Crypto custody

ZETZSCHE, Dirk Andreas; SINNIG, Julia; KOLOVOU NIKOLAKOPOULOU, Areti

doi:10.1093/cmlj/kmae010

Download

Article (Scientific journals)

Crypto custody

ZETZSCHE, Dirk Andreas; SINNIG, Julia; KOLOVOU NIKOLAKOPOULOU, Areti

2024 • In Capital Markets Law Journal, 19 (3), p. 207 - 229

Peer Reviewed verified by ORBi

Permalink
https://hdl.handle.net/10993/62083

DOI
10.1093/cmlj/kmae010

Files (1)Send to Details Statistics Bibliography Similar publications

Files

Full Text

ZetzscheSinnigNikolakopoulou_Crypto custody_CMLJ 2024.pdf

Author postprint (1.12 MB)

Download

All documents in ORBilu are protected by a user license.

Send to

RIS BibTex APA Chicago Permalink X Linkedin

Details

Keywords :

Finance; Law; crypto; custody; defi; digital assets

Abstract :

[en] This article discusses the EU’s approach to regulating crypto custody services under the Market in Crypto-assets (MiCA) Regulation against the background of asset diversions and misappropriations observed throughout the Crypto Winter. It seeks to identify whether MiCA meets its legislative objectives and whether it provides a sufficiently solid foundation for the future of the emerging crypto industry. We find that MiCA’s focus is on what we have called herein ‘institutional resilience’, ensuring that the custodian is soundly organized and governed and must not reuse clients’ assets on their own accounts. At the same time, MiCA lacks strength on ‘asset resilience’ (ie providing safeguards for cases where the custodian, third parties, the token-issuer or DeFi application, as the case may be, encounter difficulties).

Research center :

NCER-FT - FinTech National Centre of Excellence in Research

Disciplines :

Economic & commercial law

Author, co-author :

ZETZSCHE, Dirk Andreas ; University of Luxembourg > Faculty of Law, Economics and Finance (FDEF) > Department of Law (DL)

SINNIG, Julia ; University of Luxembourg > Faculty of Law, Economics and Finance (FDEF) > Department of Law (DL)

KOLOVOU NIKOLAKOPOULOU, Areti ; University of Luxembourg > Faculty of Law, Economics and Finance (FDEF) > Department of Law (DL)

External co-authors :

Language :

English

Title :

Crypto custody

Publication date :

July 2024

Journal title :

Capital Markets Law Journal

ISSN :

1750-7219

eISSN :

1750-7227

Publisher :

Oxford University Press

Volume :

Issue :

Pages :

207 - 229

Peer reviewed :

Peer Reviewed verified by ORBi

Focus Area :

Law / European Law

Additional URL :

https://academic.oup.com/cmlj/article-pdf/19/3/207/58604214/kmae010.pdf

FnR Project :

NCER22/IS/16570468/NCER-FT

Name of the research project :

U-AGR-7500 - NCER22/IS/16570468/NCER-FT_GEN.ORG_UL - FRIDGEN Gilbert

Funders :

Luxembourg National Research Fund

Funding text :

This research was funded in whole, or in part, by the Luxembourg National Research Fund (FNR), grant reference NCER22/IS/16570468/NCER-FT.

Available on ORBilu :

since 23 September 2024

Statistics

Number of views

255 (20 by Unilu)

Number of downloads

275 (8 by Unilu)

