Blockchain-Regulatory and the potential to revolutionize the global financial ecosystem.
Bass Hatvani Robert
CHIEF MAGNET IN BUSINESS ARCHITECTURE at SSR - STRATEGIC SUPPLY CHAIN REDUNDANCY
Summary
Cryptoassets are worth paying attention to as they have the potential to revolutionize the global financial ecosystem. Reducing friction has been a key element of the history of financial innovation. There is friction in the global economy, and that friction led to the invention of cryptoassets. That very friction will also define the staying power of cryptoassets as we look forward.
Cryptocurrencies like Bitcoin are one type of cryptoassets. Assets like Bitcoin are not truly currencies yet. They can be units of account, but they are not yet a store of value or a medium of exchange to be full-fledged currencies. There are many others types of cryptoassets, such as stablecoins, security tokens, and utility tokens.
Together, these assets, coins, and tokens have led to the emergence of the tokenized economy, which is one of the more promising use cases of crypto. Global financial services institutions are looking to actively retool and participate in this blockchain-based tokenized economy.
Institutionalization is the necessary next step for crypto and is required to build trust, facilitate scale, increase accessibility, and drive growth.
There are many challenges facing organizations as they institutionalize crypto. Establishing product-market fit, complying with regulatory and tax obligations, managing forks, addressing cyber risk, determining asset provenance, and updating financial reporting are all top-of-mind concerns for crypto businesses.
Lessons learned from traditional business models are still applicable, but organizations will need to channel these through a crypto lens. Organizations should look to proactively get in front of these challenges and prepare for a changed future. There is a need for a comprehensive framework and crypto-specific capabilities to support this transformation and prepare for a changed future.
A new world of finance is emerging in which transacting in cryptoassets may become standard procedure. New tokens and assets are one thing, but new business models and market participants may redefine the space significantly over the next few years.
Foreword
Kiran Nagaraj - Managing Director, KPMG
Constance Hunter - Chief Economist, KPMG
Judd Caplain - Global Banking & Capital Markets Leader, KPMG
Cryptoassets (or crypto) have garnered significant attention from the media, financial analysts, governments, regulatory institutions, and investors over the last year and a half. Crypto is defined broadly as digital units of account in which cryptographic techniques are used to regulate the generation and distribution of units on a blockchain.
In practice, crypto means multiple things to different people: an investment asset class like commodities, a store of value like gold, a legitimate medium of exchange, a covert method of exchange, an immutable record of rights and ownership, or even an incentive mechanism like rewards points.
In this paper, we use "crypto" to refer to all cryptoassets. Cryptocurrencies, security tokens, and utility coins are different types of cryptoassets. Some of these terms may be used interchangeably, particularly where concepts are applicable broadly to all types of assets, tokens, and coins.
Cryptoassets have potential. But for them to realize this potential, institutionalization is needed. Institutionalization is the at-scale participation in the crypto market of banks, broker dealers, exchanges, payment providers, fintechs, and other entities in the global financial services ecosystem. We believe this is a necessary next step for crypto to create trust and scale.
This paper provides an overview of the crypto market, introduces the emerging tokenized economy, and identifies the key challenges to the adoption of crypto in the global financial services ecosystem. We also introduce KPMGs Cryptoasset Framework to help address these challenges. The framework underpins KPMGs crypto capabilities that have been developed through our work with crypto exchanges, start-ups, and large financial services organizations.
Cryptoassets are a big deal
The case for crypto and institutionalization
Creating an open financial system and why institutionalization is key
KPMG Cryptoasset Framework
Key challenges facing institutionalization of crypto
Accounting and financial reporting
Crypto economics
Cryptoassets are a big deal
Cryptoassets are worth paying attention to. In 2017, we saw crypto competing against financial products for investment dollars across the traditional asset classes of stocks, bonds, commodities, and derivatives. The parabolic rise in market participants, coins, prices, and market capitalization is still dwarfed by traditional asset markets, however, which are more than $300 trillion globally. Nevertheless, crypto continues to garner both good and bad press, and the debate between supporters and detractors is far from settled.
In 2018, we are seeing a wave of new entrants in the market such as security token platforms, stablecoins, and even established financial services institutions that are launching crypto products and services. Cryptoassets are now impossible to ignore.
THE CASE FOR CRYPTO AND INSTITIUTIONALIZATION
Kiran Nagaraj - Managing Director, KPMG
Sal Ternullo - Manager, KPMG
Of the more than 2,000 cryptoassets issued or generated, many, including those with lofty valuations, do not even have a functional product associated with them. Further, these are also not yet currencies as we discuss in the Crypto economics section.
So, is crypto a solution looking for a problem? No, there are real problems in the global financial services ecosystem that cryptoassets are looking to address. More participation from the broader financial services ecosystem, will help drive trust and scale for the tokenized economy and help the crypto market grow and mature.
Examples of crypto use cases
Bitcoin, which is becoming an investible asset class like unallocated gold, has the potential to become a store of value that is natively digital, generationally relevant, and an alternative to traditional asset classes.
Ethereum has enabled Initial Coin Offerings (ICOs) as an alternate means of raising capital. The ICO space suffers from fraudulent activity and a lack of governance, accountability, and investor protection afforded by regulated capital markets. But ICOs represent an important innovation, providing new pathways and more efficient flows for capital from a significantly wider group of investors.
Litecoin has been used to transfer the equivalent of $99 million for less than $1 of transaction fees 9 within minutes. This transaction could have been initiated by anyone located anywhere around the world without the need for any intermediaries or third parties. While transaction times were still fairly slow compared to a Visa or a MasterCard transaction, this example represents a significant improvement compared to the speed and accessibility of existing cross-border payment rails such as wire transfers.
Tokenization - the creation of natively digital tokenized representations of traditional (and emerging) assets that are issued, traded, and managed on a blockchain can reduce friction and overhead costs associated with the issuance, transfer, and management of traditional assets such as securities, commodities, and real estate assets.
Cryptoassets that are tokenized versions of traditional assets could also fit well within existing regulatory frameworks, which may mitigate some regulatory uncertainty surrounding newer cryptoassets. Tokenization of traditional assets could also help increase liquidity, codify rules and regulations, and increase transparency throughout the asset lifecycle.
