FCA Consults on Stablecoin & Custody Rules... Confusion Looms On E-money

The FCA has been preparing to regulate 'stablecoins' for a lot longer than other types of cryptoasset, and is currently consulting on the detailed rules for issuance/offer of qualifying stablecoins, the holding and management of the backing assets, and key information that issuers will need to disclose.plan to consult separately on proposals for managing cryptoasset firm failure, including qualifying stablecoin issuers. This (evolving) post is a summary for information purposes. If you would like legal advice on the potential issues and impact, please let me know.

Terminology

"Qualifying Stablecoin" is defined in a new section 88G of the FSMA (Regulated Activities) Order (RAO) as:

a 'qualifying cryptoasset' [see s88F RAO - this excludes a cryptoasset that is already a specified investment of some kind, e-money, a fiat currency, a central bank digital currency or used in a limited network (similar to the exclusion from e-money/payment services] that: 

(a) references a fiat currency; and 

(b) seeks or purports to maintain a stable value in relation to that referenced fiat currency by the issuer holding, or arranging for the holding of: 

(i) fiat currency; or 

(ii) fiat currency and other assets, 

irrespective of whether the holding of a fiat currency other than the one referred to in sub-paragraph (a) or other asset contributes to the maintenance of that stable value. 

However, this will not include a tokenised bank deposit (we'll discuss the concept of 'tokenised e-money' below].

"Issuing" a qualifying stablecoin in the UK involves the issuer only accepting (a) money; or (b) other qualifying stablecoins issued by FCA-authorised firms, in exchange for qualifying stablecoins they issue. Where issued in exchange for money, it follows that the stablecoin they might also qualify as e-money; and this is pretty much how the FCA is treating them, albeit as a distinct form. Unlike [other] e-money, qualifying stablecoins form a subset of qualifying cryptoassets; have a secondary market value [so does e-money, where it turns out too little cash is safeguarded], and the issuer can mint tokens before receipt of funds from token holders [like prepaid/smart cards?]. The FCA proposes to consult on guidance further clarifying the differences once legislation is passed.

"Creating" includes the technical design of a qualifying stablecoin on any form of DLT, including on private, public, permissioned or permissionless blockchains. Issuers must identify and manage the risks associated with 'creation' (the design and build of a qualifying stablecoin) before it is issued. This includes analysing the risks of the underlying DLT and making sure they can manage potential disruptions

"Minting" a qualifying stablecoin such that it first exists as an identifiable asset on the blockchain in a transferrable form - an issuer must always hold backing assets in amounts equivalent to the value of the stablecoins that have been minted (1:1 in a single fiat currency, regardless of how the backing assets might perform in the markets for those types of assets). The jury is out on whether multi-currency stablecoins will be permitted, as they introduce FX and liquidity risks and the fact that 'par' would be judged against a basket of currencies, yet redemption could only be in one, thereby crysalising losses/gains. 

"Burning" or permanently removing the stablecoin from circulation (on the blockchain). 

Backing Assets 

Only certain asset classes can be used to 'back' a stablecoin, including on demand deposits; and government treasury debt instruments that mature in one year or less. This is because the composition of the 'backing asset pool' must be able to meet requirements for redemption at all times and ensure that the qualifying stablecoin maintains stability.minimum ‘floor’, known as the on-demand deposit requirement (ODDR), for the proportion of backing assets that must be held in bank deposits that are available on-demand. The ODDR is set at 5% and will apply to all stablecoin issuers - both those who only use core backing assets and those who opt-up to use expanded backing assets (who would also need an appropriate backing asset risk management tools and comply with the backing assets composition ratio (BACR) that has a core requirement (CBAR) and an estimated 'daily redemption amount (DRA) for each of the up-coming 14 redemption days, by reference to the experience over the prior 180 redemption-day period, with increases in the CBAR for each redemption day where the actual DRA is at least 110% of the forecast DRA. The intention is that core backing assets should be sufficiently liquid to meet redemptions within the T+1 timeframe. Accordingly, in this context, short term deposits must be repayable on demand or have an immediate break clause attached to them. Issuers should ensure that they manage the portion of government debt instruments used to meet the BACR in a way that meets their redemption obligations.

However, with permission and additional controls, public debt of a longer residual maturity; assets, rights or money held as a counterparty to a repurchase agreements or reverse repurchase agreements; and some limited money market funds might qualify as backing assets.firms to determine their own compositions, based on factors including the redemption modelling they undertake on an ongoing basis. An appropriate backing asset composition will be driven in part by the maturity and liquidity of the underlying assets. This will be set against the requirement for firms to place a payment order for redeemed funds by the end of the business day following receipt of a valid redemption request

Statutory Trust Over Backing Assets

The FCA is still proposing a statutory trust over backing assets held by the issuer as trustee for the benefit of stablecoin holders as beneficiaries, so there would be a fiduciary duty between the issuer and stablecoin holders. This seems more consistent with a stablecoin being an investment instrument, rather than money-like, even though some rules are intended to redress this. It must also mean that the beneficiaries hold both a stablecoin and a beneficial interest in backing assets to the same value as that stablecoin - which surely adds up to two in economic/accounting terms?

The issuer must appoint an independent third party (not a group company), to safeguard the backing assets, which must be promptly segregated on receipt; and the third party must acknowledge in writing that safeguarded qualifying stablecoin backing assets are held on trust for the benefit of the stablecoin holders (rather than for the client issuer/trustee). This sounds like good news for the custody industry and expensive. 

If an issuer issues more than one qualifying stablecoin it must ensure that the backing assets for each stablecoin product are held separately and under separate trusts for the benefit of each separate group of stablecoin holders for each corresponding qualifying stablecoin pool.

The issuer retains the obligation to ensure that each set of backing assets are managed appropriately and the qualifying stablecoins are backed 1:1 with the backing assets at all times. 

There must be reconciliations of backing assets at least daily and to ensure shortfalls are topped up and excesses removed, or that qualifying stablecoins are minted or burned to ensure parity is maintained within 1 business day, failing which the issuer must alert the FCA the following business day (though the issuer won't be expected to publish or report the value daily, only monthly...).  This is said to be in order to address the risk that any redemptions while the stablecoin has de-pegged would exacerbate the shortfall (potentially resulting in a 'run' on the issuer); and that issuers (or other investors) could speculate by buying the stablecoins below par and waiting for the issuer to restore parity. The fact that the rules could leave a window of 4 trading days (including a weekend) seems to have escaped the FCA's attention...

The issuer must redeem its qualifying stablecoins to all qualifying stablecoin holders at par, with no minimum redemption amount of stablecoin per redemption request, to an account in the name of the holder by the end of the business day following receipt of the request. Any redemption fee must be 'commensurate' with the operational costs incurred for executing redemption (not costs and losses arising from the sale of assets in the backing asset pool); and must not exceed the value of the stablecoins being redeemed. So the par value is the value of one unit of the reference currency, multiplied by the number of stablecoins being redeemed, irrespective of the value of the backing assets - so the redemption value should not fluctuate in line with the performance of the underlying backing assets (as is the case with a fund).

Issuers can retain interest on backing assets, but cannot pass interest or dividends/benefits on the backing asset pool to qualifying stablecoin holders (directly or indirectly), further distinguishing qualifying stablecoins from funds or other investment products. 

