Taxonomy and Scope

The FSB defines crypto assets as a type of digital asset that depends primarily on cryptography and DLT or similar technology and unbacked crypto assets as crypto assets that are neither tokenized traditional assets nor stablecoins.¹² Crypto assets have been variously termed virtual assets, digital assets, cryptocurrencies, and digital currencies. This paper refers to DLT in the broadest sense as a set of technological solutions that enables a single, sequenced, standardized, and cryptographically secured record of activity to be safely distributed to, and acted upon, by a network of diverse participants. This record could contain transactions, asset holdings, or identity data. The data are usually distributed, and control of this data is often decentralized to varying degrees. In its popular blockchain form, DLT has a set of defining features such as organizing data in a chain of blocks. Each block contains data that are verified, validated, and then “chained” to the next block. Some blockchains can provide for greater auditability and transparency, as well as immutability, depending on the network design and the types of assets deployed on it.

Unbacked crypto assets are not considered to be money because they do not fulfill the three common functions of money, and regulators have broadly classified them according to their function.¹³ Crypto assets are not typically used as a unit of account, a store of value, or a medium of exchange. Many unbacked crypto assets tend to have high price volatility (which makes them a poor store of value and unit of account) with little intrinsic value and are likely to be used as speculative investments akin to gambling. In these cases, users encourage others to “HODL”¹⁴ rather than spend the crypto asset— thereby increasing its price and utility as a speculative tool—when spending would increase its utility as a payment tool. Even where some crypto assets are legal tender, their use as a payment or remittance tool remains very small, they are still not considered a viable medium of exchange, and they are less likely to be used by vulnerable or unbanked consumers despite a focus on financial inclusion (Alvarez and others 2022). Additionally, leveraged trading prevails even among retail users and is offered in both centralized and decentralized exchanges as high as 125 times the initial investment, further increasing utility as a speculative tool.

No internationally agreed taxonomy exists for crypto assets, and this paper will use a classification based on broadly used taxonomies and grouping of common risks (figure 1). A globally consistent taxonomy would help create common regulatory standards and approaches; however, differing legislative and regulatory frameworks and the dichotomy between desired use case (for example, payments) and actual use case (speculation or investment) creates challenges. Absent an internationally agreed taxonomy, this paper will use four broad categories that have been adopted by many financial regulators globally:¹⁵

• ■ Unbacked crypto assets. These crypto assets are transferable, primarily designed to be used as a medium of exchange, and although they are often decentralized, there are examples of unbacked crypto assets that are centrally issued and controlled. Most unbacked crypto assets are currently used for speculation and not for payment purposes. Prominent examples include Bitcoin and Ether (although in some jurisdictions with broad definitions of securities, these might be considered security tokens)

• ■ Utility tokens. These tokens provide the token holder with access to an existing or prospective product or service. These are usually limited to a single network (that is, the issuer) or a closed network linked to the issuer. For example, a tokenized store card or certain gaming tokens might be considered types of utility tokens.

• ■ Security tokens. Although the definition of a security token varies across jurisdictions, these are tokens that provide the holder with rights like that of a traditional security, for example, the right to a share in the profits of the issuer.

• ■ Stablecoins. This type of crypto asset aims to have a stable price value. This objective is normally¹⁶ pursued by the crypto asset being linked to a single asset or a basket of assets, for example, fiat funds, commodities such as gold, or other crypto assets. Prominent examples include Tether, Binance USD, and USD Coin. Our companion paper, “Regulation of Stablecoins,” has a more in-depth discussion on the risks and regulatory responses to stablecoins.

A Taxonomy of Crypto Assets, NFTs, and CBDCs and Scope of This Note

Citation: FinTech Notes 2022, 007; 10.5089/9798400221361.063.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

A Taxonomy of Crypto Assets, NFTs, and CBDCs and Scope of This Note

Citation: FinTech Notes 2022, 007; 10.5089/9798400221361.063.A001

• Download Figure
• Download figure as PowerPoint slide

A Taxonomy of Crypto Assets, NFTs, and CBDCs and Scope of This Note

Citation: FinTech Notes 2022, 007; 10.5089/9798400221361.063.A001

• Download Figure
• Download figure as PowerPoint slide

Crypto assets are varied, and this note is focused on unbacked crypto assets, although the paper’s regulatory considerations on the broader ecosystem may apply to a wider range of crypto assets.¹⁷ Utility tokens, security tokens, stablecoins, and central bank digital currencies (CBDCs), in their various forms, are out of scope of this paper, as are issues specific to financial integrity, which have been covered by previous IMF Fintech Notes.¹⁸ This note does not cover CBDCs or payment infrastructure issues. Although some CBDCs might be cryptographically secured representations of value deployed on blockchain networks, they are not usually considered a form of crypto asset because the term generally refers to private assets issued by private entities or individuals, whereas CBDCs are instruments issued generally by public institutions such as central banks. That said, in certain CBDC models (so-called “intermediated CBDC”),¹⁹ regulatory issues explored in the note will be relevant for various entities in those ecosystems (for example, wallets). This paper does not explore security tokens because many jurisdictions have taken the approach of extending their traditional securities regulation to them while experimenting with back-office settlement and record keeping. It also does not discuss non-fungible tokens (NFTs), since they usually fall outside the scope of financial regulation in line with “same activity, same risk, same regulation.”²⁰

The Growth of Crypto Assets

Crypto assets have grown and diversified substantially since Bitcoin was first launched in 2009 and have evolved to serve different purposes and economic functions. After reaching a market capitalization of $1 billion in 2010, the crypto asset market had grown to almost $3 trillion in 2021 before falling to around $1 trillion in mid-2022 (see figure 2), although a considerable amount of wash trades might hide the true figure, which is likely to be substantially lower. This volatile growth has been led primarily by Bitcoin but supported by the increasing proliferation of crypto assets, some of which have grown proportionately quicker.²¹ The largest proportion of this market by capitalization are unbacked crypto assets, with stablecoins accounting for roughly $150 billion. The market now supports more than 10,000 different types of crypto assets and, while promoting decentralization and disintermediation, actually creates opportunities for new centralized intermediaries, such as certain issuers, crypto asset exchanges and crypto asset wallet providers, and broader ancillary products like lending and investing (many of which are also carried out by centralized entities). Although most crypto assets are primarily designed to be used as a means of exchange, globally less than 30,000 merchants accept crypto assets as payment.²² End users are more likely to focus on holding crypto assets as speculative investments, rather than on spending crypto assets as payments. However, some entities are experimenting with different types of crypto assets to improve efficiencies in areas such as cross-border transactions.

