The global cryptocurrency market today is about $2.6 trillion. As of June, there were an estimated 200 million holders of crypto around the world – a figure that could hit 300 million by the end of 2021, thanks to the surge in popularity of NFTs, according to Eric Anziani, COO at Hong Kong-based Crypto.com.
No wonder that traditional banks are jostling to provide custody, trading, and other services to this market. The most basic of services, asset custody, has been the center of attention among bank providers for several years. DigFin sometimes hear people in the industry declare custody “solved”.
But a conversation at The Network Forum, a securities-services conference, suggests crypto custody remains very much a work in progress.
From fintech to TradFi
“Complexity is unavoidable,” said Seamus Donoghue, vice president for strategic alliances at Metaco, a crypto-native custody, trading and DeFi platform for crypto. “You need a framework that is agile and can scale.”
Many businesses have emerged from within the world of cryptocurrency to provide custody and related services.
Metaco, in addition to selling its own services, has also served as tech partner to SC Ventures and Northern Trust to launch Zodia, their own crypto-native custody business.
Crypto.com, a retail-focused digital asset exchange, offers custody to its own users, in the form of a cold wallet operated by Ledger – that is, assets are stored on devices that are not connected to the internet.
However these fintechs are not the only ones in the custody game: so are traditional securities-services players such as Deutsche Bank and Standard Chartered, which are trying to integrate blockchain-based services into their existing infrastructure.
Banks from the “TradFi”, or traditional finance, world bring several advantages. They have longstanding track records in safekeeping assets, and thus deep relationships with institutional investors. They are compliant around know-your-customer and anti-money laundering rules in many countries. They are licensed to operate as custodians and provide the full range of services on top.
Waking Wall Street
Although a few banks have been dabbling in crypto for several years, Coinbase’s IPO on Nasdaq in April jolted the industry. Although crypto purists scoff at Coinbase listing on a public old-school stock exchange – centralized! – this IPO valued the company at $85 billion. After a rollercoaster ride, its stock is back to April levels and it’s currently valued at $71.6 billion.
“Coinbase going public was the big wake-up moment for those financial institutions that were on the sidelines,” Donoghue said. “Almost overnight banks began changing their risk policies to accommodate crypto.”
Ryan Cuthbertson, managing director at Standard Chartered Bank, says banks’ balance sheets and ability to keep assets safe will be vital to help regulated entities ranging from pension funds to European-domiciled Ucits funds enter the space. “We’re spending time developing how we can provide an integrated solution between traditional, analog assets and crypto assets,” he said, “as well as providing a digital-native solution.”
Insurance gap
The one hurdle that fintechs and banks all face is the lack of insurance coverage for digital assets. Crypto.com has received the single largest cover to date, at $750 million, but this doesn’t meet its needs.
Banks face the same problem. “The gap between insurance coverage and assets under custody is significant and growing,” Cuthbertson said. However, large banks do have the ability to self-insure using their own balance sheet – a potentially expensive tool to enter the market.
What is digital custody?
For banks the next puzzle to solve is what kind of custody services to offer. These can range from the cold storage like Crypto.com uses, to secure multi-party computation (MPC) – a service some crypto-native exchanges prefer for its flexibility.
Under MPC, a client or exchange doesn’t hold the key to the assets. Instead, the key is splintered among many independent nodes, and the asset owner or custodian “turns the key” but getting these nodes to compute their portion without knowing the details of the other fragments. This sort of thing may appeal to fast-trading hedge funds but it’s unlikely to pass due diligence among licensed institutions.
There are practical questions as well such as how the custodian can help clients access their assets. Cold-wallet storage is safe so long as the storage device is offline. But at some point the client needs to move assets in and out.
One solution is airgapping: using a hardware wallet without plugging it into a computer or phone, so that data can bridge the “air gap” via either a USB flash drive or a QR code scan. But airgapping assumes the data isn’t malicious or altered during transfer, or that a dedicated desktop used to airgap isn’t hacked by insiders.
Due diligence goes deep
Custodians have to build all of these capabilities, but more importantly, they also have to manage a network of sub-custodians. A bank is licensed to operate in only so many markets, but their investor or trading counterparty could be elsewhere. Banks need to rely on a network partner to provide the same level of safekeeping, security, and compliance.
This means controlling how tokens are managed end to end, including setting up users, giving permissions, and managing transactions. “It’s not just about modeling one custody layer, but managing the entire stack,” Donoghue said. “This is where we see the need.”
Banks see their due-diligence requirements extending even deeper into the cryptosphere.
Boon-Hiong Chan, head of securities market and technology advocacy at Deutsche Bank, says banks need to review a range of market-integrity factors, such as how to treat “privacy coins” such as Monero, which can be a regulatory minefield.
The challenges for banks are even more existential. “The crypto industry is now $2.6 trillion, but who’s protecting the public permissionless blockchains that support this?” Chan wondered. No single organization has such power in a decentralized market: it’s the community of developers and miners that are responsible. “How do we do due diligence on them?”
He outlined a pyramid of responsibilities that custodians must meet.
A very long checklist
The tip is licensing. As regulated institutions dive into crypto, there is now more regulation, and banks operate with uncertainty about what will be allowed and what will not.
For example, banks are now confident about cases in which distributed-ledger technology is bolted onto existing processes, such as trade finance consortia. These are club-like environments involving group permission to participant, and regulators are supportive of these initiatives. Authorities have not yet made any decisions on whether banks can participate in DeFi markets or treat new entities such as automated market-makers as counterparties.
Second is regulation around transactions, such as Travel Rule, in which anyone facilitating a crypto transaction needs to verify the identity of the originator and beneficial owner of the assets.
This is not a simple data-management exercise. Custodians must conduct due diligence on institutions, and on networks. They need to understand data privacy rules and develop policies on how to manage data transfer with counterparties – including when a bank communicates sensitive data with a virtual exchange, and how those exchanges are also handling the information.
Finally, Chan says custodians must investigate a base layer of data residency, which is beyond their capabilities. “Our I.T. department can’t develop cryptographic key storage in-house,” Chan said. “So how do we see where the data flows, and how it’s kept?” The solution is outsourcing this to fintechs like Metaco, which requires the custodian go deep on due diligence.
Is it all worth it?
If this all sounds like a lot of hard work and risk for what’s a relatively small market, it is. Although the retail market and investor demand to trade crypto is driving banks into the space, they are keeping an eye on the bigger picture, the picture that is meant to ultimately justify all the trouble: tokenization and central-bank digital currencies.
Tokenization of securities would allow banks to use blockchain efficiently, because they could strip out a lot of the reconciliation and other costs in their processes. They could free up capital by the more efficient handling of collateral.
However, tokenization remains embryonic at best. Real-estate developers aren’t rushing to make their skyscrapers liquid and tradeable assets. For the time being, the traditional banks are limited to custody and trading for crypto, which puts them in contention with the crypto-native fintechs which are better placed to capture the current boom in NFTs.
And while everyone welcomes regulatory clarity, rules can also splinter markets, and therefore liquidity.
Banks are building expensive and difficult tech stacks for what is a small market, and one in which banks are unable to play to their strengths. They need to see crypto mature and institutionalize, quickly – or they will face a shakeout.
