Over the course of late 2018 and early 2019, while in the throes of working on the Bermuda Monetary Authority’s (BMA’s) initial coin offering and Digital Asset Business license applications, I was challenged by the rapidly shifting regulatory landscape for digital assets, despite having been general counsel and chief regulatory officer for a US stock exchange. Mostly, I was impressed by the BMA’s ambitious efforts to lead the world with comprehensive digital asset regulatory standards.
Multiple jurisdictions endeavor to attract digital asset businesses by establishing licensing requirements in conjunction with more prescriptive or rules and standards-based regulation designed to foster investor confidence and provide regulatory clarity. Based on practical experience and research, the most notable jurisdictions opting for the prescriptive approach include Malta and New York.
Digital asset markets are nascent, and, like many emerging technologies and markets, evolution is hard to predict. For many jurisdictions adopting the prescriptive regulatory approach, the initial costs of licensing and ongoing compliance can be costly. Newer entrants can be dissuaded by these barriers and seek out less regulated jurisdictions. On the other hand, jurisdictions need to protect their reputation and market participants to advance their economies.
To date, most jurisdictions have opted a proscriptive or principles-based approach to digital asset regulation to provide more flexibility to digital asset markets to continue to evolve and leaving the question of how to execute on those principles largely to the participants or future interpretation, except where regulations overlap (i.e., securities, commodities, and AML).
Irrespective of the regulations governing a digital asset business, forward thinking businesses should consider adopting their own principles-based code of conduct as well as selectively draw from prescriptive standards and frameworks for their implementation of those principles for the following reasons.
As a starting point, we recommend the principles in Association of Digital Asset Market’s (ADAM) Code of Conduct published last November.
ADAM’s Code of Conduct
ADAM is a coalition of leading digital asset companies focused on the promotion of “integrity, fairness, and efficiency in digital asset markets.” ADAM’s Code represents their efforts to establish a framework to facilitate the institutionalization of the digital asset market as well as provide assurances to regulators. Each ADAM member agrees to the Code of Conduct as a condition of membership.
The ADAM Code is organized based on eight primary areas (or domains).
Digital asset businesses that choose to adopt a code of best practices such as ADAM’s Code will need to next address how to implement the underlying supporting controls. Failure to do so will create more risk as clients and regulators are likely to view documented but disregarded principles as a red flag, in addition to the potential legal implications.
For some, the solution may be to simply hire big law, accounting or consulting firms that can boast of their experience. Doing so, however, fails to contemplate other freely available resources that have been put together by the regulators themselves, in addition to potentially reducing their sense of ownership. Leveraging prescriptive regulatory rules and guidance specific to digital asset businesses (even where not governing) together with other publicly available standards and frameworks such as, for example, NIST and ISO/IEC 27001, can enable these businesses to both establish or improve upon their controls by selectively borrowing from the work already done by highly credible regulators and experts.
Notable jurisdictions for digital asset business standards
Bermuda has leveraged its status as a reinsurance leader to build a digital asset regulatory framework that provides certainty through comprehensive prescriptive guidance. In addition, the Bermuda Monetary Authority is an experienced regulator well versed in risk management. Premier Burt, in speaking of this framework and the island’s reputation, stated “Bermuda, from its regulatory perspective, stands in a class amongst itself. There’s only two countries in the world that have regulatory equivalence in risk with both the United States and the European Union, and that’s Switzerland and Bermuda.”
This commitment is, in fact, reflected in their digital asset regulatory framework and, as a result, makes it an important reference. Even other regulators have looked to Bermuda…Wyoming, home to the most progressive digital asset regulation in the US, closely modeled their own digital asset custody rules from Bermuda’s draft Digital Asset Custody Code of Practice. To date, the island has approved licenses for five digital asset businesses.
Malta sought to build upon its status in the gaming industry to push into distributed ledger technologies. In 2018, it adopted the Digital Innovation Framework, comprised of three bodies of law relating to distributed ledger technologies. Its Virtual Financial Assets Act provided for licensing requirements and prescriptive rulemaking to mature its quickly developing digital asset or blockchain market. With much enthusiasm, in speech to the United Nations their Prime Minister dubbed Malta the “Blockchain Island” and claimed to have created the world’s first comprehensive blockchain legislation. In February of 2020, the Malta Financial Services Authority followed up with their VFA Rulebook that greatly expanded their regulatory prescriptions. Malta’s embrace of blockchain led to rush of businesses to “Blockchain Island,” many of whom have since left due to frustration with what is perceived as Malta’s inability to manage the framework that it had set up. For example, out of 340 “service provider” license applications initially filed pursuant to the Virtual Financial Assets Act, none have been granted, most have been abandoned and as of April 30th, only 26 remain active.
New York’s virtual currency rules were enacted in 2015 and provide helpful prescriptive value for business continuity planning and client disclosures. Some have criticized its licensing application burdens. As of May 6, 2020, only 25 licenses had been granted.
Each of the above jurisdictions have invested extensive resources into the creation of prescriptive digital asset regulations. One view is that the scope of these regulations and the challenges of the licensing process has potentially restrained the growth for an evolving and nascent market. Given the adjustment in expectations, in no jurisdiction is this view more prevalent today than in Malta. On the other hand, a slower initial pace for licensing approvals may reflect a more judicious approach by regulators and could ultimately prove to be the approach that creates a base for digital asset markets to build upon. While the truth no doubt lies somewhere in between, these bodies of law and associated guidance provide useful standards for forward looking digital asset businesses contemplating sustainable controls.
Standards to assist in the implementation of ADAM’s Code of Conduct
Below is a mapping of ADAM’s code to the most helpful rules and guidance from these jurisdictions, along with certain other helpful rules and standards, to assist digital asset businesses to develop their own self-regulatory framework and internal controls. Market ethics was not mapped as it is generally expressed as a principle without further prescriptive guidance (and this was borne out in the prescriptive regulatory frameworks examined as well).
Governance, compliance and risk management
Conflicts of interest
Transparency and fairness
Market Integrity
Custody
Information security and business continuity
Deeper Coverage
NIST provides a wealth of comprehensive cybersecurity guidance for building and maintaining cybersecurity programs, security event recovery and securing digital assets.
Anti-money laundering and countering the finance of terrorism
Best
Bermuda’s thoughtful AML guidance is comprehensive and their prudential standards even provides templates, but these should not be a substitute for the primary authorities, such as Financial Crimes Enforcement Network’s (FinCen) Guidance related to Convertible Virtual Currencies.
Conclusion
ADAM’s Code of Conduct is a helpful resource for an industry grappling with an uncertain regulatory environment. The leadership that its members have taken demonstrates another positive step in the evolution of digital asset markets and reflects the desire of responsible market participants to self-regulate. Adopting aspirational principles without more does not, however, advance confidence in the markets or protect its participants. ADAM members, as well as other participants who have adopted similar principles, have already instituted a number of controls associated with these principles, but should consider the good work done by regulators and others to define or identify appropriate controls for executing on those principles and selectively draw from them to create or build upon their own controls.
Eric Hess is the founder of Hess Legal Counsel and Helical, Inc.
Hess Legal serves securities and digital asset firms, primarily with regards to financial, information security, AML, and privacy regulation; corporate governance; technology licensing; and various financing arrangements. Helical, Inc. offers information security products as a service to small and mid-sized businesses.
Prior to forming the above, he was CEO for a start-up execution venue and listings-like platform in over-the-counter Bulletin Board securities.
Hess holds Series 7 and 24 licenses and is admitted to practice in the States of New York and New Jersey.
Follow Us on Twitter Facebook Telegram
Featured Image: Shutterstock/sdecoret