The staying power of many cryptoassets will be defined by their ability to reduce friction and inefficiencies that currently exist within the global economy. Volatility is widely quoted as a significant limitation for the use of crypto for any use case. While volatility is certainly a problem, it is important to recognize that these assets are still fairly immature and will become less volatile as they mature. There are also significant efforts that are underway across the industry for the creation of what are called "stablecoins" to address the volatility problem.
Advancing the tokenized economy
Cryptoassets may change the financial services landscape significantly with the emergence of the tokenized economy. While it is still early stages and it is hard to predict how the next 10 years will play out, the tokenized economy will likely be one of the more impactful innovations enabled by crypto.
Alongside a wave of interest from institutions in popular cryptoassets, such as Bitcoin, there has been an increasing market focus on tokenization. Crypto products and services are already starting to pivot and the global financial services ecosystem is also beginning to retool itself for the tokenized economy.
Products and services
Two types of products and services are emerging for this economy?the cryptoassets or tokens represented by the dotted lines flowing through the various layers in the illustration and the infrastructure that enables the issuance, facilitation (e.g., exchange and custody), and utility (e.g., store of value, ownership, and rights) of these tokens. Token generation is relatively easy, and more tokens will continue to proliferate within the ecosystem.
However, that does not mean that every token can be trusted to meet market needs. "Trustware" will be an especially important layer for this economy. Unlike traditional financial assets, trust will be driven not only by independent organizations like regulators and auditors, but also by technology through innovations such as consensus mechanisms.
Institutional participation is required to facilitate scale and increase trust for this emerging economy. A single institution may take on multiple roles, but there are certain information barriers that will need to be maintained. For instance, a token issuer cannot also play the role of the only trust agent for that issuance. While the industry is building infrastructure in anticipation of widespread use of tokens, a greater demand for these tokens must be developed. This will happen only if products meet market needs.
Product-market fit
Achieving product-market fit is a journey, and cryptoassets are in promising but mostly early stages of this journey. It is important for token issuers and generators to ask some key questions about product-market fit:
As tokens evolve and their respective use cases achieve adoption, the associated infrastructure will also improve to enable greater institutionalization.
Todays internet leaders look different than they did in the late 1990s or did not even exist when the dot-com era began. We recognize and expect a lot of pivots, mergers, acquisitions, and failures that will redefine the crypto landscape in a few years.
Just as internet protocols like TCP/ IP and HTTP enabled the sharing of information in an open way, the blockchain-based tokenized economy will enable the digitization, storage, and trusted exchange of value.
The Crypto landscape and token economy
A Coinbase perspective
Jeff Horowitz - Chief Compliance Officer, Coinbase
Eric Scro - VP, Finance, Coinbase
Cryptoassets create a huge opportunity to potentially revolutionize the financial sector to create a truly open global financial system.
The current global financial system faces a number of challenges. For one, access to financial services is not guaranteed everywhere. In the U.S., we have a stable store of value in the dollar, banks, and payment rails that allow us to purchase goods and services and the ability to transfer funds from our phones. Lets take the example of Argentina, where they currently see hyperinflation.
A globally accessible, decentralized store of value could have a significantly stabilizing impact on the country?s economy. Bitcoin could potentially represent such a store of value in the future. Interestingly, even though there are large price fluctuations with Bitcoin, it is not inherently volatile. The supply is in fact fixed and algorithmically secured. It is the demand that is fluctuating and this could eventually stabilize as the market matures.
Another challenge that the financial Sector faces is in accessibility to payments networks. The current payments system has a lot of inefficiencies and intermediaries that make moving money around the world quite difficult because of the use of proprietary, bespoke payment networks that do not always interact with one another.
Why is it faster to take out $10,000 in cash, buy a plane ticket, fly to Australia, and hand the cash to someone than it is to wire those funds? Coinbase considers a truly open global financial system as one that is not controlled by any one country or company. As a result, it drives greater economic freedom, innovation, efficiency, and equality of opportunity for the world.
Crypto may help overcome many of the problems of the existing financial system. They generally are not controlled by a central bank or authority they are exchanged on a peer-to-peer network that allows anyone to access them, invest in them, and exchange them. In addition, the open protocol design of crypto will encourage the technological innovation necessary to create a fast, inexpensive payment network that connects anyone, anywhere.
There has also been an explosion in cryptoassets with a lot of innovation and experimentation happening in this space. Developers continue to flock to the space to build applications and services on top of various blockchains. Within the next couple of years, Coinbase expects to see the broader use cases that will natively use crypto to democratize access to services. Examples of current use cases being worked on include tokens being used for distributed file storage and processing and even reimagining the way users pay for generating and consuming online content.
Blockchain technology can do for value what the internet did for information. To achieve the vision of a truly open global financial system, it is not enough for a few hundred, thousand, or even million individual consumers to adopt this new technology.
The path forward
Coinbase believes crypto will mature in three stages: investment/speculation (which the industry is currently in), institutionalization, and utility. The institutionalization and utility phases may happen concurrently. But, to move from investment/speculation to utility, crypto needs to become more liquid, trusted, and accessible.
Institutionalization of crypto
Unlike most other asset classes in the modern financial system, crypto did not start with institutional adoption but rather with retail trading. Consequently, the platforms and products were largely built and designed with retail customers in mind. To encourage institutional adoption, Coinbase is building the infrastructure required for large players to enter the space such as a high-frequency, low latency matching engine, transparent and efficient price discovery tools and a qualified custodian that allows the safe storage of assets in a compliant manner.
Institutions have a different set of requirements than retail consumers and need to see a focus on compliance, transparency, and governance to comfortably use and transact with crypto. Institutional interest is growing, and many of the worlds largest financial institutions are beginning to actively trade crypto or at least consider it.
Regulatory agencies are also beginning to seriously discuss cryptoassets, which could help drive institutional participation, encouraging the marketplace to think about how engagement with these assets fits into both existing rules and regulations and new frameworks that may be needed for crypto.
The focus on crypto innovation must not come at the expense of security, compliance, and consumer protection. Leaders in the crypto space, including crypto entities and industry partners, have a responsibility to help influence andeducate key legislators and regulators to advance the overall governance and enforcement framework.
In many ways, leading crypto companies should aspire to meet the standards and leading practices established by traditional financial services companies. We believe this will help promote trust and accelerate the adoption of crypto by investors and institutional clients.
Compliance with regulatory obligations: A patchwork of regulations has emerged and continues to evolve. Maintaining compliance with laws and regulations related to an array of financial crimes is already a major challenge.
