Philippa Lamb: Hello and welcome to the ICAEW Insights in Focus podcast. I’m Philippa Lamb. Today we’re discussing the pros and cons of crypto and its impact on the work of finance professionals. The collapse of crypto exchange and hedge fund FTX in December, took $8bn of its customers’ money with it, and raised fresh questions about the sector. Fans claim crypto will revolutionise how businesses and customers interact and potentially democratise the global flow of money. For detractors, the sector is little more than an unregulated casino, rife with opportunities for investors to lose their money. Finance professionals are caught in the middle. So where could or should crypto go next? And how significant might it become? I’m joined by Paul Munson, formerly of the Financial Conduct Authority, and now head of financial crime at social investment app Shares. Esther Mallowah, ICAEW’s Head of Technology Policy and Vivienne Artz, data privacy expert and currently serving at the Global Coalition to Fight Financial Crime, are also with us. Hello, everyone. Thanks for being here.

Paul, crypto – it’s a big subject. We’re going to limit ourselves to cryptocurrency – we’re not going to be talking about things like non-fungible tokens or other assets like that. Most people, I think, have heard of Bitcoin and some people will be familiar with the theory, but can you just give us a quick explanation of how they work?

Paul Munson: If we start with Bitcoin, the most established and the greatest market capital coin, it works on the principle of a blockchain, which is an open ledger, which details transactions. That ledger is immutable, so those transactions cannot be changed. I won’t go too much into mining, but mining is effectively where a collection of transactions are brought together. And a mathematical equation works and that’s what the miners do – they’re looking to solve that equation. They then release the next blocks on the chain and are rewarded. They actually get six bitcoins each time a miner solves that equation.

PL: So that’s a key advantage, that immutability. But the blockchain, just to be clear, is not managed by any individual organisation, it’s maintained by all its participants – would that be a good way of explaining it?

PM: It’s like an ecosystem, yes, it’s maintained by those that use it and verify it. And it relies on the fact that there are rules to govern how it’s used, and how the transactions are mined. Nothing sits behind this. But it’s very important to say that, unlike a stable coin, it’s not pegged to any currency, or gold or anything of value. Its value is only the value placed in its use itself – those transactions, it being used as a mechanism for those transactions.

PL: Which brings us to volatility, which we’ll definitely get to. So Vivienne, how big is the sector? Do we actually know?

Vivienne Artz: It is enormous – it’s estimated to be in excess of $1trn in value. And it is an area that is attracting a huge amount of interest, because it is worth so much. But the lack of confidence around how is it regulated, and what are the risks that you’re taking – this is putting people off. But given not only the value today, but the potential value, there’s a huge amount of interest in it; it’s something we have to address.

PL: Who is investing in it now, when – as you say – institutional investors are wary, and we’ve all heard about the criminal element. Presumably that is still a substantial factor?

VA: There’s always a criminal element in any kind of financial structure. But there are innovators who are creating products and services on the blockchain. And then there are individuals like ourselves who want to invest. Then there’s the financial institutions who can provide services and products to help service whatever it is that is taking place on the blockchain. So the blockchain is a bit like the internet – it’s a base and you can create lots of things on it – one being cryptocurrencies, another being digital assets, and so on. Everyone has a potential stake in the blockchain and in cryptocurrencies, and it’s definitely the way of the future. The question is, how do we get there in a safe and regulated way?

PL: Paul, do you want to lay out the specific risks for investors? We mentioned volatility?

PM: It is hugely volatile, it’s cyclical, it goes up and down. There’s nothing that sits behind it, so it has no intrinsic value, only the value placed on it by consumers – certainly with the likes of Bitcoin. There are exceptions, as I said, like stable coins that might be pegged to a currency. I think the other thing is that, like any new investment, it’s risky if you don’t understand it. People who aren’t that experienced with it, really need to get into how it works. If it’s a use case, is it legitimate? Are the people in those businesses legitimate? It’s a bit like a due diligence exercise, which I do a lot as I work in financial crime – that’s really what you’re looking at. That might be hard for consumers, I suppose – where do they go to find reliable advice?

Criminals are always early adopters of everything, so they are there. So are lots of legitimate investors. But it’s very new territory. It is used heavily in terms of crime – it has historically been used, and still is, for cyber attacks and things like that, cyber-related crime. But also there is a lot of legitimate money in it, and a lot of legitimate interest moving into it. Hedge funds are moving into it. Banks are very much considering it but they may not be in that space. But it’s becoming more mainstream.

