The banking sector is showing an incremental appreciation of the use of cryptoassets and their correlation with banks’ traditional retail functions. The existing legal framework is maturing to the regulation of cryptoassets, allowing for the effective supervision of such digital assets.

Introduction

Consumer banks are responsible for three core activities; deposit-taking, provision of credit and payment intermediation. These activities are at the core of the Cyprus retail banking system and are currently undergoing an important reform, with the modernization of the traditional banking services and the appearance of new market entrants. Incumbents have embraced the offering of online and mobile banking, moving away, to some extent, from their traditional brick and mortar branches and into the digital age. Nonetheless, they have yet to incorporate cryptoassets in their offerings. Market actors often cite confusion around the technology, regulatory and legal concerns, as factors impeding the adoption and use of these assets across the banking sector. However, in so far as these concerns form the basis for the outright and blanket rejection of any use of cryptoassets, they are often exacerbated and unwarranted.

Market Developments

At the European Union level, a number of recent initiatives have been geared towards the promotion of innovation in the financial services sector and the shifting towards digitization and automation. In its 2018 “FinTech Action Plan”, the European Commission noted the importance and impact that FinTech (Financial Technology) firms are having in the financial services sector, by providing better access to finance, promoting financial inclusion and supporting operational efficiency. In its “Digital Finance Strategy for Europe”, the European Commission also highlighted the overhauling effect that innovation is having on the market structure and the business models of incumbent firms. By 2020, several incumbent firms had already shifted towards working closely with FinTech firms, as opposed to treating them as a threat. In 2022, the European Supervisory Authorities (ESAs note1 the development of growing interactions and cooperation models between incumbent firms, FinTechs and BigTechs2; partnerships, joint ventures, outsourcing and sub-outsourcing, mergers and acquisitions. The banking sector does not pose an exception to this wave of new entrants and market changes.

In so far as storing clients’ funds and facilitating payments are concerned (i.e. two out of the three core activities of retail banks), as we have noted in previous reports, FinTechs will often seek license as e-money or payment institutions; both institutions supervised by the Central Bank of Cyprus, to offer associated services. Payment institutions may engage in foreign exchange, money remittance, the withdrawal and deposit of cash on payment accounts, while e-money institutions engage in the issuing of payment cards, electronic money and the offering of e-wallets.

With regards to the provision of credit (the third function), the European Banking Authority (EBA) has recently analyzed3 the development of nonbank lending. In the EU, BigTech firms are only indirectly involved in this sector, by partnering with regulated banks and financial institutions, as opposed to individually and directly granting loans to EU-based customers themselves. For example, Amazon has recently introduced a practice already tested in the US, whereby it partners with financial intermediaries, in order to provide consumer credit to Spain-based users of its online platform. On the other hand, FinTech lending accounts for a very small portion of total lending across the EU, yet it occupies a significant share in Lithuania (9,16%), Latvia (13,61%), Estonia (6,30%) and Slovenia (2,90%).

Concurrently, lending and borrowing in cryptoassets has been on the rise, with automation and decentralization serving as important drivers towards the evolution of this form of non-bank lending. Cryptoassets lending and borrowing takes different forms and is executed under different conditions. Typical examples include the granting of credit via P2P cryptoasset lending platforms, whereby loans are granted bilaterally between lender and borrower, via the use of a smart contract and an intermediary platform. Alternatively, credit is granted via “pooled” cryptoasset lending platforms, whereby liquidity is provided by liquidity providers, whose cryptoassets are pooled at a collective level and then distributed to individual borrowers. In accordance with the EBA, none of the EU national competent authorities (NCAs) have introduced a tailored regulatory framework on cryptoasset lending. Nonetheless, the EBA continues to observe and document this form of lending, in particular insofar as regulatory and policy considerations are concerned and its interplay with the proposed text of the Market in Crypto-Assets Regulation (MiCA).