More statistics

Scopus citations^®

Scopus citations^®
without self-citations

OpenCitations

OpenAlex citations

WoS citations^™

Bibliography

Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (MiCA) [2023] OJ L150/40.
MiCA, recs 1, 2 and 4.
For an empirical analysis of the current crypto custody practice, cf Dirk Zetzsche and Areti Nikolakopoulou, ‘Crypto Custody and Crypto Wallets—An Empirical Assessment’ (2024), Working Paper accessed 25 April 2024.
Sebastiaan Hooghiemstra, ‘Depositary Regulation’ in Dirk Zetzsche (ed), The Alternative Investment Fund Managers Directive [hereinafter: AIFMD] (3rd edn, Kluwer 2020) 460.
AIFMD, art 21(8)(a)(i).
Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (AIFMD) [2011], OJ L174/1.
AIFMD, art 21(8).
cf Hooghiemstra (n 4) 465–466.
Douglas Arner and others, ‘The Financialization of Crypto: Lessons from FTX and the Crypto Winter of 2022–2023’ (2024) Computer & Security Review, available as (2023) UNSW Law Research Paper no. 23–31, 19, 6ff. accessed 25 April 2024; Dirk Zetzsche and others, ‘Remaining Regulatory Challenges in Digital Finance and Crypto-Assets after MiCA’ (2023) Study for the European Parliament, 33ff. accessed 25 April 2024.
ibid.
LHoFT, PWC and ALFI, ‘Crypto-assets Management Survey 2nd edition’ (Report, May 2023) accessed 25 April 2024.
PwC, Elwood and AIMA, ‘4th Annual Global Crypto Hedge Fund Report 2022’ (Report, June 2022) 3. accessed 25 April 2024.
cf Arner and others (n 9) 6ff; Zetzsche and others (n 9) 33ff.
CoinMarketCap, ‘Historical Data for TerraClassicUSD’ (CoinMarketCap) accessed 25 April 2024.
Zetzsche and others (n 9) 38.
ibid 33ff.
ibid 46–47.
Inter alia Gareth Jenkinson, ‘CoinEx hack: Compromised Private Keys Led to $70M Theft’ (Cointelegraph, 19 September 2023) accessed 25 April 2024; Sidhartha Shukla, ‘Crypto Exchange HTX Hit by $258 Million Outflow After Hack’ (Bloomberg, 11 December 2023) accessed 25 April 2024.
Reuters, ‘Exclusive: Behind FTX’s Fall, Battling Billionaires and A Failed Bid to Save Crypto’ (Reuters, 11 November 2022) accessed 25 April 2024.
ibid.
SEC, ‘SEC Files 13 Charges Against Binance Entities and Founder Changpeng Zhao’ (SEC, 5 June 2023) accessed 25 April 2024.
For an overview of the crypto-asset segregation and commingling practices on-chain as well as off-chain, cf Zetzsche and Nikolakopoulou (n 3).
Khadim Shubba, Joshua Oliver and Sujeet Indap, ‘New FTX chief Says Crypto Group’s Lack of Control Worse than Enron’ (Financial Times, 18 November 2022) accessed 25 April 2024.
ibid; Oliver Knight, ‘Lender Babel Finance Lost $280M Trading Customer Funds: Report’ (Coindesk, 29 July 2022) accessed 25 April 2024.
On the practice of reuse, cf Zetzsche and Nikolakopoulou (n 3).
Arner and others (n 9) 15–16.
Jannik Woxholth and others, ‘Competing Claims to Crypto assets’ (2024) 28 Uniform Law Review 226, 5ff.
Bank for International Settlements, ‘Financial Stability Risks from Cryptoassets in Emerging Market Economies’ (2023) BIS Policy Papers 138, 7–18, 21–22 accessed 25 April 2024; Roshan Iyer and Adina Popescu, ‘New Evidence on Spillovers Between Crypto Assets and Financial Markets’ (2023) IMF Working Papers 2023/213, 22ff accessed 25 April 2024.
Zetzsche and others (n 9) 36ff.
ibid.
cf Woxholth and others (n 27) 7–19.
Financial Stability Board, ‘Global Regulatory Framework for Crypto-Asset Activities’ (17 July 2023) FSB Policy Papers. accessed 25 April 2024; Financial Stability Board, ‘High-level Recommendations for the Regulation, Supervision and Oversight of Crypto-Asset Activities and Markets: Final report’ (17 July 2023) FSB Policy Papers accessed 25 April 2024 [referred to in Table 1 as ‘FSB (2023)’].
International Monetary Fund, ‘Elements of Effective Policies for Crypto Assets’ (February 2023) IMF Policy Papers accessed 25 April 2024 (referred to in Table 1 as ‘IMF (2023)’); Parma Bains and others, ‘Regulating the Crypto Ecosystem: The Case of Unbacked Crypto Assets’ (September 2022) Fintech Notes 2022/007 accessed 25 April 2024 (referred to in Table 1 as ‘IMF (2022)’).
International Organization Of Securities Commissions, ‘Final Report, Policy Recommendations for Crypto and Digital Asset Markets’ (November 2023) accessed 25 April 2024 [referred to in Table 1 as ‘IOSCO (2023)’].