PL: When you say legitimate investors, we’re talking about private individuals, day traders? But the more substantial, institutionalised investors are still wary?

VA: Very wary. I think a lot of it is to do with the fact that it’s decentralised, so who do you go to when something goes wrong? And it is borderless These are very key concepts in the whole mechanism. So who is the regulator? Sir Jon Cunliffe at the Bank of England, when FTX went down, said we must regulate this space. There’s a lot of intention, but what we haven’t seen is a follow-hrough and what that might potentially look like. Because until we know where we can go to for recourse if something goes pear-shaped, there’s a lot of concern around volatility, certainty and the legitimacy of it.

PL: I want to get into the question of regulation. Esther, that brings me directly to you, because this is the basis of problems for financial professionals, isn’t it?

Esther Mallowah: While the banks and institutional investors are wary for the reasons that Vivienne laid out, I think at the same time, there’s a fear of being made irrelevant or being left behind. And that’s why they’re dipping their toes into the waters. Most of them will have experimented a little bit with cryptocurrency, even if they’re not fully on board with it. We’re seeing the same thing happening with central banks as well. It’s not cryptocurrency in the same sense, but because of this fear of being left behind or being irrelevant.

PL: In terms of financial professionals dealing with cryptocurrency now, what are the difficulties there?

EM: One of the first difficulties is that cryptocurrencies don’t fit neatly into the current boxes that accounting standards provide. So, for example, there are institutions or shops that would accept cryptocurrency as cash,­ but then cryptocurrency doesn’t fit the accounting definition of cash. And similarly, it doesn’t fit the accounting definition of financial instruments. So there’s a question about where it would fall and therefore how it should be treated. Usually, what happens is that it falls into the category of intangible assets, and that’s where we’ve got some standards that relate to intangible assets or to inventories that can be used for crypto. But they don’t provide the full scope of guidance. For example, generally financial professionals and accountants are interested in measuring, reporting, auditing – and one of the biggest challenges with cryptocurrencies is measuring the value of the currency. As we’ve said before, there’s usually no real asset backing them, so it’s quite difficult to determine what their value is. Some of the guidance that’s given in the standards around using, for example, fair value to measure the value of the assets, only works for cryptocurrencies where there’s an active market. If that doesn’t exist, again, it’s quite tricky to measure.

PL: FTX, the exchange that collapsed in December – that was audited, wasn’t it, before it went down? This raises questions – it demonstrates everything you’ve been saying about the inefficacy of audit in this space?

EM: For a lot of these companies, they don’t have to be audited because they’re not listed. And when an audit is conducted, there might not be adequate guidance on how the audit should be conducted. So, for example, following FTX a lot of the crypto exchanges decided to provide their proof of reserves. But even with that, there isn’t specific guidance on what should be included in our pro forma reserves. So we saw situations where, for example, they would only give information about the assets. For crypto exchanges, where they’re custodians, some of those assets don’t belong to them, they belong to clients or customers, and that’s not visible from that proof of reserves.

PL: There’s a lot of work to do here, isn’t there? Is there actively work in progress trying to address these questions within audit?

EM: I know some of the big audit and accounting funds have started to invest in blockchain auditing technology. Another thing to note is that some of these companies have said that currently auditors don’t have the skills to be able to audit some of these exchanges. But then I think it’s important to note that a lot of the issues that could happen with cryptocurrency would be around things that already exist – governance, internal control processes; it’s not necessarily all to do with the technology itself.

PL: So, Paul, moving on to regulation, how does it work here in the UK?

PM: Well, there’s five permissions. The most important ones are fiat currency; that is, any currency –pounds, euros, dollars – that’s fiat, in crypto terms. Crypto to fiat exchange is one of the regulated activities. Basically you register with the FCA under the money laundering regulations, then they do an assessment of you as a business. So it’s like an audit in itself. They look at your AML controls, they look at your financial position as a business. The other regulated activity is the custodian. Being a custodian, you’re a VASP – virtual asset service provider. There is peer-to-peer exchange, but that’s higher-risk, so I don’t think there are any firms authorised to do that in the UK, but I might be corrected. And there are crypto or bitcoin ATMs, where you can buy crypto with cash. Definitely none of those are approved, but there were some prior to it coming under the FCA’s remIt. But they are incredibly high risk because you can basically put cash in and buy bitcoin.

