## ftnea2019003

## Source details

**Canonical URL:** [ftnea2019003](https://www.imf.org/-/media/files/publications/ftn063/2019/english/ftnea2019003.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/ftn063/2019/english/ftnea2019003.pdf.md)
- [Structured JSON version](/-/media/files/publications/ftn063/2019/english/ftnea2019003.pdf.json)

---

### Introduction: scope, purpose, and limits
- Identifies selected elements of regulation and supervision authorities should consider when deciding on a regulatory framework for crypto assets.
- Structured in two main sections: (1) summarizes some of the most relevant risks related to crypto assets; (2) concentrates on how regulatory frameworks could address these risks. Appendix contains country examples.
- Uses a broad definition: crypto asset denotes digital assets that use cryptography for security and are coins or tokens of distributed ledgers and/or blockchains, including asset-backed tokens. Distinction between “coins” and “tokens” is recognized; terms may be used interchangeably.
- Anchored in the IMF/World Bank Bali Fintech Agenda (BFA) and deepens monitoring, regulation, and supervision elements.
- Not intended to set standards or provide prescriptive solutions; aims to assist policymakers in framing regulatory and supervisory discussions.
- Assumes some intermediaries will exist for the time being to provide financial services to end users.
- Coverage limits and exclusions:
  - Does not specifically cover particular features of stablecoins or other newly developed crypto assets in depth.
  - Does not cover central bank digital currencies or payment system implications related to crypto assets.
  - Data and privacy issues are not covered in depth.
  - Focuses on more imminent regulatory and supervisory issues rather than long-term full decentralization implications.
- Underlying approach: similar activities and risks should be regulated in the same way to prevent excessive risk taking, contagion, financial instability, and material regulatory arbitrage.
- Need for international coordination:
  - Activities are cross-border and cross-sectoral and require closer international cooperation to address regulatory gaps and prevent regulatory arbitrage, including risk of a race to the bottom.

### The Risks — high-level characterization
- Rapid growth raises questions about regulatory perimeter and adaptability of existing regulatory architecture.
- Effective regulation should promote long-term economic stability and minimize social costs and negative externalities from financial instability.
- Major risk categories identified:
  - Operational/cyber risk
  - Market/credit/default risk
  - Commingling risk
  - Liquidity risk
  - Market integrity issues
  - Misselling and fraud
  - Misuse for money laundering and terrorist financing (AML/CFT)
  - Contagion and business model risks that could become systemic

### Investor risks (selected findings)
- Investors face significantly higher risk of loss than with traditional financial assets.
- Operational and cyber risk of wallet providers and crypto-trading platforms:
  - Several platforms and wallet providers, including large firms, have been hacked and client coins or tokens stolen.
  - Some of the largest loss incidents involved several hundred million US dollars per incident, leaving providers bankrupt and investors at a loss.
  - Even when compensation was eventually paid, investors could be unable to use hacked coins or tokens for extended periods.
  - Some exchanges mitigate risk by contracting cyber insurance or creating separate compensation funds (examples noted: Coinbase insurance of hot wallet client positions; Binance SAFU allocating 10 percent of trading fees), but typically there is no public safety net such as deposit insurance or liquidity facility from central banks.
- Market, credit, and default risks of coin and token issuers:
  - Many crypto assets are highly volatile; investors and trading platforms are exposed to material market risk.
  - Stablecoins are potentially subject to issuer credit and default risk if collateral (e.g., bank deposits) is not segregated and may be commingled in bankruptcy.
  - Stablecoin issuers often are related parties of crypto-trading platforms, creating potential conflicts of interest, including rehypothecation of collateral to related trading platform operators under favorable conditions.
- Commingling of service provider assets:
  - If crypto service providers go bankrupt, client coins and tokens could be commingled with provider assets unless clear regulatory frameworks and robust bankruptcy-remote arrangements exist.
  - If the service provider is a regulated bank, crypto-asset holdings could complicate resolution and have wider financial stability implications.
- Liquidity risk of issuers and service providers:
  - Issuers may permit frequent redemptions (typically very short term, such as daily) into other currencies or assets.
  - Investor expectations to exchange coins/tokens frequently without material cost create incentives for issuers and service providers to meet redemption requests, risking fire sales of collateral (e.g., bonds, bank deposits) that could negatively impact broader financial markets.
- Market integrity risk:
  - Many crypto assets lack tangible backing or intrinsic value, weakening price discovery and increasing vulnerability to market manipulation.
  - Anecdotal evidence suggests some large crypto-trading platforms allow wash trades.
  - Illiquidity can amplify “whale” trades and other manipulation forms.
  - Enforcement is challenging due to anonymous, cross-border, and decentralized nature of transactions.
- Risk of misselling and fraud:
  - Lack of comparable product information, intrinsic technological complexity, and hype around innovation increase the risk of fraud and misselling.

### AML/CFT risk (selected findings)
- Crypto assets create risks of misuse for money laundering and terrorist financing due to varying levels of anonymity or “pseudo-anonymity.”
- Authorities may trace blockchain transactions but may not always establish the parties’ identities or ultimate ownership.
- Internet‑based and cross-border nature enables rapid global transactions and potential bypassing of AML/CFT obligations where intermediaries are absent.
- Anonymity-enhanced features increase enforcement challenges:
  - Emergence of sophisticated mixers and tumblers that mix coins and obscure trails.
  - Anonymity-enhanced crypto assets (e.g., Monero, Z‑cash) obfuscate source of funds and provide layering services that can frustrate detection, investigation, and prosecution.
  - New application layers (e.g., lightning network) and related netting arrangements allow offline exchanges that further reduce visibility of transactions.
- Note: Detailed discussion of AML/CFT issues is outside the scope of this note; FATF developments are referenced elsewhere.

### Prudential and systemic risk (selected findings)
- Crypto-asset providers and issuers are increasingly engaging with traditional financial institutions, generating prudential risks.
- Exposures (through derivatives, crypto-linked products, cyber insurance) could trigger contagion risks to financial institutions if exposures grow or are poorly managed.
- If stablecoins become widely used, existing financial institutions may engage more actively (including issuing their own stablecoins), potentially affecting the soundness of the financial sector.
- DLT applications may affect industry structure and increase competition, with wider impacts on business models of the existing financial sector.
- Initial standard setter assessments indicated crypto assets did not pose material systemic risk at the time, but technological and market developments are moving fast and the situation may be changing.
- Crypto-trading platforms’ business models and activities:
  - Execute and receive investor orders for secondary market trades of crypto assets against fiat or other crypto assets.
  - Provide brokerage services to retail investors similar to stock brokerage firms, but generally need to provide liquidity by trading on their own account to match client orders.
  - May perform additional functions including custody (wallet services), margin lending, and provision of liquidity; margin trading and financing platforms can support considerable leverage (lack of disclosure makes sizing difficult).
  - Play roles as underwriters in initial coin offerings, raising risks of market manipulation and insider trading.

