Circular NBB_2019_20 / Expectations Regarding Crypto-Asset Activities

NBB_2019_20 – 19 July 2019 Circular – Page 1/4 boulevard de Berlaimont 14 – BE-1000 Brussels tel. +32 2 221 24 33 company number: 0203.201.340 RPM Brussels www.bnb.be

Circular
Brussels, 19 July 2019
Reference: NBB_2019_20 your contact:
Thomas Bodequin tel. +32 2 221 53 65 thomas.bodequin@nbb.be

Expectations Regarding Crypto-Asset Activities

Scope

Belgian insurance and reinsurance companies, with the exception of small Belgian insurance companies referred to in Articles 275 and 276 and Belgian local insurance companies referred to in Article 294 of the Law of 13 March 2016 on the status and supervision of insurance or reinsurance companies (hereinafter 'the insurance supervision law')

Branches established in Belgium of insurance or reinsurance companies subject to the law of States that are not members of the European Economic Area (EEA)

Entities responsible for a Belgian insurance or reinsurance group within the meaning of Articles 339, 2°, and 343 of the insurance supervision law or a Belgian financial conglomerate within the meaning of Articles 340, 1°, and 343 of the insurance supervision law

Mutual insurance companies defined in Article 15, 79°, of the aforementioned Law of 13 March 2016. For these companies, 'the supervisory authority' should be replaced by 'the Office for the Supervision of Mutual Funds and National Unions of Mutual Funds' as defined in Article 15, 84°, of the same law

Belgian credit institutions

Belgian stock exchange companies

Financial services groups whose parent company is a regulated Belgian institution and financial services groups whose parent company is a mixed Belgian financial company

Branches established in Belgium of credit institutions subject to the law of States that are not members of the EEA

Branches established in Belgium of stock exchange companies subject to the law of States that are not members of the EEA

Circular – Page 2/4 NBB_2019_20 – 19 July 2019

Madam,
Sir,

The development of 'crypto-assets' 1, which present a wide range of characteristics and different applications, has intensified significantly in recent years. As supervisory authorities, the NBB and the FSMA have warned, since 2014 2 and 2015 3, about the potential dangers of these instruments. On 13 March 2019, the Basel Committee on Banking Supervision published a statement on crypto-assets 4, in which it formulates certain expectations regarding banks. The NBB considers that this document is also relevant, in terms of content, for other institutions subject to a similar sectoral supervisory status. It therefore intends, by means of this circular, to implement these expectations in its supervisory practice for a broader set of institutions subject to its supervision.

Direct, indirect 5 or synthetic 6 exposures to crypto-assets entail potentially significant risks, including liquidity risk, credit risk, market risk, operational risk (including fraud risk and cyber-risk), risks related to money laundering and terrorist financing, as well as legal and reputational risks. These new types of instruments are also in a phase of development and instability. It is therefore expected that the concerned institutions are not significantly exposed to this type of asset.

It is incumbent upon institutions exposed to crypto-assets, or intending to be so, to exercise heightened vigilance, which translates into the following points of attention:

1. appropriate due diligence: before being exposed to crypto-assets or offering services in this regard, institutions are required to conduct an extensive and in-depth analysis of the associated risks, including the risks mentioned above in this circular. Furthermore, the institution must ensure that it possesses the technical expertise required to assess and manage said risks;

2. governance and risk management: institutions are required to have a clear and robust risk management framework and risk appetite, which is adapted to the monitoring and management of risks as well as the offering of services related to crypto-assets. The risk management processes developed for crypto-assets must be integrated into the institution's broader risk management framework.

These processes should be adapted to the high risks associated with this type of exposures and services. Senior management levels and appropriate control functions should ensure the development and implementation of these processes. In this regard, executive and non-executive directors are required to be informed with sufficient frequency about the risk profile of exposures and services related to crypto-assets.