The Growth of Crypto Assets by Market Capitalization

Citation: FinTech Notes 2022, 007; 10.5089/9798400221361.063.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

The Growth of Crypto Assets by Market Capitalization

Citation: FinTech Notes 2022, 007; 10.5089/9798400221361.063.A001

• Download Figure
• Download figure as PowerPoint slide

The Growth of Crypto Assets by Market Capitalization

Citation: FinTech Notes 2022, 007; 10.5089/9798400221361.063.A001

• Download Figure
• Download figure as PowerPoint slide

IMF (2021) identified a significant increase in correlation between crypto assets and financial assets during periods of market stress. The correlation between crypto assets and other financial assets has increased over time, driven, in part, by the continued involvement of institutional holders that are affected by common factors (Iyer 2022). Exposure to crypto assets in the banking system and other nonbank sectors²³ is growing, albeit from a low base.²⁴ Exchange-traded funds linked to Bitcoin futures have been introduced in the United States, which could provide regulatory clarity on investment in such instruments by regulated financial institutions and so broaden the user base, including other institutional users (such as pension funds and insurers). Some regulators have clarified existing requirements for banks, which in turn has facilitated more active engagements by commercial banks in crypto asset businesses (such as custodian services for unbacked crypto assets).

The financial stability risks of crypto assets may not yet be globally systemic, but the growing systemic implications can already be seen in some countries. IMF (2021) noted that risks should be closely monitored given the global implications and inadequate operational and regulatory frameworks in most jurisdictions. FSB (2022) stated that as markets are fast evolving, they could represent a threat to global financial stability because of their scale, structural vulnerabilities, and increasing interconnectedness with the traditional financial system. The Basel Committee on Banking Supervision (BCBS) (2022) shared the view that the growth of crypto assets and related services has the potential to raise financial stability concerns and to increase risks faced by banks. Furthermore, retail users in emerging markets and developing economies are more likely to own crypto assets than are advanced economies.²⁵ Trading volumes of crypto exchanges that operate only in emerging markets and developing economies have increased and are comparable to the activity on local stock exchanges and domestic interbank foreign exchange transactions. The growing systemic implications of crypto assets warrants immediate regulatory action in some countries.

Issuers

The issuance of unbacked crypto assets is frequently decentralized, and often issuers are not known, which raises risks and regulatory challenges. Although decentralization of issuance serves the intended purpose of disintermediating financial services with no central authority and a greater “democratization” of value, it also raises risks for users and broader markets. Decentralization makes it difficult to design a regulatory framework targeted at issuing entities. Most regulators have limited their response to broader consumer warnings and/or user education. The lack of known issuers often results in little information or disclosure on the unbacked crypto assets being issued, and it can be difficult to determine with accuracy the type of technology being used, the intended purpose of the token, or any beneficiaries of profits or income that might be derived from the sale of the token.

Crypto assets issued on a decentralized public network are less likely to have a single point of failure risk, with nodes and validators potentially spread around the world. This can improve security as well as reduce the need for trust in a single entity. However, such networks are still vulnerable to some cyberattacks (such as 51 percent attacks),²⁶ and centralized components like crypto asset exchanges and wallet providers are also susceptible to cyber and operational risks. Risks of selfish mining and miner extractable value in certain networks could also lead to risks to market integrity. Even when issuers are decentralized, a governance body might still exist, comprising those with the largest holdings of tokens or tokens with specific governance rights. This can lead to elements of centralization in most crypto assets, which can reintroduce a single point of failure—or require trust in a single entity.

Risks also arise from the different ways in which crypto assets are issued and distributed. There are several ways to create and issue crypto assets, the three most popular being pre-mining, continuous mining, and a hybrid approach. Crypto assets are usually distributed in five main ways: pre-token sale,²⁷ initial coin offering or token sale,²⁸ mining, airdrops,²⁹ and forks. Pre-mining is where all the tokens are created in one batch as a single event, whereas in continuous mining, crypto assets are likely to be created on an ongoing basis or at frequent intervals for either a designated period or until a set deadline. Pre-mining has the potential to create some consumer risk; price manipulation through pump-and-dump” schemes is a key concern.³⁰ Although all these methods pose some risks to consumers, initial coin offerings have been the most controversial (as covered in Cuervo and others, 2020). However, their level has substantially decreased over the past years.

Crypto asset white papers and other marketing material often lack clarity, and the technological complexities and hype make crypto assets a difficult-to-decipher product for users. The use of white papers in crypto assets dates to the launch of Bitcoin by Satoshi Nakamoto. White papers aim to provide information on the crypto asset, including its developers, objectives, and other technical information. White papers vary in their quality, with many having incomplete or inaccurate information, and in some cases, no white paper exists at all. Marketing of crypto assets often overstates the benefits, while rarely setting out associated risks. The channels for marketing are usually digital, with little oversight or requirement of having these promotions approved by a public authority.

When building a regulatory framework targeting the offering of crypto assets by issuers, authorities could focus on the following elements:³¹

• ■ Publication of white papers. White papers form an important part of the disclosure process and should provide markets and users with clear, accurate, and understandable explanations of the crypto assets issued and other essential information such as key personnel and any governance arrangements. The language contained in white papers should be easy to understand and should also provide users with the ability to analyze the technical details behind the crypto asset, the DLT on which it operates, rights conferred by the token, the problem the crypto asset was designed to solve, how it will be issued, associated risks, complaints procedures, and information about the issuing team.

• ■ Notification. Some authorities ask to be made aware of white papers through a notification process or as part of a registration or licensing process. Notification can allow authorities to better understand the size of the local crypto asset market and to remain informed on new products and developments. Many authorities also consider proportionality when building a framework for issuance, particularly where the offering is small or restricted to certain users or when it involves unregulated crypto assets such as NFTs.

• ■ Suitability tests. Where crypto assets are issued directly to end users, some authorities require issuers to ascertain the suitability of users. Issuers are asked to consider whether it is appropriate to offer their crypto assets to retail users, and if so, how the issuer is taking into consideration the needs and requirements of different users. Suitability tests should help firms understand user risk appetite, education, and capacity to absorb losses.

• ■ Fair and accurate marketing. Often, marketing of crypto assets places a disproportionate focus on benefits, with little communication of associated risks. Inexperienced consumers may therefore purchase crypto assets that are not a suitable investment for them. Some regulators have introduced or are considering requirements related to crypto asset marketing (Box 1). These may include requiring that marketing by the issuer reflects information contained in the white paper and is communicated in a way that users can understand. Marketing information should make clear whether the product has any regulatory protections in the local market. Some jurisdictions require marketing related to crypto assets to be approved by the regulator, whereas others have proposed requiring local regulated entities (such as banks) to approve such marketing. This creates new revenue opportunities for these entities, while transferring some of the risk. In some jurisdictions, authorities have banned unregulated crypto asset firms from marketing their materials to domestic consumers, although this can be difficult to enforce.

