EU banks subject to new rules on digital asset holdings

This month, the European Banking Authority (EBA) published its final draft of a new technical standards package for the European Union banking sector, which includes a slew of additional requirements governing banks’ ability to hold digital assets.

These new standards have been adopted by the European Parliament to align with the Basel III reforms introduced by the Basel Committee on Banking Supervision (BCBS) in the aftermath of the 2007-2008 global financial crisis. The BCBS is a committee of global banking supervisory authorities established by the central bank governors of the G10 to issue and maintain international banking standards. The Basil III reforms were intended to strengthen the resilience of the banking sector.

Among the changes included in the reforms was an increase in the minimum capital requirements for banks to ensure they are sufficiently able to withstand losses in times of turmoil. It also includes an overhaul of the BCBS’ risk-weighted framework, which assigns a weighting to assets based on their risk which is then used as the basis for determining how much capital a bank must have in reserve relative to the holdings of the asset.

Once agreed by the BCBS, new standards are left to its member states to implement. For the EU, these implementations are known as the CRR3/CRD6, and the specifics were published this month.

Perhaps most significantly, under the new EU standards, ‘cryptoasset’ exposure is assigned a risk weight of 1,250%, and a bank’s exposure must not exceed 1% of its core assets. The exceptions to this are asset-referenced stablecoins (in other words, stablecoins that are pegged to other assets as defined by Europe’s Markets in Crypto Asset regulation), which are weighted at 250%, and tokenized traditional assets including e-money tokens.

Notably, the requirements adopted by the EU are stricter than those mandated under the Basel III reforms. For example, the Basel III reforms set a 2% upper limit for banks digital asset exposure as opposed to the 1% implemented by the EU.

Larger banks will also be subject to additional reporting requirements for their digital asset exposures. Each year, banks must disclose to regulators their direct and indirect exposure to digital assets, risk exposure, a description of the bank’s risk management policies related to digital asset exposure, and more.

The new EU standards will become effective from January 2025.

EU steadily narrowing the regulatory gap

The EU is already further ahead than many jurisdictions in introducing a legal framework for digital assets, with the ground-breaking Markets in Crypto Asset Regulation (MiCAR), which covers many digital assets not already regulated under existing rules governing financial instruments (known as MiFID) and formally entered into force in June 2023 (though its provisions, still being revised, are set to activate in stages). As a result, in constructing the CRR3/CDR6 package, the EU has grafted many of the Basel III requirements onto MiCA’s foundation. For example, the definitions used in the rules set out above, such as ‘asset-referenced tokens,’ are defined in MiCA.

Between MiCA and the new, incoming CRR3/CDR6 standards, the gaps in digital asset regulation in the EU are narrowing all the time. The new standards mean that banks will now need to carefully consider the digital assets they hold on their balance sheet and assess the level of risk their presence poses. This reflects a recognition that digital assets of many kinds will continue to cross over into the traditional financial system as banks increase their holdings and digital asset issuers increasingly use traditional financial institutions.

However, some gaps remain. MiCA generally applies to digital asset services instead of digital assets themselves, though a limited number of digital asset types are covered, including stablecoins. Though the exact boundaries are still being teased out, assets such as BTC do not fall within MiCA directly on EU legislator’s understanding that they are fully decentralized. Assets that do not fall under MiCA may still be regulated if they fit within the definition of a financial instrument provided by the MiFID regulation, but the definition is a narrow and somewhat elusive one—and likely doesn’t cover assets such as BTC unless the EU sees the light and recognizes it as a security.

Still, the rules applicable to digital asset service providers should have an effect in the broader industry, regardless of the status of any individual assets. Entities offering digital asset services in the EU are required to obtain a license at the national level. They are subject to added requirements, such as holding an EU office, implementing and reporting on anti-money laundering (AML) controls, and only listing digital assets that are supported by a white paper. The white paper requirement alone will limit the number of shoddy coins that can get listed on licensed EU service providers.

Whether that’s enough to protect EU citizens from the dirge of dishonest digital asset projects that may not fall within either MiCA or MiFID is another question, but the EU is consulting and revising its approach to regulating digital assets all the time. Perhaps a reclassification of assets that have long been presumed not to be securities will be on the cards eventually.

Watch: Blockchain regulation with Marcin Zarakowski