Luc Cohen and Jody Godoy, ‘Bankman-Fried Sentenced to 25 Years for Multi-Billion Dollar FTX Fraud’ (Reuters, 28 March 2024) accessed 25 April 2024.
Bob Van Voris, ‘SEC Suit against Coinbase Can Go Forward, Judge Rules’, (Bloomberg, 27 March 2024) accessed 25 April 2024.
Chris Prentice and Hannah Lang, ‘Binance, SEC Face Off over Regulator’s Crypto Oversight’, (Reuters, 22 January 2024) accessed 25 April 2024; Turner Wright, ‘What to expect at Changpeng Zhao’s sentencing on April 30’ (Cointelegraph, 15 April 2024) accessed 25 April 2024.
One notable price effect may stem from ‘bitcoin halving’. For an overview of how the bitcoin halving creates scarcity and increases the demand and thus the price of Bitcoin, cf Luke Conway, ‘What Is Bitcoin Halving? Definition, How It Works, Why It Matters’ (Investopedia, 15 April 2024). < https://www.investopedia.com/bitcoin-halving-4843769> accessed 25 April 2024.
BlackRock, Fidelity and VanEck have gained the US SEC’s approval for Bitcoin exchange-traded funds; cf Paul Katzeff, ‘SEC Approves New Bitcoin ETFs: What It Means For Investors’ (Forbes, 11 January 2024). < https://www.forbes.com/advisor/investing/cryptocurrency/sec-approves-new-bitcoin-etfs/> accessed 25 April 2024.
Paypal, PayPal Stablecoin, US Dollar Cryptocurrency. accessed 25 April 2024.
For instance, Fidelity Digital Assets currently offers Bitcoin and Ether custody and trading on their own platform, cf Fidelity Digital Assets. accessed 25 April 2024.
Zetzsche and others (n 9) 52–69.
MiCA, art 59(1)(b).
Pursuant to MiCA, art 4(3), these include crypto-assets offered for free; rewards for validation, utility tokens and tokens in limited networks of merchants.
MiCA, art 3(1)(5): crypto-asset ‘means a digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology or similar technology’. For a detailed discussion of MiCA’s scope, see Dirk Zetzsche and Jannik Woxholth, EU Regulation of Crypto-assets (Cambridge University Press 2024), ch 3 (forthcoming).
MiCA, art 3(1)(7).
ibid art 3(1)(6).
ibid art 4(1).
Directive 2009/65/EC of the European Parliament and of the Council of 13 July on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (recast) (UCITSD) [2009] OJ L 302/32.
AIFMD.
For details on fund custody on behalf of alternative investment funds, see Hooghiemstra (n 4) 441ff.
For a detailed analysis of the intersection between MiCA and investment fund law, see Dirk Zetzsche, Filippo Annunziata and Julia Sinnig, ‘Digital Assets, MiCA and EU Investment Fund Law’ (2024) EBOR, forthcoming. accessed 25 April 2024.
‘Undertaking, noun’ (OALD Online, OUP 2022) accessed 25 April 2024.
This understanding is confirmed by MiFID which uses the same term for other regulated activities in regard to financial instruments.
Dirk Zetzsche, Douglas Arner and Ross Buckley, ‘Decentralized Finance (DeFi)’ (2020) 6 Journal of Financial Regulation 172, 181.
For a detailed analysis, see Zetzsche and Woxholth (n 45) ch 7 (forthcoming).
Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) (MiFID) [2014] OJ L173/349, rec 12 and 30.
cf Woxholth and others (n 27) 7–19; Zetzsche, Annunziata and Sinnig (n 52) 24 (in press).
MiCA, art 3(1)(17).
For an overview, cf Carol Goforth and Yuliya Guseva, Regulation of Cryptoassets, American Casebook Series (2nd edn, West Academic Publishing 2022) 760–781, 790; Primavera De Filippi and Aaron Wright, Blockchain and the Law: the Rule of Code (Harvard University Press 2018) 14–16, 20–29; Stephen Small, ‘Bitcoin: The Napster of Currency’ (2015) 37 Houston Journal of International Law 581, 588ff; Philipp Maume, Lena Maute and Mathias Fromberger, The Law of Crypto Assets (Bloomsbury 2022) 6–10; Wulf Kaal and Hayley Howe, ‘Custody of Digital Assets’ (2023) 63 Jurimetrics 169.
De Filippi and Wright (n 60) 21; Small (n 60) 588–89; Maume, Maute and Fromberger (n 60) 10; Matthias Haentjens, Tycho de Graaf and/Ilya Kokorin ‘The Failed Hopes of Disintermediation: Crypto-Custodian Insolvency, Legal Risks and How to Avoid Them’ (2020) 2020 Singapore Journal of Legal Studies 526, 531–34.
MiCA, rec 83 in fine.
Examples of custodial wallet providers include CEFFU, Coinbase Custody, Taurus, BitGo, Seba Bank; noncustodial wallet providers include Trezor, Atomic Wallet, MetaMask; middle-ground solutions include Ledger Recover, Zengo wallet, Casa 2-of-3 multisig wallet.