• ■ Consumer education. As detailed in the BFA, developing adequate financial and technology literacy programs (for example, through initiatives at different education levels, tailored communication, and outreach programs) should be considered a foundational element of any regulatory initiative. Some regulatory authorities are already carrying out consumer analysis to determine the level of crypto literacy to better design the appropriate response.

Crypto Asset Exchanges

Crypto asset exchanges facilitate the buying and selling of unbacked crypto assets and provide much wider services than traditional securities exchanges. Many of the largest and most popular crypto asset exchanges are centralized intermediaries that in practice negate the aim of decentralization and disintermediation that formed the basis of innovation in this space for early crypto proponents. They reintroduce both centralization and trust in a single counterparty.

Although some important differences exist in the way they operate, crypto asset exchanges raise many similar issues to those of securities exchanges. Crypto exchanges differ from securities exchanges in three main ways (although such differences vary across jurisdictions): They typically permit direct access by retail users; they might, in some cases, trade off their own inventory and provide liquidity rather than match buyers and sellers; and they may also provide custody services (through their wallets) to deliver quicker off-chain settlement. Off-chain transactions do not leverage any of the security features of blockchain but instead expose users to credit and counterparty risk of the service provider, which are subject to single point of failure, cyberattacks, and loss of funds. Some crypto asset exchanges resemble stock trading venues, but others may be directly accessed by clients and therefore resemble more a market intermediary. This means that on top of traditional securities trading concerns—operational issues, orderly trading, manipulation, transparency, and so on—authorities may also have to think about specific risks arising from the nature of the exchanges and from the provision of custodial services. Certain crypto exchanges might also issue their own crypto assets, including stablecoins, which can give rise to conflicts of interest.

Although crypto asset service providers have shown signs of improving their operational and cyber resilience, large and well-known firms have been hacked.³² The unique features described previously (trading off own inventory and offering both exchange and custody services) can make crypto asset exchanges alluring targets for cybercrime. Some of the largest loss incidents involved several hundred million US dollars per incident, leaving providers bankrupt and users at a loss. Even in cases where compensation was ultimately fully paid out within several months, users were not able to use the tokens that were stolen for extended periods of time. During the two large downturns in the crypto asset market (2018 and 2022), many users could not access their crypto assets to exit their positions because of a combination of operational failures or measures taken by exchanges to block certain crypto asset transactions.³³

Some exchanges are trying to mitigate cyber and operational risk by contracting cyber insurance coverage, keeping tokens in cold wallets, or creating separate compensation funds.³⁴ The terms and conditions for crypto asset insurance can vary from policy to policy, with some policies delivering little or no benefit. Operational risks extend further than extreme or stressed events like hacking, as it is well documented that users have found it difficult to withdraw or exchange their crypto assets for fiat currency even in normal times. Most wallet providers keep most of their hosted crypto assets offline in cold storage, but these crypto assets must be connected online before they are able to be transferred. The increased focus on improving security has meant that a smaller proportion of hacking events occur on centralized exchanges and wallets now than in recent years.

The crypto asset market is still relatively new and vulnerable to market abuse risks. Some of the intermediaries, such as wallets and exchanges, are relatively unsophisticated, or they may lack the systems and controls of regulated institutions. This can lead to risks to market integrity through information asymmetries. The price discovery function of the market is relatively weak, and therefore such assets are at high risk of market manipulation.³⁵ Anecdotal evidence suggests that some large crypto asset exchanges allow users to conduct wash trades, which inflates trading volumes and drives up price.³⁶ Many of these exchanges are also the largest holders of crypto assets and so might exercise disproportionate control of applications when engaging with networks that use Proof-of-Stake consensus.³⁷

Illiquidity could make markets vulnerable to other forms of market manipulation, such as pump-and-dump schemes, and whale trades. Even where trading is subject to regulation and surveillance by regulated exchanges, market manipulation enforcement is challenging because of the often pseudonymous, cross-border, and decentralized nature of the transactions. Market manipulation schemes are more problematic in crypto asset markets given the relative opacity of the market and illiquid nature of many (smaller) crypto assets. This could pose serious risks should asset tokenization³⁸ become more commonly used and expand to traditional assets in the future.

In many countries, crypto asset exchanges can avoid conduct or prudential regulation by listing only unbacked crypto assets. Existing conduct and prudential regulatory frameworks generally extend to exchanges that list security tokens but not to those that list unbacked crypto assets. Many jurisdictions have not developed conduct or prudential regulatory frameworks specific to crypto asset exchanges because of the small size of the local market, competing priorities, and/or a lack of skilled personnel. The cross-border nature of crypto asset exchanges also creates questions around extraterritoriality, notably when exchanges list only unbacked crypto assets. Some regulatory oversight of exchanges may exist, but generally regulation falls short of a substantive conduct or prudential framework.

The work of IOSCO on crypto asset exchanges is particularly relevant. In February 2020, IOSCO published its final report on issues, risks, and regulatory considerations relating to crypto asset exchanges.³⁹ A later section in this paper considers the case in which these exchanges might become systemic and offer clearance and settlement services, in which case further oversight is warranted. When building a regulatory framework for crypto asset platforms,⁴⁰ the IOSCO report should form the basis for a regulatory response, with additional considerations that reflect local needs, including the following:

• ■ Governance requirements for platform operators, including prudential requirements. Robust governance would be established by fit and proper senior management and control functions. In addition, having the necessary resources to run a platform can provide certain assurances on the reliability of the business. Any capital requirements would need to consider whether the operator will function bilaterally, that is, being counterparty to each transaction, or multilaterally by matching buy-and-sell orders. In the first case, counterparty risk on the part of the operator calls for risk-based capital requirements.

• ■ Requirements regarding access to the platform. Protecting the orderly functioning of trading usually requires a certain control over who accesses and uses the platform. Crypto asset platforms should have appropriate processes and controls that consider whether the platform allows direct retail access—in which case, the platform would not be able to rely on the due diligence of intermediaries.⁴¹

• ■ Requirements for the robustness, resiliency, and integrity of operating systems. One of the main vulnerabilities of crypto-asset platforms has been cyberattacks. Adequate processes and controls can help protect them from hacking or theft and can provide reassurance that they are otherwise robust and resilient enough to provide trading integrity.

• ■ Market integrity requirements. Crypto assets are prone to manipulation because of their high volatility, potential conflicts of interests or concentration issues, and low level of disclosure. Authorities should consider what market abuse rules and surveillance mechanisms should be in place to adequately protect users.

