The Basel Committee on Banking Supervision (BCBS) is the primary global standard-setter for the prudential regulation of banks and provides a forum for regular cooperation on banking supervisory matters. Its 45 members comprise central banks and bank supervisors from 28 jurisdictions.

The Financial Action Task Force (FATF) is the global money laundering and terrorist financing watchdog. The inter-governmental body sets international standards that aim to prevent these illegal activities and the harm they cause to society. As a policy-making body, the FATF works to generate the necessary political will to bring about national legislative and regulatory reforms in these areas.

With more than 200 countries and jurisdictions committed to implementing them. The FATF has developed the FATF Recommendations, or FATF Standards, which ensure a coordinated global response to prevent organized crime, corruption, and terrorism. They help authorities go after the money of criminals dealing with illegal drugs, human trafficking, and other crimes. The FATF also works to stop funding for weapons of mass destruction.

The FATF reviews money laundering and terrorist financing techniques and continuously strengthens its standards to address new risks, such as the regulation of virtual assets, which have spread as cryptocurrencies gain popularity. The FATF monitors countries to ensure they implement the FATF Standards fully and effectively and holds countries to account that does not comply.https://www.fatf-gafi.org/about/

The FATF, as the global standard-setter for AML/CFT, set out in June 2019 how the FATF standards should apply to virtual asset activities and Virtual Asset Service Providers (VASPs). 18,19 It set out recommendations that require countries to assess and mitigate the money laundering and terrorist financing risks associated with virtual asset activities and VASPs; license or register such providers; subject them to supervision or monitoring, and require that they implement all of the AML/CFT preventive measures under the FATF recommendations just like other financial institutions, including customer due diligence, record-keeping, suspicious transaction reporting, and screening all transactions for compliance with sanctions.

In October 2019, the FATF clarified that both global “Stablecoins” and their service providers would be subject to the FATF standards either as virtual assets and VASPs or as traditional financial assets and their service providers, and that Stablecoins should “never be outside of the scope of anti-money laundering controls”. Accordingly, the FATF has made clear that countries should effectively implement the FATF standards as part of their domestic regulatory and supervisory regimes for virtual assets, including Stablecoins and VASPs.

In July 2020, the FATF further expanded on these findings in its report to the G20 on so-called Stablecoins. The FATF has found that so-called Stablecoins share many of the same potential money-laundering/terrorist-financing (ML/TF) risks as some virtual assets, in virtue of their potential for anonymity global reach, and layering of illicit funds. Depending on how they are designed, they may allow anonymous peer-to-peer transactions via unhosted wallets. These features present ML/TF vulnerabilities, which are heightened if there is mass adoption. When reviewing current and potential projects, so-called Stablecoins appear better placed to achieve mass adoption than many virtual assets, if they do in fact remain stable in value, are easier to use, and are under the sponsorship of large firms that seek to integrate them into mass telecommunication platforms.

In line with its previous statements, the FATF found that the revised FATF Standards clearly apply to so-called Stablecoins. Under the revised FATF Standards, so-called Stablecoins will either be considered to be virtual assets or traditional financial assets depending on their exact nature. A range of the entities involved in any so-called Stablecoins arrangement will have AML/CFT obligations under the revised FATF Standards. Which entities will have AML/CFT obligations will depend on the design of the so-called Stablecoins, particularly the extent to which the functions of the so-called Stablecoins are centralized or decentralized, and what activities the entity undertakes. ²⁾

The Committee on Payments and Market Infrastructures (CPMI) is an international standard-setter that promotes, monitors, and makes recommendations about the safety and efficiency of payment, clearing, settlement, and related arrangements, thereby supporting financial stability and the wider economy. The CPMI also serves as a forum for central bank cooperation in related oversight, policy, and operational matters, including the provision of central bank services. https://www.bis.org/cpmi/about/overview.htm

Fraud or conflict of interest of those governing the GSC arrangement

Lack of contractual arrangements among the entities of the GSC arrangement

Difficulties to tackle the uncertainty for users due to an unclear definition of roles and responsibilities within the GSC arrangement

