The Future of Custody: Digital Assets and Its Impact on the Custody Value Chain | EBC10

[Music] thank you very much and uh thank you for the great welcome onto the stage um ladies and gentlemen we're going to quickly dive in as uh as time is pretty short and uh the panelists have got a lot to say so just before we kick off just wanted to uh allow the panelist to give everybody to give a a quick brief introduction Leo should we kick off with you sir yeah sure uh so hi everyone it's a pleasure of being here my name is y lsh I'm co-founder and CEO at gk8 uh my background is cyber security at the level of National Security I used to work for the prime minister's office I were p on of a team that protected the Strategic assess of the country from cyber security attacks um at GK we started our journey over six years ago uh when we hacked one of the most popular cold wallets in the Market within a few days we realized that none of the existing cold wallets are really cold so we come with a new security category for private keid management called imp pable custody we pair it with MPC for automated transactions we are partnering with uh both crypto native companies and traditional financial institutions providing them with our self custody technology to offer uh custody staking tokenization and defi Services uh starting last year we partner with the Galaxy digital which acquired the company but we remain fully independent company um yeah and it's pleasure being here thank you stain yeah thank you for having me stain F ston I'm leading crypto Finance we are part of the DOA berser group and offer crypto services for financial institutions so pure B2B play um we enable them on the custody side on the trading side but also staking we do that through our um Swiss franchise but also out of Frankfurt fully regulated by finma and buffin mo hello uh very glad to be here I'm managing the DLT and digital asset Center for basella uh the Cella group itself is a 140 years old private own banking group in Italy covers large spectrum of activities across retail banking digital payments and many more and as competent Center we are defining the strategy towards digital asset for the years ahead great and pepe hello everyone uh I am Pepe Fernandez every know everybody knows as Pepe I'm the global head of innovation of prur and also chairman of prur crypto uh for those they know they don't know prur is a very huge company with 160,000 employees all over the world more than 28 countries of operation and five vertical security uh physical security cast and Transit uh alarms residential alarms um and either cyber security but uh inside the cash the casin transit we we have several different business more uh leveraged on digital and proc crypto is one of them in proc crypto we offer um a fully set of tools for financial institutions uh for having not only the custody but only the access to the to the financial markets in crypto okay so that's a really interesting panel members here ladies and gentlemen so let's dive in then so moiko can we first start with you why would a traditional 180-year old private Italian Bank be interested in digital assets custody um so first of all to give you a bit more of a context uh basella is the largest private owned bank in Italy and although being uh like the 10 of 11 bank for for sides it has always been very Innovative at the Forefront of some of the most important innovation in financial ecosystem just to name a few one of the First ATM machine in Italy uh um one of the uh first open banking platform in Italy uh one of the leaders in digital payments and so on the approach has always been the same understanding technology to unlock the potential and better serve the clients we are doing the same with DT we believe that part of the future of uh Financial intermediation will be on chain and we want to be ready uh when this happen and and from that perspective you know what future value does bankal see in this where where do you see some of that future value coming from for your for your customers uh it is first of all a very interesting time since we have a a new uh regulation uh regulatory landscape uh so first of all we believe there's a huge potential in early comers that find a graceful way with dealing with this new uh technology and plus we have a raising demand coming from customers that's the basically answer for for each bank so we um identify a target of customer that has been exposed in digital asset in the early days and they are now raising demands for new uh Services they want to basically have the same relationship the same level of trust the same secure they have for classic traditional banking uh products and services also for custody and uh we believe a lot of players will step in and the in the medium term so obviously we have a competitive advantages uh being one of the first Italian player to enter the market brilliant and with that actually I think that's a good segu to to stay uh stain you know your your organization uh has a foot in in both camps the Trad camp and and the digital Camp you know H how do you bridge this uh how do you bridge the Two Worlds and and what what do you think is important there yeah I'm I'm in the market since six years now and if I look back and let's call it the early days when the first financial institutions started with their crypto projects I saw a lot of projects fail right um Banks and you might be an exception and there are exceptional banks that are very Innovative but usually the larger banks are not very Innovative and I mean they're highly regulated they don't move quick so it's it's very hard to implement that and we've seen a lot of projects fail um the the the degree of automization everybody wanted to have 100 % um not looking at it very flexibly so a lot of a lot of projects failed and some banks that were in the space in the early days still don't have an offering others do and I think here um we come into play and uh with doia berser group uh with a lot of sister companies within doia berser group right like 360t that we have with clear stream that we have one of the largest CSD in Europe um we we can put crypto on the to to the traditional rails so why does every Bank need to have their own big crypto team that looks into how we're going to go do custody look into HSM from an Hardware perspective etc etc a bank should focus on on the core competencies right and Outsource what's not their cor competency and we go exactly that route