Circular NBB_2019_20 / Expectations Concerning Crypto-Asset Activities

NBB_2019_20 – July 19, 2019 Circular – Page 1/4 14 Berlaimont Boulevard – BE-1000 Brussels Tel. +32 2 221 24 33 Company number: 0203.201.340 RPM Brussels www.nbb.be

Circular Brussels, July 19, 2019 Reference: NBB_2019_20 Your contact: Thomas Bodequin Tel. +32 2 221 53 65 thomas.bodequin@nbb.be

Expectations Concerning Crypto-Asset Activities

Scope

Belgian insurance and reinsurance undertakings, with the exception of small Belgian insurance undertakings referred to in Articles 275 and 276 and local Belgian insurance undertakings referred to in Article 294 of the Law of March 13, 2016 on the status and supervision of insurance or reinsurance undertakings (hereinafter "the Insurance Supervision Law").

Branches established in Belgium of insurance or reinsurance undertakings governed by the law of States that are not members of the European Economic Area (EEA).

Entities responsible for a Belgian insurance or reinsurance group within the meaning of Articles 339, 2°, and 343 of the Insurance Supervision Law, or a Belgian financial conglomerate within the meaning of Articles 340, 1°, and 343 of the Insurance Supervision Law.

Mutual insurance companies defined in Article 15, 79°, of the aforementioned Law of March 13, 2016. For these undertakings, the term "supervisory authority" should be replaced by "the Office for the Supervision of Mutual Funds and National Unions of Mutual Funds" as defined in Article 15, 84°, of the same Law.

Belgian credit institutions.

Belgian securities firms.

Financial services groups whose parent company is a regulated Belgian institution and financial services groups whose parent company is a Belgian mixed financial holding company.

Branches established in Belgium of credit institutions governed by the law of States that are not members of the EEA.

Branches established in Belgium of securities firms governed by the law of States that are not members of the EEA.

Circular – Page 2/4 NBB_2019_20 – July 19, 2019

Madam, Sir,

The development of "crypto-assets"¹, which present a wide range of varied characteristics and different applications, has intensified significantly in recent years. As supervisory authorities, the NBB and the FSMA warned, as early as 2014² and 2015³, against the potential dangers of these instruments. On March 13, 2019, the Basel Committee on Banking Supervision published a statement on crypto-assets⁴, in which it formulates certain expectations regarding banks. The NBB considers this document to be equally relevant in substance for other institutions subject to a similar sectoral supervisory status. Therefore, by means of this circular, it intends to implement these expectations in its supervisory practice for a broader set of institutions subject to its supervision.

Direct, indirect⁵, or synthetic⁶ exposures to crypto-assets entail potentially significant risks, including liquidity risk, credit risk, market risk, operational risk (including fraud risk and cyber risk), money laundering and terrorist financing risks, as well as legal and reputational risks. These new types of instruments are furthermore in a phase of development and instability. It is therefore expected that the concerned institutions are not significantly exposed to this type of asset.

It is incumbent upon institutions exposed to crypto-assets, or intending to become so, to exercise heightened vigilance, which translates into the following points of attention:

1. Appropriate due diligence: Before being exposed to crypto-assets or offering services in this regard, institutions are required to conduct an extensive and in-depth analysis of the risks associated with them, including the risks mentioned above in this circular. Furthermore, the institution must ensure that it possesses the required technical expertise to assess and manage said risks;

2. Governance and risk management: Institutions are required to have a clear and robust risk management and risk appetite framework, which is adapted to the monitoring and management of risks as well as the offering of services related to crypto-assets. The risk management processes developed for crypto-assets must be integrated into the institution's broader risk management framework. These processes should be adapted to the high risks associated with this type of exposure and services. Senior management levels and appropriate control functions should ensure the development and implementation of these processes. In this regard, executive and non-executive directors are required to be informed with sufficient frequency about the risk profile of exposures and services related to crypto-assets.

