Topic Fintechs Jens Münzer, BaFin
Bitcoins: Supervisory assessment and risks to users
The number of articles circulating in the media on the special aspects of Bitcoins (BTC) has been growing for some time, some of these taking a more careful and sober look at the subject than others. In this article, BaFin would like to provide the wider public with its assessment of BTC it has already communicated to public authorities, consumers and companies on request.
The article also provides an overview of the risks to which users of Bitcoins may be exposed. Although the article refers to BTC, the insights covered by it may also apply to other, similarly structured digital currencies not subject to any centralised form of management such as LiteCoin, PPCoin and their clones.
Nature of Bitcoins
BTC are based on the idea of a non-government substitute currency with a limited money supply. Unlike the fiat money of the central banks and the scriptural money of the commercial banks, whose issue is not subject to any fixed upper limit, new BTC are created using a mathematical process taking place within a computer network. For this purpose, the programs solve complex cryptographic tasks (mining). As these tasks become increasingly complex, growth in the supply of BTC will increasingly slow before eventually reaching the maximum volume of nearly 21 million. At the end of 2013 there were just over 12 million BTC. BTC are divisible, meaning that it is also possible to transfer units smaller than one BTC.
The BTC project was realised as an open-source software program, i.e. one that is accessible to everyone. Any potential users can download programs (clients) to participate in the BTC network. The network works on a peer-to-peer basis, with all users as a rule participating as equals. There is no central instance to perform, verify and manage the transactions or to generate BTC.
Already existing BTC are assigned to what are referred to as addresses. These addresses consist of a randomly generated string of alphanumeric characters. Each user can generate numerous addresses, each of which in turn may be assigned BTC. These addresses are managed by the user in his client in the form of wallet files, which in addition to the addresses also contain the respective private and public key pairs used to authenticate BTC transactions within the network. Users can transfer BTC amongst one another within the network from and to their addresses. The users must communicate the respective target addresses to one another outside the network.
The BTC at the respective addresses and all past transactions of BTC can be publicly viewed in a central file, the block chain. Based on the address, however, it is not recognisable in the network which person actually holds it. Once they have been performed, transactions are generally irreversible. Apart from transferring BTC within the network, it is also possible to transfer wallet files or addresses and keys physically between persons by storing them on data carriers, for instance.
Classification for supervisory purposes
BaFin has qualified BTC with legally binding effect as financial instruments in the form of units of account pursuant to section 1 (11) sentence 1 of the German Banking Act (Kreditwesengesetz – KWG). These are units similar to foreign currencies and not of legal tender. They include value units having the function of private means of payment in barter transactions, as well as any other substitute currency used by virtue of private-law agreements as a means of payment in multilateral settlement accounts. This makes a central issuer obsolete.
BTC are not e-money within the meaning of the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG) because there is no issuer establishing claims against himself by issuing BTC. This is different for digital currencies, which are based on a central agent (e.g. Liberty Reserve). BTC are not legal tender either, and therefore qualify neither as foreign currency nor as foreign banknotes and coins.
BTC are used to settle in personam contracts amongst the users involved. For delivery of BTC, the customer receives the desired consideration in the form of an item of purchase, a service, a currency of legal tender or other commercial goods. Commercial use of BTC may therefore be subject to authorisation pursuant to the KWG. Without such authorisation, such activity may constitute a criminal offence pursuant to section 54 of the KWG.
The mere use of BTC as a substitute currency for cash or scriptural money in currencies of legal tender to participate in the economy through exchange transactions is not an activity subject to authorisation. The provider may have his services paid with BTC without thereby providing banking transactions or financial services. The same holds true for the customer. Likewise, mining BTC per se does not constitute a transaction subject to authorisation since the miner does not issue or place the BTC himself. Neither is the sale of mined or acquired BTC or their purchase generally subject to authorisation.
However, an authorisation requirement may arise from additional circumstances. This applies where it is not only the case that BTC are mined, purchased or sold to participate in an existing market but in addition a special contribution is paid to create or preserve such market. This then qualifies as proprietary trading subject to authorisation pursuant to section 1 (1a) no. 4 of the KWG because of the additional service providing element. This is e.g. the case if persons advertise on the market that they regularly purchase and sell BTC. Another example is mining pools commercially sharing profit from mined and sold BTC in return for computing power provided by the user.
Several authorisation elements
If BTC themselves become the article of trade , several authorisation elements may be satisfied, notably principal broking services pursuant to section 1 (1) sentence 2 no. 4 of the KWG, the multilateral trading system, investment and contract broking, as well as proprietary trading already described above (section 1 (1a) sentence 2 nos. 1 to 4 of the KWG).
Commercial trading in BTC so far has essentially been transacted through Bitcoin platforms (or BTC exchanges as they are frequently also called). Under these terms, the media have lumped together many different business models, but where the question of an authorisation requirement is concerned, a differentiation has to be made in terms of technical implementation and the respective terms of the contracts and transactions.
Principal broking services
Anyone buying and selling BTC for commercial purposes in their own name for the account of third parties engages in principal broking services. These services are subject to an authorisation requirement. Purchase or sale of BTC is effected for the account of a third party if the economic advantages and disadvantages arising from such transaction are carried by the principal. Furthermore, the activity must bear sufficient resemblance to commission business pursuant to the German Commercial Code (Handelsgesetzbuch – HGB), although individual rights and obligations may differ from those of a typical commission transaction. In the case of BTC platforms, the elements of a principal broking service subject to an authorisation requirement are therefore satisfied if:
- the individual participants have power to issue instructions to the platforms up to the time of execution of the order by specifying the quantity and price of the transactions;
- the respective participants do not know their trading partners and the BTC platform acts not as representative of the participants but in its own name;
- the economic advantages and disadvantages of the transactions are carried by the participants who wire cash to platform accounts or transfer BTC to their accounts; and
- the BTC platform is required to render account to the participants on the execution of the transactions and to transfer purchased BTC.