um we offer different angles we offer software and hardware for banks that say no we want to do our own custody just sell us the the the the the the shovel uh but we also do SUB custody and um next year we will look into how we can um bring that to life with ClearStream via the traditional rails right including Swift settlement and so that what the banks actually know out of trefi to really make it simple at the end of the day crypto is an asset class so um and a lot of Institutions struggle from a risk perspective from a from from a compliance perspective from a perception but it's risky what's that going to do with my operational risk how do we mitigate those operational risks is it is it is it ensured if doche B group one of the largest market infrastructure providers offers a solution I think that should be good enough so that that's really interesting right in in terms of talking about how financial institutions can can white label can can leverage on what's already out there to move forward but I'm sure as well that there are some real challenges uh where some firms might want to do it themselves but there are then challenges that digital assets brings which are new to what they might be used to uh for example things like private keys and things like that and Leo I thought we could move on to you now and you know maybe we could talk a little bit about how you would manage the risks and how you know what what does gka do to manage that risk around those type of new risks that emerge right so first I have to uh a little bit disagree because um and it's related to the question um I think that in light of the 2022 events where a lot of crypto companies were a bit Reckless and a lot of people PID the price um financial institutions should control their own destiny and moving out their assets from sub custodians to their own assets right so I think it makes sense for banks to control their own destiny to control their own assets um I think that if they build it properly with a uh needed infrastructure that can meet both um the risk management that's also derived by by private Keys uh that can be managed properly as well as all of the internal procedures to meet different compliance and regulation requirements uh you can you can build something that uh will exist with you for the long term uh um so you know uh it's the technology providers and um our goal eventually is to uh establish trust we believe the trust is the one thing that um any of either crypto native or traditional financial institutions need to have in place um in order to succeed think about it what we need to do is be able to build a market our parents or people that are not um you know know how to speak the Bitcoin language uh can work with crypto um and it's not actually the case right now right we see a lot of eing events taking place on a monthly basis with all of the different uh technology out there uh just in the last month we've seen um werx which is one of the largest Indian exchanges they were hacked for over 300 million dollar while they uh used the multi solution uh we've seen uh DMM which is a large Japanese exchange they were hacked for over $300 million and they used cold wallets um a few years ago we've seen also liquid in Japan they were hacked for over $90 million when they use MPC technology uh so they're clearly as a problem uh with the level of trust that uh institutions are offering right now and I guess that's going to become even more of an issue if we start to tokenize and move digital assets on as well because they're going to be on the same rails as as what we have now but what are your suggestions then Leo about how we build that trust yeah that's right um we're going to uh uh see more and more tokenization projects as the regulation is more easy right now with real with real world assets that are tokenized over blockchain rather than crypto and the infrastructure that needed to work with tokenized asset is just the same as with crypto uh so I completely agree with that and to your question um in order to establish this trust um we offer uh impenetrable technology right I want to explain what I mean by that um in order to do so I want to explain the the philosophy um of how hackers think okay hacking is a business right how much hacker will invest to compromise into an exchange or into a bank it really depends how much you can get it's about Roi and hackers will invest Millions to steal billions and um today there are a few uh security categories there are this o wallets which are constantly connected to the internet and based on experience you need around $1 million of investment to compromise one public Internet connected computer then you have the more advanced solution like multi signature or MPC which means that instead of one private key you have two or three so hackers need to invest a few millions of dollar but still the the ROI will be positive and then you have the cold wallets and the problem is the existing cold wallets are not really cold they all at some point connected to the internet um either if it's with t drive if it's with QR code and Camera there is input from the internet and that's exactly the problem and we come up with a new approach which called impenetrable Vault we never receive input from the internet we have cryptography patent that allowing us to make the whole process of creating signing and sending transactions without ever receiving input from the internet uh so are not exposed to any cyber security Tech vectors now MPC is great but is great for assets movement for the day-to-day transactions but not for the long-term custody and um the right risk based approach is to manage the risk in a way that the majority of the asset should be managed and protected in the impenetrable custody while smaller percentage in the MPC and then you can enjoy both security and the usability that you need according to your business business case now that you know that that points that actually to me the key point there is a lot of the risk management changes in this in the new world that we're in some of it changes some of it is the same P I just wanted to go over to you to get you know give your background of your company as well it's all about security physical security Now moving into digital security you know what's your take on this is this all new yeah let me let me start with a story right um sometime ago I I was talking to a DLT responsible for a big Bank European bank I know him very well