For custodial wallet providers’ examples, cf n 63.
MiCA, rec 83 in fine.
Cryptopedia Staff, ‘What Are HD Crypto Wallets?’ (Gemini Cryptopedia,10 March 2022) accessed 25 April 2024, stating that ‘A hierarchical-deterministic (HD) wallet generates a new key pair from a master key pair for each crypto transaction to enhance privacy and security. Its hierarchical structure resembles that of a tree, with the master key “determining” the key pairs that follow it in the hierarchy … The vast majority of wallets are hierarchically deterministic.’
The wallet is deterministic because the same seed-master key will always produce the same sequence of keys even when imported to new wallets. The seed is a recovery mechanism. The mnemonic supports information retention or retrieval of the access data to the crypto-asset (the ‘keys’). Andreas Antonopoulos, Mastering Bitcoin: Programming the Open Blockchain (2nd edn, O’Reilly Media 2017) ch 5.
For non-custodial wallet providers’ examples, cf (n 63).
Vitalik Buterin, ‘Why we Need Wide Adoption of Social Recovery Wallets’ (Vitalik, 11 January 2021) accessed 25 April 2024.
Ledger, ‘Announcing the Ledger Recover Cryptographic Protocol White Paper’ (Ledger, 21 June 2023) accessed 25 April 2024.
‘Technically speaking, it is and always has been possible to write firmware that facilitates key extraction. You have always trusted Ledger not to deploy such firmware whether you knew it or not.’ Source: Tom Blackstone, ‘Ledger clarifies how its firmware works after deleted-tweet controversy’ (Cointelegraph, 10 May 2023) accessed 25 April 2024.
Antonopoulos (n 67) ch 7.
Amos Beimel, ‘Secret-sharing Schemes: A Survey’ (International Conference on Coding and Cryptology, Quingdao, May–June 2011) 2–3. accessed 25 April 2024; Jean-Philippe Aumasson, Adrian Hamelink and Omer Shlomovits, ‘A Survey of ECDSA Threshold Signing’ (Cryptology ePrint Archive, 2020) 1–7. accessed 25 April 2024.
In simple words, depending on the wallet set-up and technology, we encounter wallets with multiple keys or key shares where neither the wallet provider nor the client holds alone the necessary threshold of keys or key shares to initiate a transaction and they need to coordinate (see category 2 of our Taxonomy and example Zengo Wallet), or where the client holds alone the necessary threshold to initiate a transaction (see category 3 of our Taxonomy and example Casa 2-of-3 multisig wallet).
Zengo, ‘User Agreement’ (Zengo, 3 October 2023). accessed 25 April 2024, as follows: ‘Zengo uses distributed security, by which our servers hold a key share (“Server Share”) to sign transactions, while the other share is on the User’s mobile device (“Device Share”). Only when both Shares interact, a Transaction can take place. This means that Zengo is unable to access Users’ Assets without their volition and consent.’
An example is Casa 2-of-3 multisig wallet with two hardware keys. cf Nick Neuman, ‘Choosing your 3-key Vault Setup’ (Casa) accessed 25 April 2024, as follows: ‘Two hardware keys, preferably by different manufacturers (Ledger, Trezor, Coldcard, etc), One Casa Recovery Key (held by Casa for emergencies in case something happens to one of the other keys)’; Casa, ‘Casa Terms and Conditions’ accessed 25 April 2024, as follows: ‘You acknowledge and agree that if you choose to authorize Casa to control a cryptographic key created by you through the Services (a “Recovery Key”), (i) Casa will have sole and exclusive control over such Recovery Key; … You further acknowledge that the Services may require the transmission of multiple cryptographic keys to an Exchange in order to access your digital or virtual currency or assets, and that the Recovery Key alone may therefore be insufficient for such access without at least one (1) or more Private Keys …’.
cf ESMA, ‘Consultation Paper on Technical Standards specifying certain requirements of the Markets in Crypto Assets Regulation (MiCA)’ ESMA74-449133380-425, 12–29, 76–109 discussing the content of the templates for the application for authorization of the CASPs. For an analysis, cf Zetzsche and Woxholth (n 45) ch 7 (forthcoming).
AIFMD, arts 20(1) and 6(4)(b).
cf, for instance, MiCA, art 60(5) for UCITS and AIFMs with regard to order transmission and reception, portfolio management and advice.