### Box 1 — Crypto‑Trading Platforms: context, transmission channels, and regulatory actions
- At time of report, "crypto assets did not pose a material risk to global financial stability."
- Risks would arise if crypto assets became widely used in payments and settlement.
- Significant data gaps exist on leverage in crypto-asset markets and on direct and indirect exposures of financial institutions.
- Transmission channels and institutionalization:
  - Private key management solutions by fintech startups and major financial entities (for example, Fidelity Investments) could enable wider institutional use.
  - Scenario: much wider use by large institutional investors if custody and management services become reliable and competitively priced.
  - Wider use in cross-border payments could materially increase transmission channels.
- Regulatory roles and actions taken:
  - FATF updated standards to cover virtual assets and virtual asset service providers in 2018.
  - Securities regulators initiated enforcement investigations where crypto-assets may meet the definition of a security.
  - BCBS warned in March 2019 that continued growth of crypto assets has potential to raise financial stability concerns.
  - At least 82 countries have issued warnings on digital assets and at least 20 countries have issued warnings on ICOs.
- Jurisdictional responses:
  - Warnings, prohibitions (listed jurisdictions), guidance classifying crypto assets by characteristics, tailored regulation (examples: Malta, Thailand, Japan), enforcement actions (examples: US SEC and CFTC).
- The Libra example (Libra Association announced June 2019):
  - Target launch: first half of 2020, aiming to have approximately 100 members.
  - Governance: equal voting right per member; important decisions require supermajority among governance token holders.
  - Two token types planned: payment/user tokens and governance/investor tokens; governance/investor tokens subject to a minimum investment threshold of $10 million.
  - Reserve composition: backed by a reserve of real assets held by geographically distributed custodians with an investment-grade credit rating; initial set of currencies reported to be four major hard currencies (British pounds, euros, US dollars, and yen).
  - FINMA indicated the project would require a payment system license and could be subject to PFMI-aligned requirements and bank-like regulatory requirements for bank-like risks.
  - Conflicts of interest concern: governance token holders entitled to return on reserve investment versus user token holders preferring conservative reserve investing.
- Crypto-trading platforms, liquidity risk, and user redemption:
  - Ecosystem would rely heavily on crypto-trading platforms for redemption, exposing it to liquidity and foreign exchange rate risk.
  - Redemption of user tokens limited to authorized entities; users would have to sell Libra to those entities to cash out to fiat, incurring fees.
  - In a run scenario, crypto-trading platforms could face liquidity risk if the association cannot meet redemptions quickly.
  - Currently, most jurisdictions do not impose prudential requirements (including liquidity requirements) on crypto-trading platforms.
- AML/CFT, data, and operational considerations for Libra:
  - Calibra created as single wallet provider and would be subject to AML/CFT regulation and licensed as a payment service provider.
  - Transaction data will not be shared with Facebook or any third party without customer consent, though data may be shared with authorities to comply with law.
  - Uncertainty about how AML/CFT preventive measures, such as customer due diligence, will be carried out.
  - Facebook’s motivation could include access to usage data, raising data-protection and competition concerns.

### Box 2 — recent standard-setter activity and regulatory considerations
- International standard-setter activity and reports:
  - IOSCO: standing fintech network; Committee on Secondary Markets published a consultative document on crypto-asset platforms.
  - FSB: multiple reports in 2019 on decentralized financial technologies and crypto-asset work underway.
  - BCBS: “statement on crypto assets” March 2019; consultative document and discussion paper December 2019; collecting data as part of end of 2018 Basel III monitoring exercise.
  - CPMI and IOSCO: examined PFMI application to DLT initiatives in clearing and settlement; CPMI issued two 2018 papers on cross-border retail payments and central bank digital currencies.
  - FATF: adopted changes in October 2018; Interpretative Note to Recommendation 15 in June 2019; guidance in June 2019.
- Considerations for regulatory frameworks:
  - Proactive and holistic regulation, ongoing monitoring, engagement with industry, sequential development of regulatory frameworks, coordination among authorities.
  - Objectives: enhance investor protection, minimize regulatory arbitrage, retain flexibility, ensure legal foundations and clarity in terminology.
  - Risk-based and proportional regulation: prioritize public offers, trading, custodial and wallet services, financial integrity (AML/CFT), and exposure of the financial sector.

### Offering and trading crypto assets — investor protection, disclosure, and platform features
- Offering crypto assets:
  - Mining generally does not entail major investor risks at creation stage, but concentration risks (e.g., “51 percent attack”) may create vulnerabilities.
  - Distribution via public offer or availability on secondary markets raises investor protection concerns; need timely and accurate information.
  - Authorities should consider appropriate disclosure requirements at initial offer and on a continual basis, including for stablecoins: assessment of collateral, rights to access collateral, stabilization, and governance mechanisms.
  - Limitations of applying existing securities frameworks: many crypto assets do not qualify as securities yet raise similar investor protection issues.
  - Jurisdictional examples adapting frameworks: France (Loi PACTE), Malta (VFAA), Japan (PSA and FIEA amendments with revisions to come into force by June 2020 at the latest).
- Trading crypto assets:
  - Platform distinctions: direct retail access, custody services, brokerage, market-making on own account.
  - Regulatory priorities: governance, access controls, robustness/resiliency of operating systems, market integrity rules, transparency requirements, AML/CFT compliance, product listing criteria, custody and clearing/settlement arrangements.
  - IOSCO consultation report examines secondary market trading issues and references IOSCO principles to guide regulation and supervision.

### Key statistics and findings (as highlighted)
- “Crypto asset regulation is identified by respondents as the main (64 percent) gap, which so far has only been addressed by 30 percent of respondents.”
- The vast majority of the almost 2,500 crypto assets listed on CoinMarketCap.com are not backed by anything tangible.
- Only 66 stablecoins—30% of total announced tokens—are actually live and operational.
- By market capitalization, the top 10 comprise about 90%, of which Tether (the only stablecoin in the top 10) comprises less than 2%. By 24h trading volume it comprised 37% of that top 10 group.
- Other numeric and timeline references cited in the report: FSB reports (June 2019, May 2019, April 2019), BCBS statement (March 2019) and December 2019 consultative documents, BCBS Basel III monitoring exercise (end of 2018), CPMI papers (2018), FATF changes (October 2018) and Interpretative Note/guidance (June 2019), Japan PSA/FIEA revision effective by June 2020 at the latest.

### Custody of crypto assets (wallets) and third‑party custodians
- Wallets store unique private keys; loss of private keys makes crypto assets unrecoverable.
- Custodianship options: self-custody by users or delegated to third-party wallet providers (often exchanges).
- Storage/security types: “hot” wallets (online) and “cold” wallets (offline); most users/platforms use cold wallets for bulk storage and hot wallets for short-term transactions.
- Cyber risk exposure:
  - Wallets are most exposed to cyber risk; attackers target private keys in hot wallets to impersonate owners and steal funds; cold wallet attacks are possible though more difficult.
  - Wallet security requirements should align with best practices in cryptography and key lifecycle management.
  - Requirements should remain principles-based rather than hinge on fine technical distinctions between cold and hot wallets.
- Prudential regulation of third-party wallet providers:
  - Recommendation to consider reporting and prudential regulation for wallet providers: risk management (including operational and cyber risk), protection of client assets, minimum capital, and liquidity requirements (particularly if third-party reuses customer crypto assets).

