Cryptocurrency exchanges and custody providers: International regulatory developments

First published on Thomson Reuters Regulatory Intelligence on September 5, 2018

Cryptocurrency exchanges, also known as digital currency exchanges or cryptoexchanges, are essentially businesses that allow customers to trade cryptocurrencies or digital currencies for other assets including conventional fiat money or different digital currencies. They can also be market makers that take bid-ask spreads as transaction commissions for their services or charge fees as a matching platform.

Cryptocurrency exchanges are becoming integral to the crypto-asset ecosystem. Like crypto-assets in general, the rise of cryptocurrency exchanges has not yet raised sufficient concerns from a financial stability perspective, but their impact on consumer protection and money laundering has prompted regulatory intervention.

In this article we briefly consider the international regulatory response to cryptocurrency exchanges and custody providers.

In July the Financial Stability Board (FSB) published its latest report describing international work on crypto-assets.

The report noted in particular that while crypto-asset platforms are yet to pose a threat to financial stability, it was important to coordinate the work with other financial regulators such as the Basel Committee on Banking Supervision and the International Organization of Securities Commissions (IOSCO) given the consumer protection and money laundering concerns.

Specifically, the FSB noted that IOSCO's Committee on Secondary Markets has already begun to examine internet-based platforms, including cryptoasset platforms and has identified a number of key issues to consider including: transparency, custody and settlement, trading and cyber security and systems integrity.

Also, where crypto-assets are used solely for payment purposes (and are not securities), the FSB mentions that crypto-asset platforms trading may be viewed more as part of the payments infrastructure coming more under the remit of the Basel Committee and the Committee on Payments and Markets Infrastructure.

The FSB notes that the Basel Committee is already pursuing a number of policy and supervisory initiatives related to crypto-assets which essentially can be grouped into three broad categories: (i) quantifying the materiality of banks' direct and indirect exposures to crypto-assets; (ii) clarifying the prudential treatment of banks' exposures to crypto-assets; and (iii) monitoring developments related to crypto-assets/fintech and assessing their implications for banks and supervisors.

From an EU regulatory perspective, perhaps the most significant recent development has been the finalisation of the Fifth Anti-Money Laundering Directive (5MLD). The reason for this is that the directive, which has to be transposed by member states by January 10, 2020, extends the Fourth AntiMoney Laundering Directive by bringing virtual currency exchange platforms and custodian wallet providers within the scope of the EU's anti-money laundering requirements.

The 5MLD streamlines member states' regulatory regimes for virtual currency by defining certain key terms which member states will implement into their own anti-money laundering legislation.

In particular, the directive defines "virtual currency" as a "digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically."

It also defines custodian wallet providers as an "entity that provides services to safeguard private cryptographic keys on behalf of their customers, to hold, store and transfer virtual currencies."

It is also worth noting that the March 2018 European Commission Action Plan on Fintech mentions that the EU institution will publish a report on the challenges and opportunities of crypto assets later this year in the framework of its EU Blockchain Observatory and Forum.

Despite the UK's planned withdrawal from the EU, it is likely the UK government will implement rules equal or similar to the changes introduced by the 5MLD in order to retain its global standing in the financial markets and potential equivalency in the eyes of the European Commission.

In relation to recent domestic developments, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) both issued in June this year "Dear CEO" letters on crypto-assets. The PRA's "Dear CEO" letter reminded firms within its regulatory remit of their obligations regarding existing or planned exposure to crypto-assets.

The FCA's "Dear CEO" letter covered good practice as regards how UK banks should handle the financial crime risks posed by crypto-assets.

The FCA stated that where a firm offers banking services to current or prospective clients who derive significant business activities or revenue from crypto-related activities, it may be necessary to enhance the scrutiny of the client and their activities.

Such instances included

• Where the firm offers services to crypto-asset exchanges which effect conversions between fiat currency and cryptoassets and/or between different crypto-assets.
• Trading activities where the clients' or counterparties' source of wealth arises or is derived from crypto-assets.
• Where the firm wishes to arrange, advise on, or take part in an initial coin offering (ICO).