Now, regulators are focusing in on crypto businesses. What are some of the key regulatory obligations for a crypto business? In the following pages, we examine the major challenges facing the crypto industry as organizations look to introduce crypto products and services and scale their businesses.
Fork management and governance: Forks occur when a single crypto blockchain breaks into two separate chains. They have a significant impact on crypto businesses. To both decide on fork acceptance and to continue to run effectively after a fork event, how does a business manage the technological, operational, financial, accounting, tax, and customer relationship implications of the fork?
KYC and cryptoasset provenance: Crypto owners are identified not by names or account numbers but by cryptographic addresses that can be created at any time, by anyone, anywhere. This presents a unique challenge to KYC programs. How does a crypto business determine asset provenance and build its KYC program?
Securing cryptoassets: Given the potentially high value of cryptoassets and the natively digital nature, crypto businesses and their customers are prime targets for cyber criminals. How can a business build a cybersecurity program for securing cryptoassets?
Accounting and financial reporting: Cryptoassets challenge traditional financial reporting boundaries. The accounting for these assets is an emerging area, with limited industry guidance. How should a crypto business account for crypto transactions and assets?
Tax implications: Information regarding the tax treatment of crypto remains limited. Crypto businesses may face sizable tax liabilities incurred on the sale or exchange of crypto and bear significant tax accounting burdens with respect to their holdings. What are the key tax implications for a crypto business?
By Coinbase and KPMG
Jeff Horowitz - Chief Compliance Officer, Coinbase
Tracy Whille - Principal, KPMG
Robert Virgilio - Director, KPMG
Compliance with regulatory obligations - Key challenges facing institutionalization of crypto
Financial services institutions are intimately familiar with the challenges the industry faces in order to efficiently and effectively maintain compliance with laws, rules, and regulations, including those related to investor protection, market surveillance, antimoney laundering (AML), financial crime prevention, and fraud. But how does crypto adoption impact regulatory compliance?
A U.S. regulatory perspective
The explosion of consumer interest and investment in cryptoassets, in addition toincreased participation of traditional financial institutions in this asset class, has U.S. federal and state regulators keenly focusing on the regulatory obligations of the crypto businesses. When cryptoassets become institutionalized, they will likely also be traded in other markets similar to assets like commodities. In many cases, cryptoassets may have different regulators (e.g., SEC, FINRA, CFTC, etc.) depending on what type of specific asset they are considered.
Cost of noncompliance
Regulatory authorities have not been shy about enforcing regulations related to cryptoassets. A crypto exchange was fined $110 million for failure to detect suspicious transactions and file suspicious activity reports (SARs).
The current patchwork of U.S. federal and state regulations governing the crypto industry has created a challenging regulatory climate for crypto businesses. Here, we review some current regulations that apply to crypto businesses:
Security tokens bring regulatory challenges of their own
Cryptoassets deemed securities (also referred to by many as "security tokens" or "crypto securities") are becoming an important part of the emerging tokenized economy. Before listing and offering trading of a cryptoasset, an exchange should evaluate whether the asset is a security.
Those deemed as securities may require trading to be conducted through a registered broker-dealer and elicit an array of securities laws, rules, and regulatory requirements. If crypto businesses want to offer these products, they will need to address requirements of this new asset class and will likely need to establish a broker-dealer business. Below are some of the key requirements and challenges that the industry is facing related to security tokens:
Regulators are working to keep pace with crypto innovation while seeking to protect the investing public. Crypto businesses will need to clearly define their product offerings in order to navigate the evolving state and federal regulatory landscape.
It is in a crypto organizations best interest to get ahead of the evolving regulatory landscape, and we are already seeing organizations take this proactive approach.
Fork management and governance - Key challenges facing institutionalization of crypto
Adam Hirsh - Managing Director, KPMG
Agha Khan - Manager, KPMG
Forks are a unique aspect of cryptoassets that occur when a single blockchain breaks into two separate chains. These breaks can be separated into two categories: soft forks and hard forks (see sidebar). Enhancements to underlying technology, extenuating circumstances, or even philosophical differences can lead to a fork event.
Forks have a significant impact on crypto businesses. To both decide on fork acceptance and to continue to run the business effectively after a fork event, organizations must perform an end-to-end assessment of the financial, technological, operational, and customer relationship implications of the fork.
Soft forks versus hard forks
Soft forks occur when the majority of miners agree on a change to the underlying software of a cryptoasset. All transactions going forward are backward compatible with the existing blockchain, even those that did not follow the majority.
This backwards compatibility is the key difference between hard and soft forks and influences the burden of their implementation on crypto businesses. Hard forks occur when the full network makes a significant change to the underlying software of a cryptoasset.
Typically, all transactions on the existing blockchain will be recognized as of the hard forked networks start date. However, any transactions that occur after this start date will be incompatible and, therefore, not recognized by the original blockchain.
Based on our experience helping organizations manage forks, here are some key questions to consider:
Successful and efficient handling of forks requires a consistent framework and strong governance from all stakeholders of a crypto business, including front office, customer sales and trading, legal, credit and market risk, compliance, finance, tax, strategy, operations, technology, and cybersecurity.
Organizations can charter a governance committee to evaluate strategic and risk concerns and enable a decision structure for forks that will impact both the cryptoasset and related products and services.
To ensure consistency in decision making around whether to participate and where to invest to support the fork, the governance committee should follow clear and documented policies that address:
It is also important to note that organizations may choose to retain the right to determine which fork will be used as the reference currency for portfolio pricing and valuation rights that can be enforced on customers through legal agreements.
In several instances, crypto entities and exchanges have chosen not to support trading in certain forked currencies. For example, in October of 2017, Bitcoin Gold was created as a result of a hard fork from Bitcoin. There was general disagreement and concern about the technology behind Bitcoin Gold and potential vulnerabilities. As a result, the cryptoasset was not recognized or listed by many major cryptoasset exchanges.
Tax implication of forks
Both Bitcoin and Ethereum experienced hard forks that resulted from a change in the protocol.
This led to some difficult tax-related questions that have not yet been addressed:
First, does any taxable income result from the duplication of the Bitcoin protocol? Immediately before the hard fork, the taxpayer owned one Bitcoin. Immediately after the hard fork, the taxpayer owned one Bitcoin and one Bitcoin Cash. The Bitcoin Cash has value and can be sold for dollars.
