pays for the hassel, then I think all should be forgiven. It's not acceptable, but this sort of stuff happens. I'd rather a company gracefully correct their mistakes then claim to never make mistakes.

[Yankee (BitInstant)]

You mean Director. You used plural Directors.

Mark's a director also. Plus you, that makes two directors. Two is plural.

A director of the BF runs the biggest and most fucked up BTC exchange on the net. Another director, you, is covering for his fuck ups by saying "shit happens". You both share corporate seats on the BF's board of directors.

Can you at least admit that you can see why this might reflect poorly?

I already did, you should read the earlier messages

Charlie,

Instead of sticking up for your buddy at Mt Gox maybe you could message them and give them a lesson customer relations, which you and your team seem to do so well  (seriously) in responding publicly to customer issues.

I find it surprising that you've now responded several time to this thread and we have yet to hear from Mt. Gox.

Is is a slow days at the office?

See below....

Agreed. I'm not defending them. Just saying, shit happens. We are not perfect.

Thanks for the kind words about our customer support  

Right now, its 2am in Japan, thats probably why we have not heard back from them.

I did tell Mark that he should see this thread, and gave him the link an hour ago.

It's a crazy day at the office!!

Are you responding in an official capacity as a member of the Bitcoin Foundation.

Just curious.

lol, no.

If I was, I'd sign with "Charlie, Bitcoin Foundation"

-Charlie, BitInstant

Awww look, it's the TBF incrowd downplaying each other's mistakes! 

Each others mistakes? I only see one problem that OP has with Gox. Nothing to do with me.

Your grammar needs correcting.

Thanks

[Boussac]

You mean Director. You used plural Directors.

Mark's a director also. Plus you, that makes two directors. Two is plural.

A director of the BF runs the biggest and most fucked up BTC exchange on the net. Another director, you, is covering for his fuck ups by saying "shit happens". You both share corporate seats on the BF's board of directors.

Can you at least admit that you can see why this might reflect poorly?

+1
If the BF fights excessive centralization with two board members serving mt gox interests like twins, the BF is starting off the wrong foot.

[Yankee (BitInstant)]

You mean Director. You used plural Directors.

Mark's a director also. Plus you, that makes two directors. Two is plural.

A director of the BF runs the biggest and most fucked up BTC exchange on the net. Another director, you, is covering for his fuck ups by saying "shit happens". You both share corporate seats on the BF's board of directors.

Can you at least admit that you can see why this might reflect poorly?

+1
If the BF fights excessive centralization with two board members serving mt gox interests like twins, the BF is starting off the wrong foot.

Im not defending MtGox, and I have nothing to do with this situation except help the OP, which is why I'm here.

While all of you are complaining and throwing me under the bus, take a step back to realize that I'm the only one here who actually called MtGox and told them of the situation. I showed them this thread and let them know they need to be on top of their shit and fix the address at the same time take care of the OP.

Again, this has nothing to do with me and I would easily have walked away from this thread.

I want OP's issue to be resolved, and thats good enough reason for me to be here.

-Charlie