The draft RAO distinguishes 'issuing a qualifying stablecoin' from the operation or management of a Collective Investment Scheme (CIS) or Alternative Investment Fund (AIF), of which Money Market Funds are a subset, but the FCA foresees the need to consult on the differences in due course... 

Stablecoins, E-money, Tokenised E-money and E-money Tokens

The FCA has always tried to adopt a technologically neutral and 'same risk, same regulatory outcome' approach to regulation. So crypto-tokens issued 1:1 in relation to the value of a single currency on receipt of funds and accepted as a means of payment by third parties have been treated as 'e-money tokens' and therefore e-money, such that the issuer would need to be authorised as an e-money institution under the E-money Regulations (EMRs). A reminder that e-money is defined as:

...electronically (including magnetically) stored monetary value as represented by a claim on the electronic money issuer which— 

(a) is issued on receipt of funds for the purpose of making payment transactions; 

(b) is accepted by a person other than the electronic money issuer; and 

(c) is not excluded by regulation 3 [limited network, low value telecoms billing for certain things];

This remains baked into the proposed changes to the RAO, since to be a 'qualifying stablecoin', a cryptoasset must also be a 'qualifying cryptoasset', which excludes e-money.

This is also reflected in the EU's Markets in Cryptoasset Regulations (MiCAR). In a recent opinion to delineate MiCAR and the Payment Services Directive (PSD2), the European Banking Authority has confirmed that a cryptoasset which aims to stabilise its value by referencing only one official currency is an "e-money token" (EMT); and Article 48(2) of MiCAR deems EMTs to be e-money, and therefore within the definition of ‘funds’ in Article 4(25) of PSD2. Article 70(4) of MiCAR then provides that cryptoasset service providers (CASPs) who provide PSD2 payment services related to their crypto-asset services, may either do it themselves or partner with a PSD2 firm, so long as either is authorised to provide the payment services. In addition, a custodial wallet that is held in the name of one or more clients and allows the client(s) to send and receive EMTs to and from third parties is a 'payment account' within the scope of PSD2. So, the following activities involving e-money tokens (EMTs) are also to be regarded as 'payment services' under PSD2: 

• the transfer of cryptoassets as a payment service, where they entail EMTs and are carried out by the entities on behalf of their clients; 

•  the custody and administration of EMTs.

However, the UK seems to have diverged from this now in relation to qualifying stablecoins that "seek or purport to maintain their value by reference to a single fiat currency" (which I'll call 'single currency stablecoins'). The FCA seeks to explain this on the basis that such single currency 'qualifying stablecoins' are somehow different from e-money because they "have a secondary market value... the issuer can mint tokens before receipt of funds from token holders...and [due to] their use case in cryptoasset trading." This fails to acknowledge that the criteria for stored value to qualify as e-money were ordained by regulation that does not really negate such characteristics: recently, the FCA itself revealed that, in their experience of e-money institution insolvencies, only about 20% of funds corresponding to e-money balances are safeguarded, implying that UK e-money may have decoupled from sterling (just as stablecoins can). In addition, in order to reflect the custom that customers' payment accounts are credited instantly with e-money they purchase online or over the counter, the trigger point for the "receipt of funds" by e-money institutions has been inferred by the FCA as occurring earlier than when the funds themselves actually arrive in the firm's actual bank account: the e-money issuer must merely have become 'entitled to' those funds. And e-money can be used in the course of cryptoasset trading, as the EBA has confirmed.

Yet the FCA has also said that: 

"we intend to regulate [qualifying stablecoins] as money-like instruments rather than as investment products. This means we would expect qualifying stablecoin issuers to offer all holders the right to redeem at par value, and the redemption value should not fluctuate in line with the performance of the underlying backing assets as is the case with a fund. We also propose to prohibit issuers from passing interest on the backing asset pool to qualifying stablecoin holders, further distinguishing qualifying stablecoins from funds or other investment products."

Note that while a qualifying cryptoasset need only "seek or purport to" maintain its value in a reference currency/asset in order to become a 'qualifying stablecoin', the FCA will then also require that the qualifying stablecoin maintain that value.

At any rate, there is now no mention at all of "e-money tokens" in the UK proposals for stablecoins or cryptoassets more widely. While a cryptoasset is not a 'qualifying cryptoasset' (and therefore could not be a qualifying stablecoin) if it is e-money (Art 88F(4), RAO), a new exclusion from the definition of "e-money" will also be added (via Reg 3ZA in the EMRs) to provide that the concept of “stored monetary value” is not to include: 

(a) qualifying stablecoin; 

(b) money or assets held as the backing assets or the stabilisation mechanism for a qualifying stablecoin; 

(c) a cryptoasset comprising or representing a claim for the repayment of a sum of money received by way of deposit, within the scope of article 5 (accepting deposits) [in other words, tokenised bank deposits - which reflects the carve-out of tokenised bank deposits from the definition of a 'qualifying stablecoin in Art 88G RAO].

So, could a cryptoasset ever be considered "e-money" in the UK? Well, by analogy with the definition of a tokenised bank deposit, perhaps a cryptoasset that itself comprises or represents "e-money" could also be considered e-money, so long as 'the stored monetary value' is not itself a 'qualifying stablecoin' (while recalling that a to be a qualifying stablecoin, a cryptoasset must also be a qualifying cryptoasset, which excludes e-money; and around the circle we go...). 

Of course, banks can issue e-money as distinct from 'accepting deposits'.

Not only is all this quite confusing, but having separate UK regulatory regimes for single-currency stablecoins and e-money also increases the jeopardy for getting the classification wrong at the outset (especially when opining on and operating under, say, the limited network exclusion) and addressing their uses and abuses in the market.

Are Pre-minted Tokens 'Qualifying Stablecoins'?

The FCA is concerned about the fact that issuers might "mint qualifying stablecoins" (the crypto-token that is not yet backed) before issuing them to the public and that if these tokens are not 'backed' from the time they are minted, there's a risk of unbacked qualifying stablecoins slipping into the market (as could a qualifying stablecoin that has been redeemed). I guess the simple answer to this risk is that neither a pre-minted (or redeemed) unbacked token is not yet (or any longer) a qualifying stablecoin, because it does not 'seek or purport to maintain' any value. 

Stablecoin Redemptions

The FCA proposes that a redemption must be for money (not other assets); and starts when a holder makes a formal request to redeem; and ends when "a payment order for the redeemed stablecoins has been submitted to the holder's desired [bank or payment] account." These rules will need to be tightened up. Of course, the payment order in this case would be submitted by the issuer to the safeguarding custodian to pay the fiat currency to the holder's account. The issuer does not submit a payment order directly to the holder's account. Equally, 'placing a payment order' begs the question of when the payment order is to be executed. It is possible to place a future-dated payment order...

There would also be exemptions, e.g. where redemption would breach a legal requirement (e.g. AML check, as the stablecoin has been transferred from the original recipient) or court order; or where a currency exchange is required (in which case the issuer should disclose the timing of when such requests can be executed, along with redemption fees that are 'commensurate' with the operational costs incurred (excluding costs/losses from selling backing assets).