• ■ Transparency requirements. To promote the efficiency and integrity of trading, it is important to understand the extent of pre- and post-trade information, its availability, its method of dissemination, and whether it is available on an aggregated basis with other platforms trading the assets. Authorities should consider these elements to determine whether trading information on crypto assets is reliable, timely, and available to the public on a nondiscriminatory basis. Additionally, consideration should be given to the availability and transparency of platform rules and procedures, including order processing and how errors and cancellations are handled.

• ■ AML/CFT requirements. Platform operators should be expected to ensure they comply with applicable Financial Action Task Force (FATF) standards for AML/CFT. This monitoring could be developed in-house or might be delegated to a third-party provider; however, in these instances, any regulatory risk should reside with the party offering crypto asset services.

• ■ Products offered in the platforms. Platforms may have different approaches to how they determine which assets can be accepted for trading. Authorities need to consider what requirements or criteria are being applied. As discussed in the previous section, to ensure adequate disclosure to users of crypto assets, there should be clear expectations regarding availability of information on products traded, including risks. This is particularly relevant in platforms with direct retail client access. Authorities should consider whether a need exists for regulatory determination of the types of assets that can be accepted for trading or if they should be otherwise involved in the process of product listing.

• ■ Conflicts of interest. Where exchanges offer multiple services (such as issuance, exchange, lending, and storage), robust governance framework and disclosure requirements should be put in place to address conflicts of interests. Furthermore, to ensure that conflicts of interest are mitigated, regulatory authorities should consider whether exchanges should have a functional or legal separation of exchange and custody services.

• ■ Greater prudential requirements for off-chain transactions. Where crypto asset exchanges conduct significant off-chain transactions, the end users could be subject to greater risks around cyberattacks, loss of funds, and a single point of failure. Here, exchanges might be carrying out several functions that might ordinarily be delivered by the blockchain such as clearing and settlement. In these instances, crypto asset exchange should be subject to greater prudential requirements. Where these exchanges and their activities are considered systemic, the Principles for Financial Markets Infrastructures may also apply.

Wallet Providers

Custody of unbacked crypto assets takes place via wallets that can be varied in their design and operation, with implications for security and risks. The ownership of crypto assets relies on knowing the private keys stored in the wallet. If a wallet (and therefore private keys) is lost, then the crypto assets “stored” in it are unrecoverable. In terms of custody, a wallet can be managed by the users themselves or delegated to a third-party custodian (that is, a “wallet provider”), which is often a crypto-asset exchange, but it can also be a nonexchange third-party service provider. When the private keys are hosted by a third-party wallet provider, centralization is reintroduced with users no longer in control of their crypto assets, and although the risks of “losing” a wallet are reduced, the risks of cyberattacks, sharing of data, and transactions or accounts being blocked may increase.

Wallets can be classified as “hot” or “cold,” with implications for storage and transfer. Hot wallets are kept online, and cold wallets are kept offline. In addition to their role in storing private keys, wallets can also be used as a transfer function for peer-to-peer transactions. Cold wallets can be as simple as a paper put in a deposit box or an encrypted file on a USB drive. Most users and crypto asset exchanges alike use cold wallets for storing most of their crypto assets and keep only what is needed for transactions in the short term in a hot wallet. Hot wallets allow for the quicker transfer of crypto assets in peer-to-peer transactions. There is little real difference between cold and hot wallet technologies. A hot wallet becomes cold upon disconnecting it from the network and vice versa.

The use of hot and cold wallets to store private keys can give rise to a variety of risks. Cold and hot wallets face different types and degrees of risk. Hot wallets can be subject to hacking, particularly in the case of custodial wallets operated by third-party service providers. These wallets are likely to store the private keys of many customers and therefore provide an attractive “honey pot” for hackers. They might also be subject to greater operational risks because there is a reliance on the systems and controls of the third party for the token holder to be able to take control of their private keys. In the case of cold wallets, the risks of loss or physical damage to the wallet are greater than hot wallets, but cyber risks are eliminated until the user needs to use the wallet and so changes its status from cold to hot.

Risks around safeguarding and safekeeping of funds are particularly important in entities with storage and transfer functions. In the event that crypto asset wallet providers go bankrupt, and depending on the contractual arrangements in place, their clients’ tokens could be comingled with the service provider’s other assets—unless there is a clear legal and regulatory framework and robust arrangements to ensure appropriate separation of client assets and protection from the default of wallet providers. The lack of prudential and conduct regulation means that user funds might not be safeguarded in the same way as other financial products and services, for example, e-money or securities brokerage firms.

Wallets are the components of crypto asset systems that are most exposed to cyber risk, and so security is important. Specifically, attackers target the private keys in hot wallets, as obtaining them equates to impersonating the owner, allowing hackers to steal funds from corresponding wallets. Attacks against cold wallets, although much more difficult, are also possible. The security of the wallet is a crucial factor in the overall security of a crypto asset system. Wallet security requirements should be aligned with best practices in cryptography, with a focus on key protection and key lifecycle management controls. Importantly, because of the unclear delineation between cold and hot wallet technologies, requirements should go beyond technical details and should include principles-based requirements (for example, requiring that wallet protection measures be proportionate at all times to the security risk).

The provision of custody services by wallets is a critical component of the unbacked crypto asset ecosystem, hence regulatory responses should be suitably robust. Many provisions for crypto asset exchanges will be similar for wallet services, although given the role of wallets in storage and transfer, additional requirements must be considered. When building a regulatory framework for crypto assets, many authorities ask wallet providers to consider the following elements:

• ■ Segregation and safekeeping of holdings. In some jurisdictions, wallet providers are required to ensure that user holdings of funds or crypto assets are kept separate from the entity’s own funds or crypto assets. Client assets should be restricted from reuse and/or lending without explicit consent from the users and appropriate compensations. This includes ensuring that wallet addresses for users are different to the entity’s own wallet address. Funds might be kept in accounts with regulated commercial banks.

• ■ Operational and cyber resilience. Many authorities require that wallet providers ensure a robust cybersecurity framework to keep custodied crypto assets safe. There have been many occasions where consumers were unable to access their holdings because of operational failures. Therefore, it is important that wallet providers have effective incident management procedures, which include the detection and classification of major operational and security incidents. Reporting operational or cyber incidents needs to be timely and accurate to ensure market integrity. Where cyber or operational processes are delegated to third parties, the wallet provider should be responsible for the incidents that occur in the third parties with clear outsourcing requirements in place.