Intermediaries holding a license under EU financial law must submit to the NCA, inter alia, a bespoke programme of operations (including types of crypto-assets and marketing countries), disclosures on internal controls, AML/CTF measures and risk assessments, the business continuity plan, the ICT systems and security arrangements in technical and non-technical language, the procedure for the segregation of clients’ crypto-assets and funds, the custody and administration policy, whether the crypto-asset service relates to asset-referenced tokens, e-money tokens or other crypto-assets. See further on the notification process ESMA74-449133380-425, 9–11, 54–75.
The NCA then has 20 days to require in one step additional information when the notification is incomplete, and set a new deadline not exceeding 20 days which delays the expiration of the 40-day period. Further requests do not extend the deadline.
cf MiCA, art 60(9).
MiCA, art 65.
We do not discuss herein the prudential requirements (MiCA, art 67) and the provisions on governance and complaints handling (MiCa, arts 68, 69, 71). On the governance arrangements for the continuity and regularity in the performance of services as well as the record-keeping obligations for all CASPs, cf ESMA, ‘Consultation Paper on Technical Standards specifying certain requirements of Markets in Crypto Assets Regulation (MiCA) - second consultation paper’ ESMA75-453128700-438, 16–25, 37–54, 102–215. For an overview, see Zetzsche and Woxholth (n 45) ch 7 (forthcoming). On safekeeping of crypto-assets and client funds subject to MiCA art 70, cf ‘Safekeeping and custody’ section.
MiFID, art 24, UCITSD, art 25, AIFMD, art 21(10).
Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organizational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive [2006] OJ L241/26, arts 13–15; Commission Delegated Regulation (EU) No 231/2013 of 19 December 2012 supplementing Directive 2011/61/EU of the European Parliament and of the Council with regard to exemptions, general operating conditions, depositaries, leverage, transparency and supervision [2013] OJ L083/1.
According to ESMA’s initial proposal, the CASPs shall keep detailed records on the outsourcing agreements and the outsourced services and activities, cf ESMA75-453128700-438, 162, 171–172; the CASPs seeking authorization or the notifying entities shall disclose to the Competent Authority their outsourcing policy and in particular the function or person responsible for outsourcing, the resources (human and technical) allocated to the control of the outsourced functions, services or activities and the related risk assessment, cf ESMA74-449133380-425, 58, 81.
According to ESMA’s initial proposal, permissionless DLTs shall be considered a form of ‘common good’ resource, whereas the use of a permissioned DLT operated by a commercial enterprise will likely be based on contracts available for ‘white-labelled’ blockchain products, in which case it can be considered as a ‘third-party provider’. cf ESMA75-453128700-438, 19. Such a qualification encourages outsourcing to applications the provider cannot control nor monitor, in particular when seen together with privileges ESMA foresees on liability in these cases.
For details, see Zetzsche and Woxholth (n 45) ch 7 (forthcoming).
According to their qualification as CASP laid out in MiCA, art 62(1).
MiCA, art 74: CASPs ‘shall have in place a plan that is appropriate to support an orderly wind-down of their activities under applicable national law’.
While the new Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law, COM/2022/702 final, aspires to provide certain degree of harmonization amongst the Member States’ insolvency laws, there are serious doubts as to whether the Directive applies in relation to crypto-assets, therefore the problem of non-harmonization remains.
See the discussion on the repercussions of this lacking harmonization at Section 4.
Under most insolvency laws, only persons and entities can become insolvent, and it is uncertain whether DeFi applications qualify as one of the former.
Arner and others (n 9) 8–10.
cf Zetzsche and others (9) 30.
