Source: https://www.globallegalinsights.com/practice-areas/blockchain-laws-and-regulations/10-custody-and-transfer-of-digital-assets-key-u-s-legal-considerations
Timestamp: 2019-04-22 14:14:25+00:00

Document:
Particularly since 2017, cryptocurrencies, initial coin offering (“ICO”) tokens, and other similar financial assets (“Digital Assets”) have drawn increased interest and participation from institutional investors. As with other financial assets, investors in Digital Assets face the risk of theft or loss of their holdings. This risk can be especially pronounced in connection with Digital Assets because transfers may not be easily reversible, intermediaries can be lightly capitalised, and other market participants are frequently anonymous or pseudonymous. These market characteristics underscore the importance of effective practices for the custody and transfer of Digital Assets. Unfortunately, the legal framework for such custody and transfer is evolving and not always well understood.
This chapter summarises that legal framework as it currently stands within the United States (“U.S.”).1 First, it describes certain aspects of how distributed ledgers operate, which are relevant to the mechanics for holding or transferring Digital Assets. It then describes the U.S. commercial and insolvency law considerations relevant to custodial relationships and transfers involving Digital Assets. Next, it summarises the key U.S. regulatory frameworks currently applicable to Digital Asset custodians. Finally, it describes the proposed Uniform Regulation of Virtual-Currency Businesses Act (the “URVCBA”), which would make certain reforms in these areas.
The ownership and transfer of a Digital Asset is commonly recorded on a “blockchain” or other distributed ledger. Typically, distributed ledgers operate through the use of public and private keys.2 The distributed ledger shows which public key owns each Digital Asset. To effect a transfer of a Digital Asset, the transferor needs to enter the private key that corresponds to the public key that the ledger shows as the owner of the Digital Asset. Private keys are created in mathematical relation to their public key pair and are unmodifiable. Participants in the distributed ledger validate transactions by confirming that the transfer has been authorised by the private key associated with the relevant public key.
Through the possession and use of a private key to validate Digital Asset transfers, every asset recorded on a specified distributed ledger may be transferred between different public keys. Without a public key’s private key match, however, no assets held in connection with a public key may be transferred at all. As a result, Digital Asset investors must be able to effectively retain and protect such private key information, and thus control over all attached Digital Assets to protect their investments. Without security and control over all private key information, investors are susceptible to both malicious attacks intended to obtain access to their private key – resulting in a malicious actor gaining the ability to transfer their Digital Assets and often leaving investors without recourse – and to losing possession of the private key, and the ability to transfer their Digital Assets to or from any other person’s public key in the future.
On a rudimentary level, Digital Asset investors have often looked to solve this problem with what are referred to as “wallets,” which hold a private key for those investors and often require the use of a “passphrase” to subsequently access their private keys to transfer any Digital Assets. If investors choose to store their private keys in a “hot” wallet that is connected to the internet, they face an increased risk of cyber-attack – but may more quickly transfer Digital Assets to other parties. By contrast, maintaining private keys in an offline, hardware-based “cold” wallet protects against cyber-hacking risks, but requires an investor’s continued maintenance and possession of the hardware. Given some of the difficulties that investors may face in sufficiently managing all of these risks on their own, Digital Asset investors have frequently looked to some form of centralised custodian to hold their assets.
Many investors have stored Digital Assets directly with the exchanges through which they trade. Many exchanges maintain those assets in pooled, “hot” wallets that always remain connected to the internet. While such storage solutions provide for faster access when an investor is looking to execute Digital Asset transactions on the exchange, hackers have increasingly succeeded in capitalising on exchanges’ vulnerabilities, including hot wallets’ connections to the internet, to steal large quantities of pooled Digital Assets from such exchanges. In those instances, investors have faced challenges in recouping their assets from the exchanges or otherwise. Other exchanges maintain both hot wallets for immediate transactions, and cold wallets for longer-term custody. The cold wallets are usually wholly disconnected from the internet and provide far superior security.
