## ftnea2022007 — Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets

## Source details

**Canonical URL:** [ftnea2022007 — Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets](https://www.imf.org/-/media/files/publications/ftn063/2022/english/ftnea2022007.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/ftn063/2022/english/ftnea2022007.pdf.md)
- [Structured JSON version](/-/media/files/publications/ftn063/2022/english/ftnea2022007.pdf.json)

---

### Executive Summary — Executive overview
- Crypto assets were originally developed to democratize payments but are mostly used for speculation and, in the case of certain types of dollar-denominated stablecoins, also as a hedge against inflation and currency depreciation.
- Unbacked crypto assets:
  - Rely not on any backing asset for value but instead on supply and demand.
  - Offer limited or no rights for the token holder and are usually issued in a decentralized manner.
  - Are treated by users as speculative instruments rather than as a medium of exchange.
- Underlying technologies and decentralized innovations could yield benefits (greater competition and efficiency) in financial services such as remittance, trade financing, and cross-border payments if applied to real use cases and supported by appropriate regulation.

### Market size, volatility, and interconnected risks
- Total valuation of crypto assets:
  - Reached almost $3 trillion in November 2021.
  - Fell to less than $1 trillion in July 2022.
- Volatility is high; market size alone is not necessarily a financial stability risk, but growing interlinkages with regulated financial services and lack of regulation may generate systemic vulnerabilities.
- The October 2021 Global Financial Stability Report revealed that crypto asset exchanges operating in some emerging markets and developing economies have reached trading volumes comparable to those of local stock exchanges and interbank foreign exchange markets.
- Many regulatory authorities lack conduct or prudential regulation, or payments oversight, despite large retail holdings in some jurisdictions.

### Structural observations on the crypto ecosystem
- Centralization trends:
  - New centralized entities (exchanges, wallet providers) perform key functions and require users to trust centralized intermediaries; many remain largely unregulated.
  - Single entities may provide multiple functions (exchange, storage, clearing), potentially necessitating greater prudential and payment system oversight; such entities could be considered systemic FMIs.
- Global standards coverage:
  - Global standards applicable to unbacked crypto assets are limited and mostly focused on specific products (global stablecoins), issues (financial integrity), sectors (payments, securities, banking), or designated systemic entities—leaving material regulatory gaps in many countries.
- Cross-border and cross-sector nature:
  - Cross-sector and cross-border nature of crypto limits effectiveness of uncoordinated national approaches; gaps exist where crypto assets are issued, exchanged, transferred, or stored by nonbank entities or where legal interpretations exclude crypto from existing regulatory frameworks.

### Short-term regulatory guidance for domestic authorities
- Use existing regulatory powers, guided by applicable international standards, and focus on areas of vulnerability such as hosted wallets, centralized exchanges, and financial institutions’ exposures.
- Possible actions range from:
  - User education and industry guidance,
  - Targeted restrictions,
  - Ensuring short-term measures are flexible to adapt to market developments and future international standards.
- Broad bans:
  - Broad bans are likely disproportionate and ineffective long-term; targeted restrictions may be needed in the short-term (for example, on derivatives, marketing, or use in payments) while still allowing users to buy and sell crypto.
- Address underlying drivers:
  - Weak macroeconomic conditions, misleading marketing, lack of trust in traditional financial services are drivers to be addressed.

### Six elements recommended for comprehensive, consistent global regulatory frameworks
- Common taxonomies:
  - SSBs should develop taxonomies guided by groupings of risk, structural features, and economic functions rather than marketing or developer aspirations.
- Access to reliable and consistent data:
  - Common taxonomy is foundational; greater regulation, oversight, and cross-border collaboration needed to close data gaps while protecting user privacy.
- Risk-based global standards:
  - Greater requirements for entities and activities that generate more risk.
  - Clear licensing and authorization criteria, designated responsible authorities, and well-defined coordination mechanisms.
- Comprehensive coverage across activities and entities:
  - Crypto asset service providers delivering core functions and generating key risks should be licensed, registered, or authorized (storage, transfer, exchange, custody of reserves).
  - Where providers perform multiple functions, assess risks across the entity and activities and apply additional prudential, conduct, and payment oversight requirements commensurate with those risks.
- Systemic entities subject to additional requirements:
  - Entities that become systemically important should face requirements comparable to systemically important institutions: more intensive supervision, safety and soundness, stress testing, recovery, and resolvability.
  - Entities providing critical services with systemic implications could draw on CPMI-IOSCO principles for systemic FMIs.
- Level playing field and contagion mitigation:
  - Consistent yet proportionate rules for existing financial entities and nonbank crypto issuers and service providers.
  - Clear requirements for regulated financial institutions on exposure to and engagement with crypto assets, including capital and liquidity requirements and limits on exposures.
  - Clarify requirements if regulated entities provide custody services to address risks arising from that function.

### Policy objectives, key risks, and recommended regulatory responses (summary points)
- Legal Certainty
  - Key risks: Regulatory authorities lack sufficient powers or scope; lack of regulatory resources and expertise.
  - Responses: Enhance legal powers of regulators; determine legal classification of crypto assets; establish legal basis for domestic regulatory coordination and cross-border cooperation; enhance regulatory expertise.
- Effective Risk Monitoring
  - Key risks: No common taxonomy; limited accurate, consistent, and comparable data.
  - Responses: SSBs to create consistent global taxonomies; domestic authorities to implement taxonomies consistently; improve data collection by implementing existing global standards and/or regulating ancillary activities; require regulatory reporting as part of bespoke regulatory frameworks.
- Financial Stability
  - Key risks: Interlinkage with wider financial system; currency substitution; crypto asset service providers carrying out multiple activities; crypto asset service providers generating systemic risk; third-party risks; market risks.
  - Responses: Prudential requirements on bank exposures and active monitoring of indirect exposures; restrictions on regulated entities engaging with certain risky crypto assets; cross-border cooperation and targeted restrictions; prudential requirements commensurate with risk; extension of regulatory coverage to entities with critical functions; wind-down arrangements and resolution; guidance from PFMI for designated entities; IOSCO Principles on Outsourcing.
- Consumer Protection
  - Key risks: Operational failures; cyber attacks; lack of recourse to compensation; volatility; use of leverage.
  - Responses: Implement BCBS Principles on Operational Resilience (where appropriate); BCBS Principles for the Sound Management of Operational Risk (where appropriate); FSB practices on cyber incident response and recovery; CPMI-IOSCO guidance on cyber resilience for FMIs where appropriate; IOSCO Recommendations Regarding the Protection of Client Assets; segregation and safekeeping of consumer funds and appropriate record keeping; clear complaints procedures; user education; limits or restrictions on use of leverage; accurate and clear marketing.
- Market Integrity
  - Key risks: Opaque price formation; market manipulation (pump-and-dump schemes, rug pulls); conflicts of interest.
  - Responses: Transparency requirements on crypto asset service providers; governance requirements for issuers (where possible) and crypto asset service providers; requirements for white papers on issuers (where possible); market abuse rules extended to crypto asset service providers; limits to products offered on crypto asset exchanges; minimum reporting requirements on crypto asset service providers; implement IOSCO recommendations on crypto trading platforms.
- Cross-border Cooperation
  - Key risks: Lack of global standards; regulatory arbitrage.
  - Responses: Cross-sectoral global standards to close policy gaps; implement existing global standards in domestic regulation; close cooperation between authorities that host crypto asset service providers and jurisdictions where those services are marketed.

