II. THE FUNCTIONS OF SECURITIES CUSTODIANS.

Transcription

1

2

3 FinTech Law Report July/August 2018 Volume 21 Issue 4 cess to client securities. 8 In such a case, the RIA must maintain the securities with a qualified custodian, such as a broker-dealer or bank. 9 II. THE FUNCTIONS OF SECURITIES CUSTODIANS. The purposes of the federal custody requirements, and the services that custodians provide, can best be understood by recalling the time when securities were represented by physical certificates. Once upon a time, a person could buy a share or bond issued by a company and receive a handsomely printed certificate on heavy bond paper as evidence of ownership. The owner could take the certificate home if they wished. On the other hand, if an investor held the certificate at home, it could be lost, stolen or destroyed in a fire. In addition, it required the investor to journey into town whenever they wanted to sell a share or collect a dividend or interest payment. Therefore, banks and brokerdealers offered to hold their customers securities in custody, usually in a vault on the premises. The practice is still used today (such as when a smaller company issues shares and an owner deposits them for safekeeping) and is similar to the practice of holding other important documents such as deeds, or passports or valuable items, in a safe deposit box. Certain banks and trust companies concentrated on this type of service. These firms, especially those in the financial markets of New York City, came to hold large numbers of certificates issued by many companies. For this type of custodian, transferring a share or bond could be effected by moving a certificate from one customer s deposit box to another s, and moving an amount of cash the other way. Over time, the transfer came to be effected by simply making an entry on the custodian s books and records. Prior to 1973, these types of depository, custodial, payment and settlement services were handled by many different financial firms that had to physically transfer large amounts of cash and securities around town in armored cars. These arrangements were not suited to modern, high-volume financial markets. Therefore, for the most actively traded instruments, financial markets evolved the institution of the central repository. The Depository Trust Company ( DTC ) is an example. DTC holds book-entry securities and physical securities certificates in its vaults on behalf of financial institutions who, in turn, are acting on behalf of their customers. As a result of the invention of the central repository, a custodial institution no longer holds physical securities on its premises (except, as we have noted, in the case of certain smaller companies). Rather, a custodian maintains bookentry, electronic records that (a) interface with the central repository and (b) internally reflect the identity and amounts of the securities that a customer owns. In addition, custodians continue to provide numerous other services that are associated with this core function. These include settlement of trades, collection and payment of dividends and interest, valuation of securities positions, generation of statements, handling corporate actions such as stock splits or proxy voting, and more. 10 Due to their important role in the securities markets, custodians are highly regulated entities. As banks and securities broker-dealers, they are subject to regulations that require, inter alia, segregation of customer assets, compliance with capital standards, background checks for person- K 2018 Thomson Reuters 7

4 July/August 2018 Volume 21 Issue 4 FinTech Law Report nel, and regular and special examinations by regulators. Oversight of custodians promotes customer protection, and by extension, confidence in the securities markets and the formation of capital. III. THE CHALLENGE OF BLOCKCHAIN ASSETS. Many of the premises that underlie traditional custody practices are not readily applicable to virtual, cryptographic assets that are created or recorded on distributed ledgers. This is due to the nature of the technology as a peer-to-peer system. Indeed, the ur-cryptographic asset Bitcoin was designed as a peer-to-peer version of cash with the explicit purpose of eliminating the need for trusted third parties such as custodians. 11 Regulators are alert to these difficulties. In January, 2018, SEC Staff issued a letter to two securities trade groups questioning, among other things, how a regulated investment fund could conform to custody requirements and conveying concerns regarding the security of electronic assets. 12 FINRA s 2017 Report on Distributed Ledger Technology also noted that if blockchain technology resulted in the use of crypto securities, then broker-dealers would need to consider how they would account for obligations to maintain physical possession or control over these securities. 13 The Report also inquired how a broker-dealer might comply with FINRA Rule 4160, which stipulates that a broker-dealer may not permit any financial institution to serve as a custodian if it fails to promptly answer a request from FINRA for written verification of the assets maintained at the institution by the brokerdealer. 14 A. Open Networks and Cold Storage As an initial matter, we should note that distributed ledger systems may be operated as private blockchains or as open permissionless networks, such as Bitcoin. Smaller, newer enterprises, such as those that have attempted to raise capital through ICOs, are likely to employ the use of permissionless networks. These types of distributed ledger programs are open to any person who wishes to join. A user on this type of distributed ledger is able to effect transactions (that is, they are able to initiate changes to the ledger) by use of a private key. In brief, in a blockchain system, a private key is a code that authorizes transactions from a given user s wallet address. The private key is a crucial aspect of the system because it is the only method that the user has to access and transmit an asset that is recorded on the ledger. At the same time, any person who holds the private key can access the wallet address and transmit the relevant digital asset. Accordingly, control of the private key equals control of the instrument. In this setting, intermediaries in the cryptocurrency industry have implemented the concept of cold storage in order to control access to private keys. In a cold storage arrangement, private key information is recorded on a computer or external drive that is air gapped, i.e., not connected to the internet or any network. These computers or external drives are then kept in secure settings. In addition, a wallet address can be created that requires the use of multiple private keys, each of which may be stored on different devices. Systems can be made redundant, with backup hardware in place that can replace any devices that are destroyed or lost. 15 Cryptocurrency firms also may take other security steps, 8 K 2018 Thomson Reuters