Market participants have attempted to address these issues by providing Digital Asset custody services.3 Such services often primarily or exclusively use cold storage wallets, holding all Digital Asset private keys in pooled accounts that are entirely offline until an individual investor wishes to withdraw or transfer their Digital Assets. This model provides investors with increased assurances in the safety of their private keys and Digital Assets, while also removing the additional work required of investors if they were to protect this information themselves.
What service is the custodian providing?
- Is the custodian holding the holder’s private key or the Digital Asset itself?
- Has the custodian established a “multi sig” arrangement (i.e. an arrangement in which more than one key is required to authorise a Digital Asset transaction)? If so, does the custodian have all of the keys that are needed to allow the Digital Asset transaction to take place?
How does the parties’ agreement (if any) describe the relationship?
- Does it call the relationship a bailment or another similar relationship such as some form of an agency?
- Does the documentation transfer any ownership of the private key or Digital Asset to the custodian or does the customer retain all right, title, and interest in the private key or Digital Asset?
- Does the custodian have the right to reuse the custodial assets?
- Is there an agreement to treat the private key or Digital Asset as a “financial asset”?
A custodial relationship may take many different forms, and the questions to consider will depend on the facts at hand. While the documentation will likely be crucial, it is not necessarily determinative.
Bailment or similar relationship. One possible way to frame the relationship between an owner of a Digital Asset and its custodian is as a bailment or similar relationship such as some form of an agency. A number of Digital Asset market participants have characterised their relationship as a bailment or similar agency relationship in order to ensure the application of certain rights and duties, discussed in greater detail below. A written or express agreement, however, is not necessarily required for a bailment or agency to be created. A court may conclude that the facts and circumstances demonstrate that a bailment or agency relationship was created. Such characterisations are more likely when the owner does not transfer to the custodian its rights in the private key or Digital Asset.
If the custodian is recognised as the bailee or agent of the customer, then the custodian would owe certain duties to the bailor or principal. Such duties include, if the custodian is recognised as a bailee, a duty to exercise ordinary care in keeping and safeguarding property of the bailor and (if instead the custodian is recognised as the customer’s agent), then the duties of obedience, loyalty, and care.
Although the rules governing the distribution of custodial assets upon the custodian’s insolvency will depend on the applicable insolvency regime, many U.S. regimes, including the U.S. Bankruptcy Code, look to state law in the first instance to see whether the property is considered property of the custodian or instead property of the customer. If the latter, the assets will generally not be subject to claims of the custodian’s general creditors. The way state law views property held subject to a bailment or similar relationship will depend on whether the property is fungible or not. For non-fungible property, the assets would be considered property of the customer and therefore, as long as the customer can substantiate the bailment or similar relationship and identify the relevant assets, its claim for the return of the asset will not be subject to the claims of the custodian’s general creditors. State law also provides that fungible property held subject to a bailment or similar relationship is the property of the bailor, but that if there is a shortfall in the amount of a particular fungible asset relative to the claims of all bailors, the bailors will share pro rata.
While it appears unlikely that private keys would be considered fungible assets, the analysis is less clear for the Digital Assets themselves. For example, Digital Assets carried on particular blocks that make them sufficiently non-interchangeable may be non-fungible. However, if a custodian were to hold the Digital Assets in bulk with each customer owning a portion thereof, such Digital Assets could be considered fungible.
Securities intermediary-entitlement holder relationship. Another possible way to describe the customer-custodian relationship is as one between an entitlement holder and its securities intermediary within the purview of Article 8 of the Uniform Commercial Code as in effect in the applicable state (“UCC”).
