Crypto custody

Abstract

This article discusses the EU’s approach to regulating crypto custody services under the Market in Crypto-assets (MiCA) Regulation against the background of asset diversions and misappropriations observed throughout the Crypto Winter. It seeks to identify whether MiCA meets its legislative objectives and whether it provides a sufficiently solid foundation for the future of the emerging crypto industry. We find that MiCA’s focus is on what we have called herein ‘institutional resilience’, ensuring that the custodian is soundly organized and governed and must not reuse clients’ assets on their own accounts. At the same time, MiCA lacks strength on ‘asset resilience’ (ie providing safeguards for cases where the custodian, third parties, the token-issuer or DeFi application, as the case may be, encounter difficulties). This article discusses the EU’s approach to regulating crypto custody under the Markets in Crypto-assets (MiCA)1 Regulation. To ensure financial stability, an adequate degree of investor protection, market fairness and integrity in places where gaps in the traditional EU financial regulation have been identified,2 MiCA subjects crypto-asset service providers (CASPs) to both licensing and financial supervision if they provide certain crypto-asset services specified in Article 3(1)(16) MiCA. The provision of custody and administration of crypto-assets on behalf of clients is one such crypto-asset service.3 Custody is one means of providing safekeeping and is the main function of investment fund depositaries.4 Under established investment fund regulation, custody requires registration ‘in a financial instruments account opened in the depositary’s books’ or physical delivery to the depositary.5 The AIFMD6 limits the holding in custody to financial instruments, whereas for other assets, ownership verification and record-keeping is required.7 The widespread insecurity about the qualification of crypto-assets as financial instruments or not8—prior to MiCA—also impacted on what custody and safekeeping of crypto-assets was deemed to entail; this, in turn, may have contributed to token-holders’ losses in a period known as the Crypto Winter,9 with billions of Euros in asset value lost in less than two years.10 These losses have undermined the token-holders’ trust in crypto, threatening to halt the growth of crypto and investments in distributed ledger technology (DLT) at large,11 not even two years after enthusiastic predictions of a golden crypto future.12 Even today, when Bitcoin as most prominent digital asset experiences an upturn in the Spring of 2024, most large-volume crypto-assets (such as Ether, Tether, USCD) trade below their record highs of 2023. In this article, we seek to identify where MiCA furthers legal certainty in this regard, as well as the robustness of the crypto custody system at large, and whether MiCA provides a sufficiently solid foundation for the future of the emerging crypto industry. First, we discuss the context of crypto custody against the background of the Crypto Winter, the current market needs and the international proposals to regulate crypto in Section 2. We then highlight the scope of MiCA’s custody rules, as well as the general requirements applicable to all CASPs, and those affecting crypto custodians in particular in Section 3. Thereafter, Section 4 issues policy considerations, and Section 5 concludes. Starting in the second half of 2021, a series of operational shortcomings, malfunctions and asset diversions of major crypto projects became apparent, with losses often in the hundred millions of US Dollars.13 Following the Terra-Luna stablecoin algorithms’ collapse in May 2022 that wiped out US$50 billion in just three days,14 the crypto industry experienced a of of prominent crypto such as and in been to as the for the crypto industry. is the of undermined trust in the crypto asset and traditional this crypto Crypto custodians have and to a in crypto Crypto the of that the all of their clients’ in that and to the distributed These to and In this contributed to trust in Crypto custodians to the of to their clients’ Crypto custodians custody to and the and the Crypto custodians custody with of crypto investments and on the same providing custody in to their other crypto-asset services the financial of to the same and In turn, of became widespread throughout the industry and other of undermined the crypto own Crypto custodians clients’ assets with their own assets in a that their clients’ assets their own as This for the case for where clients’ the own Crypto custodians asset and that in on behalf of clients not those in the custodian own and Crypto custodians assets for on their own or a In losses with clients’ today, than one after the Crypto in their and custodians to reuse the assets for their own investment or about crypto at a when of market of the crypto with to market and market integrity of clients to to These and the of crypto The of crypto custodians in the of that when on their custodians the prominent custodians not on their of their clients’ The it that asset and as well as other custody throughout the industry. the emerging crypto and in most to for the in the of whether the the for this of crypto after was ‘in or at In of all the crypto custodians have the of international in policy proposals as on crypto custody MiCA to policy of the the and the crypto the custodians the assets and their clients’ against and in the of and they provide as well as and custody must and their clients’ they the crypto-assets their own assets, and reuse of clients’ assets with the and the safekeeping is they safeguards and and the clients the custodian provide the and the of the reuse of clients’ assets, as well as all other In the custody and of and to a of or even of The and the requirements on the safekeeping and of clients’ on of custodians must have own or in to the clients in the of asset or or of the The the of an the and and In the of crypto its the of and in In to the of of a series of cases and against the crypto most and Even today, when Bitcoin as the most prominent digital asset experiences an upturn in the Spring of to Bitcoin may most large-volume crypto-assets (such as Ether, Tether, USCD) trade below their record highs of in the case of and below in all to in crypto, on an In turn, services crypto stablecoin service on and crypto-asset and custody have The of crypto the for a even The for in MiCA the crypto-asset services in a in Article 3(1)(16) MiCA. of services is the of custody and administration of crypto-assets on behalf of clients’ Article this is it not and MiCA not that is the main or MiCA’s custody to it is that the and administration services for crypto-assets on behalf of needs an to may to a crypto-asset or an of an for a an a service investment or investment fund of MiCA provides for general applicable to all CASPs, MiCA for certain the scope of MiCA in the custody below we discuss the most Article MiCA a of the in Article MiCA provides the with to crypto-asset services in to in all of the is MiCA. of in to three the of of the EU financial other than the to MiCA to and MiCA’s of MiCA is a on It not where financial services Article In turn, MiCA’s not where a digital asset as a financial or a to two of In of the MiCA’s scope is to and the scope of MiCA that not as and that MiCA’s of not In turn, for investment the for in financial instruments the for investment and MiCA’s on of the on investment under EU financial the custody of assets on behalf of investment is to particular specified in Article We focus in this article on MiCA’s custody and the with other in in particular it is to identify a to crypto-assets have they not the scope of or of service providers providing services in of such crypto-assets MiCA. that must with MiCA even where and MiCA not We this with to crypto it the as to what in to This means that for and the if a crypto-asset service is the qualification and degree of of the whether to custody providers requires the the to in the as is the of a in Article MiCA that service means legal or other or is the provision of one or crypto-asset services to clients on a This is the that the scope of MiCA the provision of crypto-asset services in a that the on two First, the of a or that we whether the service is a on a MiCA not the general as or one that is to a crypto the second the of whether or not the service is or we that this is not a of for MiCA’s scope (ie MiCA of whether the service is or and that service provision is one of the of the crypto have a to with the regulation if the service is an that is with and with Bitcoin as the that we that an application, it legal or that is the for the of the a out In EU financial if the service is on a and the (ie out for clients of This is crypto custody Article MiCA that the provision of and administration of crypto-assets on behalf of clients’ means the safekeeping or on behalf of of crypto-assets or of the means of to such where applicable in the of issues this legislative First, MiCA that crypto-assets in a that was to that a crypto-asset is and its on the in the it that custody the safekeeping or of the means of to such where applicable in the of The is that the custody the of the service the holding of crypto-assets to clients or the means of to such in case the of the crypto-assets in the crypto-assets or the means of to to the of the crypto-asset service We what of a crypto-asset means for an asset where the of the crypto-asset on the of the same the is on and the to the of This the to the second in Article of the means of to such In their clients’ means of the crypto-assets to those a or of of a a is The is to a account that it to other the account or the is the of the or the in a that the to and the account a crypto is a digital that MiCA not what the This is an when it to providers under the of Article providers services those a or of MiCA’s This is that a of and one of the where clients not have to the crypto-assets or The custodian for the crypto-assets they to in The safekeeping and of the and assets to the the other of the custody where the of the MiCA’s that the service is the of and not provide a crypto-asset service under The and their own to This a with a as where the is the the the and the needs to it the to their and the their assets that custody the in the and the is the cases and to to the in the is This in a of custody as providers with that of the to the the is the to the of where with the in the case of the the three to three for The may the at the that they the in the may when In the of the to its the is not the the to the the trust that the not that The second of where with the to a cases of or These or a of or is to In the and the or the same We a where the or the the or the service to a for to the and of the and the of this is the the third cases of and where the the of or to a on their The or that not for and not have to clients’ or the or for in case the clients of their or We the on the clients that on the custody where clients the that the means of or of or not to the assets, the MiCA In MiCA In turn, we that MiCA to the of custody where all (ie where all the service and not to the second or third on the of the or its is to the In the service a of that to a of assets, MiCA where the is not for the of Article MiCA. that not a under EU financial MiCA a This is of for service providers that to as with to and and and and well as other the to provide crypto-asset services of to their These to the for the specified in Article to the of the service to their To and the that a under EU financial not to that they have as of their licensing if that is they must that this is the case in their that to provide crypto-asset services throughout the the of a or the to provide that provide crypto-asset services on a not to have a physical in the of a MiCA the and clients in of and a to that to investment MiCA general applicable to all The most of requirements for crypto custodians the and and and asset and to in EU financial Article MiCA that and in with the of their clients and This provision a of requirements on and of of the that clients’ the clients have been and have their to in a The on the one a that the of with other in the of MiCA that must not clients’ assets on their own accounts. the other it limits to crypto in value clients to the CASPs, as at the of the Crypto at Article MiCA on is on Article