It has been suggested that the "Dear CEO" letters are the tip of the iceberg and that an FCA thematic review may follow once firms have had the opportunity to digest the content of the "Dear CEO" letters. Notwithstanding this a Crypto-assets Taskforce comprising of the FCA, the Bank of England and HM Treasury is due to report on the regulatory response to crypto-assets in Q3 2018.

The Dutch government will implement the rules introduced by the 5MLD. It is anticipated this will be done on time although it is worth noting the Netherlands has only just implemented the 4MLD (more than a year too late).

In relation to recent domestic developments, the Netherlands Authority for the Financial Markets (AFM) and the Dutch Central Bank (DNB) both issued press releases on crypto-assets

The AFM has warned that there are serious risks associated with ICOs. While the AFM sees the potential of blockchain technology for financial services, it has concerns that ICOs are vulnerable to misrepresentation, fraud and manipulation.

Often ICOs are structured in such a way that leaves them outside the regulatory perimeter meaning that they are not subject to supervision by the Dutch regulators. In addition, due to their unregulated status and the anonymous nature of the transactions involved, ICOs are attractive for the money laundering purposes.

The DNB has issued warnings relating to crypto currencies on their basis of their unregulated status which means that they are not subject to a deposit guarantee scheme nor counterparties from which losses may be recovered.

However, the DNB also concludes that the total value of cryptos in circulation is relatively small compared to the liquidity available in, say, U.S. dollars and euros and that therefore the crypto market does not yet pose a threat to financial stability.

The DNB also sees the possibilities of the blockchain technology underlying bitcoin. Since 2015, the DNB has built four crypto prototypes based on blockchain technology, not to launch a national crypto, but to gain insight into the technology.

According to the DNB the technology is still too underdeveloped to play a role in payment systems but is hopeful that in the longer run it will offer possibilities for transactions in the financial world and beyond.

On June 25, 2018, the Abu Dhabi Global Market (ADGM), the International Financial Centre in Abu Dhabi, launched its regulatory framework for spot crypto asset activities, including those undertaken by exchanges, custodians and other intermediaries in ADGM. From a UAE regulatory perspective this has been the most significant relevant recent development.

The new ADGM crypto framework codifies the governance, oversight and transparency over crypto asset activities. This follows the completion of the public consultation on the introduction of a robust crypto asset regulatory framework by the ADGM Financial Services Regulatory Authority on May 28, 2018.

The framework is designed to address the risks associated with crypto asset activities, including risks relating to money laundering and financial crime, consumer protection, technology governance, custody and exchange operations.

The new framework is one of ADGM's projects illustrating its ongoing commitment to bolster the economic diversification of the UAE through new and sustainable initiatives.

In addition, in June the Dubai Financial Services Authority published its "Guidance - Regulation of Crypto Asset Activities in ADGM" and application form to operate a crypto asset business within ADGM.

The guidance elaborates on ADGM's approach towards the regulation of crypto asset activities and is a useful resource for potential applicants.

At present, the Hong Kong Monetary Authority and the Securities and Futures Commission regard crypto currencies as "virtual commodities" (as opposed to a currency). These assets are not subject to regulation provided the cryptocurrency in question does not have the characteristics of a "security".

As a result, an exchange facilitating secondary trading of cryptocurrencies only attracts licensing requirements to the extent such assets qualify as securities. In this case, a cryptocurrency exchange may also be considered a stock market or an automated trading system provider under the securities legislation.

Further, while payment cryptocurrencies such as bitcoin are not regulated, bitcoin futures contracts trading on U.S. exchanges are regulated products in Hong Kong and can only be offered in Hong Kong by licensed entities.

Unless a cryptocurrency exchange also handles fiat payments, no anti-money laundering (AML) and counter terrorist financing (CTF) requirements apply; however, in practice many exchanges are voluntarily conducting AML/CTF checks.

In the absence of regulation, the industry itself is taking steps to establish best practices, such as the recently published ASIFMA Best Practices for Digital Asset Exchanges.

The Monetary Authority of Singapore (MAS) does not regulate cryptocurrency per se but has been monitoring its use to assess if regulations are required in this area. What MAS does however, is to regulate the activities that surround cryptocurrency (or other forms of virtual currencies) if those activities fall within MAS' general ambit as a financial regulator, for example, for AML/CTF purposes or ICOs involving capital market products.