In the U.S., the relationship between securities broker-dealers and their customers in respect of the customers’ securities is generally subject to Article 8 of the UCC. However, a broader range of relationships can fall within the scope of Article 8 if the asset being maintained is a “financial asset.” An ICO token would likely be a financial asset by virtue of its status as a security.4 Article 8 also allows parties to agree to treat an asset that is not a security as a financial asset so long as it “makes sense to apply the [duties in Part 5 of Article 8 of the UCC (“Part 5 duties”)] to the relationship.”5 It is likely appropriate to apply the Part 5 duties to the custody of cryptocurrencies. For other assets recorded on a distributed ledger, one would have to analyse whether it would make sense to apply the Part 5 duties to the relationship based on the nature and properties of the asset, including whether the asset is transferable, generates payments or distributions, or provides holders with certain rights such as voting rights.
Overall, the benefit of electing to treat custodial assets as “financial assets” and thereby subject to Article 8 is that parties would then be able to have their relationship governed by a well-established legal regime that governs a very large market.
As in the context of a bailment or similar relationship, the rights of a customer in the event of the custodian’s insolvency will depend on the applicable insolvency regime.7 As mentioned above, most U.S. insolvency regimes look to state law to determine who has an interest in certain assets. However, the Securities Investor Protection Act (“SIPA”), which will likely govern the insolvency of a securities broker-dealer, provides that a securities customer will have a claim against the debtor based on its “net equity,” which generally reflects all of the customer’s securities positions and associated customer cash. To the extent this distribution rule applies, which it may in the case of ICO tokens held with a broker-dealer, a Digital Asset customer’s claim for the return of its securities will share ratably with the claims of other securities customers and in priority to the broker-dealer’s general creditors.
In the event the SIPA distribution rules do not apply and the insolvency regime points to state law, Section 8-503 of the UCC provides that financial assets held by a securities intermediary are not property of the securities intermediary and Section 8-511 of the UCC provides that the claims of entitlement holders would have priority over creditors except when the creditors have “control” over the financial asset. Section 8-503(b) further provides that each entitlement holder’s property interest is a pro rata property interest in all interests of the securities intermediary in the particular type of financial asset that is being held for the entitlement holder by the securities intermediary.
Other relationship characterisations. If there is no bailee-bailor or similar relationship and no securities intermediary-entitlement holder relationship, then there might only be a contractual relationship. In the context of such other relationships, the custodian may not have any special duties, and if it enters into insolvency proceedings, the customer might only have an unsecured monetary claim (and not a claim to the actual custodial assets). However, this does not exclude the possibility that there are other relationships with legal import that might exist between the custodian and its customer.
In addition to determining the rights and obligations of a custodian of a Digital Asset and the Digital Asset owner, how a Digital Asset is held and the agreement governing the Digital Asset may have significant implications for the rights of any transferee of the Digital Asset. This is because the UCC’s rules concerning perfection and priority differ for different asset categories and the nature and documentation of the custodial relationship may dictate which category a Digital Asset falls into. Most notably, while many Digital Assets would, absent an agreement to the contrary, likely be considered “general intangibles” for purposes of Article 9 of the UCC, an effective agreement between a custodian and customer to treat a Digital Asset as a financial asset would cause such asset to be “investment property” under Article 9, which is subject to very different priority and perfection rules.
Sales. Whereas there are no commercial rules that provide for adverse claim cutoff protection for general intangibles in the context of sales, Sections 8-502 and 8-510 of the UCC provide that if a transferee of a financial asset gives value, acquires its interest without notice of any adverse claims and obtains “control,” it will acquire its interest free of adverse claims.
Analysing the regulatory status of a Digital Asset custodian begins with a categorisation of the underlying Digital Asset. Generally speaking, as a matter of U.S. federal law, Digital Assets are viewed as either “securities” (as appears to be the case with most ICO tokens),9 and thus subject to regulation by the Securities and Exchange Commission (“SEC”), or non-security “commodities” (as appears to be the case with Bitcoin and certain other cryptocurrencies),10 and thus subject to regulation by the Commodity Futures Trading Commission (“CFTC”). In addition, certain state laws may apply to Digital Asset custodial activities.