### Entities in the crypto ecosystem: risks and regulatory considerations
- Core entity types and key risks:
  - Issuers: frequently decentralized and often unknown; limited disclosure; subject to cyber risks and potential governance concentration among large token holders.
  - Crypto asset service providers (exchanges, lending, investment, transfers, custody): many perform multiple activities; off-chain settlement exposes users to provider credit/counterparty risk.
  - Wallet providers: custody models (self-managed vs delegated) reintroduce centralization and cyber/blocking risks; hot vs cold wallet trade-offs.
  - Validators/miners and DLT: technology-specific risks such as 51 percent attacks, miner-extractable value, dependence on hosted nodes, cross-chain bridge vulnerabilities.
  - Regulated financial institutions: exposures (direct and indirect) warrant conservative prudential treatment and monitoring.
- Issuance and distribution methods:
  - Creation methods: pre-mining, continuous mining, hybrid approach.
  - Distribution methods: pre-token sale, initial coin offering or token sale, mining, airdrops, forks.
  - Specific issuance risks: pre-mining can facilitate price manipulation; white papers and marketing often lack clarity or accuracy.

### Regulatory levers for issuers, platforms, and wallet providers
- Issuers:
  - Publication of white papers with clear, accurate, and understandable explanations (personnel, governance, DLT design, rights, purpose, issuance method, risks, complaints).
  - Notification, registration, or licensing of issuers/white papers; proportionality for small or restricted offerings.
  - Suitability tests for direct offers to end users.
  - Fair and accurate marketing requirements; possible marketing approval regimes.
  - Consumer education programs per Bali Fintech Agenda guidance.
- Exchanges and platforms:
  - Governance and prudential requirements (fit and proper senior management, resource adequacy, capital considerations).
  - Access controls, robustness/resiliency, market integrity surveillance, transparency and reporting, AML/CFT compliance, product listing criteria, conflicts-of-interest management.
  - Greater prudential requirements when platforms conduct significant off-chain transactions; potential application of PFMI.
- Wallet providers:
  - Segregation and safekeeping of client holdings; operational and cyber resilience; recordkeeping; AML/CFT compliance; reporting and prudential regulation where appropriate; wind-down and resolution planning; conflict-of-interest governance.
  - Wallet security and key management should follow cryptography best practices and lifecycle management.

### Critical service providers and operational concentration (Box 2 highlights)
- Centralization points and operational risks:
  - "a third of hosted nodes on the Ethereum Network are hosted on Amazon Web Services,46"
  - "60 percent of all Bitcoin traffic runs through three internet service providers"
  - "Tor routes traffic for roughly half of Bitcoin nodes.47"
  - Cross-chain bridges and oracles are growing sources of centralization and vulnerability.
- Policy implications:
  - Risks from crypto-critical service providers extend beyond financial regulation and may require intervention by governments, competition authorities, and sector regulators.
  - Operational resilience expectations for crypto-critical service providers should align with PFMI Annex F and Basel Committee principles: risk identification and management; confidentiality/integrity/availability; reliability and resilience; technology planning; transparent communications.
- Management of exposure:
  - Operational risk frameworks, clear roles/responsibilities, comprehensive information security, tested business continuity plans, reliable exit strategies, and tested incident procedures including substitutability.

### Prudential treatment for regulated financial institutions (Box 2 highlights)
- BCBS proposed categorization and measures:
  - Lower-risk anchored crypto assets (tokenized assets and stablecoins) vs higher-risk "traditional" crypto assets like Bitcoin (including unbacked crypto assets).
  - Proposed prudential measures: credit and market risk capital requirements for tokenized assets similar to traditional assets; possible lower risk weight for stablecoins under certain conditions.
  - For traditional crypto assets (including unbacked crypto assets): conservative prudential treatment based on a 1,250 percent risk weight applied to maximum long and short positions.
- Supervisory considerations:
  - High volatility warrants conservative treatment of direct exposures; indirect exposures should be monitored.
  - Data suggest direct exposure remains limited for banks in number and size of exposures.
  - Robust segregation and separation between traditional and crypto business desirable; monitor loans to crypto users, derivative exposures with exchanges, and cyber insurance to wallet providers.

### Approaches to unbacked crypto asset regulation (Box 3 highlights)
- Jurisdictional approaches (selected examples):
  - European Union (MiCA): focus on stablecoins; onshoring of issuing entities and notification regime for white papers and marketing; proposed onshoring and licensing for key entities delivering critical functions.
  - Japan: Payment Service Act amendments with client asset segregation, operational risk and cyber security management, KYC, internal audits, minimum capital; retail leverage limits (up to 200 percent) introduced.
  - Switzerland: FINMA ICO guidelines, token categories, DLT amendments enabling ledger-based securities and segregation rules.
  - United Kingdom: FCA guidance; April 2022 roadmap focusing on stablecoins and sandbox for blockchain-based FMIs; proposed inclusion in Financial Promotions Regime.
  - Albania, Nigeria: examples of national legal/regulatory responses and prohibitions/clarifications on legal tender status and financial institution activities.
- Effectiveness of broad bans vs targeted restrictions:
  - Broad bans are likely ineffective long-term and can stifle innovation; enforcement is challenging given offshore providers and VPN use.
  - Empirical examples: roughly 2 million Egyptians reportedly hold crypto assets; peer-to-peer transactions grew in Nigeria despite restrictions; significant mining operations in China despite a blanket ban.
  - Targeted restrictions (derivatives, payments) can address immediate challenges while capacity is built.

### Monitoring, data, taxonomy, and supervisory tools
- Data limitations and needs:
  - Crypto asset data are often unreliable, incomplete, fragmented across borders, and lack common taxonomy; off-chain transactions reduce traceability.
  - Stablecoins accounted for roughly $150 billion.
  - The market supports more than 10,000 different types of crypto assets.
  - Globally less than 30,000 merchants accept crypto assets as payment.
- Institutional involvement and figures:
  - Market capitalization milestones: $1 billion in 2010; almost $3 trillion in 2021; around $1 trillion in mid-2022.
  - According to Coinbase and Goldman Sachs, as of Q2 2021: 10 percent of the 100 largest hedge funds were using their platform to invest in crypto assets; 15 percent of family offices have exposures to crypto assets, and close to half of these offices are potentially interested in initiating exposures.
- Supervisory tools and approaches:
  - Monitor via business-as-usual supervision, horizon scanning, supervisory technology (e.g., web scraping), outreach, consumer/market surveys.
  - Work with blockchain analytics firms while recognizing limits due to off-chain activity and VPNs.
  - Consider embedded supervision concepts for real-time interaction with distributed networks (high initial investment).
  - Use privacy-enhancing techniques (zero-knowledge proofs, homomorphic encryption) to support cross-border data sharing while protecting user privacy.

### Implementation, coordination, and international standards
- Sector-specific standards are useful but cross-sectoral coordination is essential to address crypto ecosystem regulation effectively.
- The Financial Stability Board (FSB) is well placed to coordinate establishment of global standards to guide national implementation, while considering sector-specific standards developed by other SSBs.
- In absence of a global framework, national approaches focused on critical economic functions and centralized entities can be sensible interim measures.
- Home authorities where crypto asset service providers are domiciled need to coordinate with authorities where users are located; international cooperation in enforcement and information sharing is critical.