• ■ Keeping records of holdings. DLT aims to streamline the administration of custodied assets by keeping a real-time record of holdings on the network. Many regulators require that wallet providers ensure such administration is secure, resilient, timely, and accurate. Wallet providers should be able to share with the user, on request or at regular intervals, any changes in their holdings. Reliance on DLT for record keeping can conflict with existing rules requiring centralized entities for record keeping (for example, the Central Securities Depositories Regulation in the European Union), and some authorities are considering how best to modernize these rules.

• ■ AML/CFT requirements. Platform operators are expected to ensure they comply with applicable FATF standards for AML/CFT. This monitoring could be developed in-house or delegated to a third-party provider. However, in these instances, any regulatory risk should reside with the party offering crypto asset wallet services.

• ■ Minimum set of proportionate reporting requirements. Authorities should consider subjecting wallet providers to some reporting and prudential regulation requirements, such as regarding risk management (including operational and cyber risk), protection of client assets, minimum capital, and liquidity (particularly in cases when the wallet service provider reuses the customer’s crypto assets). Proportionality is an important consideration when developing reporting procedures, but given the risks generated by wallet providers, reporting may need to encompass all necessary information and frequency to mitigate those risks.

• ■ Adequate safeguards. Regulatory frameworks might consider the need for wallet providers to have adequate safeguards, such as cyber insurance coverage, in the case of a hacking event, to mitigate risks for consumers. Such insurance could cover a minimum proportion of holdings as determined by authorities. However, authorities should have good oversight over the terms and conditions of such policies as their impact in the event of operational or cyber failure can be limited.

• ■ Wind-down arrangements and resolution. Authorities might want to consider effective wind-down arrangements where a wallet fails. Appropriate segregation of client funds can reduce consumer harm in the event of a firm failure, while working with third-party providers and maintaining critical information technology infrastructure is also important. A compelling case can be made for the prudential regulation of third-party wallet service providers to afford a degree of protection for customers in relation to fraud and to mitigate contagion risk to other parts of the financial sector, although there is a significantly weaker case for certain types of protections like deposit insurance when the wallet stores unbacked crypto assets. By allowing a third-party custodian to store private keys, there could be legal uncertainty on the inclusion of crypto assets held in custody in the event of its bankruptcy if the customers’ assets are exposed to the risk of comingling with those of other customers or those of the service provider.

• ■ Conflicts of interest. Where wallet providers are part of a broader group, they must ensure that appropriate governance procedures are in place to ensure independent decisions on wallet services and no conflict of interest from other group activities within the group. Wallet services should provide for the best interest of wallet service users, and this includes transparency and disclosure requirements where any potential conflicts of interest (such as connections to other businesses, including exchanges) are clearly communicated.

Validators, Miners, and Underlying Technology

The use of DLT in financial services may bring considerable benefits but also unique risks that regulators should consider. When DLT is deployed in an open and permissionless manner, there is no single point of failure, which reduces operational and some cyber risks. DLT in many of its forms is immutable and transparent and can provide a clear audit trail for the transfer of data. Experiments by various market participants and regulatory authorities have shown the potential efficiency that could be leveraged across payments, settlement, and clearing within financial services.⁴² However, different forms of DLT can give rise to different risks—including to financial stability. For example, risks are different depending on whether a blockchain is private and/or permissioned or public and/or permissionless. The former ensures that participants who can view and act on the data are known, whereas in the latter model, data distribution is more decentralized.

Private blockchains, especially those created by BigTechs and incumbent financial institutions, could contribute to fragmentation, concentration, and financial stability risks. These risks would be realized by creating closed ecosystems with little interoperability in key areas, such as payments infrastructure, that potentially provide critical services. This could lead to networks that are too big to fail.

Public blockchains, although more resilient to single points of failure, may still be susceptible to certain failures, including 51 percent attacks, selfish miner problems, or miner extractable value (depending on the consensus mechanism employed). Although work is being done to promote cross-network interoperability, most native crypto assets currently can operate only on their native blockchain networks. These cross-network bridges may themselves be single points of failure with $2 billion worth of crypto assets being stolen from cross-chain bridges.⁴³ Even where a crypto asset is offered on separate networks, the crypto assets may not directly be fungible with their cross-chain equivalents. Elements of public blockchains might also be reliant on centralized entities. For example, some hosted nodes on certain public blockchains are reliant on the services of BigTech entities, whereas the networks themselves might rely heavily on common infrastructures for aspects such as the provision of full nodes.⁴⁴

Authorities should consider the regulatory implications of different forms of technology. Global standard-setting bodies and regulatory authorities take a technology-neutral approach to regulation (that is, same activity, same risk, same regulation).⁴⁵ However, certain types of consensus mechanisms that underpin blockchains may inherently generate frictions with broader policy objectives and mandates, and a technology-neutral approach may not be sustainable going forward. For example, the use of proof-of-work mining requires significant energy and runs counter to the global aim of transitioning to a low-carbon economy. Other types of consensus mechanisms might generate concerns around security, transparency, or concentration. For example, although the shift from proof-of-work to proof-of-stake would improve energy efficiency and scalability, it could create excessive concentration of decision-making powers on crypto exchanges and wallet services providers, which may increase market integrity risks (Agur and others 2022). Conversely, consensus in private blockchains may be faster and cheaper, but it may centralize the ecosystem, create new entities that could become “too big to fail,” and generate concerns around data privacy and protection (Bains 2022). Points of vulnerability, such as cross-chain bridges, should be considered by authorities as part of the unique technology risks of blockchains.

Regulated Financial Institutions

Further institutionalization of crypto asset–related activities could increase transmission channels between crypto assets and traditional financial institutions. The BCBS recently issued a second consultative document on the prudential treatment of banks’ exposures to crypto assets, which aims to standardize the treatment of crypto asset holdings (BCBS 2022). The proposed standards reflect the high risk of some crypto assets, while taking a more proportional and technology-neutral approach to those that are anchored on real-world assets. The BCBS proposed splitting crypto assets into two categories: lower-risk anchored crypto assets and higher-risk ‘traditional’ crypto assets like Bitcoin. The first category was further distinguished between tokenized assets and stablecoins. Credit and market risk capital requirements for tokenized assets would be similar to those for traditional assets, whereas for stablecoins, the proposal considered a possible lower risk weight based on certain conditions. For traditional crypto assets—which include unbacked crypto assets—the BCBS proposed a conservative prudential treatment based on a 1,250 percent risk weight that would be applied to maximum long and short positions.