An exception from broker-dealer registration exists, however, for certain federal or state chartered or licensed banks engaged in custody or safekeeping activities.14 These custodians are instead subject to banking law regulation of their custodial activities. Banking regulation for custodial or fiduciary activities by state and federal banks and trust companies, whether insured by the Federal Deposit Insurance Corporation (“FDIC”) or not, is designed to preserve the customer’s interest in the property held by the bank or trust company for safekeeping. The trust departments of banks and trust companies are examined by the appropriate supervisory agency in order to require segregation and recordkeeping for trust assets, and those assets are treated exclusively as customer assets even in a failure of the bank or trust company.
At the state level, many jurisdictions similarly require that custodial services for customers’ financial assets can only be provided by certain regulated persons. Many states similarly require some form of a bank, trust company, or other fiduciary charter to act as a fiduciary in performing such custodial duties. Additionally, many state laws limit such fiduciary powers either to federally-chartered entities or to entities chartered or regulated by that state. While reciprocity may be provided to out-of-state trust companies for certain activities, the regular conduct of custodial and fiduciary activities typically requires separate licensing by the state where the customers reside.
In addition, New York requires licensing and oversight for custodial activities through the relatively extensive “BitLicense” framework introduced in 2015 or through its oversight of banks and trust companies. Persons who are “storing, holding, or maintaining custody of virtual currency on behalf of others” within the New York market are conducting “virtual currency business activity” within the jurisdiction,31 and must either obtain a BitLicense from the New York Department of Financial Services (“NYDFS”), or otherwise fit an exemption by being chartered under New York Banking Law and approved by NYDFS to engage in such activity.32 Persons operating as BitLicensees (as opposed to exempt, chartered institutions) are required to maintain a trust account with a “qualified custodian” – defined to extend only to a broad number of federal and New York banking entities in the state’s relevant regulations – and must also hold Digital Assets of the same type and amount as any “owed or obligated” to another person for whom it is providing such custodial services. Thus, for any person seeking to provide Digital Asset custodial services of any kind involving New York markets, this additional regulatory hurdle is imposed.
In addition to state laws governing custodial relationships, it is important to note the central role played to date by state money transmitter laws in governing transactions in Digital Assets. State money transmitter licensing is frequently required for many Digital Asset activities, particularly for serving as an intermediary in fiat currency, virtual currency, and related transactions. While custodial activities may not be subject to the money transmitter laws, it is important to carefully consider the applicable statutory and regulatory language as well as any interpretative rulings by individual state regulators to define what is within the ambit of that state’s money transmitter law.
The URVCBA and the UCC Article 8 Companion Act to the URVCBA (the “Companion Act”) are an initiative of the Uniform Law Commission intended to provide a state-level regulatory framework similar to that created by state money transmitter laws for entities that offer virtual currency33 transfer, exchange, or storage services. The URVCBA has not yet been enacted by any state, although it has been introduced in Connecticut, Hawaii, and Nebraska.
In order for a person to exchange, transfer or store a virtual currency for purposes of the URVCBA, such person must have “control” over that virtual currency, which means the “power to execute unilaterally or prevent indefinitely a virtual-currency transaction.”34 In the context of a “multi sig” arrangement, a custodian may only have one of several private keys that are needed to effectuate a transaction in the relevant virtual currency, in which case such custodian would not have “control” over such virtual currency for the purposes of the URVCBA. However, certain entities are exempt from the URVCBA’s requirements, including: (1) federally- or state-chartered depository institutions; (2) broker-dealers or futures commission merchants provided that their virtual currency activities are ancillary to their securities or commodities business and they comply with Section 502 of the URVCBA (discussed below); and (3) governments.
A person within the scope of the URVCBA needs to obtain a licence from state authorities if the value of such person’s virtual currency business activities exceeds a $5,000 de minimis threshold. The URVCBA, however, also creates an “on-ramp” or “lite” regime for entities whose virtual currency business activity is below a $35,000 threshold. Such persons still need to register with the relevant authorities, but are subject to less onerous licensing requirements.