and Article and the The is to ensure the of the requirements and financial supervision even where the on not service services or to third for the of operational all to operational for all of their MiCA. in to ensure that the in the of their the and their their their and the for their the Crypto account for the of such in financial and of the operational of their DeFi and the to These ensure that the robustness of the licensing of The to Article MiCA is when a service on is a third MiCA’s and when that third operational custody as a crypto-asset service is to as a that third must provide of custody the of custody is of the means of of operational the of the in the of lost or or the on a with in to to crypto-assets other than those that the custodian their own often in and to or where services with or the as of the and to in the case of they to regulation as a if the is in the We account for that in the same as we custody in general at the service a of that to a of assets, MiCA Article MiCA requires custody the of a is a that is to an of their under applicable the or of those service the of crypto-asset service providers to out an to their To the needs to with The that crypto not in the the of in clients’ Article provides for on crypto one of the safekeeping of the of Article MiCA and is the general applicable to all not all provide safekeeping in to as they (ie to in cases where custody with to crypto-assets is and MiCA in MiCA crypto custody then as a of safekeeping under Article to Article that custody as a of safekeeping for financial instruments on behalf of investment the scope of Article MiCA then not crypto crypto crypto and and services not the scope of MiCA for their main clients’ assets as an to Article and adequate to the ownership of in the of the and to the of clients’ crypto-assets for their own The on what is to the of crypto-assets under the applicable in the of the DeFi or out of The second to the widespread where crypto clients’ assets as their for to losses crypto investments in other of their crypto investment or to in clients’ assets and then to Article MiCA on custody services requires that must the and an with clients in the The most to the may to in cases of the custody a of the the and to the and the applicable The custody policy must at ensuring the safekeeping or of the means of to the This to the of custodians clients’ to crypto-assets as well as or in in the of the is to on the This provide for of the of clients’ to provide for the of crypto-assets to as well as of the assets the assets on the distributed This for that in the of the the assets Article MiCA a provision to the and other clients’ the clients’ crypto-assets or on the and to the of the at the of the of that or to the they to for on the the may or may not to that a may have in to the or of the the not the or a to the it may the This the focus of the MiCA a in Article the custodian is for their clients’ This in to the and of most crypto custody providers that or to the of to a of their clients’ The is all the is not on or on the of the custodian their that the of is in three First, the is for the of crypto-assets or the means of to assets MiCA not other that the clients may such as the of or is to and under the the is at the market value of the lost crypto-asset at the the Article MiCA may function as a in an a of and to what a on the of the and the to their clients’ if the custodian not to custody to crypto-assets on the ledger to their clients the of whether the clients the custodian to on the asset whether the assets in lost than or The same of is of when the and other of the or other to crypto-assets and the custodian to their as a of the crypto-asset or a a the In this Article and the to in their clients’ provide a in the of and Even to is what an that is to the custodian, that is where the is not is that in the of the that the or may the is what the the custodian to (ie the custodian must organized and what they must on such This may that the custodian for an an a or under Article MiCA an of In this regard, it is that MiCA to that that they not or (ie this this to to than the to this in the of a a for to the to the with the and their own for such and to in the of the for losses to their own such as or of whether they on a or a and provide an of and MiCA’s requirements for crypto the and of the MiCA crypto custody in turn, we out on and asset the of the article, we two for the of MiCA’s crypto custody We the ‘institutional we whether MiCA that the crypto custodians soundly and whether that the is We focus on the operational to crypto The second is called herein ‘asset Under that we the to the or value of the crypto-asset is of regulation in the of and the of the custodian, the the DeFi or third as the case we focus on the of MiCA the legal The ‘institutional resilience’ MiCA’s robustness in of the in the and in the context of the Crypto Winter. this MiCA is as a MiCA that the custodian is a soundly organized and to of and operational their own assets their clients’ assets and the reuse of the for their own The clients’ as well as the of the the same even where the and the may not where service providers have the to or to MiCA’s and We three to MiCA’s and The of MiCA is its what is of the is not We herein that on the of as and may the of MiCA’s custody We in the as that MiCA to the that they as an the of this to as MiCA. may this against the of MiCA its scope that provide crypto-asset services in a or for may have when it to for the application, and to in a international where the of MiCA’s to the of We have out in the as a of that the scope of MiCA’s custody in Article MiCA on a of The same out in the to this when DeFi the scope of and when This is all the a the of MiCA and its to regulate crypto is at to the of crypto-asset such as and out of they not provide crypto-asset services custody or custody with such as MiCA with services is even the to under 5 MiCA to the of clients The provision of services as a of have been a for In the of and the the of crypto-assets custody on behalf of clients as an service to and in to the of crypto-assets to and in the of that the of crypto-assets is a to Article MiCA not MiCA about what it where custody is