PL: So operators who aren’t licensed can still exist out there?

PM: They can, yes, they can be going through the process. There was what they called a temporary permissions regime. Also, if you look at the numbers, the FCA had about 200 firms apply, and 33 got through, so it’s a very high bar to being approved. Now those firms haven’t gone away, they may still be targeting UK consumers. Thinking about regulation, what consumers should do, maybe, is to look to see if the exchange they’re dealing with is UK licensed. Is it on the record? If you can check the FCA register, that might be a way that people can help themselves and prepare themselves. But there are a lot of big exchanges that aren’t on the FCA register – you’d be surprised, to be honest.

PL: But doesn’t that make the licensing regime largely meaningless?

PM: It’s about policing the perimeter. Some of the largest firms in the world are operating or supporting UK customers and do not have a licence. I won’t name them but people could find out if they wanted to quite easily.

PL: Vivienne, it sounds concerning. What do you think we need to beef the system up?

VA: I think what’s interesting is that we have so much existing legislation that can be applied to the crypto space. But there are also gaps and there are also unique elements to crypto, which means that we have to be creative or innovative in terms of regulation. This is the gap – this is where the exposure and the risk is. Some of the reasons for scandals have been for things that would affect a traditional business: security, governance, auditing. Terrestrial firms go belly-up because of those issues. What we really need to be focusing on is what is unique, what are the unique risks associated with cryptocurrencies. That’s what regulation needs to address.

One of the areas I’m particularly interested in is privacy. We’ve talked about the immutability of blockchain – once it’s on there, it’s there for ever. If you need to correct it, you can, but the original version is still there. And of course, the privacy principles are very clear about not keeping data for ever, minimising data, confidentiality. So it isn’t just a financial services regulatory issue. It is also an issue across other regulators. I think one of the biggest potential areas to get things right is with privacy and financial regulations, because there are an enormous number of privacy issues that arise and it is not clear how those can be readily addressed in an architecture like blockchain.

PL: So what would you all like to see happen right now to move this regulatory framework forward? What are the first steps we need to see?

EM: I think there needs to be more forward thinking. I guess this is from the accounting regulator’s perspective in terms of providing guidance on how to account for cryptocurrencies. At the moment the challenge is that crypto is not being used to a huge enough extent to warrant spending a lot of time on it. So, what we’ve seen is that a lot of the regulators say not that many companies have crypto on their balance sheets and not that many auditors are having to deal with crypto at the moment. It’s almost like they’re waiting for it to pick up more, before investing more time in providing guidance for it. What would be good is if the standard setters helped to lead the way, starting to think about what ‘good’ looks like. They are already doing that, but I think off the basis of how well existing standards meet crypto requirements rather than, as Vivienne said, what’s largely different about crypto and what needs to happen in that space?

PL: Esther makes a very interesting point. Paul, what’s your feeling?

PM: On the regulatory side, they’ve got to address what’s going on now, police the perimeter, as I said before. You can’t do it just within the UK, you’ve got to collaborate with other regulators. And there are certain jurisdictions where they may not be up to it, and you’ve got to act globally to deal with that. I think that’s one easy win. I think they’ve also got to adjust and at least work with firms that are trying to do the right thing, want to be regulated and want to make sure at least that their interests aren’t harmed by the way regulatory activity works. But I think we’ve got to work on educating people; the regulators have got to do the right checks. I agree with what you said earlier, about the custody side – it’s good that they’re becoming transparent and displaying the assets where they can. I think the trouble with privacy is, it’s immutable. It’s open, by its nature. So how do you get around a problem like that? I don’t really know how you crack that nut. I’m not a privacy expert. It sounds a pretty difficult one to me. But I think the way the way we do it is by collectively working, where we can, but the trouble is it’s so big and so global it’s very hard to rein in.

VA: I think it’s a really excellent point, actually – the globality of the issue. And that requires regulators, not only to collaborate within a particular jurisdiction but across jurisdictions as well, and to be focusing on outcomes, rather than the process. Because I think far too often what we’re focusing on is: does it do this? Does it do that? And have you done the following six things? Actually, what we really should be focusing on is: is there accountability? Is there trust? If something goes wrong, what are the mechanisms to deal with it? And can I find out where to go for recourse? And of course, we have to deal with the fact that it is decentralised and figure out a mechanism for safeguarding investors in that space.

PL: In terms of engendering more trust generally, we touched on this idea of central banks producing their own digital currencies – the Bank of England is looking at this. Is it going to happen?