Obligations applicable to licensees and registrants are similar to those imposed under money transmitter laws and include recordkeeping, disclosure, and business continuity planning obligations. Unlike money transmitter laws, however, Section 502 of the URVCBA requires licensees and registrants that have “control” over customers’ virtual currencies to “maintain an amount of each type of virtual currency sufficient to satisfy the aggregate entitlements of the persons to each type of virtual currency for the benefit of its resident customers.” While this obligation is similar to that imposed on securities intermediaries under Part 5 of Article 8 of the UCC, Part 5 permits a securities intermediary and its customer to agree that a different rule will apply and also provides that this obligation will be displaced to the extent addressed by another statute or regulation. Section 502 also provides that virtual currency held by a licensee or registrant for a customer is not property of the licensee or registrant and will not be available to satisfy the claims of such licensee’s or registrant’s creditors. Customers will share pro rata in the virtual currencies to which they are entitled.
The Companion Act requires entities subject to the URVCBA to agree with their customers that virtual currencies controlled by such entities for such customers are to be treated as financial assets, which would mean that the commercial law rules for financial assets discussed above would apply to such virtual currencies. Notably, the Companion Act also provides that the agreement between a licensee or registrant and their customers cannot provide for a standard for the licensee or registrant to comply with its Part 5 duties that is less protective of the customer than the standard that applies under Part 5 when there is no agreement between the parties as to which standard applies (i.e., “due care in accordance with reasonable commercial standards”). The Companion Act further requires that the agreement between a licensee or registrant and its customer must state that the licensee or registrant will not grant a security interest in the virtual currency it is maintaining on behalf of its customer.
As with many issues involving Digital Assets, the laws and interpretations governing their custody and transfer continue to evolve. Current law generally was not designed to address Digital Assets and, as a result, is being adapted to fit this new asset class that, in some areas, fits imperfectly within existing legal frameworks and interpretations. Perhaps the only sure prediction is that the law will continue to evolve and, less certainly, continue to develop to promote greater certainty as Digital Assets themselves continue to evolve and play an increasingly significant role in the markets.
The views expressed in this chapter are solely those of the authors and do not necessarily represent the policies or views of Cleary Gottlieb or any of its partners. © 2018 Cleary Gottlieb Steen & Hamilton.
The authors gratefully acknowledge the contribution of Marc Rotter, Brandon Hammer, Reshama Patel, and Jim Wintering to this chapter.
1. This chapter reflects legal developments as of July 31, 2018.
2. This chapter describes the typical operation of publicly accessible distributed ledgers, such as the blockchain used for Bitcoin. Other distributed ledger technologies, especially permissioned (i.e., “private”) blockchains, can involve different mechanics for recording the ownership and transfer of Digital Assets.
3. See, e.g., Olga Kharif and Sonali Basak, Regulated Crypto Custody Is (Almost) Here. It’s a Game Changer, Bloomberg (June 18, 2018), https://www.bloomberg.com/news/articles/2018-06-18/regulated-crypto-custody-is-almost-here-it-s-a-game-changer.
5. See UCC § 8-102 cmt. 9.
6. See UCC §§ 8-504(c)(2), 8-505(a)(2), 8-506(2), 8-507(a)(2) and 8-508(2).
7. See UCC § 8-503 cmt. 1.
8. See UCC §§ 8-106(c), 9-106(a).
10. See In re Coinflip, Inc., CFTC Docket No. 15-29 (Sep. 17, 2015) (“Bitcoin and other virtual currencies are encompassed in the definition [of commodity under Section 1a(9) of the CEA] and properly defined as commodities.”). Questions have been raised, however, regarding whether all Digital Assets qualify as commodities, or just those (such as Bitcoin) that underlie listed futures contracts. See e.g. Defs.’ Opp’n. to Pl.’s Mot. for Prelim. Inj., CFTC v. My Big Coin Pay, Inc., 1:18-cv-10077-RWZ at 7-10 (D. Mass. Apr. 3, 2018).