Redemptions could be suspended "in exceptional circumstances" where necessary to protect the rights of holders or the integrity of the stablecoin: due to a failure in the underlying blockchain/infrastructure; insolvency of the issuer; or a sudden loss of confidence in the value of the stablecoin (a 'run'). The FCA wants "at least 5 working days' notice" of restarting redemptions, which means the suspension could last at least 6 working days.

Use of Third Parties

An issuer can use third parties to sell or redeem qualifying stablecoins and manage the backing asset pool, on its behalf. In each case, there are requirements to minimise the risk on the third party's failure. It must be clear when a third party is carrying out any issuance activity.

Communications/Disclosure

Issuers must publish the number of stablecoins issued and the backing asset composition at least once every three months (why not daily?); obtain independent verification annually of any statements they've made about the 1:1 ratio in the previous 12 months; along with e.g. technology used, third parties outsourced service providers and the redemption policy/process. 

Custody

Taking custody of a cryptoasset usually means taking control over it by holding or storing the means of accessing it (the private key) on behalf of the customer, but that doesn't mean it holds the customer's private key to the customer's own wallet. Instead, the custodian receives a transfer of the cryptoasset from the customer's wallet to its own wallet to which it has access with its own private key. 

Customers often leave the cryptoasset with the exchange they bought it on, which then also acts as a custodian. 

In a cryptoasset custody arrangement, the stablecoin holder may therefore have both legal and beneficial title, only beneficial title or just a right for the return of the stablecoin.  There is no registration of ownership in some kind of central register, as there is for traditional securities, for example, under Article 40 of the RAO. While there's a record of transactions on the blockchain, that is not a definitive record of ownership. There is some reliance, therefore, on the custodian's records and service terms that might defeat ownership interests or render customers only unsecured creditors of the custodian.

Therefore, custodians will have to segregate client assets from their own and ringfence them from other creditors' claims. This could be done in individual or omnibus wallets. Reconciliation must be done each business day; and the results held independently of other records (with notification to the FCA if this is not possible or there is a shortfall (in which case the client must also be notified). 

The custodian would also have to hold the cryptoassets in a (non-statutory) trust for the clients, as a bare trustee on receipt, recording the name of the client beneficiary in the firm's internal records that state the type of asset, quantity, the address where it is held, the nature of the client's claim to it and the identity of any third party that has capacity/control to effect a transfer. 

Whether such a trust persists in the event that the customer wants the cryptoassets put to a different use in some way (e.g. staking) remains to be consulted upon.

The CASS 7 rules will apply to any cash that is held for clients.

The FCA also wants to avoid the insolvency of crypto custodians altogether, by ensuring they wind-down in an orderly fashion:

Where necessary, we propose amendments to existing CASS provisions, to ensure we accommodate the unique characteristics of cryptoasset custody outlined above. We have considered feedback from DP23/4 and other publications. These include the IOSCO Policy Recommendations for Crypto, the Law Commission’s final report on digital assets and the Property (Digital Assets Etc.) Bill which clarifies that certain digital assets, such as crypto-tokens, can be recognised as property even if they do not fit into the two traditional categories of personal property in the law of England and Wales.

Other internal controls must also be maintained; and custodians will only be able to use third party service providers under strict conditions, including that the appointment must be "in the best interests of the client, and necessary for safeguarding, which firms must evidence in a written policy." 

Custodians may be held liable for negligence, breach of contract and breach of FCA rules. 

Specific disclosure requirements are being considered, but not Proof of Reserves (a cryptographically proved, independent audit process). Audit standards will also be consulted upon, along with regulatory reporting rules.

Can EU Payment Institutions Really Hold Balances and Operate Prepaid Card Programs?

The European Banking Authority has issued some questionable guidance on how it interprets the definition of 'electronic money' in light of an odd preliminary ruling from the European Court of Justice in ABC Projektai UAB v Lietuvos bankas back in February 2024. I doubt them both and would suggest the ABC case can be restricted to its facts could not be relied upon for the principle that the EBA claims; while the EBA guidance is not binding in any event. But your mileage may differ and I may be wrong - by all means let me know. It's all a bit complex and I've summarised my understanding below for information purposes only. If you're after legal advice, please ping me via Crowley Millar as it's principally an EEA issue. Somehow, I don't see the UK adopting these interpretations... suddenly, a Brexit benefit?

How is E-money Defined in EU law?

The definition of e-money is in the second E-money Directive (EMD2), which is implemented by statute or regulations by each member state (and the UK prior to Brexit) and is intertwined with definitions in the second Payment Services Directive (PSD2) which governs payment services more generally, including those that involve e-money as the form of 'funds':

“electronic money” means electronically, including magnetically, stored monetary value as represented by a claim on the issuer which is issued on receipt of funds for the purpose of making payment transactions as defined in [the second Payment Services Directive (PSD2)], and which is accepted by a natural or legal person other than the electronic money issuer; 

‘payment transaction’ means an act, initiated by the payer or on that payer’s behalf or by the payee, of placing, transferring or withdrawing funds, irrespective of any underlying obligations between the payer and the payee.

'payee' means a natural or legal person who is the intended recipient of funds which have been the subject of a payment transaction"; 

‘payment order’ means an instruction by a payer or payee to its payment service provider requesting the execution of a payment transaction;  

‘acquiring of payment transactions’ means a payment service provided by a payment service provider contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee;

In other words, e-money is monetary value issued for the purpose of enabling the e-money holder to pay an intended third party, such as a merchant, as the payee. 

There's some protection for the e-money account holder, in terms of a requirement to immediately redeem any unspent e-money and repay the funds on demand; and safeguard the corresponding amount of cash until the e-money is spent, for example.

Of course, there has to be a mechanism for getting the stored value to the payee. It's possible, in a wallet-to-wallet e-money system that the payee will be another e-money account holder with the same issuer, in which case, the e-money issuer will simply debit the payer's account and credit the payee's account. But that use-case is very difficult to scale (trust me), so e-money issuers also issue debit cards that draw on the e-money balance to enable it to be spent with any merchant who accepts that brand of card (so-called 'prepaid cards'). Most commonly, these cards are issued under membership of the major card schemes. A merchant payee will have contracted with another payment service provider (the 'acquirer', in the case of a card transaction) to do what's necessary at its end to process payment transactions involving the payer's means of payment - the prepaid card that draws on the payer's e-money balance - and transfer the resulting funds to the merchant's own account. 

I mean, it wouldn't be great, would it, if the protection of immediate redemption of unspent value could be lost because the value is technically available via a card and doesn't pop out as the actual original e-money at the other end... (in fact, that 'e-money' status that is lost immediately within the issuer's own systems as the first step in the payment flow) so, as the FCA explained in its guidance under UK E-money Regulations implementing EMD2 pre-Brexit:

The fact that the device on which monetary value is stored is made available, for example, on a plastic card that also functions as a debit or credit card or is a mobile phone does not stop that monetary value from being electronic money. [FCA perimeter guidance ("PERG") 3A.3, Q11]

The real significance of requiring that e-money must be 'accepted by persons other than the issuer' is to avoid regulating 'basic gift cards', for example, which are issued and redeemed by a merchant to enable its customers to purchase only the goods or services that it offers. The FCA also explains this by saying that: 

"...these basic gift cards do not initiate payment orders; payment for the goods or services is made by the customer to the retailer of the goods in advance, when the card is purchased from the retailer." [PERG 15.5 Q40]

The stored value in some electronic travellers cheques is also not considered e-money (PERG 3A.3, Q13).

