Digital assets and payments

• New EU and UK regulatory frameworks will increase the oversight of digital assets firms and enable regulated firms to develop their medium-term strategies, although some detailed requirements will only emerge later in 2023.
• Regulated firms looking to offer digital assets services and products should review their risk appetite and enhance their risk management framework.
• Supervisors will scrutinise banks' risk management of Distributed Ledger Technology (DLT) providers and compliance with existing securities regulatory frameworks when issuing or providing custody of tokenised financial instruments.
• In the EU, intermediaries in unbacked digital assets markets will need to consider how becoming fully regulated will affect their viability and competitiveness.
• EU and UK stablecoin issuers should kick off their compliance efforts without delay, considering whether to seek an e-money licence. E-money firms and banks should consider their role in the stablecoins ecosystem. 

In relation to tokenised financial instruments (e.g. bonds), wholesale banks are increasingly looking to provide institutional clients with issuance and custody services. Many are exploring partnerships with DLT providers to build the technology infrastructure. The risks, especially operational, arising from these partnerships will come under significant supervisory scrutiny. In January 2023 the PRA made clear that it expects firms to have fully understood the impact of offering crypto products on their operational resilience.¹

Banks will also need to meet the requirements of existing EU and UK securities frameworks, e.g., Markets in Financial Instruments Directive (MiFID II) and Central Securities Depositories Regulation. Where possible, firms that offer central securities depository and multilateral trading facility services should leverage the planned EU and UK financial market infrastructure sandboxes to test their operating model and obtain regulatory feedback on how to overcome challenges in applying these frameworks in a DLT environment.² 

Markets in unbacked digital assets³ (e.g. Bitcoin) will be significantly affected by MiCA, under which intermediaries, such as custodians and exchanges, will be fully regulated for the first time beyond existing anti-money laundering requirements. The UK is expected to clarify its approach in 2023/24 via secondary legislation and regulatory proposals. Intermediaries will need to understand the requirements and review the viability of their offerings, considering the costs and benefits of being a fully regulated financial services (FS) firm. In most cases, this will require a significant shift in governance, compliance (e.g., client assets protection) and overall corporate culture, as recent market events underscored. We also expect these firms will experience increasing pressure from jittery institutional investors and commercial partners – including FS incumbents – to ramp up their risk management and compliance plans and prove their ability to fulfil new regulatory requirements while remaining viable and competitive.

Both the EU and UK are also bringing stablecoin⁵ issuers and custodians within the regulatory perimeter. The UK is expected to focus on stablecoins used for payments backed by fiat currencies, while the MiCA will capture a fuller suite of stablecoins backed by either fiat currency or another asset or value. While stablecoins are currently used primarily for settling trades in other digital assets, regulatory clarity could spur new use cases, such as domestic and cross-border account-to-account retail payments.

Their long-term viability will depend on whether the EU and UK launch Central Bank Digital Currencies (CBDCs) over the next three to five years, as expected. More details on potential key features of these CBDCs (e.g., limits on holdings) are likely to emerge in 2023 as both jurisdictions progress their exploratory work. However, our expectation is that any future EU and UK CBDC framework will support coexistence with private forms of money, including stablecoins.

While the key building blocks of the EU and UK stablecoins frameworks are in place, important regulatory details will only emerge in 2023. For example, amendments to the e-money and payment services regimes, which the UK confirmed will form the basis of its regulatory approach. Similarly, the European Supervisory Authorities (ESAs) will have to issue detailed rules under MiCA, e.g. concerning authorisation and liquidity requirements.

Understanding new regulatory requirements, the path to authorisation, and implementing a suitable target operating model will be a priority for newly regulated digital assets firms. But a more developed regulatory environment should also help traditional firms determine their role in the digital assets ecosystem. In some cases, they may also enjoy comparative advantages. For example, under MiCA, e-money institutions (EMIs) and banks will be able to issue e-money tokens through a simpler regulatory notification. Similarly, banks and investment firms could leverage their existing MiFID permissions to provide similar services – e.g. custody or portfolio management – for unbacked digital assets. Firms can also leverage their existing governance and compliance capabilities. However, they will need to strengthen them to address new regulatory requirements and enhanced risks, such as insider trading or market manipulation.

EU and UK regulated firms

• Review and enhance capabilities to manage the risks of third-party (TP) relationships with DLT providers. These include vendor due diligence, scrutiny of TPs’ ongoing financial and operational risk management practices and resilience, fourth-party risk management, and real-time service quality monitoring against key performance indicators.

• Update risk appetite statement to reflect digital assets risks to a granular level, and define tolerances, accounting for types of clients and offerings, updating client suitability and product selection.

• Build dedicated digital assets governance capabilities, including a digital assets compliance capability, executive-level SteerCo oversight, and working groups to ensure risk alignment.

• Enhance internal audit capabilities, with focus on new product approval and effectiveness of firms’ governance framework.

• Determine whether to become a first mover in the stablecoin market, either as issuer or custodian. For long-term use cases, consider different interaction scenarios with future EU/UK retail CBDCs.

EU and UK digital assets firms

• Conduct gap analysis against core regulatory requirements and assess their impact on the viability of current and planned offerings.

• Decide whether to become a regulated FS firm or pursue other options, including becoming a TP technology provider or merging with other digital assets firms.
• If planning to become regulated, start building key risk and compliance capabilities, including robust governance, risk management frameworks and regulatory affairs functions to engage National Competent Authorities (NCAs) on authorisation and compliance plans.

• For issuers of currency-backed stablecoins, consider the cost and benefits of seeking an e-money licence in 2023.

¹ PRA, Letter from Nathanaël Benjamin and Rebecca Jackson ‘International banks active in the UK: 2023 priorities’, January 2023

² In the EU, NCAs will be able to set up sandboxes under the DLT Pilot Regime.

³ Digital assets whose value is not derived from an underlying asset, but from supply and demand.

⁴ Speech by Nathanaël Benjamin, BoE Executive Director for Authorisations, Regulatory Technology, and International Supervision

⁵ Digital assets whose value is pegged to one or more underlying assets. E.g. fiat currency, a commodity or a basket of assets/currencies.