While not addressed in the limited IRS guidance on crypto, a number of practitioners believe that a hard fork is a taxable event to the holder under general tax principles. However, what is the nature of that income? Is it akin to a dividend? Does it occur at the time of the hard fork or later when the crypto is claimed?
Second, what is the taxpayers tax basis in the forked coin? Consider, for example, the Ethereum fork. A taxpayer owning Ethereum on the date of the Ethereum fork received new Ethereum (ETH) at the time of the fork and continued to own Ethereum (now referenced as Ethereum Classic (ETC)).
If the amount paid for the original Ethereum remained with the ETC, the taxpayer would be treated as having paid nothing for the ETH, unless the taxpayer recognized some gain at the time of the fork or when the taxpayer claimed the ETH. As a practical matter, ETH is considered the "true" Ethereum.
If no tax basis is allocated to ETH in connection with the fork, a taxpayer using ETH may have significantly more gain than what seems appropriate and would not have a way to recover what the taxpayer originally paid for Ethereum prior to the fork.
KYC and cryptoasset provenance
John Caruso - Principal, KPMG
Michael Pavlick - Director, KPMG
Ladi Ajayi - Manager, KPMG
Key challenges facing institutionalization of crypto & Establishing a Know your customer (KYC) program
A KYC program focuses on verifying the identity of customers and sufficiently understanding their background and risk profile. FinCEN considers crypto exchanges to be MSBs, subjecting them to existing banking regulations related to AML, Customer Identification (CIP), KYC, transaction monitoring, and various financial reporting requirements.
Crypto businesses should look to establish AML programs similar to those of traditional financial institutions and MSBs, including but not limited to Customer Onboarding and KYC processes, transaction monitoring for suspicious activity, and OFAC/Sanctions screening capabilities.
AML Compliance programs, including KYC programs for the crypto business? customer base, are being tailored to address the unique risks and challenges of the crypto market. This will be essential to detect real suspicious activity while avoiding inefficiencies and compliance fatigue.
The major crypto providers are actively looking to strengthen their AML programs, including KYC and transaction monitoring and if not, they should be. This could include, for example, requiring information about expected transactions and counterparties, or source of wealth analysis and enhanced due diligence for high-risk customers.
Transaction monitoring systems should also not be limited to solely monitoring fiat transactions of crypto customers, but be designed to address the unique risks of their crypto transaction activity as well.
Determining cryptoasset provenance
The underlying encryption features of blockchain technology can allow for higher degrees of privacy and anonymity for certain cryptoassets. On one hand, counterparties in a crypto transaction are identified not by names or account numbers, but by cryptographic addresses that can be created at any time, by anyone, anywhere. The contrary to that perception, however, is in the blockchain itself, wherein all addresses and their transactions involved are preserved and accessible by anyone, anywhere.
Many major exchanges have undertaken the collection of KYC information and are now an important source of data for the identification of a large percentage of addresses for certain cryptoassets. However, there will continue to remain a sizable percentage of addresses that are not exchange customers or have no available KYC information.
Further, emerging cryptographic mechanisms including zero-knowledge proofs (ZKP), ring signatures, and other privacy-centric approaches may impact an organizations ability to determine cryptoasset provenance.
It is important to acknowledge that a degree of anonymity does not mean that transactions are inherently illegal or malicious. Anonymity presents a unique challenge to KYC programs, specifically the requirement for organizations to maintain the ability to identify and monitor the provenance of customers cryptoassets, the parties they are transacting with, and their overall crypto transaction activity.
Counterparties in a crypto transaction are identified not by names or account numbers but by cryptographic addresses that can be created at any time, by anyone, anywhere.
Crypto businesses can take advantage of the underlying blockchain technology to analyze and determine the provenance of customers cryptoassets. Such analysis is not easy but can be aided by the use of third-party data providers. The analysis can enable traceability of cryptoassets and identify if given crypto address may have been involved in foul play.
While there are ways a fraudster can intentionally distort or confuse the history of the assets (e.g., using services such as "tumblers" or "mixers" 13 ), sophisticated data analytics could identify instances in which these programs were used and can assign an appropriate risk rating for transactions. Using these data providers and other blockchain features, crypto businesses can start to build a view of the provenance of customers cryptoassets over time.
This will also have to be balanced with a crypto business's need for protecting competitive intelligence. Standard practices around determining cryptoasset provenance (e.g., number of hops to look back within the blockchain) are yet to be established, and organizations will need to consider this risk as part of the buildout of their KYC.
There are still a number of open questions about how institutions should apply existing regulations to crypto transactions:
Are cryptoassets physical? Financial institutions are required to file a currency transaction report (CTR) for physical cash transactions of more than $10,000. Crypto by definition is not physical, but it is still treated and used as cash by some.
Do cryptoassets travel? The Travel Rule predominantly designed for wire trans-actions requires financial institutions to provide certain information to the institution accepting the transaction, but the decentralization and anonymity of cryptoassets may impede compliance with the rule.
领英推荐
What about Office of Foreign Assets Control (OFAC) and Sanctions obligations? The OFAC is considering adding crypto addresses to its list of persons or entities that are sanctioned or blocked from financial activity.
Do crypto trading platforms need a license? New York State requires virtual currency businesses to obtain a BitLicense that set extensive AML, cybersecurity, and fraud rules. Other states have similar but less extensive licensing requirements. It remains to be seen if this idea will be adopted federally.
Securing cryptoassets - Key challenges facing institutionalization of crypto
Kiran Nagaraj - Managing Director, KPMG
Sam Wyner - Manager, KPMG
Anderson Salinas - Manager, KPMG
Security is front and center for cryptoassets, given the heightened cyber risk associated with them.
Since cryptoassets are natively digital and often have high value, crypto businesses that transact with these assets are prime targets for cyber criminals. If hackers breach an organizations crypto infrastructure, they can transfer crypto out to external addresses, leaving the organization with little or no recourse.
Crypto transactions also occur over the open internet, which makes both the tokens and any associated services vulnerable to a variety of traditional cyberattacks, such as a phishing or malware attack. Further, even organizations that do not have any crypto operations are now targets for hackers who are looking to steal computing power that they can use for crypto mining.
As part of our crypto research work, we have analyzed many cybersecurity incidents that have impacted crypto exchanges in the past few years. The attack vectors and root causes span a wide spectrum.