And there's an express exemption from the definition of e-money and payment services for payment instruments that are only accepted within 'limited networks' of third party payees, which we don't need to cover here.

The ABC case

ABC was a payment institution authorised in Lithuania. As a payment institution, ABC was not authorised to issue e-money, but it could provide the following payment services: execute payment transactions, including: transfers of funds on a payment account with the user’s payment service provider or with another payment service provider; direct debits, including one-off direct debits, and payment transactions through a payment card or a similar device; and/or credit transfers, including standing orders. It could also offer money remittance. 

Under (Lithuania's implementation of) PSD2, any funds that ABC received from customers had to be the subject of a specific payment order, which had to be executed within specific time limits; and those funds could not be held longer than necessary to process the transaction. Under guidance of the Lithuanian regulator (approved by the European Commission), this meant that the funds held in ABC’s payment accounts without a payment order would be regarded as 'deposits', 'other repayable funds' or 'electronic money'. If it wished to issue e-money, ABC would have needed to be authorised as an e-money institution, necessitating higher initial and ongoing capital requirements based on the amount of e-money issued and outstanding. If it wished to accept deposits, ABC would have needed to be authorised as a credit institution with much higher capital requirements still.  

As it turned out, ABC had been allowing customers to deposit funds without a payment order and to hold balances in its payment accounts for long periods, so the Lithuanian regulator revoked ABC's authorisation as a payment institution, for going beyond the scope of that authorisation by issuing e-money.

The question for the ECJ was whether ABC's activities actually amounted to issuing e-money, which the ECJ said it did not, based on findings that:

• 'direct debits', for example, contemplate a payment institution receiving funds "in advance" of receiving a payment order (missing the obvious point that the direct debit instruction involves a (future dated) payment order under Article 78). 

• the rules on safeguarding funds held beyond a business day suggest that PSD2 contemplated there being no corresponding payment order in place (whereas the need for safeguarding arises because PSD2 contemplates both future dated payment orders and longer time limits for processing some payment transactions, as well as the fact that some may fail, as well as to preserve funds in the event of issuer insolvency or malfeasance).

• for funds received by the institution to constitute e-money (my emphasis): 

"47. the issuance of electronic money [must be] distinct from the mere entry in a payment account in that, inter alia, before being used for the purposes of such a payment, such money must be electronically ‘stored’, which implies that it has been issued beforehand, that is to say, converted into a monetary asset separate from the funds received, and that its use as a means of payment is accepted by a natural or legal person other than the electronic money issuer..." 

"48. ...in order for an activity to come under the issuance of ‘electronic money’, within the meaning of Article 2(2) of that directive, it is at the very least necessary that there be a contractual agreement between the user and the electronic money issuer under which those parties expressly agree that that issuer will issue a separate monetary asset up to the monetary value of the funds paid by the user. However, transferring and holding funds on a payment account without immediately mandating payment transactions up to the value of those funds does not mean that the user of the payment service has given his, her or its express or tacit consent to the issuance of electronic money." 

"49. It is not apparent from the documents before the Court that ABC Projektai converted some of the funds which it received into electronically, including magnetically, stored money which could be used by a network of customers who would accept it voluntarily. On the contrary, all the indications are that the funds in question were deposited in payment accounts and could be used solely to execute payment orders from the users concerned."

In other words, the court held that: 

• (in paragraph 47) as a matter of legal interpretation, the use of the stored value had to be accepted as a means of payment by third parties (consistent with the FCA's view, for example) [- not that the 'actual stored value had to end up with the payee']; 

• in this case, there was no explicit agreement with users that ABC was issuing stored value on the basis that it could be used to pay third parties (in paragraph 48) - [whereas the fact that the value in the payment account could be used for payment transactions means it could and would indeed be accepted by third parties];  

• (in paragraph 49) in this case, there was no evidence that any particular 'network' of third parties had accepted that they could be paid using the 'stored money' in ABC's payment accounts. The funds could simply be used to 'execute payment orders' (i.e. to request the execution of a payment transaction, according to the definition) - [again, missing the point that this implicitly means that third parties were indeed accepting this];

• By receiving and holding funds that were not the subject of a payment order but could simply be used for payment transactions at a later date, ABC was not issuing e-money, but merely providing a payment service under PSD2. Therefore, it did not need authorisation as an e-money institution under EMD2. 

In other words, I interpret the court as dealing with the interpretation of the final part of the e-money definition in paragraph 47; and referring to the lack of evidence in paragraphs 48 and 49. I do not read paragraph 49 to colour or restate what was already plainly stated in paragraph 47.

However, from an evidentiary (and logical) standpoint, the court simply ignored the notion there would eventually be an intended recipient of the funds (payee) who must thereby have accepted the means of payment afforded to the payer by ABC.

Mind blown!

Fortunately, it should be possible to restrict any application of the ABC case to its fairly narrow facts.

EBA Guidance on the definition of e-money in the context of prepaid cards

While the ABC case was ongoing, there was also a pending request to the EBA for regulatory guidance from a bank (credit institution) that was planning to issue e-money that customers could spend on prepaid debit cards issued under the major card scheme rules. The EBA accepted that the presentation of such a card as a means of payment at a merchant checkout triggers a series of payment transactions, including the debit of the customer/payer's account associated with the card, and a series of debt-creditor obligations that are net-settled from the payer's card issuer/account service provider, to the card scheme, to the card acquirer and ultimately to the merchant payee. 

In other words, in the case of the major card transactions there is never a direct payment of funds from the cardholder's payment account to the merchant's payment account (often referred to as 'account-to-account' or 'A2A' payments). 

The bank claimed that it's application to become an e-money institution [let's put aside why it applied] had been wrongly rejected because the local regulator interpreted the wording at the end of the definition of e-money “accepted by a natural or legal person other than the electronic money issuer” as requiring that a party other than the issuer must accept the electronic money as a means of payment by becoming a holder of the actual electronic money (meaning that the payee must also have an agreement directly with the same e-money issuer to accept that e-money as payment). 

"The local regulator thus takes the view that there is no issuance of electronic money in a situation where no third party (payee) becomes the holder of the issued e-money (other than the EMI’s customer holding the e-money)." 

In answering this question, the ECB cited the strange decision in ABC v Lietuvos as the basis for agreeing with the local regulator, meaning that prepaid card programs do not involve the issuance of e-money!

In light of the reasoning of the Court, the last condition of the definition of electronic money (acceptance by a natural or legal person other than the electronic money issuer) should be understood as entailing the transferability and voluntary acceptance of electronic money as a separate monetary asset, and not simply as the reception by the payee of funds resulting from redeemed e-money. The submitter states that the payees (merchants in this case) are paid in scriptural money. Therefore, in accordance with the Court’s ruling in case C 661/22 and the reasoning outlined above, there is no acceptance of electronic money by a party other than the issuer in the case in question. 

This paragraph of the EBA guidance of course, misconstrues what the ECJ said in paragraph 47 of the ABC case, which was only that the stored value (in this case, any balance on the prepaid card) must have been "issued beforehand, that is to say, converted into a monetary asset separate from the funds received, and that its use as a means of payment is accepted by a natural or legal person other than the electronic money issuer...". In other words, applied to this case, the court would only have meant that the use of the value on the prepaid card must be accepted as a means of payment, not that the e-money itself must be accepted (consistent with FCA guidance cited above). 