### Conclusions — policy priorities and macroeconomic considerations
- Regulatory design:
  - Build a robust, comprehensive, flexible regulatory framework with intense monitoring and domestic/international collaboration.
  - Focus immediately on key centralized entities carrying core functions: exchanges, wallet providers, and other centralized entities.
  - Regulation should build trust and remove uncertainty without unnecessarily stifling innovation.
- Licensing, supervision, and prudential approaches:
  - Key centralized entities that carry out core functions should be licensed and authorized.
  - Supervisory approaches should be technology-neutral where appropriate but consider unique risks of different delivery/operation methods.
  - Where entities carry out multiple activities, apply appropriate prudential and entity-based regulation; draw on PFMI for systemic entities.
- Macroeconomic responses:
  - Where crypto assets are systemic, strengthen macroeconomic policies rather than rely on broad prohibitions.
  - For jurisdictions using dollar-denominated stablecoins to hedge inflation or currency devaluation: strengthen monetary policy credibility; ensure central bank independence; hold traditional financial institutions accountable; maintain sound fiscal positions.
  - Short-term restrictions (e.g., on derivatives, payments) may dampen crypto growth while avoiding broad bans that encourage regulatory arbitrage.
- International coordination:
  - Cross-border and cross-sectoral coordination and consistent international standards are indispensable.
  - The FSB should lead coordination among sectoral SSBs; IMF staff are actively contributing to SSB activities to develop and implement robust standards.

*Source: Executive Summary and selected sections of ftnea2022007 — Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets (International Monetary Fund).*

### Executive Summary ......................................................................................................

### ftnea2022007 - Executive Summary

### Executive overview
- Crypto assets were originally developed to democratize payments but are mostly used for speculation and, in the case of certain types of dollar-denominated stablecoins, also as a hedge against inflation and currency depreciation.
- Unbacked crypto assets:
  - Rely not on any backing asset for value but instead on supply and demand.
  - Offer limited or no rights for the token holder and are usually issued in a decentralized manner.
  - Are treated by users as speculative instruments rather than as a medium of exchange.
- Underlying technologies and decentralized innovations could yield benefits (greater competition and efficiency) in financial services such as remittance, trade financing, and cross-border payments if applied to real use cases and supported by appropriate regulation.

### Market size, volatility, and interconnected risks
- Total valuation of crypto assets:
  - Reached almost $3 trillion in November 2021.
  - Fell to less than $1 trillion in July 2022.
- Volatility is high; although market size alone is not necessarily a financial stability risk, growing interlinkages with regulated financial services and lack of regulation may generate systemic vulnerabilities.
- The October 2021 Global Financial Stability Report revealed that crypto asset exchanges operating in some emerging markets and developing economies have reached trading volumes comparable to those of local stock exchanges and interbank foreign exchange markets.
- Many regulatory authorities lack conduct or prudential regulation, or payments oversight, despite large retail holdings in some jurisdictions.

### Structural observations on the crypto ecosystem
- Although originally designed to disintermediate financial services, new centralized entities (exchanges, wallet providers) perform key functions and require users to trust centralized intermediaries; many remain largely unregulated.
- Single entities may provide multiple functions (exchange, storage, clearing), potentially necessitating greater prudential and payment system oversight; such entities could be considered systemic financial market infrastructures (FMIs).
- Global standards applicable to unbacked crypto assets are limited and mostly focused on specific products (global stablecoins), issues (financial integrity), sectors (payments, securities, banking), or designated systemic entities—leaving material regulatory gaps in many countries.
- Cross-sector and cross-border nature of crypto limits effectiveness of uncoordinated national approaches; gaps exist where crypto assets are issued, exchanged, transferred, or stored by nonbank entities or where legal interpretations exclude crypto from existing regulatory frameworks.

### Short-term regulatory guidance for domestic authorities
- Use existing regulatory powers, guided by applicable international standards, and focus on areas of vulnerability such as hosted wallets, centralized exchanges, and financial institutions’ exposures.
- Actions can range from:
  - User education and industry guidance,
  - Targeted restrictions,
  - Ensuring short-term measures are flexible to adapt to market developments and future international standards.
- Broad bans are likely disproportionate and ineffective long-term; targeted restrictions may be needed in the short-term (for example, on derivatives, marketing, or use in payments) while still allowing users to buy and sell crypto.
- Address underlying drivers for crypto usage: weak macroeconomic conditions, misleading marketing, lack of trust in traditional financial services.

### Six elements recommended for comprehensive, consistent global regulatory frameworks
- Common taxonomies:
  - SSBs should develop taxonomies guided by groupings of risk, structural features, and economic functions rather than marketing or developer aspirations.
- Access to reliable and consistent data:
  - Common taxonomy is foundational; greater regulation, oversight, and cross-border collaboration needed to close data gaps while protecting user privacy.
- Risk-based global standards:
  - Greater requirements for entities and activities that generate more risk.
  - Clear licensing and authorization criteria, designated responsible authorities, and well-defined coordination mechanisms.
- Comprehensive coverage across activities and entities:
  - Crypto asset service providers delivering core functions and generating key risks should be licensed, registered, or authorized (storage, transfer, exchange, custody of reserves).
  - Where providers perform multiple functions, assess risks across the entity and activities and apply additional prudential, conduct, and payment oversight requirements commensurate with those risks.
- Systemic entities subject to additional requirements:
  - Entities that become systemically important should face requirements comparable to systemically important institutions: more intensive supervision, safety and soundness, stress testing, recovery, and resolvability.
  - Entities providing critical services with systemic implications could draw on CPMI-IOSCO principles for systemic FMIs.
- Level playing field and contagion mitigation:
  - Consistent yet proportionate rules for existing financial entities and nonbank crypto issuers and service providers.
  - Clear requirements for regulated financial institutions on exposure to and engagement with crypto assets, including capital and liquidity requirements and limits on exposures.
  - Clarify requirements if regulated entities provide custody services to address risks arising from that function.

### Table 1 — Policy objectives, key risks, and recommended regulatory responses (summarized)
- Legal Certainty
  - Key risks: Regulatory authorities lack sufficient powers or scope; lack of regulatory resources and expertise.
  - Responses: Enhancement of legal powers of regulators; determination of legal classification of crypto assets; establishment of legal basis for domestic regulatory coordination and cross-border cooperation; enhancement of regulatory expertise.
- Effective Risk Monitoring
  - Key risks: No common taxonomy; limited accurate, consistent, and comparable data.
  - Responses: SSBs to create consistent global taxonomies; domestic authorities to implement taxonomies consistently; authorities to improve data collection by implementing existing global standards and/or regulating ancillary activities; authorities to require regulatory reporting as part of bespoke regulatory frameworks.
- Financial Stability
  - Key risks: Interlinkage with wider financial system; currency substitution; crypto asset service providers carrying out multiple activities; crypto asset service providers generating systemic risk; third-party risks; market risks.
  - Responses: Prudential requirements on bank exposures and active monitoring of indirect exposures; restrictions on regulated entities engaging with certain risky crypto assets; cross-border cooperation and targeted restrictions; prudential requirements commensurate with risk; extension of regulatory coverage to entities with critical functions; wind-down arrangements and resolution; guidance from principles for financial market infrastructures (for designated entities); IOSCO Principles on Outsourcing.
- Consumer Protection
  - Key risks: Operational failures; cyber attacks; lack of recourse to compensation; volatility; use of leverage.
  - Responses: Implementation of BCBS Principles on Operational Resilience (where appropriate); BCBS Principles for the Sound Management of Operational Risk (where appropriate); FSB practices on cyber incident response and recovery; CPMI-IOSCO guidance on cyber resilience for FMIs where appropriate; IOSCO Recommendations Regarding the Protection of Client Assets; segregation and safekeeping of consumer funds and appropriate record keeping; clear complaints procedures; user education; limits or restrictions on use of leverage; accurate and clear marketing.
- Market Integrity
  - Key risks: Opaque price formation; market manipulation (pump-and-dump schemes, rug pulls); conflicts of interest.
  - Responses: Transparency requirements on crypto asset service providers; governance requirements for issuers (where possible) and crypto asset service providers; requirements for white papers on issuers (where possible); market abuse rules extended to crypto asset service providers; limits to products offered on crypto asset exchanges; minimum reporting requirements on crypto asset service providers; implementation of IOSCO recommendations on crypto trading platforms.
- Cross-border Cooperation
  - Key risks: Lack of global standards; regulatory arbitrage.
  - Responses: Cross-sectoral global standards to close policy gaps; implementation of existing global standards in domestic regulation; close cooperation between authorities that host crypto asset service providers and jurisdictions where those services are marketed.

