The crypto saga | Bringing cryptoasset regulation to real life

As financial institutions navigate today’s unpredictable economic and regulatory landscape, the pressure on risk and compliance operating models has never been greater.



Patrick Laurent - Partner - Technology - Deloitte

Francesca Messini - Director - Regulatory Strategy - Deloitte

Diogo Ramalheira - Senior Consultant - Regulatory Strategy - Deloitte

Published on 29 October 2019

Share this article


In this digital age, cryptocurrency or cryptoasset have become buzzwords of the moment.

Let’s keep it simple. Those that could be described as a “token”, a sort of unregulated and digital representation of value using cryptography for security, can be categorized as follows:

  • Exchange tokens: used as a means of exchange, to buy and sell products and services without traditional financial intermediaries[3]

  • Security tokens: instruments providing “(…) a right of ownership and an entitlement to a share of future profits or cash flows”[4]. These are raised via the “Security Token Offering” (STO), a process of issuing a financial asset in the form of a digital asset

  • Utility tokens: tokens which grant holders access to current or prospective products or services, but which do not grant rights as security tokens[5].

Since the launch of the first cryptocurrency, Bitcoin in 2009, the number of cryptocurrencies in circulation has been rising considerably [6]. There exist pure cryptocurrencies (e.g. Bitcoin) with high volatility, but also others like Tether and Libra, backed by a fiat currency or by a basket of fiat currencies, respectively.

Geographic distribution of the cryptocurrency industry

EUR 254 billion market capitalization in 2019

Cryptocurrency market capitalization has been growing around the world. It has increased from roughly €11 billion in 2014 to €254 billion in 2019, with Bitcoin accounting for around 70 percent of the total market capitalization. [19]

~900 cryptocurrencies

The number of cryptocurrencies rose from 1 in 2009 (Bitcoin) to approximately 900 as seen today. The ones with a higher market capitalization are Bitcoin, Ethereum, XRP, Bitcoin Cash, and Litecoin. [19]

Cryptocurrency owners around the world

Yes / No

35 million crypto users around the world

The cryptocurrency world gained 17 new million users in 2018, totalling around 35 million in 2018. [21]

EUR 36 million crypto wallets in the world

The number of crypto wallet users worldwide has jumped from around 6.5 million in 2016 to over 34.6 million in the first of 2019. Customers are particularly interested in the fact that it allows them to combine all of their funds at all times. [22]

Moreover, traditional banks are differentiating their service offering by embracing cryptoassets, e.g.: corporate bank accounts to start-ups dealing with crypto; advice for raising capital via STO programs; solutions to outsource storage and trading services for the ones dealing with Bitcoin.

Nevertheless, the industry still lacks regulatory guidance and investor protection. Studies say 19 percent of cryptocurrency users reported having faced hacking attacks on exchanges, while 15 percent were fraud victims.

If cryptocurrencies are here to stay, policymakers and governments need to find ways to protect investors and other stakeholders (e.g. developers [9]). In the following paragraphs, we describe examples of steps-taken so far—just to whet the appetite on the topic.

European Union level

As aforementioned, no common regulation has been released within the EU yet, although there are ongoing and flourishing discussions surrounding the topic.

Cryptocurrency taken at the European Union level

MARCH 2018

Publication of the Fintech Action Plan, which is focused on three core objectives:

One of the initiatives in place to achieve these goals is to understand current national approaches to Fintech licensing, in particular for cryptocurrencies and Initial Coin Offerings (ICOs).

JUNE 2018

Publication of the 5th AML Directive. It extends the scope of persons subject to AML and CTF requirements, namely terrorism financing risks in relation to virtual currencies, anonymous pre-paid cards and continuous technological evolutions in the field.

According to this Directive, “virtual currencies” means: “(…) Digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically”.

Under this regulatory framework, cryptocurrency exchanges and cryptocurrency wallet services will be obliged to implement measures to counter AML and CTF, such as KYC and transaction monitoring. However, the terms of implementation of this Directive may vary by jurisdiction. In fact, there are jurisdictions whose position may be more stringent and therefore each player will need to adapt considering its location in Europe.