That paragraph of the EBA guidance also ignores the fact that the merchant who accepts a card payment is the 'payee' because that merchant is the "intended recipient of funds which have been the subject of [the multiple] payment transaction[s]" triggered by the presentation of the card, as contemplated by recital 68 of PSD2:

The use of a card or card-based payment instrument for making a payment often triggers the generation of a message confirming availability of funds and two resulting payment transactions. The first transaction takes place between the [payer's card] issuer and the merchant’s [payee's] account servicing payment service provider [to pay for the goods/services], while the second, usually a direct debit, takes place between the payer’s account servicing payment service provider and the issuer [to pay the payer/cardholder's bill, though they may be the same account for a debit card]. Both transactions should be treated in the same way as any other equivalent transactions. 

The next paragraph of the EBA guidance then continues as if the payee is somehow required to have a customer agreement with the e-money issuer, when that would only be the case where the payee already held such an account and the transaction occurred within the e-money issuer's system (as a wallet-to-wallet or account-to-account payment): 

Furthermore, with regard to the question of whether the payees must be in a contractual agreement with the electronic money issuer, recital 18 of the EMD2 lays out redeemability as an intrinsic feature of electronic money, by stating that “electronic money needs to be redeemable to preserve the confidence of the electronic money holder”. In that respect, Article 11(3) of the EMD2 establishes that the conditions of redemption should be stated in the contract between the electronic money issuer and the electronic money holder. Article 11(7) further establishes that “redemption rights of a person, other than a consumer, who accepts electronic money shall be subject to the contractual agreement between the electronic money issuer and that person”. Consequently, the acceptance of electronic money whereby the person who accepts electronic money becomes a holder of electronic money, should therefore be understood to require a contractual arrangement with the electronic money issuer. 

The [prepaid card] scenario described in the question therefore fails to meet all of the criteria of the definition of electronic money.

Again, mind blown!

Fortunately, this is only guidance...

The FCA Wonders Out Loud Whether UK E-money Is Really Redeemable at Par...

The 'decoupling drama' surrounding USDT stablecoins appears to be echoing in the UK e-money world amid news from the UK Financial Conduct Authority that it doesn't know whether UK e-money firms fully safeguard the cash corresponding to their customers' e-money balances. This bombshell comes with a commitment to change the safeguarding rules in ways that could bring further problems, casting serious doubt on whether UK authorities' really have a grip on the payments sector.

This post is for information purposes only. If you would like legal advice, please let me know.

Context

The FCA's consultation on proposed changes to the 'safeguarding' rules for non-bank payment service providers makes you wonder who's been responsible for supervising the 24 year old sector. The regulatory regime has been under the FCA's direct supervision since it took over from the beleaguered Financial Services Authority in 2013. The sector comprises over 1,200 firms and processed £1.9 trillion in payment transactions in 2023. Electronic money (basically prepaid stored value that's used for making e-payments to others) represents about £1 trillion of these volumes, issued by 250 firms. Some e-money balances, such as those relating to prepaid card programmes, are significant and held for long periods. 

E-money is supposed to be issued on receipt of funds, and to be 'redeemable' on demand, at 'par value'. So, if you pay £1 to the issuer, it should immediately credit your online payment account in its systems with £1 and that balance should continue to be 'worth' 1 GBP when you transfer, spend or withdraw it. You have the regulatory right to withdraw - or 'redeem' - your e-money balance on demand. 

But e-money balances (like other non-bank payment flows) are not subject to the deposit guarantee under the Financial Services Compensation Scheme that backs bank deposits (up to a limit of £85,000 for all your deposits with the one bank). Instead, the right to redeem your e-money at par is underpinned by a regulatory obligation on the issuer to safeguard the corresponding amount of cash in GBP in a designated bank account, separate from its own funds (or with insurance), so that the funds are available to pay out immediately on demand.

Other types of non-bank payment service provider (payment institutions) must also safeguard customer funds, but they're only supposed to hold funds for as long as it takes to execute/process the related payment order, rather than allow their customers to hold an ongoing balance, so the time during which the funds are 'at risk' of the PSP going bust or dissipating the funds should be shorter than for e-money balances.

What's the immediate problem (opportunity)?

The FCA admits in its consultation paper that it does not know whether firms are failing to fully safeguard funds corresponding to the payment transactions they process or the e-money they issue. Worse, it reveals that in the 5 insolvencies of e-money institutions from 2018-2023 only 20% of funds were available and it took over 2 years on average time for an administrator to distribute the first round of customers' balances...

This seems to echo what happened when the value of  Tether's USDT 'stablecoins' - which aim to trade at parity with the USD - de-pegged from the USD. The scenario presented traders with an arbitrage opportunity: some borrowed amounts in a rival stablecoin and bought USDT at a discounted rate, betting that if USDT returned to its 1:1 peg, they could sell their USDT at parity and repay their loans at a profit.

In principle, there may be little difference between a right to redeem an 'e-money' balance in an online account and a 'fiat-backed stablecoin'. Indeed, the EU regulates fiat-backed stablecoins in the same way that it regulates e-money, while the FCA suggests they should be regulated differently, as recently discussed on LinkedIn.

Could there be an 'arbitrage opportunity' between balances issued by different e-money issuers, based on the extent of their safeguarding and availability of the balances?

Why Doesn't the FCA Make Firms Reveal How Much is Safeguarded At All Times?

Alarmingly, the FCA says the problem arises from firms not understanding how to safeguard, as well as "challenges in supervision and enforcement": 

33. In some firm failures there has been evidence of safeguarding failings which put client funds at risk and resulted in shortfalls. The current light-touch regime around [FCA!] reporting requirements means that supervisors have insufficient information to identify firms that fall short of our expectations. This then prevents the FCA from being able to prioritise resources, be that support or enforcement, on firms that pose the greatest risk to clients prior to insolvency. 

34. In particular, we are concerned about 2 areas. First, regulatory returns do not contain sufficient detail to assess whether firms are meeting their safeguarding obligations. Second, the safeguarding audits provided for in the Approach Document do not have to submitted to the FCA, further limiting our oversight. 

35. Furthermore, the lack of clarity and precision in current provisions leads to difficulties in enforcement as firms may be able to contest findings. This can undermine the credibility of enforcement as a deterrence.

Begging the question: in such circumstances, should the market continue to believe that UK issued/FCA-regulated e-money is really on par with GBP? 

New Rules...

The UK authorities' proposed remedy is to bring in more detailed rules, in two phases: supplementary rules under the current regulations "to reduce the incidence and extent of pre-insolvency shortfalls" (why so late?) and moving the e-money/payment services safeguarding regime under the FCA's wider 'client asset rules' (CASS) regime "to improve the speed and cost of distributing funds post-insolvency" - suggesting that the last attempt to improve the insolvency regime for non-bank payment service providers failed.

The interim rules will only echo current requirements, however, with only monthly reporting on the amount of e-money issued and corresponding cash safeguarded. Will the market be told? Even stablecoin issuers publish the amount of backing assets they hold (to prevent a 'run' on their stablecoins and a crash in the value). Maybe e-money issuers should start doing that, too? 