cf MiCA, art 59(2). Where already licensed financial intermediaries provide crypto-asset services pursuant to MiCA, art 60, the authorization requirements of the CRD, MiFID, UCITSD, AIFMD and other pieces of legislation also require that the registered seat and headquarter is located within the EEA.
MiCA, art 75(1). Unlike AIFMD, art 21(2), MiCA, art 75(1) does not require this agreement to be written.
MiCA, art 75(1)(a) to (g).
MiCA, art 75(3).
For an overview of the incidents in Crypto Winter, see Zetzsche and others (n 9) 24.
MiCA, art 75(2) and (4). An equivalent monitoring of an AIF’s cashflows and assets held in custody, with the objective of ensuring investor protection, is foreseen by AIFMD, art 21(7) and (8).
MiCA, art 75(5).
ibid art 75(6).
ibid art 75(7). An equivalent asset segregation and registration of an AIF’s assets is foreseen by AIFMD art 21(8) (a)(ii).
ibid art 75(4) subpara 2.
For instance CEFFU, ‘Ceffu Terms of Use’ accessed 25 April 2024, as follows: ‘The Custodian assumes no liability for any loss or damage arising from the use of the Account and/or Services by you or any third party with or without your authorization.’ Gemini, ‘User Agreement’ accessed 25 April 2024, as follows: ‘You further agree that neither we nor any Gemini Service Provider can be held responsible for any … “System Failure” (defined as a failure of any computer hardware or software used by Gemini, a Gemini Service Provider, or any telecommunications lines or devices used by Gemini or a Gemini Service Provider) … provided that we or the relevant Gemini Service Provider (as applicable) used commercially reasonable efforts to prevent or limit such …’. Bitcoin Suisse AG, ‘General Terms and Conditions’ accessed 25 April 2024, as follows: ‘Specifically, BTCS shall not be liable for damages …, to the extent permitted by law, if such damages: … occur due to circumstances, both within and outside of BTCS’ control, that cause the Services to become unavailable, including routine maintenance.’
For the widespread practice of liability caps, cf Zetzsche and Nikolakopoulou (n 3).
Since MiCA is silent regarding other losses, the fallback is the applicable national law liability regime.
MiCA, art 75(8). The equivalent provision is AIFMD art 21(12) and UCITSD art 24 (1).
ibid. art 75(4).
cf Arner and others (n 9) 8–10.
cf ESMA75-453128700-438, 19, 21, 22.
MiCA, title V ch 1.
MiCA, arts 66 and 72.
MiCA, title V ch 2.
MiCA, arts 75(7) and 70(3).
MiCA, art 70.
MiCA, art 75(1)–(3) and (5).
MiCA, art 75(8) and (6).
We have seen several examples indicating that when the regulation of a jurisdiction on crypto-asset service providers becomes strict, crypto firms choose to seek license/registration in other jurisdictions to circumvent them. For instance, cf William Langley and Chan Ho-him, ‘Hong Kong digital assets exchange warns over viability of city’s new crypto rules’ Financial Times (12 April 2024). accessed 25 April 2024.
MiCA, rec 22.
See Zetzsche, Arner and Buckley (n 55) 172–203.
Zetzsche and others (n 9) 16.
MiCA, arts 70 and 82, respectively.
MiCA, art 72. In the context of conflicts of interest management, ESMA proposes remuneration policies, procedures and practices of the CASPs. cf ESMA74-449133380-425, 37–38, 123–135.
ibid art 85.
The French regulator, for instance, has clarified that crypto-lending and -staking may constitute, depending on the agreed Terms and Conditions, crypto-asset services or payment services and in each case the respective legislation should apply. cf AMF, ‘Position—Recommendation AMF—Questions and answers relating to the regime for crypto-asset service providers’ DOC-2020-07, 34.
MiCA does not provide any substantive provisions besides MiCA, art 82. The focus is on definitions. See MiCA, art 3(1)(26) (‘providing transfer services for crypto-assets on behalf of clients’ means providing services of transfer, on behalf of a natural or legal person, of crypto-assets from one distributed ledger address or account to another); MiCA rec 93 (‘Such transfer service should not include the validators, nodes or miners that might be part of confirming a transaction and updating the state of the underlying distributed ledger. Many crypto-asset service providers also offer some kind of transfer service for crypto-assets as part of, for example, the service of providing custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds or other crypto-assets, or execution of orders for crypto-assets on behalf of clients. Depending on the precise features of the services associated to the transfer of e-money tokens, such services could fall under the definition of payment services in Directive (EU) 2015/2366. In such cases, those transfers should be provided by an entity authorised to provide such payment services in accordance with that Directive.’).