11. Section 15(a)(1) of the Exchange Act.
12. See Definition of Terms in and Specific Exemptions for Banks, Savings Associations, and Savings Banks Under Sections 3(a)(4) and 3(а)(5) of the Securities Exchange Act of 1934, SEC Release No. 34-44291 (May 11, 2001).
13. The application of these regulations to Digital Assets is not clear in many cases. For a high-level summary, see Financial Industry Regulatory Authority, Distributed Ledger Technology: Implications of Blockchain for the Securities Industry, https://www.finra.org/sites/default/files/FINRA_Blockchain_Report.pdf.
14. See Section 3(a)(4)(B)(viii) of the Exchange Act. Although most U.S. depository institutions clearly qualify for this exception, the status of other types of banks, such as state-licensed, non-depository trust companies, is not as clear in all cases.
15. Custody is broadly defined as “holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them,” and includes (i) possession of client funds or securities, (ii) any arrangement under which an adviser is authorized or permitted to withdraw client funds or securities held by a custodian upon instruction to the custodian, and (iii) access to client funds by virtue of an adviser’s dual role as both general partner and investment adviser to a limited partnership or other such capacity. Rule 206(4)-2(d)(2) under the Advisers Act.
17. The term “qualified custodian” is defined in the Custody Rule to include: banks or savings associations with deposits insured by the FDIC; broker-dealers registered with the SEC; futures commission merchants registered with the CFTC; and non-U.S. financial institutions that customarily hold financial assets for their customers, so long as they keep the advisory assets separate from their own.
18. Rule 206(4)-2(a)(3) under the Advisers Act.
19. Additionally, investment advisers that also serve as qualified custodians themselves must be subject to an annual surprise examination from an independent public accountant that is registered with and regularly inspected by the Public Company Accounting Oversight Board. Furthermore, that adviser must also obtain or receive from its affiliate an annual report prepared by such an accountant that covers all internal controls the adviser uses relating to providing custody services for client assets.
20. Rule 206(4)-2(b)(5) under the Advisers Act.
21. Rule 17f-2 under the Investment Company Act.
22. Section 17(f)(1) if the Investment Company Act.
23. Rule 17f-5 under the Investment Company Act.
24. Rule 17f-1 under the Investment Company Act. In addition, SEC-registered investment companies are able to deposit securities in securities depositories that meet certain requirements and hold assets with futures commission merchants and commodity clearing organisations in amounts necessary to effect certain types of transactions. See Rules 17f-4, 17F-6, and 17f-7 under the Investment Company Act.
25. For example, CFTC Regulation § 180.1 prohibits fraud and manipulation in connection with any contract of sale of any commodity in U.S. interstate commerce.
26. See Retail Commodity Transactions Involving Virtual Currency, 82 Fed. Reg. 60335 (Dec. 20, 2017).
27. Commodity Futures Trading Comm'n v. Monex Credit Co., 311 F. Supp. 3d 1173 (C.D. Cal. 2018).
28. For example, some of this precedent depends on whether a commodity is “nonfinancial,” which in turn depends on whether ownership of the commodity can be conveyed in some manner and the commodity can be consumed. See Further Definition of “Swap,” “Security-Based Swap,” and “Security-Based Swap Agreement”; Mixed Swaps; Security-Based Swap Agreement Recordkeeping, 77 Fed. Reg. 48208, 48233 (Aug. 13, 2012). However, this precedent was intended to address environmental commodities, such as emission allowances, that do not provide good analogies for many Digital Assets.
29. See Section 4d of the CEA and CFTC Regulations §§ 1.20-1.30 (futures segregation rules), 30.7 (foreign futures segregation rules) and Part 22 (cleared swaps segregation rules).
30. See CFTC Regulations §§ 1.20(b), 22.4, and 30.7(b).
31. 23 NYCRR § 200.2(q).
32. See 23 NYCRR § 200.3(a)-(c).
33. The URVCBA uses the term “virtual currency” throughout, which is very broadly defined. See URVCBA § 102(23).

References: § 8
 § 8
 v. 
 § 180
 v. 
 § 200
 § 200
 § 102