Examples include auditor account compromise, server failure due to DDOS, unencrypted data stores, phishing attacks, smart contract bugs, software vulnerabilities, order sequencing issues, security update failures, and poor wallet tiering among others. Most, if not all of these, are not new and unique for the crypto space.
It is clear from these that lessons learned from decades of security and risk management experience with other traditional and emerging technologies are still applicable.
In addition, a number of leading crypto security practices have emerged in the last two to three years includingcrypto address whitelisting for warm storage, geographic distribution of Hardware Security Module (HSM) keys, sharding, and many others.
There is a need for crypto-specific security standards that complement existing security frameworks such as those published by NIST and ISO. While some efforts are now underway across the industry to develop these, crypto businesses should look to build their cybersecurity programs by starting with a baseline from existing industry practices and then add-in crypto-specific security practices to provide a layered defense model.
While specific crypto security practices are confidential and vary greatly from one crypto business to another, some leading industry approaches are emerging. We discuss some of them in this section.
Blockchain threat monitoring
Many cryptoassets rely on public decentralized blockchain networks, which are not directly under the control of a single organization. Miners or groups of miners (mining pools) typically provide the hashing power that collectively control these networks.
This makes blockchains vulnerable to a bad actor that gains majority control of mining nodes, since the majority determines which transactions are valid. As of August 2018, the top four Bitcoin mining pools control around 54 percent of the total hash power of the network. 14 There was even a period of time in 2018 when a single mining pool represented more than 25 percentof the hashing power for Bitcoin. This represents a concentration risk.
Businesses, therefore, need to build sufficient blockchain monitoring capabilities to pro-actively identify such threats that could impact their operations and client assets.
Blockchain monitoring should also include the use of geographically dispersed nodes. These nodes can not only enable monitoring of the status of the network globally, but also provide the ability to better monitor the source of transactions being submitted to the network.
Organizations will also need processes for actively responding to the threat information collected by these blockchain-monitoring capabilities. They should consider which threat metrics should be integrated into their existing risk reporting processes to drive faster decision making. This information could also help drive business decisions around which cryptoassets to continue supporting.
Key management and tiered storage
Cryptoassets are typically stored in hot and cold storage facilities. Hot storage facilities afford more liquidity but are also more susceptible to hacking. Cold storage facilities?which are physically offline and disconnected from the internet are the least liquid but more secure. In some cases, warm storage facilities are used to provide temporary storage of assets as an additional layer of security before assets are moved to cold storage.
To protect client assets, organizations should keep only enough crypto in hot storage to facilitate daily business operations. The majority of crypto should be kept in cold storage. In addition, organizations should develop specific operational procedures to facilitate the movement of crypto between cold and hot storage and mitigate the risk of collusion.
Organizations should also create a crypto-specific team staffed with personnel who have been trained on how to deal with this specialized asset, including with respect to internal policies for managing the storage and the processing of crypto transactions. This team should also verify and confirm clients on-chain transactions by comparing internal transaction details with the clients blockchain records and wallet details.
Resiliency and recovery of keys
Cryptoassets typically utilize Public Key Infrastructure (PKI). PKI has always presented challenges for resiliency and disaster recovery, but those challenges are magnified forcrypto operations, which are thoroughly dependent on the availability of public and private keys to transfer assets.
Organizations managing key pairs will need to develop resiliency and disaster recovery plans for securing private keys within each storage tier and for each type of crypto. However, traditional techniques, such as the use of HSM, may fall short, given the physical dependence on the HSM. A destroyed or unavailable HSM could mean lost or unavailable cryptoassets. In addition, other traditional resiliency techniques, such as high availability, either compromise security or are simply not technically possible for an air-gapped cold wallet.
Multisignature systems and third-party wallets enable organizations to secure private keys while enabling resilience across storage tiers. Using a multisignature system can allow organizations to split up keys or require multiple signatures from separate keys to complete a single transaction. This also helps drive segregation of duties and limit potential collusion.
Organizations managing their own private keys should also expand their existing business continuity and disaster recovery plans to include their cryptoassets and related systems. It is also important to recognize that the key recovery features do differ across the various cryptoassets and the underlying protocols. These differences will also need to be factored in part of an organizations key recovery strategies.
Wallet code review
In an incident last year, a vulnerability found in the Parity wallet for Ethereum allowed remote ownership of the multisig function of the wallet, giving full control of funds to the hacker that led to the loss of $300 million equivalent of Ether. 15 Today, many crypto businesses use open-source code, allowing extensive code review by the community and increasing trust in systems, but vulnerabilities are still constantly being discovered.
Organizations that choose to use open-source software for their crypto infrastructure should look to further independently review the source code to identify risks relevant to them. They can also consider customized implementations of the base software for certain components of their crypto infrastructure such as wallets.
Protecting competitive intelligence
Asset provenance presents an interesting two-sided challenge for cryptoassets. On the one side, crypto businesses have a need for KYC and cryptoasset provenance. On the other side, crypto businesses also have a need to safeguard competitive intelligence data that may be leaked through the blockchain.
In traditional asset classes, market activity and transactions are by and large not publicly available. This information, if publicly available, could be used by market participants and competitors for a variety of purposes including, arguably, market manipulation.
But with cryptoassets, all transactions are posted to a publicly accessible, immutable ledger. With the use of advanced data analytics and asset provenance capabilities, a third party may now be able to monitor the blockchain, attribute transaction activity to a crypto business, and gain important competitive intelligence about that business. The third party may also use this data for various other purposes including market manipulation.
Despite the benefits provided by being a public immutable ledger, blockchains also create this risk for crypto businesses by allowing competitors or third-party observers to track some of their business activity.
Crypto businesses may therefore need to have a clear strategy to obfuscate their own activity that is posted to the blockchain while, at the same time, providing the ability for themselves (and their competitors) to be able to determine asset provenance. It is also important to regularly review and update this strategy to keep up with bad actors and technology advances.
Accounting & financial reporting
Jennifer Jones - Chief Accounting Officer, Coinbase
Samuel Jeffery - Partner, KPMG
Brian Fields - Partner, KPMG
Key challenges facing institutionalization of crypto
Cryptoassets challenge traditional financial reporting boundaries. The accounting for these assets is an emerging area and, so far, neither the FASB nor the IASB have provided specific accounting guidance. As the technology continues to evolve, it may not always be clear how to apply accounting requirements to these transactions.