Publication of Advice on Initial ICOs and Crypto-Assets

Publication of the Report with advice for the European Commission on crypto-assets

These reports alert national authorities, among others, for the:

However, tired of waiting for a transversal legislative proposal, and keen to protect market agents, some jurisdictions are adopting their own regulations.

United Kingdom

The United Kingdom shows an interesting evolution.

In 2019, the Financial Conduct Authority (FCA) issued a Policy Statement (PS 19/22) [10] to provide the Feedback and Final Guidance to Consultation paper 19/3. The document focused on the cryptoassets’ taxonomy:

  • E-money tokens [11]

Considered electronic money and subject to the Electronic Money Regulations [12], for which an authorization is needed. These are considered a kind of “stable coin”, as opposed to the remaining, which tend to have highly-volatile prices;

  • Security tokens

Provide rights and obligations similar to specified investments (e.g. a share or debt instrument), being regulated and requiring an authorization;

  • Unregulated tokens

Tokens not meeting the definition of e-money or security tokens, used as a means of exchange or to give access to a current or prospective good or service.

What does "stable coin" mean?

Cryptocurrencies promising a stable purchasing power or a fixed conversion rate to a specific asset/commodity, for which the appetite is increasing.

In 2019, Facebook announced the creation of a low volatility cryptocurrency, Libra Coin, backed-up by bank deposits and short-term government securities and with a special foundation - Calibra. However, its “legality” is non-consensual and governments are raising their voices saying that Calibra could become a “shadow bank”.


The UK has been evolving even within its small ultramarine territories.

Gibraltar, the UK’s territory with an area of only 6.8 km2, has been riding the crest of the wave concerning cryptocurrency regulations. In 2018, this territory introduced a regulatory framework for Distributed Ledger Technology Providers (DLT) [13], i.e., cryptocurrency exchanges.

The service providers keen to operate cryptocurrencies in Gibraltar need to apply for an authorization comprising of three stages:

  • Introductory meeting with the Gibraltar Financial Services Commission (GFSC) to discuss application’s proposal, business model, and type of services;
  • Initial Assessment of the authority on the type of customers, variety of products and services, organisational structure, AML/CTF exposure, and arrangements, among others;

  • Full Application: upon the initial feedback from GFSC, a full application including at least business plan, operations program, and compliance arrangements must be submitted. The GFSC commits to assess any application within a period of only three months!


Similarly, the Mediterranean island has been a pioneer in the cryptocurrency regulation. In 2018, the Virtual Financial Assets [14] (VFA) Act [15] was issued to regulate the Initial VFA Offerings [16] and VFA, to protect customers and to support the growth of this industry. It defines requirements for the market players

launching cryptocurrencies and for the cryptocurrency exchange service providers.

The market players falling under the regulatory framework need to apply for a license by providing a program of operations, systems, and security access protocols.


The Baltic country has an innovative cryptocurrency mind-set. Good news for the cryptocurrency exchange and wallet service providers: there are licenses for both [17].

Licenses are issued by the Estonian Financial Intelligence Unit (FIU), an independent unit of the Estonian Police and Border Guard Board.

To request a license, market players must have a company registered in Estonia and provide criminal records from all shareholders, board members, and the Compliance Officer, along with the procedures for AML/KYC and internal audit.


Germany has also been supporting cryptocurrency players. The Federal Financial Supervisory Authority (BaFin) has been considering virtual currencies as financial instruments and defined a specific authorization framework. Under the latter, cryptocurrency exchange does not require an authorization, while brokerage services related thereto do so.

However, the German Federal Minister of Finance (GFMF) will extend the cryptocurrencies’ regulatory framework

considering their growth in the market and current legal uncertainty. In May 2019, the GFMF published consultation on a Draft Act to implement the fifth anti-money laundering directive (AMLD5). This Draft Act seems to be more stringent, since beyond the need for cryptocurrency exchange and crypto wallet players to put AML/CTG arrangements in place, a license to operate is also required.


Within the Grand-Duchy there are, for the moment, no specific cryptocurrency regulations, although the government’s attitude towards crypto market players is very positive.