Inadequate governance framework

Lack of clear central body to hold accountable

Ability to regulate and supervise the GSC arrangement in a holistic manner, e.g. through cooperation among authorities (akin to comprehensive consolidated supervision)

Ability to require a GSC arrangement to be governed in a manner that facilitates effective regulation and supervision, including by prohibiting fully decentralised systems

Governance, internal control and risk management requirements applicable at the level of the entire GSC arrangement

Power to wind down or resolve a GSC arrangement

Governance requirements requiring a solid legal basis

Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

The revised FATF Standards apply. Based on known models, developers and governance bodies of centralised GSCs will, in general, have AML/CFT obligations as a financial institution (e.g., as a business involved in the ‘issuing and managing means of payment’) or a VASP (e.g. as a business involved in the ‘participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset’). They can then be held accountable for the implementation of AML/CFT controls across the arrangement and taking steps to mitigate ML/TF risks (e.g. in the design of the so-called stablecoin).This could include, for example, limiting the scope of customers’ ability to transact anonymously using the so-called stablecoin and/or by ensuring that AML/CFT obligations of AML/CFT-obliged intermediaries within the arrangement are fulfilled.

For GSC arrangements set up entirely by banks, the Basel Framework and associated principles for supervision and colleges would provide a basis for overseeing the setup. ³⁾

For GSC arrangements deemed to perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. On the basis of a preliminary analysis, some of the most relevant principles regarding these vulnerabilities would be those on legal basis, governance and comprehensive management of risks. Responsibility E would provide a strong basis for cooperation among relevant authorities. See Annex 4 on CPMI-IOSCO preliminary analysis.

For GSC arrangements where the token or the reserve qualifies as a security, relevant IOSCO Principles and Standards that cover governance arrangements would apply, depending on the structure. These would include relevant cooperation agreements (IOSCO Principles⁴⁾ covering Cooperation in regulation (Principles 13 to 15), IOSCO’s Multilateral MoU Concerning Consultation and Cooperation and the Exchange of Information,⁵⁾the Enhanced Multilateral MoU Concerning Consultation and Cooperation and the Exchange of Information,⁶⁾ IOSCO’s Principles on Cross-Border Supervisory

Cooperation⁷⁾ of May 2010, the cross-border regulatory cooperation aspect of the IOSCO 2015 Cross-Border Regulation Task Force Report⁸⁾ and the work of the Follow-Up Group to address potential regulatory arbitrage).

Inability to meet redemptions in stressed conditions

For algorithmic arrangements, errors in the issuance or redemption algorithm that impact value

Adequate liquidity (risk) management

Liquidity risk management tools (e.g. redemption gates)

Certain own funds/liquidity requirements Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

FATF standards apply to firms “issuing and managing means of payment” or to those who provide “participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset”.

For GSC arrangements involving banks, the prudential risks and operational resilience vulnerabilities would be subject to the Basel Framework and Principles for the sound management of operational risk.

For GSC arrangements deemed to perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. On the basis of a preliminary analysis, some of the most relevant principles regarding these vulnerabilities would be those related to frameworks for comprehensive risk management and settlement. See Annex 4 on CPMI-IOSCO preliminary analysis. Depending on the creation/redemption processes, the IOSCO Principles for the Regulation of Exchange Traded Funds (2013)⁹⁾ could be relevant.

A sharp fall in price and/or liquidity of reserve asset(s)

Change in reserve allocation across reserve assets Lack of transparency in the composition of reserve

Fraud or mismanagement of the reserve

Investment in illiquid assets

Significant increase in the price volatility of the reserve assets that cannot be or is not readily managed

Portfolio diversification rules and issuer limits rules

Liquidity and other financial risk safeguards

Liquidity risk management tools (e.g. redemption gates)

Requirements on disclosure of the composition of the assets

Disclosure of investment policies

Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

FATF standards apply to those who provide “safekeeping and administration of cash and liquid securities on behalf of other persons”, or “safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets”.

For GSC arrangements involving banks, the prudential risks and operational resilience vulnerabilities would be subject to the Basel Framework and Principles for the sound management of operational risk.