VA: All the big economies are looking at central bank digital currencies. There are the private sector ones – Bitcoin and others based on stable coins and such like – but central bank digital currencies are definitely something of the future. And I would suggest it’s the near future, not the far future.

PL: They would be pegged to a hard currency – that’s the key difference?

PM: Yes, there’s a couple already. There’s Tether, for example, that’s pegged to the dollar; it’s used a lot for liquidity and trading – it’s actually used in institutional firms already.

PL: So less volatility?

PM: Yes, exactly. It should be paired one-to-one with dollars – dollars are held behind it. I won’t go into the intricacies of trading, but when it’s been traded a lot there are times when they start to unpair and that’s worrying. But the essential premise is yes, it does have something sitting behind it, dollar to dollar or pound to pound. That’s how a stable coin would work.

PL: And you’re thinking in the reasonably short term?

VA: I think so absolutely. Innovation is moving at pace.

EM: I agree that it’s looking to be in the relatively short term. The Bank of England, for example – they‘re looking at a central bank digital currency from 2025. I think they need to address some challenges such as around what the role of banks would be with the central bank digital currency, and the issues around privacy that we’ve already discussed, as well. Those are the things that need to be ironed out before it’s implemented.

PL: And obviously, with legitimacy comes tax?

PM: What is coming in is the Criminal Finances Act, that puts an onus on firms to prevent tax evasion. Crypto is an area where some traders, especially if they’ve been in it for a while – since 2016 – could have made enormous gains. There are people who are millionaires just on the back of this and may not even be aware that they’re realising capital gains if they sell that coin. That’s where I think HMRC is coming in. They’re looking in that area, and they’ve produced guidance that people can find if they want to. It’s something professionals in accountancy would be interested in, especially for their clients who may already be early adopters and have investments. You need to think about the capital gains position, because it can be tricky and crypto mining is not exempt. It’s quite detailed guidance. Tax is important and it’s being looked at in America as well. I think it’s going on your annual statutory tax report in the UK now – there’s a box: do you hold or own any crypto assets?

PL: Presumably, the issues that Esther raised earlier about establishing actual value for the purposes of accounting play into this. There are huge difficulties there, surely?

EM: There are, yes, because on your tax return, you’d have to say what the value of the crypto you hold is.

PL: And as you described, that’s quite problematic.

VA: There’s an opportunity for tax arbitrage. This is something, of course, that must be thought about when you’re talking about a cross-border global reality. Where do you realise the income? Because that will be where the tax is payable. And as we know, with the digital economy, a lot of firms are positioning themselves in particular ways in order to leverage the most accommodating tax environment. I think we’ll find the same with digital currencies.

PL: I’m sure we’ll revisit this subject. But before we wrap this one up, can I ask you all to future-gaze: your thoughts on how the sector might expand and the timeframe?

PM: There’s a lot of things that function on ether. NFTs – non-fungible tokens, devolved finance – DeFi – that is the chain they use for it. But there’s a lot of things operating on there. They are growing and growing. NFTs, for example, can be used for digital forms of art; they’re being used already for tickets –when you buy tickets to gigs, or to the theatre, you get that QR code now. So tokenisation is definitely a theme – company shares could be on a blockchain. And the information about that company? Subject to privacy, you could publish accounts there. I think that’s where it’s going; I can see it as a way of tokenising and putting a value on a lot of those interactions and using the ledger for that.

VA: I think it’s very much here now, not in the future. But with greater clarity around what you can and cannot do – with the establishment of, I would suggest, more international and technical standards, rather than regulation – certainty will be able to be delivered. And I think what we’ll then see is an exponential increase in the adoption of cryptocurrencies, digital assets, etc. So for me, it’s more a question of speed, rather than time.

EM: The market capitalisation is likely going to grow. I think people are curious, and so more people are going to invest in cryptocurrencies and to use cryptocurrencies. A few countries have already acknowledged digital currencies as currency. I think it is going to grow – and it’s also going to interact a lot with other technologies out there. So when you start having things like Web3, and the metaverse, people can start to buy assets in the metaverse because it has more agility. And as Vivienne said, having the right controls around it will really accelerate the process.

PL: Thank you for a really useful discussion. The next Insights podcasts will air in early February, and we’ll be discussing what the future holds for the audit profession. The next In Focus podcast will tackle strategies to attract and retain accountancy talent. That will be live later in February.