¹ Crypto-assets are instruments whose inherent or perceived value depends primarily on cryptography, distributed ledger technology (DLT), or similar technologies. ² Press release from the NBB and the FSMA of January 15, 2014: https://www.nbb.be/fr/articles/attention-largent-virtuel-comme-bitcoin. ³ Press release from the NBB and the FSMA of April 16, 2015: https://www.nbb.be/doc/ts/enterprise/press/2015/cp150416fr_fsma_nbb.pdf. ⁴ Basel Committee on Banking Supervision, March 13, 2019: https://www.bis.org/publ/bcbs_nl21.htm. ⁵ Indirect exposures include, for example, exposures to counterparties whose revenues depend on crypto-asset activities, such as the custody of such assets or the facilitation of crypto-asset transactions, or whose solvency depends on crypto-assets, for example due to investments in crypto-assets. The indirect exposures that institutions must take into account are those that can have a significant impact on the valuation or risk related to the institution's exposure to these counterparties. ⁶ A synthetic exposure to a crypto-asset is an exposure whose valuation is directly linked to the value of a crypto-asset (see also Article 4, paragraph 1, point 126, of Regulation (EU) No 575/2013 of the European Parliament and of the Council of June 26, 2013 on prudential requirements for credit institutions and investment firms).

NBB_2019_20 – July 19, 2019 Circular – Page 3/4

It is essential that money laundering and terrorist financing risks are sufficiently taken into account. Certain crypto-assets that offer increased levels of anonymity and are subject to limited or non-existent control are considered particularly risky in this regard.

Institutions conducting an ORSA or an ICAAP and an ILAAP must analyze in detail the risks of their exposures and activities related to crypto-assets and establish adequate capital and liquidity buffers. In this regard, sufficient attention should also be paid to indirect exposures, which result, for example, from granting loans to companies when the repayment or solvency of the borrower depends on crypto-asset-related activities. From a broader perspective, prudential reporting must be appropriately supplemented with information on exposures and activities related to crypto-assets.

Pending further clarification of the prudential treatment of crypto-assets, institutions are expected to apply the most prudent treatment and to inform the supervisory authority of how these exposures are integrated into prudential reporting;

3. Information disclosure: Institutions are required to disclose their significant⁷ exposures to crypto-assets and their services in this regard in their periodic reporting (such as, among others, in their annual report and communications required for prudential purposes). In this regard, the accounting treatment of these exposures should be specified;

4. Dialogue with the supervisory authority: Institutions are required to inform the supervisory authority in a timely manner of their current and planned exposures and activities related to crypto-assets. In this regard, the institution must demonstrate to the supervisory authority that it has fully assessed the risks and that the activities are, in this case, permitted, and explain how it will control or mitigate the risks and how these exposures will be integrated into prudential reporting. The supervisory authority will then examine whether prior authorization is necessary depending on the supervisory status of the concerned institution⁸. Institutions are required to inform the supervisory authority, no later than October 31, 2019, of existing exposures to crypto-assets.

Furthermore, the NBB wishes to emphasize that it considers that "crypto-currencies" are not comparable to money issued by a central bank or a public authority⁹, because crypto-currencies are not considered a legal means of payment, they benefit from no guarantee, and these crypto-currencies do not correctly fulfill the fundamental functions of money. For these reasons, but also because some crypto-assets do not aim to offer an alternative to existing currencies, the broader term "crypto-assets" was chosen.

⁷ For institutions subject to Regulation (EU) No 575/2013 of the European Parliament and of the Council of June 26, 2013 on prudential requirements for credit institutions and investment firms, significant importance is defined in Article 432, paragraph 1, and in the European Banking Authority guidelines on the significance, sensitivity, and confidentiality and on the frequency of publication of information under Article 432, paragraphs 1 and 2, and Article 433 of Regulation (EU) No 575/2013 (EBA/GL/2014/14). ⁸ The provisions of this circular do not, in fact, prejudice the prior authorization of the supervisory authority that may be required under certain supervisory statuses, such as, for example, for securities firms in the case of application of Article 532 of the Banking Law. ⁹ Crypto-assets differ from digital currencies issued by central banks (see in particular the following report by the "Committee on Payments and Market Infrastructures" and the "Committee on Markets": https://www.bis.org/cpmi/publ/d174.htm).

Circular – Page 4/4 NBB_2019_20 – July 19, 2019

This circular enters into application with immediate effect. A copy of this circular is sent to the commissioner(s), approved auditor(s) of your company. We ask you to accept, Madam, Sir, the expression of our distinguished sentiments.

Pierre Wunsch Governor