Among the eventual CASS rules will be an obligation to hold safeguarded funds under a statutory trust in favour of their e-money holders. This reflects the FCA's frustration at having already lost the argument in the case of Ipagoo in the Court of Appeal, which held that there is no statutory trust in favour of e-money holders under the E-money Regulations. The FCA is also pressing for a statutory trust over the cash which 'backs' fiat-backed stablecoins (while the EU has not). 

The statutory trust idea, in particular, raises a number of issues. 

The first issue is whether an e-money holder could have property rights in two distinct assets: the e-money balance (or the right to redeem it at par) and the beneficial interest in the pool of cash held by the issuer in the statutory trust (equating to the par value of e-money held)? If so, does the e-money holder simply have double the value of their e-money balance and/or could the value of these interests diverge?

Secondly, if the e-money itself gives the holder rights in the underlying cash in the statutory trust, why isn't e-money an investment instrument of some kind (the very thing that stablecoin issuers have structured their offerings to avoid, for fear of creating a regulated 'security')? Could it be traded on an exchange (or 'multi-lateral trading facility'), for instance? 

Thirdly, the requirement for the corresponding cash to be held in trust is no guarantee that an adequate amount will be held, or that the issuer won't somehow subvert the trust by, for example, failing to deduct 'own funds' (such as amounts owed in fees). What would such a failure mean for the value of the e-money balance itself (or the right to redeem it at par)?

There are likely other issues, such as those arising where an e-money holder has somehow granted an interest to a third party in either the e-money balance or the beneficial interest in the statutory trust. Currently, only the e-money issuer may have an interest in corresponding cash that is safeguarded. 

None of this is to suggest that there aren't answers in each case. The point is that the new concept of a statutory trust over the cash corresponding to e-money balances raises fresh uncertainty where the situation already appears grave under simpler rules; and without really solving the fundamental problems of potentially safeguarding too little and slow distribution on insolvency. 

More transparency and closer supervision would seem to be preferable.

Conclusion

The potential for new safeguarding rules is an almighty distraction from the critical uncertainty surrounding the integrity of the non-bank payment sector today.  

To ensure market confidence, e-money and payment firms may need to resort to publishing their safeguarding position on a daily basis, regardless of the FCA's requirements.

And new FCA rules will prove futile if the level of supervision remains the same.

This post is for information purposes only. If you would like legal advice, please let me know.

Do Payment Account Balances Held By A Payment Institution Without A Payment Order Constitute E-money?

Interesting opinion in ABC Projektai UAB v Bank of Lithuania, where the regulator had said that a payment institution had engaged in e-money issuance merely by holding funds for which it had received no payment orders. I've advised on this issue before, but this post is not legal advice, so let me know if you need it.  

The Advocate General's view is that a payment institution which holds funds without executing a payment order will infringe Articles 78 and 83 of PSD2 (as locally implemented) which govern the timing of receipt and execution of payment orders; potentially breach the service contractual for the operation of the payment account; and may trigger liability for non-/late execution under Article 89. 

But the funds would not be somehow converted into e-money "merely because funds have been transferred to a payment account and are kept in that account for the execution of future payment orders." 

There was also no e-money involved because the steps required for issuance of e-money under the E-money Directive (as implemented locally) were neither contemplated by the parties nor actually followed. 

It's worrying that there were in fact no payment orders (rather than, for example, existing payment orders that were not yet deemed to have been received by virtue of article 78(2) PSD2). The PSP had said that it had warned customers to provide payment orders or their funds would be returned (though the firm had not actually returned them...😬). Consistent with the AG's overall reasoning, however, the view must be that this will only amount to a breach of PSD2, rather than somehow convert the payment account balances into e-money. 

UK Review of the Payment Services (and E-money) Regulations

The Treasury is calling for evidence to assist in its review of the Payment Services Regulations 2017. This also necessarily involves consideration of the Electronic Money Regulations 2011, since e-money institutions are subject to both. Those regulations implemented corresponding EU directives that are also being reviewed (which the Treasury ignores). You have until 7 April 2023 to submit responses to the UK process. Please let me know if you would like assistance.

Of course, 'elephant in the room' is whether the UK regulations should remain harmonised with the EU directives that they implemented, particularly as most UK payment service providers will have EEA aspirations, at least, if not their own regulated firms within the trade bloc. Indeed, the UK review will seem eerily familiar to many, because the European Commission embarked on its own review of the second Payment Services Directive (PSD2) in May 2022; and in July the European Banking Authority proposed numerous changes that I summarised for Ogier Leman in Ireland, including the merger of PSD2 and the second E-money Directive (EMD2). I suspect the UK review is timed to coincide with likely changes arising from the EU's review process. The timing might not work perfectly, so the UK might make any changes that seem settled or non-controversial in the EU process, then mop up the rest in due course.

The UK government believes that its e-money and payment services regulation should address: 

• 'authorised push payment' (APP) fraud; 
• whether 'strong customer authentication' requirements are too prescriptive and should be 'outcome-based' including delaying payments where APP fraud is suspected to allow for communication with a potentially affected customer;
• the use of cryptoassets or cryptocurrencies as payment methods.

There is no mention of the European Commission or EBA proposals relating to the review of PSD2 and EMD2, let alone consideration of whether those proposals should be addressed in the UK. I guess that is left to the rest of us to consider and submit.

The UK has already made changes to its insolvency regime to cater for the more orderly and efficient wind-down of payment and e-money institutions, as this was something that the EU directives did not really address (aside from the 'pooling' provisions relating to safeguarded funds). The UK government is also inviting evidence on whether these additional arrangements are adequate (and the EBA has urged greater clarity on wind-down arrangements under the EU directive(s).

The government persists in its tediously jingoistic claims that the UK somehow pioneered 'Open Banking' through the API requirements proposed by the Competition and Markets Authority in 2016 (among other remedies to improve competition for retail banking). However, that happened three years after the specific open banking requirements were proposed in the first version of PSD2. In fact, such 'open data' and 'midata' initiatives were fully developed by 2012 common across Europe and, indeed, globally within the context of the World Economic Forum, as I posted at the time. It cites unspecified plans to ‘develop’ and ‘progress’ such services through a Joint Regulatory Oversight Committee after the CMA found that its mandated Open Banking Implementation Entity was improperly managed and lacked corporate governance.

While omitting a focus on whether banks unfairly withhold payment accounts from innovative financial services businesses, the consultation also includes highly irregular claims that the government is concerned about whether payment service providers might be terminating customer relationships in reaction to the customers' right wing, 'libertarian' political views. The paper concedes that there is no evidence at all that this is a genuine issue, merely citing assertions from a Conservative MP based on speculation by a conservative pundit about why PayPal might have regarded his accounts as suspicious. That such nonsense has found its way into a Treasury consultation paper is deeply worrying. It smacks of the false claims about Channel 4's activities by the then Culture Secretary, ironic given the government's decision to boycott and later sell Channel 4 in reaction to what it believed was unwarranted scrutiny of its activities by journalists. Just as the government has been forced to row back on the sale of Channel 4, it would seem unwise to politicise payment services regulation...