uh he told me Pepe we are thinking that we had the enough skills to store the private kid by ourselves and I say to him man this is not the key point this is not about private keys this is not about multi-party competition this is not about multi- signature no it's who is taking the risk who is taking the risk you if you have a custody solution you are taking the risk if you pal is zero tomorrow the best the worst day of your life start tomorrow this is the point we manage more than half trillion dollar every year of risk with a full insurance coverage and we have a full insurance coverage for our our crypto in in our Bankers that's the key for me I've been working for banks for 25 years and some people of the team too uh for something to happen in a bank three things first regulation if it's not regulation the bank is not going to come second risk management risk management who is taking the risk uh this is product is new I don't want to take the risk this should be in the head of the people of the banks and number three and this is important trust who are who who do you trust in I mean I'm talking about not in technology you don't trust in technology is very important but it's like courage in the war you should have no it's trust between people if you take my money every day or you have my assets every day I trust you I trust you I know how you work and we have been working in the good times and in the bad times and this is what is important for financial entities these three times are quite important I couldn't agree more with the Pepe which is a respectful colleague of ours um the trust should be B Bas based not only on the proper technology but on the way that you operate and to operate with the right people um porul build something amazing with the crypto bunker um and we are proud to be partners uh with our um cyber technology and their physical and human being uh level of trust which I really think brings something very strong to the market cool if I may jump on this please I I strongly agree to your point but uh um the trust the banks are leveraging on now uh didn't happen in on day and so you should also give the organization the time to to rebuild their trust on new capabilities and new technologies and this is what exactly what is happening with banks stepping in right now obviously you take your risk but you are also dealing with internal culture risk killing upskill Talent attraction and this is something that takes time requires time and this is what is happening right now I believe I mean if it sounds a little bit like 2015 right and don't get me wrong I mean at the time it was like okay we don't need Banks Bitcoin is the new bank be your own bank right today most retail investors buy Bitcoin and don't hold it in a private wallet they have it somewhere bit panda with banks that offer it etc etc and the like so that's over now everybody's try to convince the bank you need to be the technology owner you have to have everything under control but also here you can pull that to very specific service providers that have the credibility that have the trust and that have over the past 100 years proven that they know how Market infrastructure works right so why as an organization if I don't have a USP there are some right there are some that have a USP that um have a very unique offering in in in the crypto space that are very Innovative but if you're just going to offer Bitcoin and ethereum to your clients I mean don't go through the hassle by setting up everything yourself it's way too expensive you can have it much cheaper without much less risk that wasn't possible 5 years ago but I think today we see the fully regulated providers in the market and um that's the easy way I I I agree that it's it's easier to start with walking with third party to do it for you uh but basically when you walk with third party there are third party risks that associated with providing services to your client by relying on someone else even the way that you want to uh require withdrawal request from the custody um there are a large um uh risks that are added on top of what you do if you control your own uh assets and on top of that as we all know the blockchain market is moving very fast all the time new trends and um Banks although they will start with the most basic services such as custody but um oranization at this point but um as the market continue to grow they should be able to offer additional services and adapt to new Services right away and if they uh own their own infrastructure and uh control their own private keys and manage their assets by themselves they can more quickly build new business Logic on the infrastructure that they already own by licensed technology rather relying on on third parties uh that might not offer the services that they're looking to offer um so there are de advantages and disadvantages um yeah and I think I think actually just stepping back and one of the things I quite like to do is to compare what happened in the traire world versus what is now happening in the world that we are we are in and I know the Ft did some funny articles on this but you know we shouldn't reinvent the wheel either if things are already working let's improve it and let's make it better right and if you look across in that world as well we have as you as as you all have said panel members there are certain institutions that are generalists that provide this service at a general level there are some institutions that are very specific where you have a specific risk where you have a specific type of of uh Financial product or asset or something you know if you want to keep your art safe you wouldn't keep that in the same people that are keeping your car safe for example right so you know I think what we we we are coalescing around or what we're coming around is there there are different options there and that you need to be aware of the risks the different type of risks that arise from these different type of assets to then make sure that you are custody it in the right way that actually works for the client understanding the risk and then moving forward with with with that sort of view uh I think that I'm I'm seeing nods on the on the on the stage which which I'm glad about um but given that view um and I think we are also all of you are in different places in that custody value chain you still as organizations you know have to provide a service and uh somebody needs to recognize that the service has a