cd ~/blog && cat building-it-once.md
Building it once
Regulation as just another product requirement
When a new regulation is announced, many companies react the same way: with fear. Are they going to ban something? How much will it cost us? Will we have to rebuild everything?
Whether or not you agree with a given rule, experience in heavily regulated sectors such as banking or payments teaches something useful: what costs the most isn’t complying with it, but finding out about it late.
An example: MiCA
In June 2023, Europe published the MiCA regulation, the first common framework for crypto-assets across the whole Union. Its rules on stablecoins apply from 30 June 2024. Those affecting exchanges, custodians and other service providers come into force on 30 December 2024, with a transition period for those already operating.
Among other things, MiCA requires providers that hold crypto-assets on behalf of their clients to keep them separate from their own, both on the chain and legally. If the company goes bust, its creditors can’t touch the clients’ money.
It sounds obvious, but it hasn’t always been done. In November 2022, the collapse of the FTX exchange revealed that its customers’ funds had been used for other purposes, and many users lost what they had deposited. A rule like this turns good practice into an obligation.
Just another requirement
The underlying idea works for any rule: regulation is a product requirement, just like speed, security or accessibility.
If it’s taken into account from the design stage, it costs little. Keeping clients’ funds separate on a new platform is a one-day architecture decision. Doing it on a platform that has been mixing them for years can take months and mean rebuilding half the application.
That’s why, when a rule arrives, the useful question isn’t “how does this affect us?” but “what does our system need to do to comply?”. The first one is scary. The second can be turned into a to-do list.
Three habits that help
Read the rule early and turn it into requirements. European regulations are published long before they apply; MiCA, a year and a half before. That time is for turning legal articles into concrete sentences: “the system must keep each client’s funds separate”, “the system must be able to produce this report”.
Keep only what the law requires. Complying doesn’t mean hoarding data “just in case”, and some data, once leaked, can never be changed. Every extra piece of data is one more risk and one more obligation to protect it. Privacy and compliance can go hand in hand: keeping only what’s needed is both safer and easier to defend in front of an auditor.
Leave a trail of decisions. Write down why the system does what it does, which article prompted each change and who approved it. The day an audit comes, that record is worth its weight in gold.
What changes for the people using these services
Using a regulated platform means accepting its rules: handing over your personal data to open an account, following its steps to operate and depending on whatever it’s authorised to offer in your country. In return, your funds must be kept separate from theirs. It’s a choice, and like every choice, it comes at a price.
That’s why it’s worth remembering that regulated platforms aren’t the only option. Anyone who prefers to hold their own funds, with their own keys, can keep doing so. Regulation governs those who look after other people’s money; it doesn’t force anyone to leave theirs in someone else’s hands.
Blueprints, not threats
A rule that’s read well is more like a set of blueprints than a threat: it tells you what the structure has to hold. Whoever builds it in from the start builds once. Whoever ignores it until the end builds twice.