Overall, the abovementioned highlight that banking should not be thought of as an exclusive, unified service, or one which is reserved to banks. FinTechs and BigTechs are actively involved in this space; introducing more effective ways to carry out traditional banking services, or, as the case of cryptoassets lending evidences, modernize those entirely.

The Stance of the Banking Sector

The banking sector has been particularly reluctant in incorporating cryptoassets in their offerings, although there is a growing client demand in the provision of cryptoassets-related services. Indeed, even banks which are unwilling to directly engage with the cryptoassets space are required to engage in associated services. These may include “intermediation services for customers who seek exposure to this asset class, clearing of contracts that reference cryptocurrencies, or services for cryptocurrency issuers such as underwriting initial coin offerings”4. Therefore, banks and the cryptoassets sector share an interesting dynamic relationship. On the one hand, the role of banks in the real economy and the chain of transactions between fiat, cryptocurrencies or otherwise, remains paramount. On the other side, in light of the increasing adoption that cryptoassets are enjoying across the financial services sector more generally5, banks cannot afford to miss on leveraging on the opportunities that cryptoassets provide.

Against this background, it is worth addressing areas of concern which have to date discouraged banks from engaging in this space. Senior bank officials have mentioned that the lack of tailored guidance from the Central Bank of Cyprus (CBC) on the treatment of cryptocurrencies constitutes a major setback in this regard. This is true and indeed in line with what one of us has previously pointed out in their recent interview; that, in order to fully reap the benefits that Blockchain technology more generally has to offer, legislative intervention is necessary. Nonetheless, we are at the same time of the opinion that the current legal framework provides the necessary tools for banks wishing to at least “test the water” of the cryptoassets space.

Concurrently, an equally important setback is that of having outdated legacy systems and a shared need to revise the sector’s culture. Internal policies and manuals have been drafted on the basis of the traditional retail banking model and do not account for the specificities of the cryptoassets sector. Existing technological systems are tailored towards hindering rather than facilitating cryptoassets-related business transactions. As practical examples, past clients trying to liquidate their cryptocurrencies, have not been allowed to transfer the funds resulting from the sale of those assets to the bank accounts they hold with incumbent banks, on the basis that those funds would be treated as “gambling profits”. Concurrently, others have reported that their banks would block their online payments merely on the basis that the description of those payments would include a reference to “crypto”; no matter the purpose of the transfer, the receiving entity or the currency being transferred. Overall, while further guidance from the CBC would indeed be welcomed, terming anything “crypto” as bad or dangerous cannot be the preferred alternative as it hinders innovation, it is counter-intuitive and damaging to both the banks and the cryptoassets sector. Therefore, it is necessary to map out a non-exhaustive overview of the existing relevant legal and regulatory framework, indicating what may be permissible.

Key Legal Framework for a Bank’s First Steps in Crypto

First of all, it is necessary to identify what may constitute a cryptoasset. From the outset, while a driving force around the adoption of cryptocurrencies has been that they can potentially replace national currencies, they do not qualify as a currency. Currencies need to operate as mediums of exchange, serve as units of accounts and store of value. While their traditional role is to act as such mediums of exchange, they do not neatly fall into the other two categories, as it is not always possible to measure the value of something in cryptocurrencies (units of account) and their value can fluctuate significantly (store of value). From a banking law perspective, the European Banking’s Authority Report on Cryptoassets clarifies that cryptoassets may qualify as “electronic money” or “funds” for the purposes of the Electronic Money Directive (Directive 2009/110/EC) (“EMD2”) and the Payment services Directive (Directive 2015/2366) (“PSD 2”) respectively. In order to determine this, an ad-hoc approach is essential, bearing in mind that different cryptoassets have different characteristics and that a substance over form approach is essential.