### Implementation and coordination
- Sector-specific global standards are useful but cross-sectoral coordination is important to achieve an effective regulatory framework for the crypto ecosystem.
- The Financial Stability Board (FSB) is well placed to coordinate establishment of global standards to guide national implementation, while considering sector-specific standards developed by other SSBs.
- Although this note focuses on unbacked crypto assets, its regulatory considerations may apply to a wider range of crypto assets, including stablecoins.

*Source: Executive Summary of ftnea2022007 — Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets (International Monetary Fund).*

### Introduction

### Introduction

### Overview
- Crypto assets can generate efficiencies in financial services (disintermediation, lowering costs, speeding up processes) but also create material risks for market integrity, consumer protection, financial integrity, and financial stability.
- Despite decentralization being a core concept, most users access crypto assets through centralized entities (exchanges, wallet providers) that:
  - hold information on users;
  - can accept or block transactions from certain addresses;
  - can share transaction data with other organizations.
- Wallet providers and exchanges act as custodians and trading platforms analogous to banks and stock exchanges, requiring user trust in centralized entities. Many such entities offer multiple products and services as one-stop shops.
- Concentration risks exist: holdings of many crypto assets can be concentrated in the hands of a few “whales.” Ben Mariem and others (2020) estimate that 4.5 percent of entities hold 85 percent of all circulating bitcoins.

### Policy framework
- The Bali Fintech Agenda (BFA), a guiding framework developed jointly by the IMF and the World Bank, consists of 12 policy elements and is a useful framework to guide authorities in harnessing fintech benefits while mitigating risks.
- This Fintech Note builds on prior IMF work to focus on prudential and conduct regulatory challenges from unbacked crypto assets and to provide high-level guidance to regulators and supervisors.
- Companion and prior IMF Fintech Notes cover: regulation and supervision of crypto assets (Cuervo and others 2020), crypto assets and financial integrity (Schwarz and others 2021a and 2021b), crypto assets and capital flow measures (He and others 2022), and regulation of stablecoins (Bains and others 2022). Other IMF work explores technology underpinnings and regulatory implications.

### Key definitional points from this note
- FSB definition: crypto assets are a type of digital asset that depends primarily on cryptography and DLT or similar technology; unbacked crypto assets are crypto assets that are neither tokenized traditional assets nor stablecoins.
- DLT is used broadly as technological solutions enabling a single, sequenced, standardized, and cryptographically secured record of activity distributed to a network of participants.
- Unbacked crypto assets are not considered money because they do not fulfill the three common functions of money and tend to have high price volatility, making them poor unit of account and store of value.
- Retail and leveraged trading features:
  - Leveraged trading is offered in both centralized and decentralized exchanges as high as 125 times the initial investment.
  - End users are more likely to hold crypto assets as speculative investments rather than use them as payments; even where crypto assets are legal tender, use as payment or remittance remains very small.

### Taxonomy and scope
- No internationally agreed taxonomy exists; this note uses four broad categories adopted by many regulators:
  - Unbacked crypto assets: transferable, primarily designed for medium of exchange; most are used for speculation. Prominent examples include Bitcoin and Ether (jurisdictional classification may vary).
  - Utility tokens: provide holders access to a product or service, usually limited to a single or closed network.
  - Security tokens: tokens that provide holders rights like traditional securities (definitions vary by jurisdiction).
  - Stablecoins: aim to have a stable price value by linking to a single asset or basket of assets (fiat funds, commodities such as gold, or other crypto assets). Prominent examples include Tether, Binance USD, and USD Coin.
- Scope exclusions: this note focuses on unbacked crypto assets and does not cover CBDCs, stablecoins in depth (covered by the companion paper), NFTs, or payment infrastructure issues. Regulatory considerations may nonetheless apply to intermediaries in other ecosystems (for example, wallets in intermediated CBDC models).

### Growth of crypto assets (selected exact figures)
- Market capitalization milestones and volatility:
  - Reached a market capitalization of $1 billion in 2010.
  - Grew to almost $3 trillion in 2021.
  - Fell to around $1 trillion in mid-2022 (note: substantial wash trades may hide the true figure).
- Market composition and breadth:
  - Stablecoins accounted for roughly $150 billion.
  - The market supports more than 10,000 different types of crypto assets.
  - Globally less than 30,000 merchants accept crypto assets as payment.
- Institutional and sector involvement:
  - Exchange-traded funds linked to Bitcoin futures have been introduced in the United States.
  - According to Coinbase and Goldman Sachs, as of Q2 2021:
    - 10 percent of the 100 largest hedge funds were using their platform to invest in crypto assets.
    - 15 percent of family offices have exposures to crypto assets, and close to half of these offices are potentially interested in initiating exposures.
- Correlation and systemic risk observations:
  - IMF (2021) identified a significant increase in correlation between crypto assets and financial assets during periods of market stress.
  - Exposure to crypto assets in the banking system and other nonbank sectors is growing, albeit from a low base.
  - BCBS (2022) noted that “banks’ exposures to crypto assets are currently limited” but also shared the view that growth of crypto assets and related services has the potential to raise financial stability concerns and to increase risks faced by banks.
  - FSB (2022) cautioned that markets could threaten global financial stability because of scale, structural vulnerabilities, and increasing interconnectedness with the traditional financial system.
  - Trading volumes of crypto exchanges operating only in emerging markets and developing economies have increased and are comparable to activity on local stock exchanges and domestic interbank foreign exchange transactions.
  - Retail users in emerging markets and developing economies are more likely to own crypto assets than in advanced economies.

### The crypto ecosystem: risks and regulatory responses (overview)
- The note identifies key entities that perform core functions and may be sources of or vulnerable to risks:
  - Issuers (mint crypto assets)
  - Crypto asset service providers (exchanges offering trading, lending, investment, transfers, custody)
  - Wallet providers (storage and transfers)
  - Validators or miners (maintain ledger integrity)
  - Underlying technology (DLT)
  - Regulated financial institutions (with exposures to crypto assets)
- Many crypto asset service providers carry out multiple activities, potentially making them systemic market infrastructures in the future.