The high volatility of certain unbacked crypto assets warrants a conservative treatment on direct exposures, but indirect exposures should also be monitored. Regulated entities are vulnerable to loss from direct exposure to unbacked crypto assets because of their high volatility, although data suggest that such exposure remains limited for banks both in terms of number of banks exposed and the size of exposures (Auer and others 2022). Prudentially regulated financial institutions will likely need to follow a conservative approach, such as capital deductions or the imposition of high-risk weights, for their internal risk and capital management purposes. Robust segregation and separation between traditional and crypto business are desirable, although group-wide and step-in risk would also need to be considered even when crypto businesses are located in a separate entity within the group. Financial institutions should also monitor their indirect exposures. This could be through loans to crypto users, derivative exposures with crypto-asset exchanges, cyber insurance to wallet providers, and so on. Although such risks brought by indirect exposures are not the same as from direct exposures, they can be strongly correlated with market movement.

Other prudentially regulated financial institutions (such as broker dealers, asset managers, and insurers) need to manage their risks carefully. Some broker dealers are actively expanding their services toward unbacked crypto assets. Asset managers also provide investment products linked to crypto assets. Crypto-linked exchange-traded funds would need active market making by authorized participants, which are typically prudentially regulated financial institutions. Insurers could potentially increase their exposure to unbacked crypto assets in search for yield. Although those risks may be immaterial at this stage, strong interest among retail users (especially in emerging markets and developing economies) would likely encourage those institutions to offer products linked to unbacked crypto assets in the future. Therefore, authorities should enhance their communication with and monitoring of financial institutions to encourage prudent business decisions and enhanced risk management.

Multiple Functions and Market Infrastructure

Increasing off-chain transactions suggest some centralized entities are taking the role of financial market infrastructures. In principle, in the crypto asset space, traditional financial market infrastructure tasks, such as clearing and settlement, are carried out by the underlying technology in a decentralized manner. Crypto assets were, in fact, designed to operate without traditional FMIs: Technology itself would be responsible for value transfer, record keeping, clearing, and settlement. Nevertheless, the growing importance of “off-chain” transactions through some centralized entities could mean that these entities are playing an important role in the crypto asset ecosystem. For example, such transactions will require that some crypto asset service providers offer clearing services and settlement services.

Additionally, crypto asset service providers are more likely to provide multiple services globally within one entity. In wider financial markets, key functions (such as exchange, custody, clearing, and settlement) have been provided by multiple and dedicated entities. However, in the crypto asset ecosystem, rapid “off-chain” clearing and settlement can occur as, unlike in traditional securities markets where there is separation between exchanges and custodians, these two functions are more likely to be delivered by a single entity. Furthermore, these crypto asset service providers may carry out additional services such as lending and payments, while large crypto exchanges can also operate globally without creating subsidiaries or branches in each jurisdiction.

The potential broadening of offerings and the growth of “off-chain” transactions could lead to crypto asset service providers becoming critical to the crypto asset ecosystem. However regulatory and oversight gaps may remain. To address their critical role, in some jurisdictions, certain crypto asset service providers could be considered or designated as FMIs (although unlikely in relation to unbacked crypto assets). Some differences stand out compared to traditional FMIs. First, traditional FMIs carry out critical non-substitutable services, whereas crypto users could replace one crypto exchange with a competitor or resort to “on-chain” transactions; therefore, the essential services could continue to be provided in the absence of these entities. Second, “off-chain” transactions might be considered “closed loops” which may not trigger FMI oversight. Appropriately addressing oversight of critical service providers remains an important issue.

Where crypto asset services providers carry out multiple activities or offer clearing and settlement services, greater prudential requirements are necessary. Depending on the scope of the activities provided, a regulator or supervisor may want to establish expectations for crypto asset service providers offering infrastructure-like services such as clearing and settlement. The expectations would support the overall objectives of safety and efficiency, including the implementation of greater prudential requirements across the entity that reflect increased risks generated by additional activities. Similar to traditional FMIs, crypto asset service providers can reach a level where they concentrate risk, which, if not properly managed, can contribute to financial system disruption and can trigger shocks throughout financial system. Where the activities of these entities constitute important infrastructure for financial markets or generate risks to broader financial stability, domestic regulators might determine they are systemically important.

Designation of a crypto service provider as systemic is at the discretion of authorities. In the case of FMIs, the key factor is the potential of an FMI to trigger systemic disruptions.⁴⁹ For stablecoin arrangements, for example, the systemic importance can be determined by domestic regulators based on such factors as size of stablecoin arrangement in terms of number of users and value or volume of transactions, nature and risk profile of the stablecoin arrangements’ activity, interconnectedness and interdependencies with the real economy and financial system, and availability of alternatives to using the stablecoin arrangement as a means of payment or settlement for time-critical services.⁵⁰ The process of identification and designation of crypto service provider as systemically important can be complex because factors should be viewed holistically by domestic regulators. It is unlikely that crypto asset service providers will reach such a level in most jurisdictions, but if they do, they would be subject to the PFMIs.

Considerations for Regulatory Frameworks across Crypto Assets

As crypto assets continue to evolve and transform financial services, authorities should take a proactive and holistic approach to regulation, based on a comprehensive and evidence-based assessment of risks. The BFA provides a general framework for regulators to engage with new technologies in financial services. Particularly relevant in the context of regulating crypto assets are elements V (monitor the developments closely), VI (adapt regulatory framework and supervisory practices), and X (develop robust financial and data infrastructure).

The soundness of the legal framework is a precondition for a strong regulatory framework for crypto assets. The BFA⁵⁷ sets out that legal certainty helps build confidence in the trustworthiness and reliability of financial products and services. Some legal aspects are specific to crypto assets. For example, legal certainty related to the nature and the extent of the rights of the holders could be lacking in many of those arrangements, and the general legal regime may fall short of providing the needed answers. Jurisdictions might consider these issues as part of their overall approach to regulating crypto assets, thus ensuring that the legal framework evolves with global financial markets and technologies.

Several steps need to be taken when developing a national regulatory framework for crypto assets:

• Authorities should first monitor developments to accurately gauge the size of the market and to identify areas of risk, which can be challenging given the lack of data available on crypto asset markets to allow authorities to gauge the size of the risks.

• Authorities should consider the risks of unbacked crypto assets as part of their broader regulatory and supervisory duties and determine whether the crypto asset market presents risks to their mandate that would reflect the considerable resources required to regulate and supervise crypto assets.

• Authorities should determine a clear scope for regulation, that is, which entities, crypto assets, and activities will fall within the regulatory scope.

• Regulatory development should be a collaborative effort of financial sector regulators and relevant government departments, taking into account guidance from standard-setting bodies and regulatory approaches in peer countries. Cross-sectoral collaboration is particularly important given the lack of legal clarity in many jurisdictions as well as the hybrid nature of many types of crypto assets. Such collaboration can occur through memorandums of understanding, working groups, standing committees, or joint taskforces such as the UK Crypto Asset Taskforce. Regulation may require authorities to shift from a technology-neutral approach to one that considers the specificities and risk of different technologies.