### Exposure to crypto assets — prudential treatment and monitoring
- No global standard currently for prudential treatment of exposures to crypto assets for banks or other regulated entities; differing classifications exist.
- Basel Committee: “will in due course clarify the prudential treatment of such exposures to appropriately reflect the high degree of risk of crypto assets.”
- High volatility warrants conservative treatment on direct exposures:
  - Expectation of conservative approaches such as capital deductions or imposition of high-risk weights for internal risk and capital management.
  - Robust segregation and separation between traditional business and crypto business is desirable; group-wide and step-in risk must be considered.
- Exposures to stablecoins:
  - Benefits from collateral only if issuers are subject to appropriate regulation and supervision.
  - Good quality collateral could be reflected in prudential treatment only if issuers are prudentially regulated and legal certainty exists regarding availability of collateral in stressed environments.
- Monitoring indirect exposures:
  - Financial institutions should monitor indirect exposures (loans to crypto investors, derivative exposures with crypto-asset trading platforms, cyber insurance to wallet providers, etc.) because such risks can be strongly correlated with market movements.
- Institutions issuing crypto assets or crypto-asset-linked products:
  - Economically similar activities to deposit-taking should be subject to existing prudential regulation (liquidity coverage ratio and net stable funding ratio) when applicable.
  - Careful analysis needed if a separate issuing entity is established “independently” from prudentially regulated financial institutions because banks may face reputational pressure to provide liquidity to the issuing entity.

### Handle with Care — overarching regulatory guidance
- Regulatory approach must involve intense monitoring and flexibility as the industry evolves.
- Regulators need to continuously monitor the crypto-asset landscape and address data gaps to monitor markets and potential contagion effects.
- Regulation should build trust, not stifle innovation; clear guidelines remove uncertainty and foster confidence.
- Regulators should proactively address emerging risks and swiftly build capacity and expertise in new instruments and technologies.
- Evaluate capacity and resources of supervisory authorities and potential damage to trust in the financial sector on a case-by-case basis.
- Clear public communication about the role of regulation and supervision is important to emphasize investor and consumer risks.
- Cross-sector and cross-border coordination and cooperation are key due to jurisdictional challenges and global accessibility of crypto assets:
  - Determining geographic location and jurisdictional powers can be challenging.
  - Inconsistent domestic measures that ignore cross-border issues may create opportunities for regulatory arbitrage and diminish effectiveness of domestic policy responses.
  - Enhanced cross-border cooperation and potential new mechanisms for regulatory cooperation are likely to be increasingly necessary.

### Case study: JPM Coin (Box 3 highlights)
- JPM Coin description:
  - Announced February 2019 by J.P. Morgan Chase N.A., focusing on wholesale clients; based on blockchain enabling instantaneous transfer of payments among JPM group’s institutional clients.
  - Digital coin representing US dollars held in designated accounts at JPMorgan Chase N.A.; prototype test successfully completed.
  - Potential use cases: cross-border payments; delivery versus payment between tokenized securities and the coin; internal liquidity optimization for large, complex corporate clients.
  - Instantaneous transfer available 24 hours, 7 days a week, every day of the year.
  - Issued on Quorum Blockchain and extendable to other platforms.
  - Redemption: holder can redeem for equivalent amount of US dollars, similar to the bank’s demand deposit.
  - Access limited to institutional customers passing JP Morgan Chase Bank “Know-Your-Customer” standards and onboarded for JPM Coin; managed under a private blockchain.
- Risks and regulatory fit:
  - Risks to holders similar to wholesale bank deposits: exposure to default risk of JPMorgan Chase N.A. unless covered by FDIC, operational and cyber risk (lower than public-blockchain cryptocurrencies).
  - Existing regulations (capital and liquidity requirements) could be well fit to the risks to which holders of JPM Coins and JP Morgan Chase N.A. would be exposed; exposures would be treated similarly to bank deposits for capital and liquidity requirements.
  - Supervisors would address operational and cyber risk of both coin holders and JP Morgan; if existing regulatory treatment applies, no material regulatory gaps are expected.

### Box 3 — illustrative incidents and sector adaptations
- Documented cyber-attacks and losses:
  - Binance: $41 million in Bitcoin stolen (May 2019).
  - Cryptopia: $16 million stolen (January 2019).
  - CoinBene and DragonEx: combined $46 million worth of Ethereum-based tokens lost (disclosed March 2019).
  - Bithumb: $13 million lost in March; later reports suspected a further $6 million in Ripple taken.
  - Coinbin: forced into bankruptcy with roughly $26 million lost.
  - QuadrigaCX: investors unable to access about $190 million after founder’s death (December 2018).
- Market/default incidents:
  - Bitfinex alleged loss of $850 million and subsequent use of funds from affiliated stablecoin operator Tether to cover the shortfall (New York Attorney General’s allegation).
- Market integrity and fraud findings:
  - Wall Street Journal analysis of 3,291 crypto assets white papers: 16% showed signs of plagiarism, identity theft, and promises of implausible returns; at least 61% contained luring terms such as “nothing to lose,” “guaranteed profit,” “highest return,” “no risk.”
- AML/CFT high-profile cases:
  - AlphaBay: more than $1 billion exchanged through crypto assets until shut down.
- Sector adaptations and business model risks:
  - IBM signed six banks to issue stablecoins on its Stellar public blockchain; multiple banks have announced interest in issuing stablecoins; JP Morgan confirmed it is working on a digital coin for payments.
- Prudential and systemic considerations:
  - ECB Crypto-Assets Task Force and BCBS have published recommendations and expectations regarding prudential treatment, segregation, and potential subtraction from CET1.

*International Monetary Fund | December 2019*

### Introduction                                                                                                            

### Introduction

### Scope and purpose
- Identifies selected elements of regulation and supervision that authorities should consider when deciding on a regulatory framework for crypto assets.
- Structured in two main sections: (1) summarizes some of the most relevant risks related to crypto assets; (2) concentrates on how regulatory frameworks could address these risks. Appendix contains country examples.
- Uses a broad definition: crypto asset denotes digital assets that use cryptography for security and are coins or tokens of distributed ledgers and/or blockchains, including asset-backed tokens. Distinction between “coins” and “tokens” is recognized; terms may be used interchangeably.
- Anchored in the IMF/World Bank Bali Fintech Agenda (BFA), which brings together 12 elements for policymakers, including enabling technologies, ensuring financial sector resilience, addressing risks, and promoting international cooperation. The note deepens monitoring, regulation, and supervision elements of the BFA.
- Not intended to set standards or provide prescriptive solutions; aims to assist policymakers in framing regulatory and supervisory discussions.
- Assumes some intermediaries will exist for the time being to provide financial services to end users.