### Issuers: risks and regulatory considerations
- Principal risks from issuance:
  - Issuance is frequently decentralized and issuers are often unknown, complicating traditional regulatory targeting and disclosure expectations.
  - Lack of known issuers results in little information or disclosure on the token, difficulty determining technology, intended purpose, or beneficiaries of token sales.
  - Decentralized public networks can reduce single-point-of-failure risk, but they remain vulnerable to cyberattacks (for example, 51 percent attacks), and centralized components (exchanges, wallets) are susceptible to cyber and operational risks.
  - Centralization can re-emerge via governance bodies concentrated among large token holders with governance rights.
- Common issuance and distribution methods (three popular creation methods; five distribution methods):
  - Creation methods: pre-mining, continuous mining, hybrid approach.
  - Distribution methods: pre-token sale, initial coin offering or token sale, mining, airdrops, forks.
  - Specific risks:
    - Pre-mining can create consumer risks and facilitate price manipulation via “pump-and-dump” schemes.
    - Initial coin offerings have been controversial, though their level has substantially decreased in recent years.
- Information asymmetry and marketing risks:
  - White papers and marketing materials often lack clarity or contain incomplete/inaccurate information; marketing frequently overstates benefits and understates risks.
  - Digital channels for marketing often proceed with little oversight or approval requirements.
- Regulatory levers and measures authorities could consider when targeting issuance:
  - Publication of white papers:
    - White papers should provide clear, accurate, and understandable explanations of the crypto asset, including key personnel, governance arrangements, the DLT design, rights conferred by the token, intended purpose, issuance method, associated risks, complaints procedures, and information about the issuing team.
  - Notification:
    - Authorities may require notification of white papers, or registration/licensing, to better understand local market size and new products. Proportionality should be considered for small or restricted offerings or NFTs.
  - Suitability tests:
    - Where crypto assets are offered directly to end users, issuers may be required to ascertain user suitability, including consideration of retail appropriateness, user risk appetite, education, and loss-absorption capacity.
  - Fair and accurate marketing:
    - Marketing should reflect white paper information, be communicated in user-understandable ways, and make clear whether products have local regulatory protections.
    - Some jurisdictions require marketing approval by regulators or local regulated entities; others have banned unregulated firms from marketing domestically (noting enforcement challenges).
  - Consumer education:
    - As per the BFA, financial and technology literacy programs (education at different levels, tailored communication, outreach) are foundational.
    - Some regulators are carrying out consumer analysis to determine crypto literacy levels to design appropriate responses.

*Source: ftnea2022007 - Introduction (IMF Fintech Note).*

### Box 1. Regulating Crypto Asset Promotions

### Box 1. Regulating Crypto Asset Promotions

### Crypto asset promotions: jurisdictional approaches and evidence
- United Kingdom
  - The UK Crypto Assets Taskforce (HM Treasury, Bank of England, FCA) found misleading advertising and lack of suitable information were key consumer protection issues in crypto asset markets.
  - FCA consumer research found that "31 percent" of crypto asset holders that saw an advertisement were encouraged to buy as a result.
  - In January 2022, the UK Treasury proposed bringing crypto assets within its Financial Promotions Regime so the promotion of qualifying crypto assets will be subject to FCA rules aligned with other financial promotions (stocks, shares, insurance).
  - Key regulated activities referenced: dealing in securities and contractually based investments, arranging deals in investments, managing investments, advising on investments, and agreeing to conduct specified kinds of activities.
- Singapore
  - In January 2022, the Monetary Authority of Singapore published guidelines restricting marketing of crypto assets in public transport, broadcast media, third-party websites, social media platforms (including "influencers"), public events, road shows.
  - Crypto ATMs are considered a form of crypto asset marketing.
  - Marketing is effectively limited to an entity’s own corporate website, official social media accounts, and mobile applications, and must not be "trivialized."
- Spain
  - In January 2022, the National Securities Market Commission issued a circular setting new rules for crypto asset marketing for mass marketing, including presence of risk warnings and requiring promotions to be "clear, balanced, and fair."

### Crypto asset exchanges: structure, risks, and historical incidents
- Structural characteristics and differences from securities exchanges
  - Many large exchanges are centralized intermediaries introducing counterparty trust and single points of failure.
  - Typical differences: direct retail access; trading off their own inventory and providing liquidity; providing custody services via wallets enabling quicker off-chain settlement.
  - Off-chain settlement bypasses blockchain security features and exposes users to credit and counterparty risk of the service provider.
- Operational, cyber, and market integrity risks
  - Large, well-known firms have been hacked; notable incidents cited:
    - BitMart attack in December 2021 with hackers stealing "$200 million" of crypto assets (largely SafeMoon).
    - LCX hot wallet attack in January 2022 with losses of "approximately $7 million" of crypto assets across eight tokens.
  - During market downturns (2018 and 2022), many users could not access assets to exit positions because of operational failures or exchange-imposed transaction blocks.
  - Some mitigation measures: cyber insurance, cold wallets, separate compensation funds; however, insurance terms can deliver little or no benefit in some policies.
  - Market-structure issues: weak price discovery, susceptibility to market manipulation (wash trades, pump-and-dump, whale trades), and concentration where exchanges are large holders and may influence Proof-of-Stake networks.
  - Cross-border and unbacked-asset listing practices mean many exchanges can avoid conduct or prudential regulation; regulation often falls short of substantive frameworks.
- Quantified and anecdotal risk markers
  - Cross-chain bridges: referenced thefts with "$2 billion" worth of crypto assets stolen from cross-chain bridges (as a topical figure associated with bridge vulnerability).

### Regulatory framework considerations for crypto asset platforms (IOSCO-based and additional elements)
- Governance and prudential requirements
  - Fit and proper senior management and control functions; resource adequacy; capital requirements should consider whether operator functions bilaterally (counterparty risk) or multilaterally (matching).
- Access controls
  - Controls over who may access and use platform; special consideration where platforms allow direct retail access.
- Robustness, resiliency, and integrity of operating systems
  - Adequate processes and controls to mitigate cyberattacks and theft; effective incident detection and response.
- Market integrity requirements
  - Market abuse rules and surveillance mechanisms to counter manipulation given high volatility, conflicts of interest, concentration, and low disclosure.
- Transparency requirements
  - Pre- and post-trade information availability, dissemination methods, aggregation across platforms, and publication of platform rules, order processing, and error/cancellation handling.
- AML/CFT requirements
  - Compliance with FATF standards; monitoring can be in-house or delegated, but regulatory risk should reside with the service provider.
- Product listing and disclosure expectations
  - Clear requirements or criteria for asset acceptance for trading; expectations on availability of information and disclosure of risks, especially for retail-access platforms.
- Conflicts of interest
  - Disclosure and governance where exchanges offer multiple services (issuance, exchange, lending, storage); consideration of functional or legal separation of exchange and custody services.
- Greater prudential requirements for off-chain transactions
  - When exchanges conduct significant off-chain transactions (acting for clearing/settlement), end users face higher cyber, loss-of-fund, and single-point-of-failure risks; such exchanges may warrant greater prudential requirements and application of Principles for Financial Markets Infrastructures if systemic.

### Wallet providers: custody models, risks, and regulatory elements
- Custody models and security implications
  - Ownership depends on private keys; loss of keys renders crypto assets unrecoverable.
  - Custody can be self-managed or delegated to third-party wallet providers (often exchanges or nonexchange providers); third-party custody reintroduces centralization and increases cyber and blocking risks.
  - Wallet types: "hot" (online) and "cold" (offline); cold wallets become hot when connected and vice versa; practical differences minimal.
- Risk profiles
  - Hot wallets: hacking risk, attractive targets when custodial (many customers’ keys stored); operational reliance on third-party systems.
  - Cold wallets: higher risk of physical loss or damage; cyber risk eliminated while offline but resurfaces when reconnected.
  - Commingling risk on provider bankruptcy unless clear legal/regulatory separation exists.
- Wallet security and key management
  - Wallet security requirements should align with cryptography best practices and focus on key protection and lifecycle management; requirements should be principles-based and proportionate to security risks.
- Regulatory elements authorities commonly consider for wallet providers
  - Segregation and safekeeping of holdings: separation of client holdings from provider assets; restrictions on reuse/lending without consent; distinct wallet addresses; possible bank accounts for fiat.
  - Operational and cyber resilience: robust cybersecurity frameworks; effective incident management and timely reporting; wallet providers remain responsible for incidents by third parties with clear outsourcing rules.
  - Recordkeeping: ensure administration is secure, resilient, timely, accurate; ability to share holdings information with users; interaction with rules requiring centralized record keeping (e.g., Central Securities Depositories Regulation).
  - AML/CFT: compliance with FATF standards; monitoring may be in-house or delegated but regulatory risk remains with the wallet service provider.
  - Reporting and prudential regulation: proportionate but possibly including risk management, protection of client assets, minimum capital and liquidity (especially if wallet provider reuses customer assets).
  - Adequate safeguards: cyber insurance coverage considered; authorities should oversee policy terms given limited coverage in some cases.
  - Wind-down and resolution: segregation of client funds and continuity of critical IT infrastructure; prudential regulation of third-party custodians may mitigate fraud and contagion risk, though deposit-insurance-type protections are less justifiable for unbacked crypto assets.
  - Conflicts of interest: governance to ensure independent decisions on wallet services where providers are part of broader groups; transparency and disclosure of potential conflicts (e.g., connections to exchanges).

