US Banking Agencies Increase Their Focus on Crypto-Assets

The primary US bank regulators - the Federal Reserve, FDIC, and OCC - issued a joint statement on crypto-asset risks to banking organizations. The statement lists several risks on which the regulators are focusing. John and Elliot discuss some of the risks and speculate on where regulators may be heading in this space.

US Banking Agencies Increase Their Focus on Crypto-Assets TRANSCRIPT

Elliot Berman: Hi, John. How are you today? 

John Byrne: Hey, Elliot. Happy New Year. How have you been? 

Elliot Berman: Happy New Year to you. I've been well. I've been traveling. We were in Denver for a wedding on New Year's Eve and then came out to LA. But that didn't keep me from paying attention to what was happening in the financial world. You and I both came upon this joint statement on crypto-asset risks to banking organizations issued this week by the Federal Reserve, the FDIC, and the OCC. What's your take on this?  

John Byrne: Well, I think it's consistent with what many of us have been saying in terms of the end-of-the-year review of 2022 and what to expect in 2023, that there'll be more active events, projects, and direction on crypto asset-related regulation. Whatever ends up happening is pretty clear, whether it's the FTX or some of the issues that occurred in 2022 that the regulators know they can't sit still. And this one I thought was it's always these joy statements are always valuable, but this is really the first out of the box. For the new year, I think it is relevant, and as we know, it was issued by the Fed, the FDIC, and the OCC, and they make a pretty strong statement up front, again, obvious, but a strong statement.

The events of the past year have been marked by significant volatility and exposure of vulnerabilities in what they term the crypto assets sector. And then they list a number of risks that I know we'll talk about. But, I do think, you know, what's gonna happen here is there's gonna be a focus in the US, by Congress and the regulators, about what needs to be done.

And I will just tell you sort of an off-the-record conversation I had with some folks on the house side. As we know, the House is now, although, as we record this, it hasn't happened yet because of a lot of chaos. But the House will be run by the Republicans on this issue of crypto and stablecoin.

You know, the things that sort of fall under that broad category, I don't see this as being partisan. So I like the Senate, the House will, and the House Financial Services Committee and maybe some of the other committees as well will continue to look at these issues and these risk mitigation ideas and recommendations that they have.

So, a long-winded way of saying this to me is sort of putting a stake in the ground, saying, okay, folks, a lot going on out there from the banking perspective. Here's what you need to think about, and we will do more and more guidance and statements on this going forward. 

Elliot Berman: Yeah. There were two explicit statements in the joint statement that I thought was interesting cuz if you saw one or the other by itself, you'd almost say they were going in different directions.

One is risks that cannot be mitigated or controlled mustn't migrate to the banking sector okay. I mean, that sort of makes sense. If you think about risk management, it's about identifying risks. It's about mitigating risks and then deciding what your risk appetite is for what you'll take as less mitigated risk.

So that made sense. And then the other one is it neither prohibited nor discouraged banking from providing services to customers of any specific class or type as permitted by law regulations. So again, we're not telling you don't bank crypto-related companies, you know, that's the unspoken piece there.

But it's interesting cuz they frame it very carefully because, as we know, there's the whole issue around cannabis banking because it's permitted by law regulations. So kind of interesting framing out the whole thing. They list eight classes of risks that they're concerned about, some of which you can clearly tie to specific events.

They mentioned stablecoin, and of course, the Taraxa USD Luna problem of mid-2022 comes right out of there. They talk about the legal uncertainties. By exchanges being effective, you know, with custody and redemptions and ownership rights and that FTX and block five both, you know, popped up there where there and others where there were restrictions on withdrawals.

And particularly with FTX, there's a huge question that is gonna be resolved probably by the bankruptcy court about, you know, ownership of assets and things like that. 

John Byrne: Yeah. And you know, a couple of the other risks are relevant because they're relevant to the existing financial sector. So when they say that one of the risks would be risk management and governance practices in that sector did exhibit a lack of maturity and robustness.

That's an issue for a small bank startup. That's an issue for a big bank that's engaged in different products that they weren't used to. So I think that what the regulators are telling everybody, or at least our former industry, is that, you know, governance needs to be strong and risk management.

And certainly, there's more of a chance in the crypto world that is not mature. But certainly, we've seen examples of risk management deficiencies and, you know, internal structures in existing financial institutions, traditional financial institutions that have been problematic. So I think by saying that they're not entering the new ground at all, but they sort of have to continue to mention those things.