Though maybe the drafts-person was fully aware of the irony in referring to the 'Daily Sceptic' and the 'Free Speech Union' in the context of better ways to combat APP fraud.  

New Insolvency Rules for UK E-money and Payment Institutions

The Payment and Electronic Money Institution Insolvency (England and Wales) Rules 2021 (SI 2021/1178) will come into force on 12 November 2021 (there is an explanatory memorandum). The new rules provide detailed operating provisions to support the special administration process for payment institutions and electronic money institutions governed by The Payment and Electronic Money Institution Insolvency Regulations 2021 (SI 2021/716) which came into effect on 8 July 2021 (there is also an explanatory memo relating to those regs).

Amongst other provisions, the new rules: 

• Require insolvency practitioners to provide a reasonable notice period before a claims bar date comes into effect. 
• Clarify the full hierarchy of expenses. 
• Require notice of a bar date to be given to all persons whom the administrator believes to have a right to assert a security interest or other entitlement over the relevant funds. 
• Require the special administrator to engage closely with payment systems operators during the special administration. 

The Government consultation response explains the evolution of this legislation.

Payment and E-money Institution Insolvency Regulations Take Effect On 8 July

As covered in December, the Payment and Electronic Money Institution Insolvency Regulations 2021 were passed on 17 June and take effect on 8 July 2021.

While the Regulations mainly deal with an insolvency scenario, it’s worth noting there is also provision for the Financial Conduct Authority to seek a special administration merely where that is ‘fair’ (see Regulation 9(1)(b) and 9(3)). This might assist in cases where the institution is solvent but otherwise proving difficult.

Please let me know if I can help.

E-money Institutions To Remind Customers About Safeguarding vs The Financial Services Compensation Scheme

The UK Financial Conduct Authority is still concerned that customers of electronic money institutions (EMIs) do not understand that any funds they hold in their e-money accounts are safeguarded, but not covered by the "Financial Services Compensation Scheme" (basically, the UK depositor protection scheme for banks, building societies and credit unions). Of course, if the bank where the EMI holds its safeguarding account were to fold then the bank account would be covered by the FSCS but that is a different matter. 

The FCA has written to EMIs asking them to write to their customers before 29 June 2021 to "remind them of how their money is protected through safeguarding and that FSCS protection does not apply." Firms may include a link to the FCA's explanation to help customers decide whether that level of protection is appropriate for their circumstances (e.g. EMIs cannot pay interest, so any balance you aren't likely to use in the near future may as well be moved to a bank savings account that does). The communication must be separate from any other messaging or promotional activity, and the method(s) of communication may vary based on the EMI's business model and customer base, including any vulnerable customers. 

EMIs must also review their financial promotions in this regard to ensure customers get enough information on the topic. Where the FCA is named in promotions that refer to matters the FCA does not regulate, it must be made clear that those matters are not regulated by the FCA (a wider issue for the FCA).

The FCA wants its letter brought to the attention of the EMI's board of directors, which is expected to have considered the issues and to have approved the action taken in response. 

The FCA has promised to assess the action taken by a sample of EMIs.

Please let me know if I can help.

 

Proposed Extension of UK Cryptoasset Regulation

The UK Treasury is consulting until 21 March 2021 on its approach to extending financial regulation to 'cryptoassets'. This is intended to build on the FCA's previous guidance on the UK's regulatory approach to cryptoassets, which divides them into regulated 'e-money' and 'security' tokens and unregulated 'utility' and 'exchange' tokens. Any token could fall into multiple categories, with 'stablecoins' being a prime example that will likely be regulated in their own right. Certain types of service provider will become subject to the full weight of FCA authorisation and regulation. A 'technology neutral' approach means that any asset which replicates the features of a regulated cryptoasset will also be regulated as one ('same risk, same regulatory outcome'). The goal is to protect the 'regulated financial system' not consumers or investors, so speculation in unstable 'exchange' tokens, such as Bitcoin, will remain unregulated (but subject to anti-money laundering checks and, potentially, rules on financial promotions). A key challenge for some existing cryptoassets is that some authorisation requirements would need to have been addressed at launch but were not. Due to the digital, decentralised and cross-border nature of cryptoassets, the government is considering whether firms actively marketing regulated tokens to UK consumers should be required to have a UK establishment and be authorised in the UK.

Extending the concept of 'cryptoasset'

The Treasury takes a broader view of cryptoassets than authorities have done to date, defining them to be 

"a digital representation of value or contractual rights that can be transferred, stored or traded electronically, and which may (though does not necessarily) utilise cryptography, distributed ledger technology or similar technology."

The term ‘token’ is used interchangeably with ‘cryptoasset’. This means that the government's proposals go beyond the proposed extension of financial promotions regulation and the scope of the UK’s anti-money laundering regulations (implementing the EU's 5th Money Laundering Directive).

It is proposed that stablecoins - or 'stable tokens', as the Treasury refers to them - should receive a distinct regulatory status but this will affect assets designed to similar effect that are not based on distributed ledger technology.

FCA research published in June 2020 estimated that 4% of the UK population use or invest in cryptoasset, of whom:

• 47% of UK cryptoasset consumers said they bought cryptocurrencies ‘as a gamble that could make or lose money’; 
• stablecoins are the most likely to be used as a means of payment; 
• 27% of stablecoin owners have used those tokens to purchase goods and services.
  
• 89% understood that cryptoassets are not subject to regulatory protections. 

The government is therefore considering an approach in which the use of currently unregulated tokens and associated activities primarily used for speculative investment purposes, such as Bitcoin, could initially remain outside the perimeter for conduct and prudential purposes, while subject to more stringent regulation in relation to consumer communications via the financial promotions regime (if adopted) and anti-money laundering regulation. 

Utility tokens (used to access a system or service, for example) would also remain outside the authorisation perimeter. 

The issuance and use of stablecoins concerns the government more than rampant speculation in cryptoassets by consumers, partly in light of 10 recommendations from the Financial Stability Board of the Bank of England in December 2019. 

In other words, the more likely that a cryptoasset could be reliably used for retail or wholesale transactions, the more likely it will be subject to a UK authorisation regime. 

Yet investors should be left unprotected in relation to tokens that are not suitable for retail or wholesale transactions. These include ‘algorithmic stablecoins’ that seek to maintain a stable value through the use of algorithms to control supply, without any backing by a reference asset, as they are judged to pose similar risks to unbacked exchange tokens and in their ability to maintain stability of value. You're free to lose your shirt, just so long as it does not affect the 'system'.

Likely scope of authorisation

Key regulated participants are likely to include: 

• issuers or systems operators, responsible for managing the rules of a system, the infrastructure, burning and mining/minting coins (among others);
• cryptoassets exchanges, enabling the exchange of tokens for fiat money or other tokens;
• wallet providers, who provide custody of tokens and/or manage private keys and are often the main customer contact point, along with exchanges. 

