Cryptovaults: Upgrading Custodial Services with Blockchain Technology
There has been a surge of interest in cryptocurrency investments, necessitating a closer look at how crypto vault storage solutions are attempting to meet traditional custodial intermediary standards and in what ways they might provide innovation. One of the biggest roadblocks to institutional investment in cryptocurrency is the lack of custody services around digital assets. The Securities and Exchange Commission (“SEC”) issued a staff letter regarding cryptocurrency-related holdings and investment fund innovation. One of the primary questions posed by the SEC is whether cryptocurrency investment funds can comply with the custodial requirements of the 1940 Act, specifically with respect to (1) the procedures used to validate ownership and make transactions; (2) the safekeeping of assets from cybersecurity and hacking threats.
In response to this call Goldman Sachs, JPMorgan Chase, and Northern Trust have all recently announced their intention to provide institutional custody services for crypto-related assets. Coinbase and Kingdom Trust are the first of many U.S. companies who have rolled out to crypto custody services, often referred to as crypto vault storage.
These developments raise the questions of whether crypto vault solutions can replace custodial services that banks have provided for the past 70 years and in what ways these solutions can be applied to private equity innovation? The answer to these two questions depends to some extent on whether national and supranational economic systems integrate or replace fiat with virtual currency, which is still a shaky proposition at best (according to the Bank of International Settlement report). However, in the interim.
In the private equity context custodial relationships between investors, investment managers and third-party custodians are generally governed by Rule 206(4)-2 of the Investment Advisers Act of 1940. The custody rule establishes a Registered Investment Adviser’s custodial obligation to its client’s assets and securities. Under the rule, custody means “holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.” A registered investment adviser with custody of client funds is required to hold them at a “qualified custodian.” Qualified custodians are generally defined by state and federal statutes, but are typically banks, registered broker-dealers, savings associations, futures commissions merchants and certain foreign financial institutions.
The heart of the custody rule is the investment adviser’s (or its agent’s) fiduciary responsibility to maintain client funds in such a way that the assets are insulated from and not jeopardized by unlawful activities, financial reverses, or insolvency. As originally intended the rule required registered investment advisers with custody of client securities to deposit them in a segregated bank account.
Banks as Qualified Custodians
Banks have traditionally been the standard for “qualified” custodianship for their obvious central role in transaction settlement and clearing. To provide custody services banks establish cash and securities accounts for investors (or their investment managers) assets, including equity and debt securities, ownership in mutual funds, asset-backed securities, alternative investments, and commodities.
Until more recently, securities were generally represented in certificated form and held in one of the following ways: (1) directly by the investor; (2) directly by a legal representative of the investor (e.g. an agent); (3) directly by the investor’s broker-dealer or investment adviser; (4) directly by the investor’s bank and deposited into a secure vault or safety deposit box.
Modern-day custody services provided by banks have largely moved away from their role as a direct physical custodian of assets due to the dematerialization of certificated assets. Instead, banks act as one of several intermediaries providing reconciliation and settlement services. In the private equity context, the settlement and clearing procedures that are largely handled by central securities depositories like the Depository Trust & Clearing Company do not exist and banks continue to play a more central role in the physical custody of stock certificates and other assets. As such banks provide a useful template for purposes of understanding the value and purpose of crypto vaults.
What are Cryptovaults?
A crypto vault is a physical vault where off-line hardware storage devices containing digital assets or access keys are stored. A crypto vault “cold storage” solution stands in contrast to a digital asset “hot wallet” based on the vaults primarily off-line storage capacity. Hot wallets are online account storage systems typically provided by digital asset exchanges. The major difference between hot and cold wallets is that the hot wallet is always accessible due to its reliance on network connectivity and is typically used like a checking account. Cold storage solutions are only connected to a network for purposes of facilitating transactions but are otherwise offline. Storing digital assets in a hot wallet is considered the least secure storage method because the owner may only rely on the security procedures of the exchange, which even under the best of circumstances is susceptible to hacking. The primary purpose of a crypto vault is, therefore, to provide the highest level of storage for digital assets as it mitigates the risk associated with an online wallet and the fear of hackers remotely accessing the access keys.
Cryptovault storage is a callback to the custody function that banks played in the 19th century but with a modern twist. In the U.S., bank vault custody services arose primarily as a response to the Gold Rush of 1949. Wells Fargo started out as a transportation, storage, and exchange service provider for gold miners. At the time banks relied on small iron safes to custody client assets, which in turn gave failed prospectors opportunity to become bank robbers. Banks responded to the surge in gold deposit robberies by replacing iron safes with built-in vaults. Vaults were designed specifically to deter robbers and withstand natural disasters. Over time as the role of commercial banks developed, storage of assets in vaults became a fixture of custodial services.
Physical Vault Storage
As in the case of the Gold Rush robber, enterprising hackers have found numerous ways to pick the proverbial crypto-locks. Crypto Aware reports that the estimated loss from hacks and scams from 2011-2018 is $2.3 Billion USD. Instead of robbing bank vaults in a continual technological escalation arms race (pick-axes to nitroglycerine to acetylene torches), hackers of crypto wallets and exchanges are launching transaction malleability attacks, DDOS, Phish and extortion attacks. In the case of bank vaults, as robbers became more sophisticated, the vault manufacturers responded in kind (adding heat sensors, motion sensor technology, foot keys and 22-ton vault doors). Cryptovault custodians are attempting to provide the same kind of sophisticated response to the threat posed by hackers by, somewhat ironically, relying on the old-school method of storing valuables in vaults, but with a cryptographic twist.
Vault Storage With a Cryptographic Twist
Cryptovault storage, conceptually, is as simple as the storing of gold in a bank vault. However, modern solutions blend intricate cryptography methods for access key generation with procedures to segregate hardware storage devices, combined with multiple control methods for component distribution and reconstruction, then finished off with escalating physical vault storage.
Foreign regulated companies are already offering “deep cold storage” solutions that for digital assets right alongside a client’s physical gold deposits. Others are using a blend of front-end encryption, multi-signature authorizations, and military-grade bunkers for storage of digital access keys and assets. Several U.S. startups are currently wading through the process of becoming qualified custodians pursuant to their state and federal licensing procedures. Some of these companies are right on the cusp, including Coinbase and Kingdom Trust.
Whether these companies crypto vault storage solutions meet the standards required of qualified custodians depends to a large extent on how state and federal regulators evaluate their cold-storage procedures and it makes sense that they would take cues from banks regarding physical custodianship.
Cryptovault Storage of Digital Securities
The SEC’s staff letter also poses the question of how investment funds intend to validate ownership of providing settlement services provided by traditional custodial services. Private equity is primed to innovate with the combined technological solutions provided by distributed ledger technology, smart contracts, and crypto vault solutions. One example of an area that is primed for innovation is the securities transaction and settlement process performed by banks, service providers, and fund managers.
Private companies are stuck in the past when it comes to the issuance of ownership records (i.e. physical and e-certificate issuance of privately held stock). In the public securities market, stock certificate issuance has evolved from physical certificate issuance to ownership recordation on a centralized digital registration ledger (Direct Registration System). Direct registration is simply the process of recording the name of the owner on the issuer’s books while the company or its transfer agent holds the security in book-entry form on its ledger. Sound familiar?
Blockchain distributed ledger technology is designed specifically to facilitate recordation and settlement procedures. The next stage of innovation for custodial services should focus on the combined technological strength and possibility provided by the blockchain. Imagine a process where contracting parties digitally represent (“tokenize”) their securities offerings, then execute them in a decentralized, secure, and automated manner via a smart contract, then stored cryptographically in a crypto vault.