5 FinTech Law Report July/August 2018 Volume 21 Issue 4 such as by adopting controls that limit access to storage devices by personnel, implementing background checks for employees, procuring insurance coverage, etc. Thus, cold storage techniques bear a strong resemblance to some of the original practices involved in maintaining custody of physical securities certificates. The device that stores the private key can be compared to a bearer certificate, entitling the holder to retain or dispose of an interest that consists of a Bitcoin, or if applicable, a security. However, it is not clear that the SEC would, at this point, equate the physical possession of a device that records a private code in an open blockchain network with the physical possession or control of a security as required by law and regulation. Regulators may believe that the protection of a private key would not adequately ensure the security and safekeeping of such a blockchain-based security because the distributed ledger network where that security is recorded and transferred is not controlled by a regulated entity, and may suffer from its own weaknesses. For example, in a smaller, new blockchain, a user or group of users may be able to gather sufficient computational power to alter the ledger and transfer assets to themselves (known as a 51% attack ). 16 An open access distributed ledger may also have a flaw in the design of its underlying code: in the case of The DAO, an attacker was able to divert, at least temporarily, large amounts of cryptocurrency worth up to $50 million, from the proceeds of a securities offering due to a flaw in coding. 17 Accordingly, until the industry has gained experience, and is able to identify one that addresses these concerns, it seems unlikely that the SEC would be prepared to find that a given open blockchain network could support the safekeeping of a security at the levels provided by traditional custodians. B. Closed Networks Private blockchain networks, on the other hand, are restricted, invitation only affairs, operated by one or more administrators and open only to known, trusted parties. Those users that are permitted to have access to such systems may have full privileges, or they may have tiered access on a graduated scale. There is no reason that a regulated entity or group of regulated entities could not operate this type of private blockchain for the issuance, transfer and holding of digital securities. If operated by an SEC-registered clearing agency and its regulated members, such a technology would be analogous to systems that are currently in operation, and subject to regulatory standards that are already in place. 18 Indeed, certain regulated entities are currently experimenting with distributed ledger technologies in connection with their transaction clearance and settlement functions. 19 Custodial arrangements in a closed network setting offer several advantages. Among other things, the entities that share this form of distributed ledger have a common interest in the integrity and smooth operation of the system. The entities are known to each other (as opposed to the anonymity that prevails on many open networks) and are capable of interacting in order to settle disputes or address mistakes. The controlled nature of the technology also permits modifications and improvements whenever necessary. Finally, the activities and operations of all of the participating entities that provide custody services are subject to inspection by regulatory authorities, which permits compliance with such K 2018 Thomson Reuters 9

6 July/August 2018 Volume 21 Issue 4 FinTech Law Report things as requirements for the verification of assets. IV. CONCLUSION. Distributed ledger technology has the potential to significantly improve securities clearance, settlement and custody practices. In the future, securities may commonly be issued, traded and held on blockchain networks. However, for the present, these networks are likely to be closed systems that are operated by financial entities that are subject to high degrees of regulation. Since it is unlikely that regulatory authorities will recognize open blockchain systems as having the capacity to support securities safekeeping functions, the securities industry should prioritize efforts on the development of private blockchain networks. After experience in this setting, it may be possible to address the security concerns that are currently associated with the use of open blockchain networks in connection with securities custody services. ENDNOTES: 1 See e.g., SEC Rel. No , Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO (July 25, 2017). 2 In a review of 1,450 ICOs, the Wall Street found rampant plagiarism, identity theft and promises of improbable returns. Hundreds of Bitcoin Wannabes Show Hallmarks of Fraud; Wall Street Journal (May 17, 2018). 3 Of course, custody is but one of numerous matters that a securities firm would have to address before venturing into the world of blockchain securities. A broad survey of such matters can be found in the Report on Distributed Ledger Technology: Implications of Blockchain for the Securities Industry issued by the Financial Industry Regulatory Authority ( FINRA ) in March, CFR c3-3(b). Fully paid securities are those that the customer has paid for in full. 17 CFR c3-3(a)(3). Excess margin securities are securities that are carried as margin collateral to the extent they exceed 140% of the amount of the debit balances in a customer s account. 17 CFR c3-3(a)(5) CFR c3-3(c); see e.g., Letter from M. Macchiaroli, Associate Director, SEC Division of Trading and Markets to Peter Morgan III, Senior Vice President and General Counsel, Charles Schwab and Co., Inc. (Feb. 3, 2012) (granting no-action relief based on use of National Securities Clearing Corporation s Alternative Investment Products Service to establish satisfactory control locations under the Customer Protection Rule for uncertificated securities) U.S.C.A. 80a-17(f); 17 CFR f-1 through 17 CFR f-7. The ICA s custody requirement applies to a registered investment fund s securities and similar investments. Thus, its standards would also apply to a mutual fund s digital assets that are not securities, such as Bitcoin. See SEC Staff Letter to the Investment Company Institute and Securities Industry and Financial Markets Association: Engaging on Fund Innovation and Cryptocurrency- Related Holdings (Jan. 18, 2018) (describing custody requirements for the holdings of a registered investment fund), available at /cryptocurrency htm CFR f-2(b) CFR (4) CFR (4)-2(d)(6). 10 The Clearing House, The Custody Services of Banks (Jul. 2016) (available at eclearinghouse.org/-/media/tch/documents/resea rch/articles/2016/07/ _tch_white_pape r_the_custody_services_of_banks.pdf). 11 Nakamoto, Bitcoin: A Peer To Peer Electronic Cash System, at 1 ( A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to 10 K 2018 Thomson Reuters

7