• Continuous assessment of risks will be needed to identify shifting risks and business models that may require updating regulations to ensure effective protection of markets, consumers, and financial stability. All of this is predicated on the availability and accuracy of relevant data to inform decision-making. Each of these steps is considered in more detail below.

Monitoring

The ability to monitor developments effectively and accurately is a core part of the BFA, and the first step in developing a regulatory framework is obtaining information. Some regulators are already assessing the size and composition of their domestic crypto asset market as well as user knowledge and behavior. The crypto asset ecosystem can be monitored through business-as-usual supervision, dedicated horizon scanning tools such as innovation offices, and/or the use of supervisory technology like web scraping. Monitoring can also be done through outreach and engagement, such as consumer and market surveys. Information and analysis should cover the types of crypto asset service providers and types of issuers. For instance, it will be difficult to develop a regulatory framework focused on issuers if most crypto assets within a jurisdiction are issued in a decentralized manner or if crypto asset service providers are located offshore.

Prioritization

Regulators often face stretched resources, competing priorities, and little crypto asset expertise. They will therefore allocate scarce resources depending on their assessment of risks. Where crypto asset markets are small, some regulators have employed an active “wait and see” approach, preferring to focus on other areas of financial regulation, while keeping a close eye on developments using targeted outreach and engagement with the crypto asset community (for example, themed events, drop-in sessions). The resources needed to implement different regulatory approaches vary, and authorities should carefully consider the feasibility of a regulatory approach given their resource constraints. Authorities should also be mindful that developing a regulatory framework for crypto assets has the potential of legitimizing the market—which in turn could spur growth and further stretch regulatory resources.

Scope

The regulatory scope should be clear and focused on the critical functions of the crypto ecosystem. It is important that a clear scope is identified based on the risks generated by different entities and crypto assets. Although it is useful to have regulatory frameworks that cover the entire crypto ecosystem in the long term, in many jurisdictions, economic functions of unbacked crypto assets and certain types of stablecoins are likely to be most prevalent given their use as speculative investments, as access points for other crypto assets, and (for certain stablecoins) as stores of value. In many jurisdictions, those critical functions are supported by centralized entities, such as wallets, exchanges, and existing financial institutions such as commercial banks, brokers, and dealers. Therefore, greater oversight should be given to those entities as well as the exposures that regulated financial institutions (like banks) have to these crypto assets. Conversely, other types of crypto assets like NFTs and certain types of utility tokens remain niche, with unclear use cases that are unlikely to generate systemic risks in the near-term, and so they may not directly affect the mandates of financial regulators in their pure form (see footnote 26). The scale of adoption and economic function of crypto assets should determine the appropriate regulatory and supervisory approach. Where usage of crypto assets is limited, a regulatory focus on user education and potentially consumer warnings may suffice, as risks to consumers are likely small. For example, consumer research in the United Kingdom has suggested that crypto assets are often used like gambling, but users do not speculate with large amounts or borrowed money (FCA 2020). Where crypto assets are used purely for speculation—with some similarities to gambling—consumer protection issues may be better addressed by other government agencies, such as those responsible for gambling. In jurisdictions where crypto assets are not widely used as a means of exchange or store of value and regulated institutions do not have large exposures of crypto assets or do not service crypto asset service providers, the risks to financial stability or market conduct might also be small, and so developing bespoke regulation may not be a regulatory priority. However, although some jurisdictions may not deem regulation of crypto assets to be a domestic priority, if they host crypto asset service providers that serve consumers globally, then they should consider developing regulation in collaboration with their regulatory peers, including host jurisdictions. This analysis of economic functions and scale of use can allow regulatory authorities to focus on areas with the highest risks.

The multiple activities carried out by crypto asset service providers can inform and may warrant additional regulatory and supervisory action. Crypto asset service providers often carry out multiple activities that are likely to generate additional cumulative risks. Authorities should determine whether these entities are playing a role akin to a systemic infrastructure provider and should be regulated and supervised as such. Although some authorities may be able to mandate on-shoring of these entities to ensure supervisory oversight, others will need to rely on home regulators setting out strong prudential rules and carrying out robust entity-based supervision. Authorities should regulate all entities that carry out key functions in the crypto asset ecosystem.

Domestic Collaboration

Coordination among financial authorities is important to achieve respective mandates. Many regulators have broad mandates (such as consumer protection, micro- and macroprudential) and different priorities over their mandates. In addition, it is often the case that these mandates are allocated to multiple financial authorities. Therefore, any regulatory framework should be developed as a coordinated effort across financial regulators to achieve various and sometimes competing objectives.

The primary objective of regulation and supervision should be to promote the safety and soundness of the financial system. If the supervisor is assigned broader responsibilities, these should be subordinate to the primary objective and should not conflict with it. Depending on the economic conditions and needs of the local market, some authorities might have lower risk tolerance regarding financial stability, and if so, might allocate more resources to entities and activities that pose higher stability risks. Other markets may have a greater desire to increase financial inclusion and so might be more open to innovation (viewing competition as a way to not only better serve consumers but also to mitigate longer-term systemic risk). In either scenario, regulation needs to be tailored to the risks and to address all important risks discussed in this section.⁵⁸

Close coordination between domestic authorities and other stakeholders can support effective regulation. In many jurisdictions, regulatory frameworks were developed sequentially, based on priorities and resources. Regular coordination among the relevant domestic authorities can facilitate a clear allocation of responsibilities. The potential for regulatory arbitrage, scarce expertise and resources, existing laws and regulations, and reputational risks should all be taken into account when determining which authority or authorities—including those with AML/CFT mandates—should regulate and supervise different aspects of crypto assets. It is also key that the assessment of risks and monitoring involve cross-sector coordination, as well as an ongoing dialogue with the industry and other key stakeholders. This would help authorities better anticipate risks in market developments and proactively seek appropriate responses.

Continuous Assessment of Risks

Although technology neutrality is conceptually appealing, in practice, monitoring and risk assessment will need to adapt to a changing landscape and risk outlook, including technology developments. Technology neutrality is conceptually appealing but difficult in practice as different technologies will have unique benefits and risks. Although most authorities aim to be technology neutral, it is often the case that different regulatory stances are needed depending on specific risks brought by the technology used. Where a specific type of crypto asset, or a DLT underpinning the crypto asset, creates risks to markets and consumers, authorities look to ensure such risks are mitigated. Likewise, where certain types of crypto assets or DLT can help deliver innovation that benefits markets and consumers, some authorities have supported their development. Furthermore, although the concept of same activity, same risk, same regulation is key, the very use of a novel technology (like DLT) can alter the risk profile of traditional assets (for example, through fractionalization, decentralization, availability of greater liquidity) and so unique risks may require bespoke regulatory approaches. Although a technology-neutral approach to regulation might be appropriate, supervisory approaches should consider the unique risks of different methods of delivery and operation, and authorities should be confident in identifying where particular types of technologies might challenge (or support) their objectives.