### Validators, miners, and technology risks: DLT considerations
- Benefits and differing risk profiles
  - DLT can reduce single points of failure (in permissionless deployments), is often immutable and transparent, and can provide auditability and potential efficiency gains for payments, settlement, and clearing.
  - Risks vary by blockchain type: private/permissioned versus public/permissionless.
- Private/permissioned blockchains
  - Potential for fragmentation, concentration, and financial stability risks through closed ecosystems with limited interoperability and possible "too big to fail" networks.
- Public/permissionless blockchains
  - Resilience to single points of failure but vulnerability to 51 percent attacks, selfish-miner problems, miner-extractable value (depending on consensus).
  - Cross-network interoperability is limited; cross-chain bridges present single points of failure and have been the subject of large thefts.
  - Reliance on centralized hosted nodes or common infrastructure providers (including BigTech services) can reintroduce centralization risks.
- Technology-neutral regulation caveat
  - Global bodies favor technology-neutral approaches ("same activity, same risk, same regulation"), but certain consensus mechanisms may conflict with policy objectives (e.g., proof-of-work energy use).
  - Transition to proof-of-stake improves energy efficiency and scalability but may concentrate decision-making power in exchanges and wallet providers, increasing market-integrity risks.
  - Private consensus can centralize ecosystems and create data privacy/protection concerns.
- Points of vulnerability to be considered by authorities
  - Cross-chain bridges and centralization dependencies are highlighted as specific technology risks requiring regulatory consideration.

*International Monetary Fund*

### Box 2. Critical Service Providers

### Box 2. Critical Service Providers

### Centralization points and operational risks
- Some elements of the crypto ecosystem provide services that are critical to the ongoing operation of networks despite marketing as decentralized.
- Important points of centralization include:
  - "a third of hosted nodes on the Ethereum Network are hosted on Amazon Web Services,46"
  - "60 percent of all Bitcoin traffic runs through three internet service providers"
  - "Tor routes traffic for roughly half of Bitcoin nodes.47"
  - Cross-chain bridges (transfer representations of crypto assets between networks) and oracles (connect decentralized algorithms to off-chain data) are growing sources of centralization driven by decentralized finance.
- Malicious actions, operational failures, or refusal to offer service at these points of centralization could generate significant risks for the smooth operation of blockchain networks.

### Policy implications and regulatory scope
- Risks from critical service providers extend beyond financial regulation and may require intervention by:
  - Governments
  - Competition authorities
  - Sector regulators such as telecommunications authorities
- Financial authorities should consider regulatory responses where appropriate and make clear regulatory expectations on operations by crypto-critical service providers to align with applicable international standards.
- Expectation: operational resilience of a crypto-critical service provider should be held to the same standards as if provided by a financial market infrastructure’s critical service provider or a third-party critical service provider.

### Minimum expectations and operational resilience (alignment with international standards)
- In line with the PFMI (Annex F on oversight expectations applicable to critical service providers) and Basel Committee principles for operational resilience and operational risk management, expectations on critical service providers should cover:
  - (1) risk identification and management
  - (2) confidentiality and integrity of information and availability of provided critical services
  - (3) reliability and resilience of critical services
  - (4) effective technology planning
  - (5) transparent communications with users
- Management of exposure to critical third-party and subcontractor service providers should include:
  - operational risk management frameworks
  - clear roles and responsibilities for operational risk management and communication lines with the critical service provider
  - comprehensive information security policies
  - tested business continuity plans
  - reliable exit strategies
  - tested procedures for managing operational disruptions and incidents, including substitutability of service providers.48

### Regulated financial institutions: exposures and prudential treatment
- The BCBS issued a second consultative document on prudential treatment of banks’ exposures to crypto assets (BCBS 2022) aiming to standardize treatment and reflect high risk of some crypto assets while taking a more proportional, technology-neutral approach to those anchored on real-world assets.
- BCBS proposed categorization:
  - lower-risk anchored crypto assets (distinguished between tokenized assets and stablecoins)
  - higher-risk "traditional" crypto assets like Bitcoin (which include unbacked crypto assets)
- Proposed prudential measures:
  - Credit and market risk capital requirements for tokenized assets similar to those for traditional assets
  - For stablecoins, possible lower risk weight based on certain conditions
  - For traditional crypto assets (including unbacked crypto assets): a conservative prudential treatment based on a 1,250 percent risk weight applied to maximum long and short positions
- Supervisory considerations:
  - High volatility of unbacked crypto assets warrants conservative treatment on direct exposures; indirect exposures should also be monitored.
  - Data suggest direct exposure remains limited for banks in number and size of exposures (Auer and others 2022).
  - Prudentially regulated financial institutions likely need conservative approaches (capital deductions or high-risk weights) for internal risk and capital management.
  - Robust segregation and separation between traditional and crypto business are desirable, with group-wide and step-in risk considered even when crypto businesses are in a separate entity.
  - Monitor indirect exposures such as loans to crypto users, derivative exposures with crypto-asset exchanges, and cyber insurance to wallet providers, since these can be strongly correlated with market movements.
- Other institutions:
  - Broker dealers, asset managers, and insurers need careful risk management as they expand crypto-related services (e.g., broker dealers offering unbacked crypto services; asset managers providing crypto-linked products; insurers increasing exposure in search for yield).
  - Authorities should enhance communication with and monitoring of financial institutions to encourage prudent business decisions and enhanced risk management.

### Multiple functions, market infrastructure roles, and systemic designation
- Increasing off-chain transactions mean centralized entities may take on roles similar to financial market infrastructures (FMIs) despite crypto’s original design for decentralized clearing and settlement.
- Features of crypto asset service providers:
  - More likely to provide multiple services globally within a single entity (exchange, custody, clearing, settlement, lending, payments)
  - Rapid off-chain clearing and settlement can result in single entities delivering exchange and custodian functions and additional services
  - Large crypto exchanges can operate globally without subsidiaries or branches in each jurisdiction
- Regulatory and oversight gaps may remain:
  - Some jurisdictions could consider designating certain crypto asset service providers as FMIs (although unlikely for unbacked crypto assets)
  - Differences versus traditional FMIs:
    - Traditional FMIs carry out critical non-substitutable services; crypto users might replace one exchange with another or use on-chain transactions
    - Off-chain transactions might be "closed loops" that do not trigger FMI oversight
  - Appropriately addressing oversight of critical service providers is an important issue
- Where crypto asset service providers carry out multiple activities or offer clearing and settlement services, greater prudential requirements are necessary:
  - Regulators may establish expectations for infrastructure-like services to support safety and efficiency, including greater prudential requirements across entities reflecting increased risks from additional activities
  - Crypto asset service providers can concentrate risk and, if not properly managed, contribute to financial system disruption
  - Where activities constitute important infrastructure for financial markets or generate risks to broader financial stability, domestic regulators might determine entities are systemically important and subject them to the PFMIs
- Designation of systemic importance is at authorities’ discretion; factors can include:
  - size of arrangement in terms of number of users and value or volume of transactions
  - nature and risk profile of activities
  - interconnectedness and interdependencies with the real economy and financial system
  - availability of alternatives to using the arrangement as a means of payment or settlement for time-critical services49,50
- Identification and designation can be complex and should be viewed holistically by domestic regulators; it is unlikely most crypto asset service providers will reach systemic levels in most jurisdictions.