MAS is consulting on its proposed Payment Services Bill that seeks to address AML/CFT issues relating to cryptocurrency. Under this bill, MAS intends to regulate, among other activities, virtual currency services, which is the buying or selling of virtual currency or the provision of a platform that allows persons to exchange virtual currency in Singapore. AML/CFT requirements will be imposed on virtual currencies intermediaries that deal in or facilitate the exchange of virtual currencies for real currencies.

Such requirements will include the identification and verification of customer and beneficial owner, ongoing monitoring, screening for money laundering/terrorist financing (ML/TF) concerns, suspicious transaction reporting and recordkeeping. Only virtual currency service providers that process funds or virtual currencies will fall within this new proposed regulatory ambit.

The requirements will not be imposed on mainstream inline marketplaces and social media platforms as they do not pose the same ML/TF risks. Virtual currency exchanges that possess funds will also be expected to hold a payment services license.

In Australia, digital currency exchanges that trade cryptocurrencies or custodians who hold crypto-assets that are not characterised as financial products (see INFO 225) are not subject to regulatory oversight by the Australian Securities and Investments Commission (ASIC) under the Corporations Act 2001.

However, if the digital currency exchange facilitates the trading of cryptocurrencies that are characterised as financial products (see INFO 225) the operator of that exchange will need to hold an Australian market licence with appropriate authorisations by ASIC.

Similarly, custodians who hold crypto-assets that are characterised as financial products are subject to ASIC regulation under the Corporations Act 2001. They are required to hold an Australian financial services licence (AFSL) that authorises them to provide custodial or depository services to clients with respect of financial products, and need to comply with obligations imposed upon them as AFSL holders.

In any case, regardless of whether the digital currency exchange facilitates the trading of financial products, any exchange that converts fiat currencies into digital currencies (and/or from digital currencies into fiat currencies) will need to comply with Australia's AML/CTF laws.

AML/CTF obligations imposed upon such digital currency exchanges include the requirement to be registered and enrolled with the Australian Transaction Reports and Analysis Centre (AUSTRAC), an AML/CTF program needs to be in place, customer due diligence and "know your customer" measures need to be implemented and conducted, suspicious and other reportable transactions need to be reported to AUSTRAC, and certain relevant records need to be kept.

However, these AML/CTF obligations do not apply to digital currency exchanges that only convert between digital currencies and where no fiat currency is involved.

The Canadian Securities Administrators released Staff Notice 46-307 – Cryptocurrency Offerings in August of 2017. As per the staff notice, cryptocurrency exchanges that permit the trading of coins, tokens or cryptocurrencies that qualify as "securities" will be subject to Canadian securities law requirements.

Although the staff notice does not suggest that bitcoin itself is a security, some cryptocurrency exchanges may take the view that they are not subject to Canadian securities regulation because they do not permit the trading of securities.

However, many cryptocurrency exchanges also permit the trading of coins or tokens that may be securities, and some cryptocurrencies may also be considered securities. Accordingly, such cryptocurrency exchanges may be subject to Canadian securities laws to the extent there are Canadian market participants.

So far, no cryptocurrency exchange has obtained the recognition required, or an exemption from such recognition requirement, in order to allow Canadians to participate in on-exchange securities trading.

AML and money services business laws may well apply to cryptocurrency exchanges operating in Canada or with Canadian clients.

With a similar mandate as the 5MLD in mind, Canadian legislation has placed the responsibility of implementing AML/CTF policies with certain stakeholders, including bankers, accountants, lawyers and other professions.

The Canadian Department of Finance recently published certain draft amendments under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act affecting both financial and non-financial entities, including dealers in virtual currency and foreign money services businesses.

These amendments are expected to be published towards the end of 2018 with a view to implementation in early 2019. The proposed amendments introduce many new directives, including that persons and entities dealing in virtual currency are regulated as money services businesses.

Under the proposed amendments, persons dealing with virtual currency will be required to register with the Financial Transactions and Reports Analysis Centre of Canada and must have in place an AML/CTF compliance program.

This will invariably impact well-known cryptocurrencies such as Bitcoin. Also, all reporting entities that receive $10,000 or more in virtual currency will have recordkeeping and reporting obligations.

