Digital assets and payments

Digital assets markets experienced significant disruption and failures in 2022. While regulated firms’ interest has remained resilient overall, calls for swift and effective regulation have grown louder. Against this background, policymakers continued to shape their future digital assets regulatory frameworks, which will increase oversight of digital assets firms. Nevertheless, some regulatory uncertainty and gaps will persist.

The Markets in Crypto Assets regulation (MiCA) will enter into force in Q1 with a phased implementation starting one year later. It will harmonise the EU regulatory framework and expand the perimeter to capture most unregulated digital assets firms - notably stablecoin issuers, custodians and exchanges - for the first time. While MiCA will mitigate some issues highlighted by recent failures – especially concerning governance, organisational structures, and safeguarding client assets – some gaps will remain. For example, it will not regulate riskier activities such as leveraged trading and crypto lending.

In the UK, the Financial Services and Markets Bill (FSMB) – once passed - will give authorities the power to oversee digital assets markets as a whole. The secondary legislation that will clarify which activities and market participants they will regulate may not emerge until late this year, if not 2024. However, we expect the UK approach to focus initially on issuers of stablecoins used in payments, financial promotions, and exchanges and custodians, and to use existing regulatory frameworks (e.g. for investment products) as a starting point.

In general, across both the UK and the EU the impact will vary by firm type, form of digital assets, and the range of activities undertaken.

In relation to tokenised financial instruments (e.g. bonds), wholesale banks are increasingly looking to provide institutional clients with issuance and custody services. Many are exploring partnerships with DLT providers to build the technology infrastructure. The risks, especially operational, arising from these partnerships will come under significant supervisory scrutiny. In January 2023 the PRA made clear that it expects firms to have fully understood the impact of offering crypto products on their operational resilience.¹

Banks will also need to meet the requirements of existing EU and UK securities frameworks, e.g., Markets in Financial Instruments Directive (MiFID II) and Central Securities Depositories Regulation. Where possible, firms that offer central securities depository and multilateral trading facility services should leverage the planned EU and UK financial market infrastructure sandboxes to test their operating model and obtain regulatory feedback on how to overcome challenges in applying these frameworks in a DLT environment.²

Markets in unbacked digital assets³ (e.g. Bitcoin) will be significantly affected by MiCA, under which intermediaries, such as custodians and exchanges, will be fully regulated for the first time beyond existing anti-money laundering requirements. The UK is expected to clarify its approach in 2023/24 via secondary legislation and regulatory proposals. Intermediaries will need to understand the requirements and review the viability of their offerings, considering the costs and benefits of being a fully regulated financial services (FS) firm. In most cases, this will require a significant shift in governance, compliance (e.g., client assets protection) and overall corporate culture, as recent market events underscored. We also expect these firms will experience increasing pressure from jittery institutional investors and commercial partners – including FS incumbents – to ramp up their risk management and compliance plans and prove their ability to fulfil new regulatory requirements while remaining viable and competitive.

Both the EU and UK are also bringing stablecoin⁵ issuers and custodians within the regulatory perimeter. The UK is expected to focus on stablecoins used for payments backed by fiat currencies, while the MiCA will capture a fuller suite of stablecoins backed by either fiat currency or another asset or value. While stablecoins are currently used primarily for settling trades in other digital assets, regulatory clarity could spur new use cases, such as domestic and cross-border account-to-account retail payments.

Their long-term viability will depend on whether the EU and UK launch Central Bank Digital Currencies (CBDCs) over the next three to five years, as expected. More details on potential key features of these CBDCs (e.g., limits on holdings) are likely to emerge in 2023 as both jurisdictions progress their exploratory work. However, our expectation is that any future EU and UK CBDC framework will support coexistence with private forms of money, including stablecoins.

While the key building blocks of the EU and UK stablecoins frameworks are in place, important regulatory details will only emerge in 2023. For example, amendments to the e-money and payment services regimes, which the UK confirmed will form the basis of its regulatory approach. Similarly, the European Supervisory Authorities (ESAs) will have to issue detailed rules under MiCA, e.g. concerning authorisation and liquidity requirements.

Understanding new regulatory requirements, the path to authorisation, and implementing a suitable target operating model will be a priority for newly regulated digital assets firms. But a more developed regulatory environment should also help traditional firms determine their role in the digital assets ecosystem. In some cases, they may also enjoy comparative advantages. For example, under MiCA, e-money institutions (EMIs) and banks will be able to issue e-money tokens through a simpler regulatory notification. Similarly, banks and investment firms could leverage their existing MiFID permissions to provide similar services – e.g. custody or portfolio management – for unbacked digital assets. Firms can also leverage their existing governance and compliance capabilities. However, they will need to strengthen them to address new regulatory requirements and enhanced risks, such as insider trading or market manipulation.

EU and UK regulated firms

• Review and enhance capabilities to manage the risks of third-party (TP) relationships with DLT providers. These include vendor due diligence, scrutiny of TPs’ ongoing financial and operational risk management practices and resilience, fourth-party risk management, and real-time service quality monitoring against key performance indicators.

• Update risk appetite statement to reflect digital assets risks to a granular level, and define tolerances, accounting for types of clients and offerings, updating client suitability and product selection.

• Build dedicated digital assets governance capabilities, including a digital assets compliance capability, executive-level SteerCo oversight, and working groups to ensure risk alignment.

• Enhance internal audit capabilities, with focus on new product approval and effectiveness of firms’ governance framework.

• Determine whether to become a first mover in the stablecoin market, either as issuer or custodian. For long-term use cases, consider different interaction scenarios with future EU/UK retail CBDCs.

EU and UK digital assets firms

• Conduct gap analysis against core regulatory requirements and assess their impact on the viability of current and planned offerings.

• Decide whether to become a regulated FS firm or pursue other options, including becoming a TP technology provider or merging with other digital assets firms.
• If planning to become regulated, start building key risk and compliance capabilities, including robust governance, risk management frameworks and regulatory affairs functions to engage National Competent Authorities (NCAs) on authorisation and compliance plans.

• For issuers of currency-backed stablecoins, consider the cost and benefits of seeking an e-money licence in 2023.