### Coverage limits and exclusions
- Focuses on selected aspects of financial regulation related to a wide range of crypto-asset features existing today—but not all.
- Does not specifically cover particular features of stablecoins or other newly developed crypto assets in depth.
- Does not cover central bank digital currencies or payment system implications related to crypto assets.
- Data and privacy issues are not covered, although acknowledged as potentially significant for network effects and growth of crypto-asset ecosystems.
- Focuses on more imminent regulatory and supervisory issues; long-term challenges (e.g., implications of full decentralization) are noted but not the main focus.
- Underlying approach: similar activities and risks should be regulated in the same way to prevent excessive risk taking, contagion, financial instability, and material regulatory arbitrage.

### Need for international coordination
- Activities related to crypto assets are cross-border and cross-sectoral by design and require closer international cooperation and coordination to address regulatory gaps and prevent regulatory arbitrage, including the risk of a race to the bottom by regulators.

---

### The Risks

### High‑level risk characterization
- Rapid growth of crypto assets raises questions about regulatory perimeter and adaptability of existing regulatory architecture.
- Effective regulation should promote long-term economic stability and minimize social costs and negative externalities from financial instability.
- Crypto-investors, users, and crypto-asset service providers are exposed to high risks due to inherently high volatility, technology features, and anonymity.
- Major risk categories identified: operational/cyber risk, market/credit/default risk, commingling risk, liquidity risk, market integrity issues, misselling and fraud, misuse for money laundering and terrorist financing, contagion and business model risks that could become systemic.

### Investor risks (selected findings)
- Investors face significantly higher risk of loss than with traditional financial assets.
- Operational and cyber risk of wallet providers and crypto-trading platforms:
  - Several platforms and wallet providers, including large firms, have been hacked and client coins or tokens stolen.
  - Some of the largest loss incidents involved several hundred million US dollars per incident, leaving providers bankrupt and investors at a loss.
  - Even when compensation was eventually paid, investors could be unable to use hacked coins or tokens for extended periods.
  - Some exchanges mitigate risk by contracting cyber insurance or creating separate compensation funds (examples noted: Coinbase insurance of hot wallet client positions; Binance SAFU allocating 10 percent of trading fees), but typically there is no public safety net such as deposit insurance or liquidity facility from central banks.
- Market, credit, and default risks of coin and token issuers:
  - Many crypto assets are highly volatile; investors and trading platforms are exposed to material market risk.
  - Stablecoins are potentially subject to issuer credit and default risk if collateral (e.g., bank deposits) is not segregated and may be commingled in bankruptcy.
  - Stablecoin issuers often are related parties of crypto-trading platforms, creating potential conflicts of interest, including rehypothecation of collateral to related trading platform operators under favorable conditions.
- Commingling of service provider assets:
  - If crypto service providers go bankrupt, client coins and tokens could be commingled with provider assets unless clear regulatory frameworks and robust bankruptcy-remote arrangements exist.
  - If the service provider is a regulated bank, crypto-asset holdings could complicate resolution and have wider financial stability implications.
- Liquidity risk of issuers and service providers:
  - Issuers may permit frequent redemptions (typically very short term, such as daily) into other currencies or assets.
  - Investor expectations to exchange coins/tokens frequently without material cost create incentives for issuers and service providers to meet redemption requests, risking fire sales of collateral (e.g., bonds, bank deposits) that could negatively impact broader financial markets.
- Market integrity risk:
  - Many crypto assets lack tangible backing or intrinsic value (unlike stablecoins), weakening price discovery and increasing vulnerability to market manipulation.
  - Anecdotal evidence suggests some large crypto-trading platforms allow wash trades.
  - Illiquidity can amplify “whale” trades and other manipulation forms.
  - Enforcement is challenging due to anonymous, cross-border, and decentralized nature of transactions.
- Risk of misselling and fraud:
  - Lack of comparable product information, intrinsic technological complexity, and hype around innovation increase the risk of fraud and misselling.

### Anti–Money Laundering/Combating the Financing of Terrorism (AML/CFT) risk (selected findings)
- Crypto assets create risks of misuse for money laundering and terrorist financing due to varying levels of anonymity or “pseudo-anonymity.”
- Authorities may trace blockchain transactions but may not always establish the parties’ identities or ultimate ownership.
- Internet‑based and cross-border nature enables rapid global transactions and potential bypassing of AML/CFT obligations where intermediaries are absent.
- Anonymity-enhanced features increase enforcement challenges:
  - Emergence of sophisticated mixers and tumblers that mix coins and obscure trails.
  - Anonymity-enhanced crypto assets (e.g., Monero, Z‑cash) obfuscate source of funds and provide layering services that can frustrate detection, investigation, and prosecution.
  - New application layers (e.g., lightning network) and related netting arrangements allow offline exchanges that further reduce visibility of transactions.
- Note: Detailed discussion of AML/CFT issues is outside the scope of this note; the Financial Action Task Force (FATF) developments are referenced elsewhere in the paper.

### Prudential and systemic risk (selected findings)
- Crypto-asset providers and issuers are increasingly engaging with traditional financial institutions and modifying the competitive landscape, generating prudential risks.
- Exposures (through derivatives, crypto-linked products, cyber insurance) could trigger contagion risks to financial institutions if exposures grow or are poorly managed.
- If stablecoins become widely used, existing financial institutions may engage more actively (including issuing their own stablecoins), potentially affecting the soundness of the financial sector.
- DLT applications may affect industry structure and increase competition, with wider impacts on business models of the existing financial sector (beyond scope of this note).
- Initial standard setter assessments indicated crypto assets did not pose material systemic risk, but technological and market developments are moving fast and the situation may be changing.
- Crypto-trading platforms’ business models and activities:
  - Typically execute and receive investor orders for secondary market trades of crypto assets against fiat or other crypto assets.
  - Provide brokerage services to retail investors similar to stock brokerage firms, but generally need to provide liquidity by trading on their own account to match client orders.
  - Do not operate like EU multilateral trading systems (MTFs) because MTF operators cannot trade on their own account in the trading platform they operate.
  - May perform additional functions including custody (wallet services), margin lending, and provision of liquidity; margin trading and financing platforms can support considerable leverage (lack of disclosure makes sizing difficult).
  - Play roles as underwriters in initial coin offerings, raising risks of market manipulation and insider trading.

---

*International Monetary Fund | December 2019*

### Box 1. Crypto-Trading Platforms

### Box 1. Crypto-Trading Platforms

### Context and systemic risk
- At the time of the report, "crypto assets did not pose a material risk to global financial stability."
- Risks would arise if crypto assets became widely used in payments and settlement.
- Significant data gaps exist on the extent of leverage in crypto-asset markets and on direct and indirect exposures of financial institutions, complicating assessment and monitoring of systemic risk.
- Current transmission channels between the crypto space and traditional financial institutions are restricted to small direct exposures and limited indirect exposures.
- Further institutionalization of crypto-related activities could increase transmission channels and raise financial stability concerns.