Cryptocurrency exchanges and new cryptocurrency businesses can operate in Luxembourg under a payment institutions license. The first license was granted in 2016 to Bitstamp, a cryptocurrency exchange

that trades in several currencies and “passports” its products and services towards other EU member-states.

However, since this activity is not under a specific regulatory framework, CSSF is warning investors about the high volatility of virtual currencies and of the risks associated to investments in such currencies [18].


[1] The Guardian (2019), Donald Trump: Bitcoin and cryptocurrencies aren’t money. Available at:

[2] The Independent (2019), China says state cryptocurrency set to rival Bitcoin is ‘close’ to launch. Available at:

[3] Guidance on Cryptoassets – FCA (2019): Policy Statement – PS 19/22. Available at:

[4] Deloitte Luxembourg (2019), Are token assets the securities of tomorrow?. Available at:

[5] Guidance on Cryptoassets – FCA (2019): Policy Statement – PS 19/22. Available at:

[6] According to data available on (August 2019)

[7] ING (2018) Cracking the code on Cryptocurrency: Bitcoin buy-in across Europe, the USA and Australia. Available at:

[8] Kaspersky Lab (2018): The Kaspersky Cryptocurrency Report 2019 – 22 countries. Available at:

[9] Techopedia (2019): “A developer is an individual that builds and create software and applications. He or she writes, debugs and executes the source code of a software application. A developer is also known as a software developer, computer programmer, programmer, software coder or software engineer”. Available at:

[10] Guidance on Cryptoassets – FCA (2019): Policy Statement – PS 19/22. Available at:

[11] For the FCA, “cryptoassets” refer to the broad term and “token” to the different forms of cryptoassets.

[12] Electronic Money Regulations (2011): Part 1. Available at:

[13] Gibraltar Financial Services Commission (2019): Distributed Ledger Technology Providers. Available at:

[14] Virtual Financial Assets means any form of digital medium recordation, used as a digital means of exchange, unit of account, or store of value and that is not (a) electronic money; (b) financial instrument; or (c) a virtual token.

[15] Virtual Financial Assets Act (2018) – Malta. Available at:

[16] Initial Virtual Financial Assets offerings are defined as a DLT-enabled method to raise funds by an issuer who issues or intends to issue a VFA in or from Malta, and offers it to the general public in exchange of funds.

[17] Starting a cryptocurrency company in Estonia – Company register (2019). Available at:

[18] Commission de Surveillance du Secteur Financier (2018) : Warning on Virtual Currencies. Available at :

[19] Source: CoinMarketCap, 2019. Available at:

[20] Source: CoinMarketCap, 2019. Available at:

[21] Source: Cointelegraph, 2019. Available at:

[22] Source: Bitcoin, 2019. Available at:

What's next?

One has to admit that the wording around crypto can be quite misleading, since each jurisdiction applies its own taxonomy.

In some cases, the presence of a specific framework for cryptocurrencies is seen as an advantage, and something that other players follow and replicate. On the other hand, the lack of a uniform regulatory framework represents a challenge to crypto players and investors, due to the lack of common-rules to protect them, to provide business in a consistent way and to benefit from the “passport” across the EU.

However, even though there is no expected date for the EU to issue a common regulatory framework, the European Institutions are positively moving towards a more structured way of doing cryptocurrency business. The design of that framework might however be balanced by the urge to go green through regulatory production from the EU, hence powering the various systems might become a critical component of their design.

Although it may not be an easy task to align the rules in different jurisdictions and the potential upcoming European legislation, it will certainly make it more challenging and interesting.

Keep an eye on the topic, the best is yet to come!

Share #DeloitteInsideNow


Are token assets the securities of tomorrow?

We often equate crypto-assets with bitcoin or other cryptocurrencies. But “crypto-asset” is actually a much broader term covering security tokens and new disruptive models for the security value chain from issuance to custody and settlement.

© 2021. See Terms of Use for more information. Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see to learn more about our global network of member firms. The Luxembourg member firm of Deloitte Touche Tohmatsu Limited Privacy Statement notice may be found at