of the a the to the of clients for than that for under Article MiCA. where reuse on the what limits with to the to to as a for a the legal requirements for a to the The to MiCA the of Article where and must they may to of the that the crypto market is in out of crypto is one of financial have when their crypto is in the as a and observed is to the main the scope of To the that most crypto, and not to the of the crypto market in and crypto, and large, a In this it is that MiCA not a of crypto custodians may under custodians the it is that the losses may to an where the is to clients for To this is a crypto clients and it may the and the crypto In the of that in the of of in To the of we to account the and of of of These to the to ensure and These have been to as for and than the that the under Article MiCA. to EU even crypto of the to the Article provides that the in the for all of their MiCA. The in the of their the and their their their and the for their of the the the the is not to MiCA as as it is not the the EU to of under to all or most of the losses even if it is for its (such as the to and when to crypto service even when MiCA that in the case of issues to the of the safekeeping not sufficiently MiCA. in in cases of of the safekeeping it is established that the assets the assets, the assets, as well as assets to other clients of the third We not find the same to the case in MiCA. This is not the that the needs to certain and all the and provision for the in its MiCA requires of the assets the it lacks on crypto custody to EU investment fund In with to asset the MiCA is as to the First, whether it requires (ie with or whether (ie means of a record-keeping whether the custodian on the of the the in to its own MiCA not safeguards for the not a the that a on the not that the assets in the that the legal in legal and to the the is one of asset we it in that context in the MiCA we less that MiCA provides the with to asset (ie a that the of the assets when on the distributed ledger when the token-issuer or DeFi or when the crypto custodian, or such as the other or to MiCA the and of the token-issuer in the context of and in its and it the or on the distributed ledger for all of crypto-assets in two MiCA provides for the of Article and the to the of the clients’ such in with the and its the to with the case that the custodian, or third find in malfunctions or affecting the clients’ and MiCA provide the to the assets and to a custody in the of the the to for the to clients’ assets the own the of asset reuse for the own and the of the for asset the of asset requires context the on crypto-assets a of the of financial regulation to ensure asset that we on asset after the of MiCA. to the of the of the asset on the and the of other In this the of legal on the and of the that the the crypto-assets in under the applicable MiCA requires crypto custodians to the ownership of their clients in the of the and where it provides for a solid for their it that it for the of and for crypto-assets an of on the means of the to the ownership is undermined when it is not a that the clients have ownership the crypto-assets and whether their is or after all the is and a to legal In turn, have to the widespread legal ownership and in digital it to for clients in the requirements on a In the of a legal and the custodians to provide in their and that the an the provide for To the regulation for and in and MiCA for this with to of and to and and and of to their when is at This asset even where is the and operational of on the of the and the This MiCA on other crypto-assets of other assets MiCA the and of the custodian and their clients in the of the own or provide asset third parties, such as the other and for the of assets in the case of or of the other MiCA the to clients’ assets the own assets (ie on the and (ie means of a record-keeping This the of for and the assets of clients with their own MiCA not on a on the This for the of (ie to clients’ crypto-assets the of crypto clients lacks the of where the of is when the safekeeping is and under In turn, crypto clients not to the of to the of the other clients of the custodian, assets the same that have about other and have means of out or of This to legal the of the token-holders’ in the crypto for the of assets in the case of or of MiCA not provide for the that the and the of the assets in case of of the on as for the of assets in the case of or of the custodian or third such as the Article MiCA the reuse of clients’ assets for the own account and MiCA requires that the clients’ assets the and the of for In of that of asset with the of an function as custodian, or we find that MiCA’s on the legal requirements for asset an of protection, with one of the main safeguards that when the custodian all and to the and their the custodian is not to their clients’ third or of other they have legal to the clients and their in legal third under MiCA. the to clients the legal is with one that the registration on behalf of their clients on the distributed this at with of on the safekeeping and and even where is the in crypto the of legal on behalf of clients MiCA lacks the and of of investment their clients’ and under most legal in as to where against the fund that the financial regulation on investment have for the of investment in a regulation provides a for crypto MiCA to MiCA’s on custody and provide a for to regulate In this regard, MiCA’s focus is on what we have called herein ‘institutional resilience’, ensuring that the custodian is soundly organized and governed and must not reuse clients’ assets on their own accounts. Under MiCA’s rules, all crypto custodians and to of asset and operational The on the the to clients’ At the same time, MiCA lacks strength on ‘asset resilience’ (ie providing safeguards for cases where the custodian, third parties, the or DeFi application, as the case may be, encounter difficulties). This is to the of where the of the asset on the and the of other and to the that MiCA not regulate and the crypto-assets in To the for and for this of other crypto-assets In this regard, in of protection, regulation where a in ensuring asset that for of other service and of clients’ in legal against third