### Transmission channels and institutionalization
- Development of private key management solutions by fintech startups and major financial entities (for example, Fidelity Investments) could enable wider institutional use.
- A possible scenario: much wider use of crypto assets by large institutional investors (asset managers, insurance companies, and pension funds) if custody and management services become reliable and competitively priced.
- Wider use of crypto-based payment systems (such as for cross-border payments) could materially increase transmission channels between crypto assets and financial institutions.

### Regulatory roles and actions taken
- Central banks and AML/CFT authorities were mostly the first to react; emergence of ICOs shifted focus to securities regulators and standard-setting bodies.
- FATF updated its standards to cover virtual assets and virtual asset service providers in 2018.
- Many AML/CFT authorities developed or adapted regulation to apply to certain types of crypto assets.
- Securities regulators initiated enforcement investigations where crypto-assets may meet the definition of a security.
- The Basel Committee on Banking Supervision (BCBS) warned in March 2019 that continued growth of crypto assets has potential to raise financial stability concerns and increase risks faced by banks.
- At least 82 countries have issued warnings on digital assets and at least 20 countries have issued warnings on ICOs, specifically.

### What jurisdictions have done so far
- Warnings: Most jurisdictions issued public statements warning about crypto asset risks, often focusing on investor protection and financial integrity; many noted some crypto assets could resemble securities (examples: US SEC and UK FCA).
- Prohibition: Several jurisdictions banned any crypto-asset activity (listed examples include Algeria, Bahrain, Bangladesh, Bolivia, China, Colombia, the Dominican Republic (for regulated financial institutions), Indonesia, Iran, Iraq, Morocco, Nepal, Kuwait, Kyrgyzstan, Macao SAR, Maldives, and Qatar).
- Guidance: Many authorities issued high-level guidance classifying crypto assets by characteristics and economic purpose (inspired by Swiss approach): (i) securities assets; (ii) payment assets; (iii) utility assets. Guidance focuses on whether existing legislation applies.
- Tailored regulation: Some jurisdictions created specific regulatory frameworks for crypto assets (examples: Malta and Thailand). Japan amended the Payment Services Act and the Financial Instruments and Exchange Act, 2019; Malta issued the Virtual Financial Assets Act, 2018; Thailand issued the Emergency Decree on the Digital Asset Business B.E. 2561 (C.E. 2018).
- Enforcement: Several authorities used enforcement and sanction powers case-by-case (examples: US SEC and CFTC).
- Standard setters: Many bodies engaged in reports and guidance; however, standards have effectively been issued only by FATF.

### The Libra example and implications for crypto-trading platforms
- Libra Association announced in June 2019 a digital currency project led by Facebook and 27 other members.
- In October 2019, 22 members formally signed the Libra Association Charter, formalized the Libra Association Council, elected the Board of Directors, and appointed members of the Libra Association Executive Team.
- Target launch: first half of 2020, aiming to have approximately 100 members.
- Governance: Each member to have an equal voting right; important decisions require supermajority among governance token holders.
- Two token types planned: payment/user tokens for users, and governance/investor tokens. Governance/investor tokens subject to a minimum investment threshold of $10 million.
- Reserve composition: backed by a reserve of real assets held by a geographically distributed network of custodians with an investment-grade credit rating; reserve composed of low-volatility assets—bank deposits and government securities in currencies from stable and reputable central banks; initial set of currencies reported to be four major hard currencies (British pounds, euros, US dollars, and yen).
- Reserve management: association plans to rely on short-dated securities issued by stable governments traded in liquid markets; association may occasionally change the composition of the basket subject to a supermajority vote by the council.
- Users of Libra would not receive returns from the reserve; revenue used to promote the coins and as a return to governance token investors.
- Supervision uncertainty: association established in Geneva and reported to be subject to Swiss FINMA; FINMA indicated the project would require a payment system license and could be subject to PFMI-aligned requirements, capital allocation for credit, market, and operational risks, liquidity and risk concentration requirements, and bank-like regulatory requirements for bank-like risks.
- FINMA indicated a necessary condition for payment system license: returns and risks associated with reserve management must be borne entirely by the Libra Association and not by stablecoin holders.
- Conflicts of interest: governance token holders entitled to return on reserve investment may push yield-enhancing activities (such as securities lending); user token holders would prefer conservative, well-diversified reserve investing to minimize volatility.
- The association’s initial reserve management policy states that "the goal will always be value preservation," but member composition could pressure a shift toward riskier investments over time.

### Crypto-trading platforms, liquidity risk, and user redemption
- The ecosystem would rely heavily on crypto-trading platforms for redemption, exposing it to liquidity and foreign exchange rate risk.
- Redemption of user tokens limited to entities authorized by the association to transact large amounts of fiat and Libra in and out of the reserve.
- So far, founding members have included crypto-trading platforms rather than banking groups; users would have to sell Libra to those entities to cash out to fiat, incurring fees (foreign exchange conversion and transaction fees).
- In a run scenario, crypto-trading platforms could face liquidity risk if the association cannot meet redemptions to those entities as quickly as end users require.
- Currently, most jurisdictions do not impose prudential requirements (including liquidity requirements) on crypto-trading platforms.
- It would be useful for the association to have additional reserves and be able to use such reserves for liquidity provisions to authorized resellers in stressed situations.

### AML/CFT, data, and operational considerations
- Calibra, a Facebook subsidiary, created to serve as the single wallet provider of Libra and would be subject to AML/CFT regulation and licensed as a payment service provider.
- Transaction data will not be shared with Facebook or any third party without customer consent, though data may be shared with authorities to comply with law.
- There is uncertainty about how AML/CFT preventive measures, such as customer due diligence, will be carried out.
- One of Facebook’s motivations for Libra could be access to usage data, raising data-protection and competition concerns.

*International Monetary Fund | December 2019 — Box 1. Crypto-Trading Platforms.*

### Box 2. A Special Mention of Recent Crypto Developments: Facebook and Libra (continued)

### Box 2. A Special Mention of Recent Crypto Developments: Facebook and Libra (continued)

### International standard-setter activity and recent reports
- IOSCO: standing fintech network to track developments and identify policy needs; Committee on Secondary Markets published a consultative document on crypto-asset platforms (see IOSCO Consultation Report CR02/2019 referenced in source).
- FSB:
  - “Decentralised financial technologies,” June 2019: considered financial stability and regulatory and governance implications of decentralized financial technologies.
  - “Crypto-assets: Work underway, regulatory approaches and potential gaps,” May 2019: summarized recent work by international organizations covering investor protection, market integrity, AML, bank exposures, and financial stability monitoring; recommended G20 keep regulatory approaches and potential gaps under review.
  - “Crypto-assets regulators directory,” April 2019: provides information on relevant regulators/authorities in FSB jurisdictions and international bodies.
- BCBS:
  - Issued a “statement on crypto assets” in March 2019 and a consultative document in December 2019 setting prudential expectations related to banks’ exposures to crypto assets and related services.
  - Highlighted risks for banks including liquidity risk; credit risk; market risk; operational risk (including fraud and cyber risks); money laundering and terrorist financing risk; and legal and reputation risks.
  - Collecting data on banks’ direct and indirect exposures to crypto assets as part of its end of 2018 Basel III monitoring exercise.
  - Published a discussion paper related to prudential regulatory treatment of crypto assets in December 2019.
- CPMI and IOSCO joint work:
  - Examined PFMI application to initiatives using DLT in clearing and settlement.
  - CPMI issued two papers in 2018 on i) cross-border retail payments and ii) central bank digital currencies; cross-border retail payments report noted emerging alternative clearing and settlement arrangements.
  - CPMI chairman: “The emergence and use of cryptocurrencies across borders signals to central bankers that our current payment systems are too expensive and slow. Action is needed to put better arrangements in place.”
- FATF:
  - Adopted changes in October 2018 clarifying application to virtual assets and related service providers.
  - Adopted an Interpretative Note to Recommendation 15 in June 2019 setting out binding measures for regulation, supervision, or monitoring of virtual asset service providers.
  - Issued guidance in June 2019 on application of the risk-based approach to virtual assets and virtual asset service providers.

