Whose coinsthey are isno longera design choice.
- Instrument
- Regulation (EU) 2023/1114
- Binds
- Crypto-asset service providers
- Core duties
- Art. 70 and Art. 75
- Liability
- Art. 75(8)
Article 67 asks what a provider holds against failure. These two ask what it is holding in the first place.
What they require
Client assets are safeguarded and kept apart from each other
Ownership rights in clients' crypto-assets and funds are safeguarded, and the assets of different clients are segregated from one another. Clients are told, in clear and non-technical language, what the systems, policies and procedures behind that actually are.
Custody is a written agreement, not a practice
A provider offering custody and administration concludes an agreement with the client setting out the duties and responsibilities of each side, and operates a custody policy. What was an operational habit becomes a document a supervisor can read.
Segregation reaches down to the ledger
Clients' crypto-assets are held separately from the provider's own on the distributed ledger itself, and are segregated from the provider's estate. Segregation stops being an entry in an internal system and becomes a fact about where the assets sit.
The assets, or the means of access, come back
The provider must have procedures in place to return the crypto-assets held on behalf of clients, or the means of access to them, as soon as possible. A key that only one departed engineer could produce is not a procedure.
The line: attributable, or not
The provider is liable to its clients for the loss of crypto-assets attributable to it, and a loss arising from the provision of its services is deemed attributable. It is not liable for an event occurring independently of its operations — the example the Regulation itself reaches for is a problem inherent in the operation of a distributed ledger that the provider does not control.
A statutory liability is a definable exposure
Article 75(8) does not create insurance. It does something more useful for anyone assessing this risk: it says which losses land on the provider by law, and which do not. An exposure with an edge written into a regulation is an exposure that can be described, evidenced and argued about, instead of one that has to be guessed at.