Search This Blog

Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Tuesday, 30 May 2023

Dealing With Cryptoassets: UNIDROIT Principles on Digital Assets and Private Law

The International Institute for the Unification of Private Law (UNIDROIT) has adopted legal guidance on how to approach private law transactions involving "digital assets", with examples. The principles are intended to be "guidelines for States to enable their private laws to be consistent with best practice and international standards in relation to the holding, transfer and use as collateral of digital assets", rather than covering financial or other ‘regulation’ or ‘regulatory law’, such as whether a person must be authorised to engaging in activities relating to digital assets or how digital assets should be 'held' for regulatory purposes. This is one of a number of such initiatives (such as the UK Law Commission consultation on "digital objects") that have been running in parallel for some time. There are some differences in approach, a key one being whether 'control' should be a distinguishing criteria for the purpose legal status or treatment.

The UNIDROIT Principles set out:

  • The scope of private law principles in dealing a subset of digital assets that are capable of being subject to 'control', including definitions;
  • the principal that a digital asset can be the subject of proprietary rights (without addressing whether they are considered ‘property’ under local law);
  • the concept of linked assets;
  • applicable private international law; 
  • the concept of "control" of a digital asset and the factual 'abilities' needed to demonstrate control;
  • identifying a person in control of a digital asset; 
  • the rights of innocent acquirers who have 'control' and meet certain additional requirements;
  • the rights of transferees from innnocent acquirers ('shelter rule');
  • custody, including duties owed by a custodian to its client;
  • insolvency of a custodian and related creditor claims;
  • secured transactions, including control as a security method;
  • priority of security rights (a secured creditor who has control of a digital asset will have priority over other secured creditors with a security right in the same digital asset who do not have control of the digital asset);
  • enforcement of security;
  • the application of laws to address procedural matters, including enforcement; and
  • the effect of insolvency on proprietary rights in digital assets.
The UNIDROIT principles are aimed at gaps in typical state laws and stop short of addressing issues such as intellectual property rights, consumer protection, contract and property law, such as whether a proprietary right in a digital asset has been validly transferred, a security right validly created.


Monday, 18 January 2021

Proposed Extension of UK Cryptoasset Regulation

The UK Treasury is consulting until 21 March 2021 on its approach to extending financial regulation to 'cryptoassets'. This is intended to build on the FCA's previous guidance on the UK's regulatory approach to cryptoassets, which divides them into regulated 'e-money' and 'security' tokens and unregulated 'utility' and 'exchange' tokens. Any token could fall into multiple categories, with 'stablecoins' being a prime example that will likely be regulated in their own right. Certain types of service provider will become subject to the full weight of FCA authorisation and regulation. A 'technology neutral' approach means that any asset which replicates the features of a regulated cryptoasset will also be regulated as one ('same risk, same regulatory outcome'). The goal is to protect the 'regulated financial system' not consumers or investors, so speculation in unstable 'exchange' tokens, such as Bitcoin, will remain unregulated (but subject to anti-money laundering checks and, potentially, rules on financial promotions). A key challenge for some existing cryptoassets is that some authorisation requirements would need to have been addressed at launch but were not. Due to the digital, decentralised and cross-border nature of cryptoassets, the government is considering whether firms actively marketing regulated tokens to UK consumers should be required to have a UK establishment and be authorised in the UK.

Extending the concept of 'cryptoasset'

The Treasury takes a broader view of cryptoassets than authorities have done to date, defining them to be 

"a digital representation of value or contractual rights that can be transferred, stored or traded electronically, and which may (though does not necessarily) utilise cryptography, distributed ledger technology or similar technology."

The term ‘token’ is used interchangeably with ‘cryptoasset’. This means that the government's proposals go beyond the proposed extension of financial promotions regulation and the scope of the UK’s anti-money laundering regulations (implementing the EU's 5th Money Laundering Directive).

It is proposed that stablecoins - or 'stable tokens', as the Treasury refers to them - should receive a distinct regulatory status but this will affect assets designed to similar effect that are not based on distributed ledger technology.