### Considerations for the development of regulatory frameworks
- Recommended approach:
  - Proactive and holistic regulation stemming from comprehensive consideration of risks.
  - Monitor developments to analyze emerging risks, identify significant vulnerabilities, and determine priorities.
  - Ongoing engagement with industry to anticipate risks and seek appropriate measures.
  - Sequential development of regulatory frameworks based on priorities and resources, with continuous comprehensive risk assessment and strategic planning involving all financial sector regulators and relevant authorities.
- Coordination and allocation of responsibilities:
  - Regular coordination among relevant authorities to allocate responsibilities; consider potential for regulatory arbitrage, scarceness of expertise and resources, existing regulatory framework, and reputational risks.
  - One or more authorities may be responsible; coordination with all other financial sector authorities is key.
- Objectives and legal foundations:
  - Aim to enhance investor protection, minimize regulatory arbitrage, and retain flexibility to adapt to changing landscape and risk outlook.
  - Design comprehensive plans addressing crypto-asset risks, including legislative/regulatory actions, continuous monitoring, coordinated communication, and investor education programs.
  - Ensure clarity and consistency in terminology.
  - Sound legal frameworks are a precondition for a strong financial system in the crypto-asset era; legal certainty of ownership rights is essential for secure transfer and finality.
  - International cooperation is crucial for monitoring, containing risks, identifying cross-border considerations, tackling regulatory arbitrage, and enforcing/prosecuting crypto-asset-related cases.
- Risk-based and proportional regulation:
  - Immediate consideration for public offers (investor risks from information asymmetries, lack of transparency, fraud), trading (operational and cyber risks, market integrity), custodial and wallet services (segregation and safe handling of client assets), financial integrity risks (AML/CFT), and exposure of the financial sector (prudential and financial stability risks).
  - Recognize that entities may perform multiple functions (issuance, trading, custody) and applicable regulations should address each function.

### Offering crypto assets — investor protection and disclosure
- Creation/distribution:
  - Mining (e.g., Bitcoin miners) generally does not seem to entail major investor risks at creation stage because acquirers are limited and presumably knowledgeable; however, concentration risks (e.g., small number of miners) may create vulnerabilities such as manipulation, fraud, or a “51 percent attack.”
- Public offers and transferability:
  - Distribution via public offer or availability on secondary markets raises investor protection concerns when assets are transferable/tradeable; policy need for investors to make informed decisions based on timely and accurate information.
- Financial and technology literacy:
  - Low public understanding of different crypto assets’ features and risks; need for education beyond warnings—e.g., initiatives at different education levels and tailored outreach.
- Disclosure requirements:
  - Authorities should consider appropriate disclosure requirements at initial offer and on a continual basis.
  - Disclosure should provide comprehensive description of features and risks; for stablecoins, likely include assessment of collateral, rights to access collateral, and discussion of stabilization and governance mechanisms.
  - Disclosure promotes more accurate pricing, enhanced investor protection, reduces fraudulent offers, and assists market efficiency.
- Limitations of applying existing securities frameworks:
  - Applying existing securities regulation to crypto assets that meet a jurisdiction’s legal definition of security may be used but can fall short for many crypto assets that do not qualify as securities yet raise similar investor protection issues.
  - Issuers may design assets to escape securities definitions or choose jurisdictions with narrower definitions.
  - Securities regulators may need to rely on enforcement powers; securities disclosure regimes may not be adequate for all crypto-asset offers.
- Jurisdictional examples of adapting frameworks:
  - France: Loi PACTE provides a specific voluntary regime for public offers of crypto assets not qualifying as securities; issuers can apply to AMF for a visa by submitting a white paper with detailed information.
  - Malta: Virtual Financial Asset Act (VFAA) effective 2018 creates a specific regime for crypto assets and a Malta Digital Innovation Authority; regulates offers of virtual assets not qualifying as electronic money, financial instruments, or virtual tokens.
  - Japan: Financial Services Agency introduced registration for crypto-asset trading platforms in 2017 under the Payment Services Act (PSA), designating payment tokens (e.g., Bitcoin) under PSA; Financial Instruments and Exchange Act (FIEA) amendments to define and regulate investment-type tokens as securities, with revised acts to come into force by June 2020 at the latest.

### Trading crypto assets — platform features and regulatory priorities
- Platform distinctions and risks:
  - Crypto-asset trading platforms often permit direct retail access and may provide custody services; some resemble stock trading venues while others act as market intermediaries.
  - Risks include operational issues, orderly trading, manipulation, transparency, plus platform-specific risks and custodial-service risks.
- IOSCO work:
  - IOSCO’s consultation report on issues, risks, and regulatory considerations relating to crypto-asset trading platforms examines main secondary market trading issues and references relevant IOSCO principles and methodology to guide regulation and supervision of crypto-asset platforms.

### Key statistics and findings highlighted
- “Crypto asset regulation is identified by respondents as the main (64 percent) gap, which so far has only been addressed by 30 percent of respondents.”
- Regulatory timing and documents cited:
  - FSB reports: June 2019, May 2019, April 2019.
  - BCBS statement: March 2019; consultative document and discussion paper: December 2019.
  - BCBS Basel III monitoring exercise: end of 2018.
  - CPMI papers and press statements: 2018.
  - FATF changes: October 2018; Interpretative Note and guidance: June 2019.
  - Japan PSA/FIEA revision effective by June 2020 at the latest.
- Note on forthcoming work:
  - A dedicated Fintech Note on modernizing legal frameworks is expected to be published in due course.