Understanding DLT networks and inherent risks can help authorities decide if and when a more technology-agnostic approach is needed. Upskilling staff or hiring DLT experts can help authorities better determine the underlying technology used to deliver many types of crypto assets and to accurately understand new risks that might be created. Although frontline supervisors may not necessarily need to review code, they will need to understand important differences that exist between different types of blockchain networks and different types of crypto assets. Many types of DLT work on the basis of fundamental trade-offs, some networks favor security and integrity, some focus on speed and efficiency, and some are designed to be transparent and auditable. Each has relative strengths and weaknesses in different areas of financial services and may be more, or less, suited to existing regulatory frameworks. Better understanding the underlying technology can help authorities determine, for example, risks from high energy consumption, risks of network failure (whether malicious or technological), operational risks, risks to financial integrity, and—if used as scale—risks to financial stability (Bains 2022).

Determining the geographic location⁵⁹ of crypto assets and activities is challenging, making international action key in the continuous assessment of risks. Domestic regulatory frameworks will need to consider the cross-border and global accessibility nature of crypto assets to minimize regulatory arbitrage. Although regulation specifically targeting crypto assets would need to be tailored to jurisdiction-specific features, a consistent approach and international cooperation will be key to prevent and minimize regulatory arbitrage and potential inconsistencies in the application of laws and regulations. Domestic regulatory measures that do not consider cross-border issues and overseas regulatory measures may create opportunities for regulatory arbitrage. Active engagement is needed to identify cross-border considerations and to tackle potential regulatory arbitrage. International cooperation in enforcement will continue to be key for sanctioning and prosecuting crypto asset–related cases, and authorities should ensure they have the appropriate mechanisms to share information in the context of investigations and prosecution.⁶⁰ Finally, specific regulatory and supervisory colleges can help unite authorities in response to product launches and ongoing supervision in multiple jurisdictions at the same time.

Standard-setting bodies and international institutions are playing critical roles to ensure monitoring and assessment of risks, and the IMF can leverage its universal membership to provide guidance and support. Many authorities use cooperation networks and standard-setter initiatives to exchange information on developments in the crypto assets space and ensure they can effectively monitor new and developing risks. Many standard-setting bodies have specific committees that look at the risks of crypto assets (for example, IOSCO Fintech Task Force, FSB Financial Innovation Network, FSB Regulatory Issues of Stablecoins, BCBS Financial Technology expert group, and so on) and membership of such groups can help authorities share new developments and best practices regarding regulatory responses.

Considerations for Data Availability⁶¹

The fragmented growth of the crypto asset ecosystem coupled with the relative immaturity of the market means data are often unavailable or unreliable. Data in crypto asset markets are currently unreliable, incomplete, or fragmented across borders. As there are few global standards and no common taxonomy, data gaps are substantial. Reporting and disclosure by entities such as issuers, wallets, and exchanges are largely voluntary, lack uniformity, and are sometimes overstated. For most jurisdictions, regulatory data reporting by crypto asset service providers is limited to AML/CFT requirements or no reporting occurs at all.

Crypto asset data are normally limited to what is captured on chain and rely on accurate geolocation capture. Although public distributed systems tend to be transparent and immutable, that transparency extends only to those transactions recorded on chain. Where transactions occur off chain, which is mostly the case in centralized entities such as exchanges and wallets or on certain second-layer applications like the Lightning Network, they may be more difficult to track. Furthermore, the use of VPNs to access these centralized services can make accurate geolocation data more challenging. Most crypto asset issuers have little information about their users’ profiles (either retail or institutional) and locations.

Data and insights help regulatory authorities determine whether there are material risks to consumer protection, market integrity, and financial stability. Better tools to understand the crypto ecosystem can help authorities determine whether the development of a regulatory framework for crypto assets should be a priority and how it can be effectively implemented. It can help authorities decide which approach to take, based on solid evidence.

More accurate, granular, and standardized data can help better gauge and manage risks. Data that can help determine domestic market size (such as volume of transactions, number and location of customers and service providers, number of domestic crypto asset issuers and service providers, and so on), consumer and user behavior (type of consumer, size of retail holdings), and composition of market (type of crypto asset entity in local market) can all help authorities better gauge and manage risks.

A common taxonomy can form the foundation of a more coherent and consistent regulatory approach to crypto assets globally. The fragmented approach to categorizing crypto assets is a significant inhibitor to the development of globally consistent standards and can inhibit the reliability and availability of data. Although different legislative frameworks are likely to capture individual tokens in different categories (for example, the broad nature of the Howey Test in the United States used for security tokens), a common taxonomy can ensure authorities have a standardized set of categories to understand the use and impact of crypto assets, identify relevant data, and collect useful information. The absence of common taxonomies and differences in the granularity of data collected mean that data capture might differ across jurisdictions.

In addition to a common taxonomy, data collection can be improved with strong home-host data sharing, extended regulatory coverage, and the use of new technologies. The reporting of crypto asset data is largely limited to voluntary reporting or reporting under the AML/CTF framework. Data collection should be made more consistent across borders, and collected data should be shared among relevant home and host authorities within existing legal frameworks. Extending regulatory coverage for conduct and prudential purposes might help authorities collect more accurate and reliable data from the entities that perform critical functions, such as crypto asset service providers, network administrators, and certain issuers.

Some authorities are beginning to work with blockchain analytics firms to better understand the flow of funds through a crypto asset value chain, and although significant limitations exist (for example, off-chain data collection and the use of VPNs), such an approach is a sensible first step. Some organizations are exploring concepts of embedded supervision that can allow authorities to directly interact with distributed networks, which improves their access to data while enabling them to monitor compliance in real time by viewing blockchain transaction data.⁶² Although theoretically appealing, such an approach would initially be limited to authorities with the relevant resources and expertise, and a high initial investment could be required, with ongoing costs of maintenance and training. Furthermore, this investment would be limited to a niche use case that is blockchain regulation and may not warrant highest priority in those jurisdictions where the financial stability and consumer protection risks of crypto assets remain low. Finally, the use of privacy-enhancing techniques, such as zero-knowledge proofs and homomorphic encryption in data collection, might better allow authorities to view these data across borders while protecting individual user privacy and remaining compliant with data protection laws.