Cryptoassets like Bitcoin may exhibit certain characteristics of assets covered by different accounting codification topics. For example, some have suggested that Bitcoin is akinto traditional currencies like those backed by sovereign governments.
Others view Bitcoin as a commodity, such as digital gold. Under Generally Accepted Accounting Principles in the United States (U.S. GAAP) as written today crypto would generally meet the definition of an indefinite- lived intangible asset because they do not convey specific rights to cash or ownership in a legal entity in the same way as financial instruments.
Some have noted that the accounting guidance for intangible cryptoassets was not written with crypto in mind. That is true. While we believe many cryptoassets fall within the scope of those standards based on the specific rights conveyed, this is an innovative and emergent area that could benefit from reexamination by standard setters.
Recognition and measurement
While many believe cryptoassets like bitcoin would be better measured at fair value each period, there are only limited circumstances in which U.S. GAAP currently supportsthis, such as when bitcoin is held as an investment by an investment company.
16 In other circumstances, indefinite-lived intangible assets are not amortized, but are required to be recognized and measured at their historical cost; impairment is recognized when their carrying amount exceeds fair value. The subsequent reversal of previously recognized impairment losses is prohibited.
Also important is that each asset needs to be evaluated based on its specific characteristics. For example, as interest in crypto has grown, so have the number of intermediaries that allow the purchase, sale, and custody of these assets.
In some cases these holdings may represent direct ownership of a crypto held in custody by a counterparty, while in others they may simply represent a contractual right that could be a financial contract (i.e., a loan receivable tied to the value of crypto). Similarly, derivative contracts such as forwards, futures, and investments in funds that hold interests in cryptoassets would generally be accounted for as financial instruments.
To accurately value crypto that is received in exchange for goods or services, a company may need to seek the expertise of specialists and use judgment. While Bitcoin currently trades regularly and in high volume, this may vary for other digital assets. It may be necessary to evaluate and consider information from many sources to determine the fair value of cryptoasset holdings.
The recognition and derecognition of cryptoassets is generally based on the concept of control. That is, crypto is recognized as an asset when control over that asset is obtained and derecognized when control is lost. When evaluating the transfer of control and ownership, it may be important to consider the relevant legal environment, especially in situations that are more complicated than a simple sale (e.g., a transaction that involves ongoing custodial services by the seller). For crypto, this evaluation may require special attention to legal issues, which is complicated by the fact that case law is only beginning to develop.
Example: Sale of product in exchange for crypto
Seller enters into a contract to deliver a product to Customer on July 1 in exchange for 100 units of Cryptoasset X when it is trading at $10 per unit. Assume that Cryptoasset X has characteristics similar to Bitcoin it is not a financial instrument and would be treated as an intangible asset by its holders. Seller delivers the product on July 1 and also receives payment at that time. Seller still holds Cryptoasset X on September 30 when it trades for $8 per unit and on December 31 when it trades for $11 per unit.
Tokenization
In the case of Bitcoin, we believe what has been tokenized is an intangible asset (a specific number of units of Bitcoin), because ownership does not come with any other rights and obligations. In contrast, other cryptoassets, such as tokens or coins in an initial coin offering, may convey specific utility or financial characteristics, such as rights to goods or services or a share of profits of a company or project. In each case, we believe the accounting should follow the rights and obligations conveyed.
Issuers and holders of cryptoassets should carefully evaluate the specific characteristics of the asset to determine the appropriate accounting. Issuers would determine whether the token or coin should be accounted for as debt, equity, or a right to goods or services in the financial statements.
Holders would determine whether the token or coin represents a financial asset, a right to goods or services, or something else. For example, a token that conveys specific rights to cash over time may meet the definition of a debt security or loan irrespective of whether ownership of the token is represented on a blockchain.
Of course, it is also critical to evaluate cryptoasset transactions to verify that they comply with relevant legal and regulatory requirements. For example, an issuance of tokens may represent a security that would require registration with the SEC, unless the issuance qualifies for an exemption.
Other accounting issues
Crypto raises novel accounting questions, many of which are just starting to be examined. For instance, holders of crypto may need to evaluate how best to account for blockchain forks and other such events.
Crypto miners must determine how best to account for the receipt of assets related to their mining efforts. Because of the limited accounting guidance in this area and the dynamic and evolving nature of the industry, crypto participants should stay tuned in to financial reporting developments.
Internal control and the future of accounting
Some have asked how blockchain technologies might change accounting and financial reporting. While that may be difficult to predict, we believe blockchain fits into a broader wave of automation technologies that have the potential to improve the efficiency and effectiveness of financial reporting. Those effects may extend across the spectrum of preparing, controlling, and analyzing financial information.
Nevertheless, while blockchain and other systems could ultimately make verifying a transaction and its amount more automated, internal control over financial reporting involves considerations that extend beyond the integrity of software systems. Companies must maintain responsibility for their own control environment and assess and respond to new risks in their processes.
Further, where external organizations provide services related to blockchain technologies, due diligence, and analysis are performed to ensure that the service organization has the appropriate controls in place.
Crypto in particular raises unusual books and records challenges that require an effective system of internal control to answer key questions, such as:
As the pace of automation accelerates, we believe the financial reporting function will play an important role in assessing and addressing the risks that accompany innovation.
Tax implications
Candice Turner - Principal, KPMG
Robert Principe - Managing Director, KPMG
Erika Bonner - Partner, KPMG
Key challenges facing institutionalization of crypto
Although the crypto market is rapidly growing, guidance regarding the tax treatment of crypto remains minimal.
The only clear guidance from the IRS came in the form of Notice 2014-21, released almost four years ago, stating the IRS position that a virtual currency is a digital representation of value that functions as a medium of exchange but does not have all the attributes of real currency, such as legal tender status in any jurisdiction. Accordingly, the IRS treats crypto as property, not as another currency.
The only clear guidance from the IRS came in the form of Notice 2014-21, released almost four years ago, stating the IRS position that a virtual currency is a digital representation of value that functions as a medium of exchange but does not have all the attributes of real currency, such as legal tender status in any jurisdiction. Accordingly, the IRS treats crypto as property, not as another currency.
Tax treatment of crypto:
The basics
Tax accounting
In addition to potentially sizable tax liabilities incurred on the sale or exchange of crypto, taxpayers may also bear significant tax accounting burdens with respect to their holdings, depending on the number and frequency of crypto transactions in which they engage. As noted above, users of crypto must calculate gain or loss every time they transact.