*International Monetary Fund | December 2019 — Box 2. A Special Mention of Recent Crypto Developments: Facebook and Libra (continued)*

### references to other IOSCO materials when relevant.

### references to other IOSCO materials when relevant.

### Regulatory framework for crypto-asset platforms
- Governance requirements for platform operators, including prudential requirements:
  - Robust governance established by fit and proper senior management and control functions.
  - Necessary resources to run a platform provide assurances on business reliability.
  - Capital requirements must consider whether the operator functions bilaterally (counterparty to each transaction) or multilaterally (matching buy and sell orders); bilateral operation adds counterparty risk and calls for risk-based capital requirements.
- Requirements regarding access to the platform:
  - Platforms should have appropriate processes and controls governing who accesses and uses the platform.
  - If the platform allows direct retail access, it cannot rely on due diligence of intermediaries. 31
- Requirements for robustness, resiliency, and integrity of operating systems:
  - Cyber-attacks are a main vulnerability; adequate processes and controls help protect from hacking or theft and provide trading integrity.
- Market integrity requirements:
  - Crypto assets are prone to manipulation due to high volatility, potential conflicts of interests/concentration issues, and low level of disclosure.
  - Authorities should consider market abuse rules and surveillance mechanisms to protect investors.
- Transparency requirements:
  - Authorities should assess extent of pre- and post-trade information, recipients, dissemination method, and whether information is available aggregated with other platforms.
  - Determine whether trading information is reliable, timely, and publicly available on a nondiscriminatory basis.
  - Consider availability and transparency of platform rules and procedures, including order processing and handling of errors and cancellations.
- AML/CFT requirements:
  - Platform operators should be expected to comply with applicable FATF standards for AML/CFT.
- Products offered on platforms:
  - Platforms may differ in how they determine which assets are accepted for trading.
  - Authorities should consider requirements or criteria applied and ensure clear expectations regarding availability of information on products traded, including risks—particularly relevant for platforms with direct retail client access.
  - Authorities should consider regulatory determination of asset types acceptable for trading or involvement in product listing.
- Custody and clearing/settlement:
  - Platforms may hold custody of client assets; authorities should consider measures to safeguard client assets, ensure orderly liquidation and return if the platform closes, prevent use of client assets for proprietary purposes, and facilitate prompt identification and transfer of positions.
  - Platforms may perform clearing and settlement activities; understanding legal transfer of ownership is key. Legal certainty varies by jurisdiction of the service provider.
  - Authorities should consider internal record keeping and accounting systems to ensure correct and timely allocation of funds and assets to clients.

### Custody of Crypto Assets (wallets)
- Wallets: file or software storing a unique private key and public key (user’s address as an alpha-numeric string); ownership of crypto assets relies on knowing private keys—loss of wallet file (and private keys) makes crypto assets unrecoverable.
- Key characteristics for regulatory consideration:
  - Custodianship: wallet managed by users themselves or delegated to a third-party custodian (“wallet provider”), often an exchange or third-party service provider.
  - Storage/security types: “hot” wallets (kept online/connected) and “cold” wallets (kept offline).
- Cold vs hot wallet risks:
  - Cold wallets: higher risks of loss or physical damage; cyber risks eliminated until reconnected.
  - Most users and platforms use cold wallets for bulk storage and hot wallets for short-term transactions.
  - No clear delineation between cold and hot wallet technologies; a hot wallet becomes cold upon disconnecting and vice versa.
- Cyber risk exposure:
  - Wallets are most exposed to cyber risk; attackers target private keys in hot wallets to impersonate owners and steal funds; attacks against cold wallets, while more difficult, are possible.
  - Wallet security requirements should align with best practices in cryptography, focusing on key protection and key lifecycle management controls.
  - Requirements should remain principles-based and not focus on fine technical distinctions between cold and hot wallets.
- Prudential regulation of third-party wallet providers:
  - Compelling case to afford customer protection and mitigate contagion risk to the financial sector.
  - Legal uncertainty in bankruptcy (inclusion of crypto assets held in custody), risk of comingling, operational failures, or theft/loss of private keys.
  - Recommendation to consider reporting and prudential regulation requirements for wallet providers, such as risk management (including operational and cyber risk), protection of client assets, minimum capital, and liquidity requirements (particularly if third-party reuses customer crypto assets).

### Exposure to Crypto Assets (prudential treatment)
- No global standard currently for prudential treatment of exposures to crypto assets for banks or other regulated entities; most jurisdictions have not clarified prudential treatment, leading to differing classifications (intangible assets, cash, or commodities) and differing prudential treatments.
- Forthcoming international standards likely to reflect high risks of crypto assets:
  - Basel Committee on Banking Supervision noted it “will in due course clarify the prudential treatment of such exposures to appropriately reflect the high degree of risk of crypto assets.” 32
  - The statement described minimum expectations on due diligence, risk management, and disclosure.
- High volatility warrants conservative treatment on direct exposures:
  - Regulated entities could be vulnerable due to high volatility.
  - Expectation of conservative approaches such as capital deductions or imposition of high-risk weights for internal risk and capital management.
  - Robust segregation and separation between traditional business and crypto business is desirable; group-wide and step-in risk must also be considered even when crypto businesses are in separate entities.
- Exposures to stablecoins:
  - Benefits from collateral only if issuers are subject to appropriate regulation and supervision.
  - Many stablecoins reportedly fully backed by hard currencies, bank deposits, and government bonds; good quality collateral could be reflected in prudential treatment only if issuers are prudentially regulated and legal certainty exists regarding availability of collateral in stressed environments.
  - Risk mitigation from collateral should be reflected only if robust safeguards are in place, such as prudential regulation and supervision covering ownership and availability of collateral by the financial regulator or the central bank.
- Monitoring indirect exposures:
  - Financial institutions should monitor indirect exposures (loans to crypto investors, derivative exposures with crypto-asset trading platforms, cyber insurance to wallet providers, etc.) because such risks can be strongly correlated with market movements.
- Institutions issuing crypto assets or crypto-asset-linked products:
  - Some banks have or plan to issue coins/tokens (examples cited) for payments and delivery-versus-payment of securities settlements; some have issued structured bonds linked to crypto assets or may issue stablecoins for payments or trade financing.
  - Economically similar activities to deposit-taking should be subject to existing prudential regulation (liquidity coverage ratio and net stable funding ratio) when applicable.
  - Careful analysis needed if a separate issuing entity is established “independently” from prudentially regulated financial institutions because banks may face reputational pressure to provide liquidity to the issuing entity.
  - Financial institutions expected to manage operational risk and conduct risk when issuing such products. (See Box 3.)

### Handle with Care (overall guidance)
- Regulatory approach must involve intense monitoring and flexibility as the industry evolves.
- Regulators need to continuously monitor the crypto-asset landscape and address data gaps to monitor markets and potential contagion effects to the existing financial sector.
- Regulation should build trust, not stifle innovation; clear guidelines remove uncertainty and foster confidence.
- Regulators should proactively address emerging risks, swiftly build capacity and expertise in new instruments and technologies given high reputational risks.
- Evaluate capacity and resources of supervisory authorities and potential damage to trust in the financial sector on a case-by-case basis.
- Clear public communication about the role of regulation and supervision is important to emphasize investor and consumer risks and avoid misunderstanding or over-trust in regulation or authorities.
- Cross-sector and cross-border coordination and cooperation are key due to jurisdictional challenges and global accessibility of crypto assets:
  - Determining geographic location and jurisdictional powers can be challenging. 33
  - Inconsistent domestic measures that ignore cross-border issues may create opportunities for regulatory arbitrage and diminish effectiveness of domestic policy responses (monetary policies and macroprudential measures).
  - Enhanced cross-border cooperation and potential new mechanisms for regulatory cooperation are likely to be increasingly necessary.

