Regulator warns CEOs on crypto-assets

The Prudential Regulation Authority’s deputy governor has written to chief executives of banks, insurance companies and investment firms to warn them about their obligations regarding exposure to crypto-assets.

Sam Woods’ ‘Dear CEO’ letter acknowledged that firms may have taken limited exposure to crypto-assets to date, and recognised that the underlying distributed ledger or cryptographic technologies have significant potential benefits to the efficiency and resilience of the financial system over time.

However, he cautioned: “In their short history, crypto-assets have exhibited high price volatility and relative illiquidity. Crypto-assets also raise concerns related to misconduct and market integrity – many appear vulnerable to fraud and manipulation, as well as money-laundering and terrorist financing risks – entering into activity related to crypto-assets may give also rise to reputational risks.”

The risk strategies and risk management systems that the PRA considers most appropriate to cryptoassets include the following:

• First, recognition by firms that crypto-assets represent a new, evolving asset class with risks which should be considered fully by the board and highest levels of executive management. In particular, an individual approved by the PRA to perform an appropriate Senior Management Function should be involved actively in reviewing and signing off on the risk assessment framework for any planned business direct exposure to crypto-assets and/or entities heavily exposed to crypto-assets.

• Second, firms’ remuneration policies and practices should ensure that the incentives provided for engaging in this activity do not encourage excessive risk-taking.

• Third, firms ensuring that their risk management approach is commensurate to the risks of cryptoassets.

The letter continued that given the technical complexity of crypto-assets, firms should ensure that they have access to appropriate, relevant expertise to assess any risks stemming from their exposure to these assets. Firms should also conduct extensive due diligence before taking on any crypto-exposure and maintain appropriate safeguards against all the related risks.

Iqbal V. Gandham, chair of industry association CryptoUK, responded that the majority of firms within the cryptocurrency sector operate to a high standard, replicating existing models of compliance and best practice for financial services firms.

“Nonetheless, the concerns raised by the deputy governor support CryptoUK’s calls for regulation, set at an appropriate level that allows firms operating within the sector to grow and flourish,” he said. “Currently, the risks from cryptocurrencies largely stem from low levels of consumer knowledge and a lack of an appropriate regulatory framework surrounding them.”

    Share Story:

Recent Stories


Creating value together: Strategic partnerships in the age of GCCs
As Global Capability Centres reshape the financial services landscape, one question stands out: how do leading banks balance in-house innovation with strategic partnerships to drive real transformation?

Data trust in the AI era: Building customer confidence through responsible banking
In the second episode of FStech’s three-part video podcast series sponsored by HCLTech, Sudip Lahiri, Executive Vice President & Head of Financial Services for Europe & UKI at HCLTech examines the critical relationship between data trust, transparency, and responsible AI implementation in financial services.

Banking's GenAI evolution: Beyond the hype, building the future
In the first episode of a three-part video podcast series sponsored by HCLTech, Sudip Lahiri, Executive Vice President & Head of Financial Services for Europe & UKI at HCLTech explores how financial institutions can navigate the transformative potential of Generative AI while building lasting foundations for innovation.

Beyond compliance: Building unshakeable operational resilience in financial services
In today's rapidly evolving financial landscape, operational resilience has become a critical focus for institutions worldwide. As regulatory requirements grow more complex and cyber threats, particularly ransomware, become increasingly sophisticated, financial services providers must adapt and strengthen their defences. The intersection of compliance, technology, and security presents both challenges and opportunities.