Multilateral trading systems
In the absence of principle broking business with BTC platforms, it is in all likelihood the case that a multilateral trading system is being operated. A multilateral trading system brings together multiple third-party buying and selling interests in financial instruments within the system and in accordance with pre-defined provisions in a way that results in a contract in respect of the financial instruments.
In the case of BTC platforms that means that there is a framework on membership, on BTC trading between the members and on reports of concluded transactions. A trading platform in the technical sense is not required. Multilateral means that the operator brings together only the parties of a potential transaction for BTC. Buying and selling interests also include expressions of interest, orders and quotes. Multiple parties primarily means that it is not an order for broking in the individual case. Under the framework, the interests must be brought together by software or protocols without the parties being able to decide in the individual case whether they wish to enter into a BTC transaction with a certain counterparty. It is irrelevant whether the contract is subsequently executed within the system.
Multilateral trading systems therefore have to be assumed particularly in the case of BTC platforms in which providers allocate BTC and define a price threshold as of which a trade is to be executed, or in which providers secure transactions with a deposit by transferring BTC to the platform and releasing these only when the payment is confirmed by the provider.
Broking and proprietary trading
Offering regionally structured commercial web lists consisting of persons who buy or sell BTC at their place of residence qualifies as investment and contract broking. Providers who act as “currency exchange offices”, exchanging currencies of legal tender directly into BTC, satisfy the elements of proprietary trading. In the past, it was often not described or not described clearly how exactly BTC platforms work, and there were frequently no general terms and conditions either.
The authorisation requirement is generally a legally complex question. Potential providers should therefore obtain an assessment from BaFin of their planned business activity well in advance to clarify whether it is subject to supervision.
Risks to users
BTC hold risks for companies and consumers. Although these risks are not new on the financial market per se, they are being increasingly encountered there given the specific structure of BTC. For example, BTC – like cash – can be lost or stolen. If the user loses addresses or private keys due to computer malfunction or if these are stolen either physically or through cyber-attacks, the BTC, which are still registered in the network, are irrecoverably lost for such user because he no longer has any control over them.
There is also the risk of the costs for transactions rising, which may diminish the acceptance of BTC. Currently, BTC are also being used as an affordable transaction solution for small amounts in global trading since the costs incurred in the form of additional remuneration for miners are usually very low. In return for successfully solving the tasks by which, at the same time, they verify the transactions, they receive new BTC through the system as well as fractions of the transferred BTC. As the number of generated BTC grows, so too does the complexity of the tasks including the computing power required to solve them. After, or already before the maximum number of BTC is reached, the costs of miners in terms of hardware and electricity might prove to be no longer profitable for them without transaction fees. As a result, they might end up charging fees for these transactions similar to those charged by banks. That may result in users turning away from BTC in favour of alternative systems, which in turn may diminish the acceptance of BTC. This might later produce similar effects with the alternative systems.
An additional risk of BTC is fluctuations in their value. The value of the BTC is the result of supply and demand as well as acceptance within the economy. Just like currencies of legal tender, BTC are not covered by any real value. Users having used the BTC system from the beginning have a great number of BTC that they could sell. But it is especially with speculators arriving on the scene, who do not acquire BTC as a means of payment, that there have been significant price fluctuations and bubbles – as with other highly volatile financial instruments. This can entail considerable profits but also losses.
There is also the abstract risk of the BTC system becoming corrupted from within as a result of conflicts between different client types. The BTC system as such is not completely rigid and fixed. Ideally, the majority of users decides on the selection of clients and, through their programming, on adjustments to the system. However, some users are able to exert a disproportionate influence as a result of their outstanding expertise. This could trigger conflicts relating to the permissibility of changes and adjustments.
Responsibility of users
Every potential user must therefore carefully assess the network together with its opportunities and risks. Users have to assume responsibility themselves through their selection of clients and regular participation in the network. The network is not subject to any central supervision or regulation by government authorities. For such decentralised network this is not feasible.
Supervision by service providers
BTC platforms and similar service providers may lose BTC by their own negligence or attacks by hackers. There is no way for the individual customer to prevent these risks. For that reason, the service provider must create the financial and organisational basis to ensure that the customers do not suffer any disadvantages. This holds true particularly where the provider is able to dispose over BTC and monies of customers. But since many service providers in the past have failed to effectively implement these obligations, their customers have suffered losses as a result.
For customers – just as with other financial instruments – there is moreover the general risk of individual providers on the financial market trading fraudulently in BTC to their detriment.
BTC further carry the risk of being abused for money laundering and other illegal activities given the partial anonymity of the transactions. This may result in police investigations using block chain analyses. It may also lead to action being taken by government authorities, including the blocking of accounts and seizures on premises of service providers – measures that may also affect legal users.
Providers who increase the already existing risks for users of BTC by trading in BTC on their behalf are subject to financial supervision by law – just like traders of other financial instruments such as shares, derivatives and foreign currencies. The purpose of supervision is to ensure that the financial and organisational standards in business transactions with customers and financial instruments are observed, that only trustworthy providers operate on the market and – in the interest of customers and Germany as a financial centre – the necessary precautions are taken to prevent money laundering. Banks and financial service providers already holding an authorisation to trade in financial instruments are also permitted to engage in transactions with BTC.