cf Zetzsche, Annunziata and Sinnig (n 52), 37–38.
In similar vein, see on the criticism of the 2022 US SEC staff accounting bulletin (SAB) on accounting for custodied crypto-assets because the proposed inclusion of the custodied crypto-assets on the balance sheet of banks acts as a major deterrent for banks to engage in any crypto custody services. cf Celisa Morin and Will Atherton, ‘A SAB state of affairs: SEC guidance deters U.S. financial institutions from providing crypto-asset custody’ (ReedSmith, 25 July 2023) accessed 25 April 2024 and Bill Flook, ‘Resolution Nixing SEC Crypto Accounting Guidance Clears House Committee’ (Thomson Reuters, 1 March 2024) accessed 25 April 2024.
MiCA, art 67 and Annex IV require that custodians have a regulatory capital of EUR 125,000 plus a quarter of the fixed overhead costs of the preceding year. For instance, where there fixed overhead costs amount to EUR 3 million (which we estimate is a reasonable amount for a fairly large CASP with 20 to 30 employees) the overall regulatory capital available will sum up to EUR 875,000. In the absence of additional banking business, these custodians will hardly be able to cover large losses of token holders.
We also see some spill-over effects: where custodians depend on custodial networks the prevalence of many small and thinly capitalized crypto custodians paired with liability rules will mute the readiness of the well-financed (traditional or DeFi-only) custodians to enter the market.
Zetzsche and others (n 9) 46–47.
cf Bains and others (n 33) 22.
MiCA, art 2(1).
For a geographical breakdown of the prominent crypto custodians cf Zetzsche and Nikolakopoulou (n 3).
Idem for the possibility of non-protection of the clients’ assets in case of insolvency when the safekeeping has been delegated to third parties. Several contractual clauses in the researched Terms and Conditions have mentioned the fact that the third-parties (sub-)custodians reside in third-country jurisdictions where the local legislation applies as a factor that undermines the protection of the custodied assets in case of insolvency, indicating possible deterioration of the clients’ position when outsourcing to several jurisdictions lacking the EEA’s legal safeguards takes place.
art 67 and Annex IV MiCA sets the mandatory capital of CASPs providing crypto custody at EUR 125,000 plus a quarter of the annual fixed costs.
AIFMD, art 11(d), UCITS, art 22a(3), Commission Delegated Regulation (EU) 2018/1618 of 12 July 2018 amending Delegated Regulation (EU) No 231/2013 as regards safe-keeping duties of depositaries [2018] OJ L271/1, rec 2, Commission Delegated Directive (EU) 2017/593 of 7 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to safeguarding of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits [2016] OJ L87/500, art 2(1)(d).
According to ESMA’s consultation paper, the CASP shall keep records from the third-party CASP evidencing the positions of the clients and shall keep records of the communications evidencing that the CASP complied with MiCA, art 75(9) subpara 2, when the CASP uses other CASPs for safekeeping or controlling the crypto-assets or the means of access. cf ESMA75-453128700-438, 171–172.
According to ESMA, the business continuity plan of the CASP shall take into account the potential impact of the insolvency or other failures of third-party service providers, death of a key person and, where relevant, political risks in the service provider’s jurisdiction. cf ESMA74-449133380-425, 86.
MiCA, art 75(7).
For an overview of the asset segregation and commingling practices on-chain as well as off-chain, cf Zetzsche and Nikolakopoulou (n 3).
For issues stemming from that reliance with regard to investment fund depositaries, see Isabelle Riassetto, ‘La segregation des instruments financiers et le depositaire d’OPC’ (2018) 5 Revue de Droit Bancaire et Financier 25.