Further, the objective of the proposed amendments was to align Canada's AML/CTF regime with international standards set by the intergovernmental body of the Financial Action Task Force (FATF). In its last evaluation of Canada in 2015, the FATF identified several deficiencies in the Canadian model, which have been addressed by proposed amendments.

In the United States, trading of crypto-assets is regulated by many different agencies at both the federal and state levels. Crypto-assets that meet the definition of a security are subject to regulation by the Securities and Exchange Commission (SEC) under U.S. securities laws.

To the extent a crypto-exchange permits certain regulated commodities transactions or swaps in crypto-assets, it will be subject to regulation by the Commodity Futures Trading Commission (CFTC). The U.S. anti-money laundering agency, the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) deems businesses involved in buying and selling of cryptocurrency to customers or transferring cryptocurrency on behalf of customers to be money services businesses required to register with FinCEN and maintain AML compliance programs and follow other U.S. federal AML requirements.

With respect to applicable state law, New York State views the buying and selling of cryptocurrency as money transmission and has promulgated regulations requiring licensing of persons engaged in the virtual currency business. The New York Department of Financial Services (DFS) has chartered two limited purpose trust companies, which are a form of banking organization, to act as virtual currency exchanges: Paxos Trust Company, LLC and Gemini Trust Company, LLC, both of which can offer exchange and custody services for various virtual currencies.

The DFS also has issued special "bitlicenses" to engage in certain virtual currency activities such as buying and selling specified virtual currencies and providing payment processing services for merchants accepting bitcoin in payment to several businesses.

The SEC regulates securities transactions, broker-dealers, investment advisers and other securities market participants. If a cryptocurrency or a product that is linked to a cryptocurrency is determined to be a security, the offer and sale of such cryptocurrency or product must comply with the U.S. federal securities laws, including registration as a security under the U.S. Securities Act or compliance with an exemption from such registration.

These obligations on sellers generally apply regardless of whether the crypt-asset is traded through a regulated exchange. Additionally, a crypto-exchange needs to understand the various broker-dealer rules, registration requirements and exemptions under the U.S. Securities Exchange Act to determine whether it would need to register as an exchange with the SEC and the Financial Industry Regulatory Authority (FINRA) or qualify as something else, such as an alternative trading system or a bulletin board.

Those who advise on the trading of crypto-assets that constitute securities, whether through an exchange or not, may need to register with the SEC under the U.S. Investment Advisers Act. Applications have been made to the SEC for approval of cryptocurrency-linked exchange-traded funds (ETFs), but as of August 2018, the SEC had yet to approve any such ETFs.

The CFTC's regulatory jurisdiction includes commodity futures contracts, options on futures and swaps, but generally excludes spot contracts and forward transactions unless they are leveraged or financed. The CFTC also has anti-fraud jurisdiction over the commodity spot and forward markets. In 2015, the CFTC determined that bitcoin was properly defined as a commodity.

To the extent another cryptocurrency falls under the definition of commodity, then futures, options, swaps and leveraged products involving such cryptocurrency are subject to regulation under the US Commodity Exchange Act.

Anyone brokering or dealing in such transactions may be required to register with the National Futures Association (NFA), for example as a futures commission merchant, introducing broker or swap dealer. Moreover, certain products may only be sold to "eligible contract participants" even if traded on a regulated commodity crypto-exchange.

Those who advise on the trading of crypto-assets that constitute commodities, whether through an exchange or not, may need to register with the NFA as a commodity trading adviser or a commodity pool operator.

There are approved cryptocurrency futures products being traded on different commodities exchanges such as the Chicago Mercantile Exchange and the CBOE Futures Exchange and through swap execution facilities such as LedgerX and TeraExchange.

Both the SEC and the CFTC have issued numerous statements and advisories to the public to urge caution in investing in cryptocurrencies and take into consideration the various risks involved in investing in cryptocurrencies, including the fact that many of the systems and platforms on which trading occurs are not registered (but perhaps should be) or are located outside the United States and thus potentially outside the jurisdiction of U.S. regulators and protections of U.S. law.

Simon Lovegrove is head of financial services knowledge – global, based in London. Albert Weatherill is an associate in the financial services group. The views expressed are their own.