Regulation would apply to such firms where they undertake the following functions or activities:

• issuing, creating or destroying asset-linked tokens 
• issuing, creating or destroying single fiat-linked tokens 
• value stabilisation and reserve management 
• validation of transactions 
• facilitating access access of participants to the network or underlying infrastructure 
• transmission/settlement of funds 
• custody and administration of a stable token for a third party, including the storage of private keys 
• executing transactions in stable tokens 
• exchanging tokens for fiat money and vice versa 

The following high-level requirements would be necessary for authorised firms:

• meeting certain gating criteria and threshold conditions prior to operating;
• capital, liquidity, accounting and audit requirements;
  
• maintenance and management of a reserve of assets underlying the token’s value and ensuring the quality and safekeeping on those assets;
  
• orderly failure and insolvency requirements;
  
• safeguarding requirements, principally on wallets and exchanges to ensure those entities are appropriately protecting users' tokens and the privacy and security of keys to those tokens;
  
• systems, controls, risk management and governance;
  
• notification and reporting;
  
• record keeping;
  
• conduct requirements toward customers;
  
• financial crime requirements;
• outsourcing requirements;
  
• operational resilience, service reliability and continuity requirements; and
  
• security requirements (including cyber and cloud).
  

Systemic Stablecoins

The government is considering requirements in relation to the reserves held for stable tokens (and related innovations), particularly where they operate at systemic scale (intended for widespread use in retail or wholesale transactions). Issuers would need to hold reserve assets in central bank accounts, commercial bank deposits or high-quality liquid assets.

Arrangements similar to existing 'payments systems' may need to be regulated by the Payment Systems Regulator as system operators, infrastructure providers or payment service providers in relation to that system. 

A systemic stable token arrangement could be assessed for Bank of England regulation in the same way that current payment systems and service providers are when potential disruption could lead to financial stability risks. Criteria include consideration of their ability to disrupt the UK financial system and businesses based on current or likely volume and value of transactions, nature of transactions and links to other systems, as well as substitutability and use by the Bank of England in its role as monetary authority. 

This would mean that a stable token with significant potential to be systemic at launch would need to be captured from launch by such regulation. Appropriate triggers would include likely user base, likely transaction volumes and likely avenues for acquisition of customers. 

Issuers or system operators that reach systemic status, as well as critical service providers, would be subject to regulation by the Bank of England and would be required to produce an annual compliance self-assessment. 

Payment FinTechs Beware: Banking Law Is Riding The New Payment Rails

Recent cases in the UK have applied English banking law to  non-bank accounts that hold customer funds, including the payment accounts of 'fintech' e-money and payment institutions. These cases effectively require the extension of a firm's anti-fraud and/or anti-money laundering programme to guard against the fraudulent misappropriation of a corporate customer's funds by the customer's own directors or other mandate holders. Equally, corporate customers should also be aware that they will need to treat their accounts with non-bank institutions like bank accounts, if they do not already, and be ready to respond promptly and clearly when transactions are queried. If you have concerns in this area, please let me know.

Acting in good faith

Traditionally, banks have been required to execute their customers' instructions promptly, and where a bank acts in good faith and a loss occurs, the customer must bear that loss (Bank of England v Vagliano Bros [1891] AC 107). 

Quincecare Duty

But a bank must not executing a customer’s order if, and for so long as, the bank has reasonable grounds (though not necessarily proof), for believing that the order is an attempt to defraud the customer (Barclays Bank plc v Quincecare Ltd, [1992] 4 All ER 363). If it were to go ahead, the bank may be liable for the customer's loss. 

This "Quincecare duty" protects a company from its funds being stolen by management or staff who've been permitted by the company to operate the company's bank accounts in the ordinary course of business. 

In this type of case (unlike in some other scenarios) the courts tend not to attribute the employee's fraudulent acts to the company, because that would leave the company unprotected from the fraud (Singularis Holdings Ltd (in official liquidation) v Daiwa Capital Markets Europe Ltd [2019] UKSC 50, where the firm was not actually a deposit-taking bank). 

Extending this to fintech firms

More recently, the High Court (in Hamblin v World First Ltd [2020] 6 WLUK 314) has made a preliminary ruling which extends all of this law firmly into fintech territory. The court held that: 

• an action for breach of statutory duty could be brought under the Payment Services Regulations 2017 where the regulations impose a duty for a limited class of the public and there is a clear parliamentary intention to confer a private right of action for breach on members of that class (certain principles derived from EU law should also be considered at the trial);
• it was arguable that a claim for a breach of the customer's mandate could be estopped (prevented) where the payment service provider acted in in good faith, even if the account holder had no directors (!) and was in fact under the control of fraudsters, but it was also observed that the service provider's internal documents relating to the opening of the account could affect the outcome...;
• it was arguable that the acts of fraudsters who misappropriated funds from the company account should not be attributed to the company, so as to give the company protection from the fraud (Singularis);
• similarly, a person has 'standing' to bring such claims in the form of a 'derivative action' against a payment provider on behalf of the corporate customer (effectively standing in the shoes of the corporate customer) where that person paid funds to the corporate customer in a way that made the company a trustee (due to its knowledge of the payment and the receipt of funds on trust or as a result of a fraudulent scheme) and where the company as trustee has committed a breach of trust, or in other exceptional circumstances such as fraud. 

Practical Steps  

These cases highlight the importance of having good customer on-boarding and account opening processes/records, as well as 'transaction monitoring' processes - both of which are otherwise required by the anti-money laundering regime in any event. 

A payment service provider should be in a position to know that a corporate customer has no directors, as well as the nature of its business and the purposes for which customers are asked to make payments to its accounts. The service provider must also be able to recognise activity on its customer's payment accounts that is unusual, in order to determine whether it is an attempt to misappropriate funds, as well as whether it is suspicious from a money laundering or terrorist financing perspective. Triggers for suspicion or being 'on notice' of potential for fraud or misappropriation of funds include where the customer is in financial difficulties; there is a breakdown in relations among directors, or directors and shareholders; or the customer has suffered significant security breaches and so on. 

As with suspicious activity from a money laundering perspective, once suspicion or 'notice' is triggered, it must be investigated. Explanations for activity should be sought and should receive appropriate scrutiny (not simply believed and filed); and decisions to proceed or not should be made and documented. Of course this process must be balanced against the need to avoid 'tipping-off' and/or to file a suspicious activity report where appropriate; and the firm should document where those legal and compliance requirements prevents further "Quincecare" related work to resolve whether funds are being misappropriated. 

Equally, it is incumbent on corporate account holders to monitor the activity on their own payment accounts, inform the service provider of changes to the nature of their business or solutions to potential 'trigger' problems; and to be ready to respond promptly and clearly to queries from banks and other account providers. Not only should those steps help ensure their funds are not misappropriated, but it should also help avoid a situation where a confused service provider needlessly interrupts the flow of genuine transactions.

If you have concerns in this area, please let me know.

Transferring Prepaid Card Programmes Is Non-Trivial

Ominous news that the UK e-money subsidiary of scandal-ridden Wirecard AG is "intending to wind-down its FCA-regulated business" and that "the business will continue to trade while alternative arrangements are being made with its card providers." 

Having advised on the creation and transition of various prepaid card programmes and customers, I'm aware this is highly technical from an e-money and payments regulation standpoint, and will involve intensive 'customer due diligence' under the anti-money laundering regime, as well as a careful approach to the processing of personal data. 

The FCA claims to be "working closely with Wirecard throughout this process to ensure that its customers are treated fairly," so programme managers any e-money issuer(s) taking them and their programmes on will need to tread carefully.

Needless to say, I'm here to help the transferring programme managers or their new e-money service providers either in the UK or in relation to any EEA programmes via Ireland.