FCA research published in June 2020 estimated that 4% of the UK population use or invest in cryptoasset, of whom:

  • 47% of UK cryptoasset consumers said they bought cryptocurrencies ‘as a gamble that could make or lose money’; 
  • stablecoins are the most likely to be used as a means of payment; 
  • 27% of stablecoin owners have used those tokens to purchase goods and services.
  • 89% understood that cryptoassets are not subject to regulatory protections. 

The government is therefore considering an approach in which the use of currently unregulated tokens and associated activities primarily used for speculative investment purposes, such as Bitcoin, could initially remain outside the perimeter for conduct and prudential purposes, while subject to more stringent regulation in relation to consumer communications via the financial promotions regime (if adopted) and anti-money laundering regulation. 

Utility tokens (used to access a system or service, for example) would also remain outside the authorisation perimeter. 

The issuance and use of stablecoins concerns the government more than rampant speculation in cryptoassets by consumers, partly in light of 10 recommendations from the Financial Stability Board of the Bank of England in December 2019. 

In other words, the more likely that a cryptoasset could be reliably used for retail or wholesale transactions, the more likely it will be subject to a UK authorisation regime. 

Yet investors should be left unprotected in relation to tokens that are not suitable for retail or wholesale transactions. These include ‘algorithmic stablecoins’ that seek to maintain a stable value through the use of algorithms to control supply, without any backing by a reference asset, as they are judged to pose similar risks to unbacked exchange tokens and in their ability to maintain stability of value. You're free to lose your shirt, just so long as it does not affect the 'system'.

Likely scope of authorisation

Key regulated participants are likely to include: 

  • issuers or systems operators, responsible for managing the rules of a system, the infrastructure, burning and mining/minting coins (among others);
  • cryptoassets exchanges, enabling the exchange of tokens for fiat money or other tokens;
  • wallet providers, who provide custody of tokens and/or manage private keys and are often the main customer contact point, along with exchanges. 

Regulation would apply to such firms where they undertake the following functions or activities:

  • issuing, creating or destroying asset-linked tokens 
  • issuing, creating or destroying single fiat-linked tokens 
  • value stabilisation and reserve management 
  • validation of transactions 
  • facilitating access access of participants to the network or underlying infrastructure 
  • transmission/settlement of funds 
  • custody and administration of a stable token for a third party, including the storage of private keys 
  • executing transactions in stable tokens 
  • exchanging tokens for fiat money and vice versa 

The following high-level requirements would be necessary for authorised firms:

  • meeting certain gating criteria and threshold conditions prior to operating;
  • capital, liquidity, accounting and audit requirements;
  • maintenance and management of a reserve of assets underlying the token’s value and ensuring the quality and safekeeping on those assets;
  • orderly failure and insolvency requirements;
  • safeguarding requirements, principally on wallets and exchanges to ensure those entities are appropriately protecting users' tokens and the privacy and security of keys to those tokens;
  • systems, controls, risk management and governance;
  • notification and reporting;
  • record keeping;
  • conduct requirements toward customers;
  • financial crime requirements;
  • outsourcing requirements;
  • operational resilience, service reliability and continuity requirements; and
  • security requirements (including cyber and cloud).

Systemic Stablecoins

The government is considering requirements in relation to the reserves held for stable tokens (and related innovations), particularly where they operate at systemic scale (intended for widespread use in retail or wholesale transactions). Issuers would need to hold reserve assets in central bank accounts, commercial bank deposits or high-quality liquid assets.

Arrangements similar to existing 'payments systems' may need to be regulated by the Payment Systems Regulator as system operators, infrastructure providers or payment service providers in relation to that system. 

A systemic stable token arrangement could be assessed for Bank of England regulation in the same way that current payment systems and service providers are when potential disruption could lead to financial stability risks. Criteria include consideration of their ability to disrupt the UK financial system and businesses based on current or likely volume and value of transactions, nature of transactions and links to other systems, as well as substitutability and use by the Bank of England in its role as monetary authority. 

This would mean that a stable token with significant potential to be systemic at launch would need to be captured from launch by such regulation. Appropriate triggers would include likely user base, likely transaction volumes and likely avenues for acquisition of customers. 

Issuers or system operators that reach systemic status, as well as critical service providers, would be subject to regulation by the Bank of England and would be required to produce an annual compliance self-assessment.