### Cross-border challenges and the need for a global regulatory framework
- Cross-border nature of crypto assets complicates regulation, supervision, and enforcement:
  - Many service providers operate from offshore jurisdictions while serving users globally
  - Without a common global approach, entities may relocate to regulation- or tax-friendly jurisdictions and continue offering services elsewhere
  - Use of crypto assets in unregulated exchanges could facilitate circumvention of capital flow management measures
  - Most authorities lack resources or mandate for cross-border enforcement; regulatory actions may take longer to be effective across borders
- Global framework objectives:
  - Provide a level playing field along the activity and risk spectrum
  - Ensure key entities providing critical functions in the crypto asset value chain are authorized and licensed
  - Build requirements around actual economic functions of crypto assets in addition to technical design and aims
  - Clearly articulate requirements on regulated financial institutions concerning their exposure to crypto assets
- In absence of a global framework, national approaches to manage risks may provide a sensible alternative.51,52,53

*Source: Box 2. Critical Service Providers, ftnea2022007*

### Box 3. Approaches to Unbacked Crypto Asset Regulation

### Box 3. Approaches to Unbacked Crypto Asset Regulation

### Jurisdictional approaches and key regulatory measures
- European Union (MiCA)
  - MiCA forms part of the European Union’s digital finance strategy and encompasses a broad array of crypto assets.
  - Focus on stablecoins; for other crypto assets, MiCA requires onshoring of issuing entities and a notification regime for white papers and marketing.
  - Proposed onshoring and licensing for key entities delivering critical functions such as exchanges and wallet providers.
- Japan
  - April 2017: Payment Service Act amended; bespoke regulation for crypto asset service providers introduced.
  - Main requirements: clients’ asset segregation, operational risk and cyber security management, Know-Your-Customer, internal audits, and minimum capital requirement.
  - May 2019: amendment expanded crypto regulation to other entities (wallet service providers), enhanced exchange requirements, including limitation (up to 200 percent) of the leverage provided to retail customers; clarified application of existing securities laws to security tokens.
  - June 2020: Payment Service Act further amended to introduce stablecoin regulations.
- Switzerland
  - February 2018: FINMA issued ICO guidelines; introduced token categories—payment tokens, utility tokens, and asset tokens.
  - FINMA clarified that tradable tokens at prefinancing and presale stages are generally asset tokens and could be treated as securities.
  - June 2018: Financial Services Act harmonized prospectus requirements across all securities (including asset tokens).
  - February 2021: DLT amendments to civil and financial market laws enabled ledger-based securities on a blockchain and provided rules for segregation of crypto assets in custodian bankruptcy.
- United Kingdom
  - July 2019: FCA “Final Guidance on Cryptoassets”: security tokens inside regulatory purview; utility and “exchange tokens” (unbacked crypto assets) outside prudential and conduct regime.
  - Significant consumer research undertaken by FCA since 2019.
  - April 2022: UK Treasury roadmap for crypto asset regulation—focus on stablecoins; proposed sandbox regime for blockchain-based FMIs and longer-term aim to extend regulatory perimeter to cover crypto assets like Bitcoin.
  - January 2022: UK Treasury proposed bringing crypto assets within its Financial Promotions Regime.
- Albania
  - May 2020: Law no. 66/2020 on “DLT-based Financial Markets” legalized crypto assets for investment purposes (the “Fintoken Act”).
  - Regulates issuance of “Digital Tokens” and “Virtual Currencies” and licensing, monitoring, and supervision of distribution, trading, and custody entities.
  - Competent authorities: Albanian Financial Supervisory Authority (AFSA), National Agency for Information Society (NAIS); Bank of Albania for stablecoins.
  - Licensing process relies heavily on third-party agents licensed as Digital Token Agents (AFSA) and Innovative Service Providers (NAIS).
- Nigeria
  - February 2018: Central Bank of Nigeria (CBN) stated crypto assets are not legal tender.
  - February 2021: CBN wrote to regulated financial institutions that dealing in crypto assets and facilitating payments for crypto asset service providers was a prohibited activity.
  - May 2022: Securities and Exchange Commission published “New Rules on Issuance, Offering Platforms and Custody of Digital Assets,” placing “digital asset offerings” within SEC purview and imposing requirements on “digital asset offering platforms” and “digital asset offering custodians.”

### Effectiveness of broad bans versus targeted restrictions
- Broad findings
  - Broad bans on crypto assets are likely to be ineffective in the long run and likely to stifle useful innovation unless globally agreed upon.
  - Enforcement of bans is challenging because many crypto asset service providers operate offshore and users can use VPNs to obscure location.
- Empirical examples and figures
  - Despite strict domestic restrictions, roughly 2 million Egyptians reportedly hold crypto assets.
  - Peer-to-peer transactions in crypto assets have grown in Nigeria despite tight restrictions.
  - Data suggest significant mining operations exist in China despite a blanket ban.
- Policy implications
  - Targeted restrictions can address immediate challenges while regulatory capacity is being built.
  - Examples of targeted approaches: restricting derivatives linked to crypto assets (Japan, United Kingdom) or restricting use of crypto assets for payments while allowing buy/sell.
  - Administrative restrictions should be embedded in legislation, unauthorized operators proactively identified and sanctioned, and criminal law frameworks enabled for crypto-related criminal activity.

### Considerations for regulatory frameworks across crypto assets
- Guiding principles
  - Authorities should take a proactive, holistic, and evidence-based approach to regulation.
  - Relevant Bali Fintech Agenda (BFA) elements: V (monitor developments closely), VI (adapt regulatory framework and supervisory practices), and X (develop robust financial and data infrastructure).
  - Sound legal framework and legal certainty (nature and extent of holders’ rights) are preconditions for strong regulation.
- Sequenced steps for national frameworks
  - Monitor developments to gauge market size and identify risks (noting data limitations).
  - Consider risks of unbacked crypto assets as part of broader regulatory and supervisory duties and resource implications.
  - Determine clear regulatory scope: which entities, crypto assets, and activities fall within scope.
  - Collaborative regulatory development across financial sector regulators and government departments; consider guidance from standard-setting bodies and peer approaches.
  - Continuous assessment to identify shifting risks and business models; dependent on availability and accuracy of data.

### Monitoring, prioritization, and scope
- Monitoring
  - Obtain information through business-as-usual supervision, horizon scanning (innovation offices), supervisory technology (e.g., web scraping), outreach, and consumer/market surveys.
  - Information should cover types of crypto asset service providers and issuers; decentralized issuance and offshore providers complicate issuer-focused regulation.
- Prioritization
  - Regulators with limited resources may adopt an active “wait and see” approach while monitoring developments.
  - Developing regulation can legitimize markets and spur growth—regulators should consider feasibility given resource constraints.
- Scope
  - Regulatory scope should focus on critical economic functions of the crypto ecosystem.
  - Unbacked crypto assets and certain stablecoins often function as speculative investments, access points to other crypto assets, and (for some stablecoins) stores of value—these may warrant priority.
  - Centralized entities (wallets, exchanges, banks, brokers, dealers) that support critical functions merit greater oversight.
  - NFTs and some utility tokens are often niche with unclear use cases and lower near-term systemic risk.