### Case study: JPM Coin
- JPM Coin description:
  - Announced February 2019 by J.P. Morgan Chase N.A., focusing on wholesale clients; based on blockchain enabling instantaneous transfer of payments among JPM group’s institutional clients.
  - Digital coin representing US dollars held in designated accounts at JPMorgan Chase N.A.; prototype test successfully completed.
  - Potential use cases: i) cross-border payments; ii) delivery versus payment between tokenized securities and the coin; iii) internal liquidity optimization for large, complex corporate clients.
  - Instantaneous transfer available 24 hours, 7 days a week, every day of the year.
  - Issued on Quorum Blockchain and extendable to other platforms; operable on all standard blockchain networks.
  - Redemption: holder can redeem for equivalent amount of US dollars, similar to the bank’s demand deposit.
  - Access limited to institutional customers passing JP Morgan Chase Bank “Know-Your-Customer” standards and onboarded for JPM Coin; managed under a private blockchain.
  - Limited to wholesale users; scalability and capacity not a binding constraint initially; potential future expansion to retail payments when scalability/capacity constraints are addressed or interbank payment systems upgraded.
- Risks and regulatory fit:
  - Risks to holders similar to wholesale bank deposits: exposure to default risk of JPMorgan Chase N.A. unless covered by FDIC, operational and cyber risk (lower than public-blockchain crypto currencies).
  - JP Morgan Group faces liquidity, operational, and cyber risks similar in nature and scale to traditional banking operations.
  - Faster transfer of coins would require upgrades to liquidity risk management by individual branches and entities of the JPMorgan Group.
  - Existing regulations (capital and liquidity requirements) could be well fit to the risks to which holders of JPM Coins and JP Morgan Chase N.A. would be exposed; exposures would be treated similarly to bank deposits for capital and liquidity requirements.
  - Supervisors would address operational and cyber risk of both coin holders and JP Morgan; if existing regulatory treatment applies, no material regulatory gaps are expected.

*ftnea2019003 - references to other IOSCO materials when relevant.*

### Box 3. A Special Mention of Distributed Ledger Technology Adaptations by Financial Institutions: JPM

### Box 3. A Special Mention of Distributed Ledger Technology Adaptations by Financial Institutions: JPM Coin

### Overview
- The box highlights adaptations of distributed ledger technology (DLT) by financial institutions and presents Appendix I, which lists illustrative examples of crypto assets–related risks and concrete instances where those risks have been realized.
- Focus areas include investor protection risks, market and credit risks, market integrity risks, commingling risk, risks of mis-selling and fraud, AML/CFT risk, prudential risks, business model risks, and systemic risk.

### Illustrative risks and documented examples
- Investor protection risk — operational and cyber risk of wallet providers and crypto-trading platforms:
  - In May 2019, one of the largest crypto exchanges by trading volume (Binance) suffered from cyber-attacks with a total of $41 million in Bitcoin being stolen.
  - Sixteen million dollars were stolen from digital asset exchange Cryptopia in January 2019.
  - Exchanges CoinBene and DragonEx lost a combined $46 million dollars’ worth of Ethereum-based tokens through attacks disclosed in March 2019.
  - South Korean exchange Bithumb was also rocked by its third attack, when $13 million worth of coin was lost in March.
  - Later reports suspected a further $6 million in Ripple had also been taken. Coinbin, another South Korean exchange, was forced into bankruptcy last quarter—roughly $26 million had been lost.
  - Investors in QuadrigaCX, Canada’s largest cryptocurrency exchange, were unable to access their funds (about $190 million) after its founder, Gerald Cotten, died in December 2018. According to an Ernst & Young (the bankruptcy auditor) report issued in May 2019, a significant number of clients’ assets had been transferred to the founder’s private accounts.
- Market, credit, and default risks of coins/tokens’ issuers:
  - The New York Attorney General’s office has alleged that crypto-exchange Bitfinex, which lost $850 million, subsequently used funds from affiliated stablecoin operator Tether to cover the shortfall.
- Market integrity risk:
  - The majority of crypto asset trading occurs over centralized exchanges (with custody and centralized settling) but decentralized cryptocurrency exchanges (DEXes) allow for more direct trading and are gaining more prominence.
  - Researchers at Cornell Tech found that high-frequency trading on these exchanges is using autonomous algorithmic trading programs to take advantage of ordinary users’ trading patterns and other market manipulation techniques.
- Commingling risk:
  - In Italy, an exchange called BitGrail that was hacked was also found responsible during the court proceedings to frequently deposit customer funds into wallets directly under Firano’s (the exchange’s owner) control.
- Market integrity risk — token backing and concentration:
  - The vast majority of the almost 2,500 crypto assets listed on CoinMarketCap.com are not backed by anything tangible. Only 66 stablecoins—30% of total announced tokens—are actually live and operational.
  - By market capitalization, the top 10 comprise about 90%, of which Tether (the only stablecoin in the top 10) comprises less than 2%. However, it should be noted that by 24h trading volume it comprised 37% of that top 10 group.
- Risk of mis-selling and fraud:
  - The Wall Street Journal conducted an analysis of 3,291 crypto assets white papers and concluded that 16% showed signs of plagiarism, identity theft, and promises of implausible returns. At least 61% contained luring terms such as “nothing to lose,” “guaranteed profit,” “highest return,” “no risk.” US state and federal regulators have previously issued cease-and-desist orders on various offerings with similar language.
- AML/CFT risk:
  - High-profile money laundering cases include AlphaBay, where more than $1 billion was exchanged through crypto assets until the US District Court of Eastern California shut it down in a multinational law enforcement operation. The platform allegedly was 10 times larger than its predecessor, Silk Road.

### Prudential, business model, and systemic considerations
- Prudential risk and regulatory guidance:
  - The ECB Crypto-Assets Task Force published a paper providing recommendations for the prudential treatment of crypto assets, advocating measures such as subtracting crypto assets exposures from CET1 or requiring the segregation of crypto business to ensure FMI’s safety.
  - The BCBS issued a statement setting out its prudential expectations related to banks' exposures to crypto assets and related services that will further clarify the prudential treatment of such exposures in the future.
- Business model risk:
  - There is potential blurring of lines between regulated financial institutions’ business models and unregulated crypto assets and exchanges as more and more FIs engage with crypto assets.
  - Example adaptations: IBM has signed six banks to issue stablecoins on its Stellar public blockchain. Multiple banks have announced their interest in issuing stablecoins and JP Morgan has confirmed it is working on a digital coin for payments.
- Systemic risk:
  - BCBS has warned that the crypto industry can potentially “raise financial stability concerns and increase risks faced by banks.”

*Source: Box 3 and Appendix I in the IMF document ftnea2019003 (December 2019).*

---


_Source: https://www.imf.org/-/media/files/publications/ftn063/2019/english/ftnea2019003.pdf_