Relatedly, following the government’s report on Distributed Ledger Technologies (Blockchain): A National Strategy for Cyprus, the Ministry of Finance has circulated a draft Bill on Distributed Ledger Technology, which identifies cryptoassets as personal, movable property, regardless of whether they are digitally or non-digitally native. This is in itself important, as it recognizes that cryptoassets can be owned and traded, and rights and obligations attach thereto. Hence, they store certain value and can be the subject of transactions. With regards to the retail banking sector, cryptoasset owners can keep their own accounts with consumer banks in the form of online wallets, the cryptographic key to which is shared between the customer and the servicing bank (the deposit-taking function). From the perspective of the Central Bank of Cyprus, custodial services on digital assets are supervised, to the extent that those fall within the definition of financial instruments, pursuant to the Business of Credit Institutions Laws of 1997 (Law No. 66(I)/1997), as amended.

With regards to a bank’s traditional custodianship role, the “administration, transfer of ownership, transfer of site, holding, and/or safekeeping, including custody, of crypto-assets or cryptographic keys or means enabling control over crypto-assets”, fall within the Class 3 Crypto Asset Services Providers (CASP) licensing and authorization regime, laid down by the Cyprus Securities Exchange Commission (CySEC). Concurrently, cryptoassets can be exchanged in the context of private transactions (the payment intermediation function), such as by being distributed in accordance with the will of a deceased or provide the purchase/selling price for goods and services. In principle, the mining of cryptocurrencies, user-controlled wallets, the making/receiving of payments in DLT/Blockchain/ cryptoassets and the buying and selling of cryptoassets at the private level, is not yet regulated.

Finally, cryptoassets can be pledged as collateral for the granting of credit or indeed act as the subject of a loan (the provision of credit function). There are already entities providing loans secured by cryptoassets. From our experience, this undertaking requires very careful planning and study of the business model to be adopted and risks inherent to the cryptoassets space (where cryptoassets are held, who the ultimate owner is even when they are pledged, safety provisions dealing with the value of the collateral and liquidation thereof). Further, it is the most complex of the three banking services, both in traditional terms and with regards to the incorporation of cryptoassets in the offering of loans. As such, offering cryptoassets-backed loans, is a scenario which would in most cases amount to putting the cart before the horse, insofar as maturity of the market and understanding of the business and associated risks are concerned, both from the perspective of the services providers and that of consumers.

The AML concerns

The greatest area of concern for banks operating in this space is the application of Anti-Money Laundering and Counter Financing of Terrorism (AML/CFT) measures. This is also arguably the most developed legal area concerning the use of cryptoassets and has been addressed to an appreciable extent by policymakers and Parliament alike. The European Securities Markets Authority (ESMA) has previously expressed7 its support towards subjecting all cryptoassets and related activities to AML provisions. Furthermore, AMLD5 regulates providers engaged in exchange services between virtual currencies and fiat currencies, as well as custodian wallet providers, recognizing them as “obliged entities”.

?he FATF’s 2020 Report on Virtual Assets (Financial Action Task Force) also provides a list of comprehensive factors that reporting entities must take into account in the context of their reporting obligations, especially their Know-Your-Customer (KYC) and Customer Due Diligence (CDD) obligations. The work of the FATF in this area is particularly important, as it provides a practical approach to the checks and safeguards that need to be applied when dealing in cryptoassets. The EBA has equally noted8 the importance of the FATF recommendations in providing a holistic review of the need, if any, for action at the EU level, to address issues relating to cryptoassets. Finally, the Cyprus Government has expressed9 its intention to gold-plate Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLD5) and bring Cyprus law in line with the FATF recommendations. Such a gold-plating exercise will aim to bring additional cryptoasset activities under the AML/CFT obligations and address the AML risks emanating from cryptoassets in a more comprehensive manner.

Conclusion

Overall, the abovementioned indicate a slow but steady maturity of the banking market and regulatory appreciation of the particularities of cryptoassets. Indeed, there is a drastic change from EBA’s earlier stance (2014), whereby the EBA had recommended10 that in the absence of a sound legal framework, national supervisory authorities should discourage customers and regulated entities from holding virtual currencies entirely. On the contrary, the incorporation of cryptoassets in retail banking has now become an issue of understanding the opportunities and risks offered in the market and navigating through them.