So I think that was another important part of this, you know, and to your earlier point about them, coming out with their statements, you know, they almost have to say that. They almost have to say; we're not gonna tell you not to bank. Cuz there have been so many examples. The marijuana business is certainly one that you mentioned.

The whole de-risking issue. All these things have been problematic. ATM operators, which I'm not as sympathetic, but of course, that's also another issue. So I think the regulators almost have to say, look, we're not telling you not to do this, that they don't have—the legal authority to prohibit it anyway.

But, they're also saying, look, we're giving you a heads up that you need to pay attention. And I could see potential enforcement actions down the line where this document is gonna be used as the list of potential offenses, right? Hey, we issued this in January, and here's what you didn't do.

Traditional financial institutions regarding your customer or customer's customer in the crypto asset world. So I think it's a really good premise to start from. And I also think they do a good job of not prohibiting, but definitely sort of wagging their proverbial finger and say, be careful here, you know?

Elliot Berman: Right, and as you pointed out, all of this is really, you know, a refocusing of traditional advice and parameters on a new, more emergent industry. I think that we've seen this in other spaces when other things were emergent or where we saw the industry, the traditional players in the industry that focused on a, I'll call it, more exotic product.

Being followed by a lot of organizations that probably didn't have the knowledge and sophistication about that product trade finance is one that I think of, you know? Right. Yeah, we've had instances where companies thought, oh, trade finance, that looks like fun. I mean, I don't, I'm not trying to make fun of them, but, you know, they certainly didn't sit down and say, okay, who's our trade finance expert?

Where are we getting the knowledge? You know, how do we evaluate our systems? It was more I think they didn't, they never used the word, but I feel like this is a reminder. Don't just chase revenue and profit. You really have to manage. 

John Byrne: Yeah. And I say finally from my end reference the brief mention, but a mention of cyber attacks, you know, that's also going to continue to be big a challenge for all of us in our broad-based AML sanctioned CTF community in 2023. And the regulators also make it clear that there are vulnerabilities related to cyber attacks in the crypto world. So you need to factor those risks in as well. 

Elliot Berman: Yes, one other sort of, you know, what isn't here?

So this could have been arguably a joint statement from the FFIC, which would've then brought in the NCUA. I'm sorry for all the letters. You know FFIC is all the regulators together, and the NCUA is a Federal Credit Union regulator, but the Federal Credit Union regulator is not deaf to this stuff.

They issued some comprehensive guidance about dealing with it, and they focused on it from a distributed ledger technology perspective, but it came to the same point back in May of 2022. So for those of you in our audience who you know, work with or work at credit unions, there is guidance for you as well.

I also would recommend that you know this guidance is a useful outline of things to consider. And be sure that you are dealing with crypto customers and customers who want you to help them with crypto, which are two different classes of risk that you would have.

John Byrne: Yep. So the document is on the agency's website, of course, on January 3rd, and there are some links. To previous statements and other directives there as well. I would just say, as we've just both alluded to, this will probably be the beginning of the year and maybe years long, focusing on what needs to be done to mitigate, reduce, and understand the various risks regarding crypto.

Elliot Berman: Yes. I'm sure that you and I, both privately and through our podcast and our writing, will touch on this topic a number of times more during 2023. So what's w what's in the pipeline for the rest of this month, John? 

John Byrne: Well, on the 25th, we will be doing a webinar on the continued challenge of human trafficking. This is Human Trafficking Awareness Month, so we'll be fortunate to have a few experts from anti-trafficking organizations like Polaris. We are looking for the possibility of an additional person from the AML community. The bottom line is we're gonna give you updates on what's going on with the human trafficking issue from a crime perspective, so that'll be there. There are a few other things that I actually have in the pipeline that I've not scheduled yet. I got a really interesting, and we haven't had a chance to talk about this, but I had a really interesting offer from folks from the NGO community. If you remember, at the end of December. And the treasury separately issued some statements regarding helping the ability to have humanitarian work proceed without too many restrictions. I'm being very generalized here, but the folks from the NGO community said they'd love to explain the licensing process because their goal is always to get money, funds, and help in the hands of victims of conflicts and victims of crises around the world.

So just got that offer yesterday. So I'm gonna try to get that up as a podcast in the next couple of weeks but obviously something that our community cares deeply about that.

Elliot Berman: That'll be very interesting. And again, for those that don't live on the sanction side. The licensing piece is how to get a permissive exception to prohibitions under a sanctions rule. So have a great rest of the week and a great weekend. I'll be back homes shortly, and we'll find something interesting to talk about next week. 

John Byrne: Great, Elliot, stay safe. Safe travel.

Elliot Berman: Thanks. Take care. Bye-Bye.