1 Crypto-assets are instruments whose inherent or perceived value depends primarily on cryptography, distributed ledger technology (DLT), or similar technologies.
2 Press release from the NBB and FSMA of 15 January 2014: https://www.nbb.be/fr/articles/attention-largent-virtuel-comme-bitcoin.
3 Press release from the NBB and FSMA of 16 April 2015: https://www.nbb.be/doc/ts/enterprise/press/2015/cp150416fr_fsma_nbb.pdf.
4 Basel Committee on Banking Supervision, 13 March 2019: https://www.bis.org/publ/bcbs_nl21.htm.
5 Among indirect exposures are, for example, exposures to counterparties whose revenues depend on crypto-asset activities, such as the custody of such assets or the facilitation of crypto-asset transactions, or whose solvency depends on crypto-assets, for example due to investments in crypto-assets. The indirect exposures that institutions must take into account are those that may have a significant impact on the valuation or risk related to the institution's exposure to these counterparties. 6 A synthetic exposure to a crypto-asset is an exposure whose valuation is directly linked to the value of a crypto-asset (see also Article 4, paragraph 1, point 126, of Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms).

NBB_2019_20 – 19 July 2019 Circular – Page 3/4

It is essential that risks related to money laundering and terrorist financing are sufficiently taken into account. Certain crypto-assets that offer increased levels of anonymity and are subject to limited or non-existent regulation are considered particularly risky in this regard.

Institutions conducting an ORSA or an ICAAP and an ILAAP must analyze in detail the risks of their exposures and activities related to crypto-assets and establish adequate capital and liquidity buffers. In this regard, sufficient attention should also be devoted to indirect exposures, which result, for example, from granting loans to companies when the repayment or solvency of the borrower depends on activities related to crypto-assets. From a broader perspective, prudential reporting must be appropriately supplemented with information on exposures and activities related to crypto-assets.

Pending greater clarity on the prudential treatment of crypto-assets, institutions are expected to apply the most prudent treatment and to inform the supervisory authority of how these exposures are integrated into prudential reporting;

3. information disclosure: institutions are required to disclose their significant 7 exposures to crypto-assets and their services in this regard in their periodic reporting (such as, among others, in their annual report and communications required for prudential purposes). In this regard, the accounting treatment of these exposures should be specified;

4. dialogue with the supervisory authority: institutions are required to inform the supervisory authority in a timely manner of their current and planned exposures and activities related to crypto-assets. In this regard, the institution must demonstrate to the supervisory authority that it has fully assessed the risks and that the activities are, in this case, permitted, and explain how it will manage or mitigate the risks and how these exposures will be integrated into prudential reporting. The supervisory authority will then examine whether prior authorization is necessary based on the supervisory status of the concerned institution 8.

Institutions are required to inform the supervisory authority, no later than 31 October 2019, of existing exposures to crypto-assets.

Furthermore, the NBB wishes to emphasize that it considers that 'cryptocurrencies' are not comparable to money issued by a central bank or public authority 9, due to the fact that cryptocurrencies are not considered a legal means of payment, that they benefit from no guarantee, and that these cryptocurrencies do not correctly fulfill the fundamental functions of money. It is for these reasons, but also because some crypto-assets do not aim to offer an alternative to existing currencies, that the broader term 'crypto-assets' was chosen.

7 For institutions subject to Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms, significant importance is defined in Article 432, paragraph 1, and in the European Banking Authority guidelines on the significance, sensitivity and confidentiality and on the frequency of publication of information under Article 432, paragraphs 1 and 2, and Article 433 of Regulation (EU) No 575/2013 (EBA/GL/2014/14). 8 The provisions of this circular do not prejudice, therefore, the prior authorization of the supervisory authority that may be required under certain supervisory statuses, such as, for example, for stock exchange companies in the case of application of Article 532 of the Banking Law. 9 Crypto-assets differ from digital currencies issued by central banks (cf. in particular the following report from the 'Committee on Payments and Market Infrastructures' and the 'Committee on Markets': https://www.bis.org/cpmi/publ/d174.htm).

Circular – Page 4/4 NBB_2019_20 – 19 July 2019

This circular enters into application with immediate effect.
A copy of this circular is sent to the commissioner(s), approved auditor(s) of your company.
We ask you to accept, Madam, Sir, the expression of our distinguished sentiments.

Pierre Wunsch
Governor