Taxpayers that are transacting at a high frequency using a trading bot, or mundane transactions such as buying cups of coffee with a crypto debit card, can rack up significant amounts of taxable transactions that they will have to individually account for.
Taxpayers will need to identify those transactions that represent a sale or an exchange of crypto for a good or service (and are thereby taxable) and those that are merely transfers into an account that the taxpayer controls, such as another wallet or a payment channel (and are potentially not taxable). 19 They will then need to determine the value in dollars of each transaction.
Determining this dollar value is relatively straightforward for sales of cryptoassets for fiat currency, but exchanges of crypto for other property may present a challenge. Taxpayers will need to determine the dollar value of the good or service received from the counterparty less the dollar value taxpayer paid for the crypto used to buy that good or service, which presents two potential issues:
1 - What if a taxpayer is using a crypto to purchase another crypto?
Provided that transactions are with respect to more commonly used cryptoassets, there are some reputable sources of pricing data. However, altcoins that are not sold for dollars may need to be priced based on a readily convertible crypto such as Bitcoin.
2 - If the taxpayer has purchased multiple units of crypto at different prices, which price should they use to determine the cost of crypto used in a particular transaction?
General tax principles may point to specific identification the crypto exchange must be traced to a particular tranche of purchases to determine what was paid for a specific block of Bitcoin, for example. Alternative methods such as last in, first out (LIFO) or first in, first out (FIFO) may also be available.
These alternative methods do not require a taxpayer to distinguish specific blocks of crypto. Rather, in the case of LIFO, the taxpayer is assumed to be using the most recent crypto the taxpayer purchased and uses that price for which it was purchased. Or, in the case of FIFO, the taxpayer is assumed to be using the first crypto the taxpayer purchased and uses that price for which it was purchased.
The availability and relative merits of each method of tax accounting should be assessed by taxpayers at the outset of their participation in the crypto marketplace.
Intermediaries and tax compliance obligations
Custodial business models will trigger compliance obligations with respect to cryptoassets. Generally, if a company holds crypto on behalf of others and facilitates transactions, the company should consider whether certain tax information reporting (usually on IRS Form 1099) is required with respect to the person for whom the crypto is held. If a company pays service providers with crypto, other tax reporting rules may apply depending on whether the service provider is an employee.
Further, companies should be aware that they may be subject to withholding tax obligations on payments to service providers even if the payment is made in crypto. As a general matter, these reporting and withholding requirements require companies to request, at a minimum, the tax identification or social security number of customers, service providers, and other payees.
However, the pseudonymous nature of crypto presents a challenge. A primary role of tax advisers should be to assist companies in simplifying and automating tax reporting and withholding compliance procedures in order to prevent these requirements from disrupting the market. This will reduce the burden on individuals and organizations such that taxpayers may freely transact with cryptoassets.
KPMG’s Cryptoasset Framework
As adoption of crypto increases in a big way, organizations will need to prepare for a changed future. In working with start- ups, exchanges and large financial services organizations, KPMGs Cryptoasset practice has developed a cross- functional framework that helps a crypto business scale while addressing the key challenges discussed previously.
KPMGs framework that has been applied successfully to several advanced crypto projects and businesses. This framework comprises of key capabilities required for a crypto business covering strategy, technology, operations, cybersecurity, risk management, finance and compliance to help them on the road to institutionalization. The framework categorizes these capabilities under five pillars as illustrated on the following page:
Plan: Strategize the products and services to be provided and establish product-market fit
Onboard: Onboard the cryptoasset and the customer
Service and deliver: Provide support for the servicing and management of cryptoassets
Protect: Secure cryptoassets, protect client confidentiality, and monitor the blockchains
Comply and report: Comply with the applicable regulatory frameworks, financial reporting requirements, and tax reporting obligations
KPMGs Cryptoasset Framework
Crypto economics
Constance Hunter - Chief Economist, KPMG
Money has continued to evolve since the beginning of civilization. In this section, we provide a deeper dive into the history of money and the economic value of crypto to help assess if crypto is a money evolution, a custody evolution or a record keeping evolution.
Are cryptoassets truly currencies?
What is in a name? Sometimes it is aspiration. That is the case for the moniker currency in cryptocurrency. Cryptocurrency is a remarkable and innovative leap forward, but the leap is not far enough yet to meet all the criteria for a true currency.
Furthermore, the jury is still out on the utility of cryptocurrencies, and deliberations could take several years, if not more. While some people expect cryptocurrencies to take over from government-issued fiat currency, there are still big hurdles before they can attain mainstream global acceptance.
In order to meet the definition of a currency, three criteria must be met: unit of account, store of value, and unit of exchange. Many people believe cryptocurrencies pass the first test; they are units of account. One can measure, in units, the amount of crypto purchased or used. This is critical, as currencies are the basis for accounting.
One holds inventory of 10 widgets at a purchase price of 10 Bitcoin each. Or one sells 10 widgets at a profit of 4 Bitcoin each. Or one buys 10 bonds at 10 Litecoin each and marks the value to market each day in currency units.
To fulfill the requirements of store of value, cryptocurrencies must be much more stable. Consider for a moment extending a person or entity a loan in a cryptocurrency. The value is too unstable at the moment to be assured repayment. Under these conditions, neither lenders nor borrowers would be willing to take the risk of transacting in cryptocurrencies. After all, extending credit in a currency that risks significant devaluation or borrowing if the value appreciated beyond the borrower?s ability to pay would be a fools errand.
As a medium of exchange, a currency must have ubiquitous acceptance within a large enough jurisdiction to be practical. The larger the jurisdiction, the greater the efficiency (or the greater the reduction of friction). For example, the creation of the Euro reduced friction within the European Union (the trading block) and increased trade and per capita GDP.
The use of a reserve currency also reduces friction. The dollars is the worlds reserve currency. In addition to commodities being priced in dollars, dollar invoicing is used in 4.7 times the U.S. import share. 20 This elimination of a foreign exchange transaction in trade reduces friction.
History of currency innovation
So, if cryptocurrencies are not truly currencies, what are they and what economic benefits do they possess? To answer this question, it is helpful to consider a brief history of money and the various innovations that have occurred over the millennia. All of the innovations that have endured had one thing in common: they reduced friction and, by doing so, increased economic activity.