Depending on its structure, the reserve may engage IOSCO Liquidity Risk Management Recommendations (2018),¹⁰⁾ IOSCO Principles for the Regulation of Exchange Traded Funds or IOSCO Policy Recommendations for MMFs (2012).¹¹⁾

For GSC arrangements deemed to perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. On the basis of a preliminary analysis, some of the most relevant principles regarding these vulnerabilities would be those on custody and investment risks and transparency. See Annex 4 on CPMI-IOSCO preliminary analysis.

Custodian failure, cross-border resolution, fraud

Liquidity

Lack of legal clarity regarding rights to reserve assets, particularly where legal regimes of different jurisdictions are implicated

Segregation requirements/rights for reserve assets

Liquidity and other financial risk safeguards

Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

FATF standards apply to those who provide “safekeeping and administration of cash and liquid securities on behalf of other persons” or “safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets”.

For GSC arrangements involving banks, the prudential risks and operational resilience vulnerabilities would be subject to the Basel Framework and Principles for the sound management of operational risk.

IOSCO Recommendations Regarding the Protection of Client Assets (2013).45

For GSC arrangements deemed to perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. On the basis of a preliminary analysis, some of the most relevant principles regarding these vulnerabilities would be those on custody and investment risks and transparency. See Annex 4 on CPMI-IOSCO preliminary analysis.

45 Recommendations Regarding the Protection of Client Assets Consultation Report and Final Report.

Disruption to the mechanism that links the value of the stablecoin and the value of its reserves, for example a cyber incident

Uncertainty on the revocability of the payments

GSC ledger compromised due to design flaw, operational (e.g. cyber) incident

Liquidity and other financial risk safeguards Requirements on payments finality Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

GSC ledger compromised due to failure of multiple validator nodes

Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

Depending on the functions they perform, the validator nodes that validate the underlying distributed ledger technology may be VASPs or financial institutions.

For GSC arrangements involving banks, the prudential risks and operational resilience vulnerabilities would be subject to the Basel Framework and Principles for the sound management of operational risk.

For GSC arrangements deemed to perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. On the basis of a preliminary analysis, some of the most relevant principles regarding this vulnerability would be that on operational risk and settlement. See Annex 4 on CPMI-IOSCO preliminary analysis.

Disruption of a wallet, for example, theft of coins from a digital wallet or operational (e.g. cyber) incident.

Direct loss, including by consumers

Liquidity and other financial risk safeguards Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

FATF Standards apply to all businesses providing custodial wallet services. The FATF Standards do not place explicit obligations on unhosted wallets.

For GSC arrangements involving banks, the prudential risks and operational resilience vulnerabilities would be subject to the Basel Framework and Principles for the sound management of operational risk.

For GSC arrangements deemed to be perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. On the basis of a preliminary analysis, a relevant principle regarding these vulnerabilities would be that on operational risk. See Annex 4 on CPMI-IOSCO preliminary analysis.

Withdrawal of liquidity provision by authorised resellers/market makers

Disruption of a trading platform.

Fraud, market manipulation, unauthorised transactions

Cyber incident

Liquidity and other financial risk safeguards

Settlement finality requirements

Allocation of legal responsibility for unauthorised transactions Cyber security and other operational resiliency safeguards

AML/CFT and sanctions controls

FATF Standards apply to all businesses carrying out trading/exchanging activity. The FATF Standards do not explicitly apply to peer-to-peer transactions without use of a VASP or financial institution.

For GSC arrangements involving banks, the prudential risks and operational resilience vulnerabilities would be subject to the Basel Framework and Principles for the sound management of operational risk.

For GSC arrangements deemed to perform systemically important payment system functions or other FMI functions that are systemically important, the PFMI apply. See Annex 4 on CPMI-IOSCO preliminary analysis.

Issues Risks and Regulatory Considerations Relating to Crypto-Asset Trading Platforms (2020)46, discussing IOSCO Principles47 13, 14, 15, 33, 34, 35, 36, ¹²⁾, 29, 30, 31, 32, ¹³⁾ and associated IOSCO reports.