cf (n 140).
cf ‘Custody contract, policy and procedures under Article 75 MiCA’ section.
cf MiCA, arts 66, 72, 75(2), (7) and (5).
MiCA, arts 70(1) and 75(7).
MiCA, art 74.
On the clients’ entitlements to crypto-assets according to the Terms and Conditions of the prominent crypto custodians. cf Zetzsche and Nikolakopoulou (n 3).
cf Woxholth and others (n 27) 7–19; Ignacio Tirado and Louise Gullifer, ‘Proprietary rights and digital assets: a “modest proposal” from a Transnational Law perspective’ (2024) 87(2) Law and Contemporary Problems, forthcoming. For an argument that streamlining of crypto insolvency laws is a priority, cf Zetzsche and others (n 9) 91.
The obligation of the custodian to protect the ownership rights of the client may be circumvented if the clients have no ownership over the assets, while the custodian or any third party appears as the owner. cf Foris DAX Limited, ‘Exchange Terms and Conditions’ accessed 25 April 2024, as follows: ‘Subject to clause 5.4 [Custodial arrangements for jurisdictions and clients for which certain special safekeeping rules apply] … you grant Crypto.com and/or its Affiliates (as applicable) the rights to all On-Exchange Assets … b) your rights in relation to any On-Exchange Assets are limited to a contractual obligation for Crypto.com to provide an equivalent amount and type of On-Exchange Assets.’. BitMEX, ‘BitMEX HK Risk Disclosure’ accessed 25 April 2024, as follows: ‘… you do not have any proprietary claim in respect of any digital assets transferred to the Company or any Account balance.’
MiCA, title III chs 2, 3 and 6.
MiCA, title IV ch 1.
See MiCA, title III ch 6 and art 55. For a detailed analysis, see Zetzsche and Woxholth (n 45) ch 6 (forthcoming).
According to proposals by ESMA, the CASP needs to ensure that the clients have separate wallet addresses from the CASP’s own wallet address. However, with regard to the segregation of the clients’ assets, the CASP only needs to disclose how they segregate clients’ crypto-assets. cf ESMA74-449133380-425, 60, 91.
MiCA, arts 70(1), 75(2), (4), (5) and ESMA (in its initial proposal) require CASPs to keep records that the CASPs can distinguish crypto-assets held for one client from crypto-assets held for other clients and from their own assets. cf ESMA75-453128700-438, 161–62, 170–72.
For an overview of the crypto-asset segregation and commingling practices on-chain as well as off-chain, cf Zetzsche and Nikolakopoulou (n 3).
cf AIFMD art 21(8) and (11), Commission Delegated Regulation 2018/1618, rec 2, UCITSD, arts 22(5) and 22a, Commission Delegated Directive (EU) 2017/593, art 2.
Malicious actors usually attack omnibus wallets to take advantage of multiple clients’ assets.
On omnibus accounts transparency requirements, see Recommendation 14 in International Organization of Securities Commissions (n 34).
For instance, many custodians claim in their Terms and Conditions that they don’t reuse the clients’ assets for their own account but merely all of the custodians have a security interest, lien, right to set-off or title transfer arrangements in place to cover any (present or future) outstanding claims they have against their clients, which seems to be at odds with the absolute obligation to keep the clients’ assets unencumbered as per MiCA Recital 83. For further analysis, cf Zetzsche and Nikolakopoulou (n 3).
Arner and others (n 9) 24–25.
Eg. MiFID, art 16(8) to (10), Commission Delegated Directive (EU) 2017/593, arts 5 and 6. On title transfer arrangements regarding crypto-assets cf International Organization of Securities Commissions (n 34); Financial Stability Board (n 32).
For instance, when each client’s assets have their own blockchain wallet address.
UCITSD, art 22(3) and (4) and AIFMD, art 21(7) and (9).
Dirk Zetzsche, ‘Aktivlegitimation gem€aß §§ 78, 89 KAGB im Investment-Drei- und -Viereck’, in Matthias Casper, Lars Klohn, € Wulf-Henning Roth and Christian Schmies (eds), Festschrift fur € Johannes Kondgen € (RWS 2016) 677–700.
See Dirk Zetzsche, ‘Das grenzuberschreitende € Investmentdreieck’, in Dirk Zetzsche and Matthias Lehmann (eds), Grenzuberschreitende € Finanzdienstleistungen (Mohr Siebeck 2018).