Reducing friction is a key element of the history of currency innovation.
The first unit of account reduced the friction that was inherent in barter. For example, if one had berries and wanted meat, in order for the exchange to take place it was necessary to find a person with meat who was looking for berries.
The introduction of currency allowed berries to be exchanged for money, which could then be used at any future date to purchase anything. The first currencies shells, cocoa beans, salt, barley and the like all suffered from a common problem: the units were not infinitely divisible and they could be destroyed or lost.
In the seventh century B.C., Lydia (what is now modern day Turkey) created the first metal coins. 21 This was such a significant innovation in the use of money that it was quickly copied and used across many countries. Coins with the same mark were uniform, they were worth the same amount in large jurisdictions and everyone agreed on what they were worth.
This saved time on weighing chunks of metal or counting cocoa beans, and it decreased the probability of cheating. During the Renaissance, the Italians came up with a new innovation: credit. This made Italian money (florin from Florence or ducat from Venice) the reserve currency of the day. 22 In this way, one can see that currency markets illustrated the first instance of what is known today as the winner- take-all effect and the network effect.
We cannot stress enough the importance of trust. It is essential so that currencies can facilitate not just current transactions but future transactions by being a means of accumulating savings and acquiring credit.
Paper money was invented in China in 740 B.C., 23 but it took longer to become more ubitquitous than coins or more modern inventions like electronic money and credit cards. The reason for the delay? Trust. Specifically, the lack of it.
Creative destruction and the value of bubbles
In Europe, ubiquitous use of paper money thrived when credit became widely used. While the Italians were innovators in finance, creating the dual-entry accounting system, and introducing credit, the Dutch - with their large colonial holdings and trading empire that spanned the world - took the introduction of credit to the next level. The level of bubbles. So, is crypto a bubble? And if it is a bubble, does it have lasting value? Some bubbles create lasting value because excess liquidity is pumped into ideas so innovative that they would not otherwise receive funding.
Think of the dot-com bubble. This type of bubble falls under the purview of the famous economist Joseph Schumpeter who coined the phrase creative destruction. This is relevant for crypto because it is likely that crypto would not have gained the value and market share it has without excess liquidity in the financial system looking for a home.
Globally, there are over $16 trillion of assets on central bank balance sheets. This liquidity has found its way into markets, and it is highly possible that the crypto market is one beneficiary. Like the liquidity created in the wake of the Asian and Russian currency crises in the late 1990s, money has found an innovation to support.
At the height of the dot-com bubble, many businesses had lofty valuations and some had scant business models underneath them. However, we can see clearly over 15 years later that many of the technological innovations funded in that bubble created lasting value that has been a building block of much of the innovation of the past decade.
However, some bubbles are like the tulip mania that swept the Netherlands and then the world in the 1600s. One could argue it all started financial innovation and increased liquidity. As mentioned above, the innovation of paper money facilitated the transferability of credits which in turn reduced the friction of trading with unknown counter-parties and this ultimately increased economic output.
The Dutch took the Italian invention of credit and supercharged it via its global trading empire. The influx of liquidity from the economic success of the Netherlands gave everyone, from the aristocracy and the bourgeoisie to the artisans and laborers, increased wealth. It was this base of increased wealth that allowed tulip mania to take off. When this bubble crashed, much of the wealth crashed with it as there was no innovation value in the tulips themselves, only increased demand and the liquidity to fuel it.
The economic value of cryptoassets
If cryptoassets are not true currencies, what is their value now and what might make them currencies in the future? To analyze this situation one must consider that not all cryptoassets are as freely available as fiat currency.
Crypto designers consider three main features for tokens depending on the utility they want to achieve: acquirability, transferability, and redeemability. With acquirability, some tokens need to be earned, and some can be both earned and bought. For transferability, sometimes it is advantageous to limit transferability outside of a closed system. With redeemability, it must be decided if the crypto can be exchanged for government-issued fiat currency.
If all three features are enabled, a token is said to be fully equipped.
For example, if one considers credit card reward points, they can be earned and they can be redeemed for gift cards which are electronic facsimiles of fiat currency. However, they are usually only purchased if they are also earned.
Reward points can increase loyalty and purchases on a platform and have the utility of increasing customer engagement, but they do not change value based on market dynamics and they can only be redeemed for preapproved purposes. Thus they are not fully equipped.
The game Second Life has a fully equipped currency called Linden Dollars, which can be earned, purchased, transferred, and redeemed. While the so-called economy of Second Life has grown over the past decade, the value of Linden Dollars has remained stable, between $24 and $27/Linden Dollar. Linden Dollars have the moniker of a currency, but it is a misnomer because Linden Dollars are not a medium of exchange.
Many cryptoassets generally aspire to be usable currencies within the general economy, but to get there a chicken or the egg type of problem needs to be solved. In order to be a medium of exchange, a crypto must be a store of value. In order to be a store of value, the speculative nature of crypto must dissipate. However, many creators of crypto seem quite happy with the steep appreciation their tokens have achieved. Until at least one crypto meets all three criteria, they cannot be considered full currencies.
This does not mean cryptoassets cannot evolve and earn the currency moniker. It is possible to find friction within the global financial system that a crypto could alleviate, such as the global payments market. In this market, individuals pay high fees to transact. Approximately $600 billion is transferred annually around the world in global remittances.
If a crypto could achieve enough stability of value to be used for this purpose, it could eliminate the need to have bank accounts in multiple countries and could allow individuals to transfer money to anyone without paying wire fees. If a fully equipped crypto that has a stable value becomes easier and less expensive to transact than a government-issued fiat currency, it could be an innovation that becomes ubiquitous in the global financial services system.
Unsurprisingly, central banks take a somewhat skeptical view of the explosion of private money because private money was eliminated with the introduction of federally backed money in the 19th and 20th centuries. To prove successful and to ultimately become institutionalized, crypto must show innovative qualities and improve on the current money system.
Becoming a full-fledged asset class
As crypto matures, it remains to be seen if it will be a safe haven asset such as treasury bonds, a commodity such as gold, or a risk asset such as equities, or something else. The answer to this question lies in the level of trust crypto is able to garner from the market.
Cryptoassets have the potential to increase trust via the immutability feature of the underlying blockchain technology. However, this alone may not be sufficient to generate trust without also embracing institutionalization.