### Domestic coordination and supervisory responsibilities
- Domestic collaboration
  - Coordination among financial authorities is important to achieve mandates (consumer protection, micro- and macroprudential).
  - Regulatory frameworks should be coordinated across authorities to allocate responsibilities clearly.
  - Allocation should consider potential for regulatory arbitrage, scarce expertise, existing laws, and reputational risks.
  - Cross-sector coordination and industry dialogue help anticipate risks and formulate responses.
- Supervisory objective
  - Primary objective: promote safety and soundness of the financial system; broader responsibilities should be subordinate to this objective.
  - Jurisdictions may differ in risk tolerance (financial stability focus vs. innovation/financial inclusion).

### Continuous assessment of risks and technology considerations
- Technology neutrality and limits
  - Technology neutrality is conceptually appealing but in practice may require different regulatory stances based on technology-specific risks.
  - Novel technologies (DLT) can change risk profiles of traditional assets (fractionalization, decentralization, liquidity); may require bespoke approaches.
- Understanding DLT networks
  - Upskilling staff or hiring DLT experts helps determine underlying technologies and risks.
  - Frontline supervisors need to understand differences across blockchain networks (trade-offs like security vs. speed vs. transparency).
  - Key risks to assess: high energy consumption, network failure (malicious or technological), operational risks, financial integrity risks, risks to financial stability.
- Geographic location challenges
  - Determining geographic location of crypto assets and activities is challenging; international action and cooperation are key.
  - Domestic frameworks must consider cross-border accessibility to minimize regulatory arbitrage.
  - International cooperation in enforcement and information sharing (e.g., supervisory colleges, MMoUs) is critical.

### Data availability, taxonomy, and tools for supervision
- Data limitations
  - Crypto asset data are often unreliable, incomplete, fragmented across borders, and lack common taxonomy; reporting and disclosure largely voluntary.
  - On-chain transparency is limited to recorded transactions; off-chain transactions (centralized exchanges, wallets, second-layer solutions) reduce traceability.
  - Use of VPNs and limited issuer information on user profiles and locations complicate geolocation and market sizing.
- Value of improved data
  - More accurate, granular, and standardized data help gauge domestic market size (volume of transactions, number and location of customers and service providers, number of domestic issuers and service providers), consumer behavior (type of consumer, size of retail holdings), and market composition.
  - A common taxonomy supports coherent global regulatory approaches and more reliable data collection.
- Approaches to enhance data collection and analysis
  - Strong home-host data sharing and extended regulatory coverage can improve cross-border data consistency.
  - Authorities are beginning to work with blockchain analytics firms to map flow of funds—useful but limited by off-chain activity and VPN use.
  - Embedded supervision concepts could allow authorities direct interaction with distributed networks for real-time monitoring; high initial investment and resource requirements limit applicability.
  - Privacy-enhancing techniques (zero-knowledge proofs, homomorphic encryption) could support cross-border data sharing while protecting user privacy and complying with data protection laws.

*International Monetary Fund — FINTECH NOTES: Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets (Box 3)*

### Conclusions

### Conclusions

### Building a regulatory framework
- Developing a robust and comprehensive regulatory framework for this quickly evolving industry will involve intense monitoring, a flexible approach, and domestic and global collaboration.
- The global regulatory framework should provide a level playing field along the activity and risk spectrum.
- Regulators need to continuously monitor the crypto asset landscape to understand the direction of industry developments; ongoing efforts to address data gaps to monitor markets and potential contagion effects to the existing financial sector are welcome.
- Regulation should be seen as building trust rather than stifling innovation; clear guidelines can remove uncertainty and foster confidence.
- Defining a clear scope is important; the immediate focus should be on key entities that carry out core functions such as exchanges, wallet providers, and other centralized entities.

### Licensing, supervision, and prudential approaches
- For crypto assets, key centralized entities that carry out core functions should be licensed and authorized.
- Regulatory approaches should focus on key components and their functions to ensure those entities are licensed and authorized.
- Authorities should consider any unique risks—from the underlying technology to volatility, market awareness, product knowledge and understanding, and how the crypto assets are used.
- A technology-neutral approach may be appropriate, but supervisory approaches should consider the unique risks of different methods of delivery and operation, and authorities should be confident in identifying where particular types of technologies might challenge (or support) their objectives.
- Regulators may need to consider cross-sectoral issues that require bespoke responses.
- Where entities carry out multiple activities, appropriate prudential requirements coupled with entity-based regulation and supervision will be needed to manage these additional risks.
- Where these entities are considered systemic, drawing guidance from the PFMI could be appropriate.

### Systemic crypto-assets and macroeconomic policy responses
- In jurisdictions where crypto assets are systemic, immediate action may need to be taken, including strengthening macroeconomic policies; broad-based restrictions are unlikely to be a long-term solution.
- In the short term, in certain emerging markets and developing economies where crypto assets might already generate risks to financial stability, authorities should use existing regulatory powers to manage risks while more comprehensive standards are developed at the global level.
- In jurisdictions where residents use crypto assets (in particular, dollar-denominated stablecoins) to hedge against inflation or currency devaluation risk, implementing stronger domestic macroeconomic policies may help dampen incentives, including:
  - strengthening monetary policy credibility;
  - ensuring central banks have independence from political and industry influence;
  - ensuring traditional financial institutions are held accountable for their failings;
  - maintaining a sound fiscal position.
- Restricting the use of crypto assets for certain activities—such as restricting derivatives linked to, or payments in, crypto assets—could be a short-term solution to dampen crypto asset growth.
- Broader prohibitions on the creation and use of crypto assets are likely to inhibit innovation and be ineffective given ease of cross-border access; prohibitions could also trigger stronger incentives for regulatory arbitrage and circumvention, rendering enforcement extremely difficult.

### Cross-border and cross-sector coordination; international standards
- The cross-sector and cross-border dimensions of crypto assets make domestic and international coordination and cooperation key.
- Activities related to crypto assets are, and will continue to be, more cross-border and cross-sectoral than many traditional financial activities; this requires close international cooperation 63 to address regulatory gaps and prevent regulatory arbitrage.
- Consistent regulatory approaches can prevent the potential risk of a race to the bottom by regulators and policymakers and can address regulatory arbitrage by financial entities.
- Robust international standards are indispensable to ensure effective and efficient cross-sectoral and cross-border cooperation.
- Relevant SSBs are making efforts to develop standards according to their mandates; however, the economic functions of crypto assets are likely to change over time, changing the suitability of sector-specific regulations.
- The FSB should take a leading role in coordinating efforts by the sectoral SSBs.
- Home authorities where crypto asset service providers are domiciled need to coordinate with other relevant authorities where the users of the crypto assets are located.
- IMF staff are actively contributing to the SSBs’ activities to facilitate the development and implementation of robust international standards to ensure consumer protection, market integrity, and financial stability.

- Footnote: Although data, privacy, and tax issues are outside the scope of this note, it is important to address those issues in regard to cross-border and cross-agency cooperation. (63)

*Conclusions — Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets*

---


_Source: https://www.imf.org/-/media/files/publications/ftn063/2022/english/ftnea2022007.pdf_