value and it's worth paying for I think to the point that we've all raised there have been some blowups recently we all know about them I think that is REM Ed people about um counterparty risk I think that has reminded people about uh you get what you pay for uh it's also reminded people that if you get something for free maybe you are the product uh and all of that sort of good things that actually remind people about what's going on with that in mind you know what would you advise what are the takeaways you would advise our audience here if they are looking at digital assets and risks what are the considerations you want them to walk away with can we start with you at the end Pepe you know what would you suggest yeah sure uh first of all I I would like to deep a little bit uh why the financial institutions should come in into this this is very important this 10% of the population that wants to have crypto we are already on bit panda on cracking we are talking to the other 90% to the other 90% Who is the owner of the confidence of the retail Financial customer financial institutions mean Banks if the banks are coming to the crypto world this is going to change for all for all data bbba has only in Spain 14 million customers active customers what if we offer them something crypto starting January the 1st let's say this is is a game changer to your to your question uh when I was very young um in bbba no sorry in other bank uh they call O products o products what are o can I ask what are o out of balance oh out of balance and why are why are they out of balance because we only distribute them we send the broker to buy the asset and then other people custody the product so this is really already invented a long time ago this is different product but a smaller or mediumsized bank has no asset to the NASDAQ at least in Spain uses a broker and this broker has a custodian this is already invented that's why my my speaking to the banks is is nothing different in the concept is different in the technology it's different in the security measures it's different in some things but it's this is something that you already did I want the crypto to be an outof balance product in the bank and they uh start being a distribution Channel just just that and M what is it you would say to your board a few advice uh uh giving our perspective the first of all is uh build cross functional teams so having tech people business people and people for Control Function on board since day one in order to really grasp the the opportunity but also understand how to mitigate risks the second one is bring new talent in and uh maybe open the organization to a change welcoming also people coming from the crypto World why not the third is um perform deep analysis and carefully select the best player in the p in the market for example dealing with custody is not a long run you need technology provider info marketing marketing for provider uh forensic tools and so on and so forth and and you need to carefully select and then you need to understand how to evolve the value added Services together with your organization uh we don't go for a crazy run we go maybe a little uh slower but keeping the level of attention very high and protecting the client yeah protecting the client I think is a critical phase that I'm phrase that I'm hearing from this group right you know it is all about trust it's all about reputation it's all about risk management it's all about protecting that client because we are going to have to win their trust before they give us custody of these digital Assets in the future world right and and stay you know your organization is in the middle of quite a lot of this as well in the trfi world you know what do you guys you know when when your board for example talks to you what are the different angles that they come to you with where they might be a bit different from the trfi side sir yeah I mean we also offer technology right and I think it's twofold that I'm if if we do offer technology then I absolutely agree the the our client the Bank should be on top of crypto they should have a team people who understand the risks but it should also be implemented fully into the risk framework of the financial organization which they have to do anyways no board is going to sign off on it otherwise and then on the other side we have the um sub custodian solution where we say look don't worry about anything we'll we'll do it for you and here of course it's about due diligence but again I mean all banks have sub custodians that's nothing new there is an onboarding process for a sub custodian there are about 625 questions to a new sub custodian you need to fulfill this that you got you have to suck one report suck two reports you have to have the capital the insurance blah blah blah if you take all the boxes good to go right and I mean the apis today are standardized the booking is standardized then you have to think about how do I front that to my end client valid questions but here usually that's the easy part you built a fancy app you integrate it into front- end system so um not much risks involved here but um overall it is managing risks yes because they're fundamentally different than the traditional risks that we know and I'm not talking about the market risk the counterparty risk is the same concept it's really the additional technology risk that I have which traditional assets don't have right I mean my share is at the CSD if everything goes down it's in my name somewhere right so I can get it if my private key is compromised it's gone right and I think that's a really important point right I mean you know we for example even as a firm are now offering sock one sock two services but a lot of the more Crypt native firms hadn't realized that's what they needed to do to be honest to play in this space but that is actually you know part of what firms are financial institutions are much more uh looking for to be honest to be able to provide right and and how do you provide that trust uh but Leo one of the things that you said I want to just sort of come back to you know you you talk about you talked about MPC you talked about some of the different ways you talked about the risk there what other criteria do you think people should look at when they're choosing their Tech provider then sir yeah so um eventually when an institution need to choose the right custody technology provider there are a lot of aspect that you to that they should uh keep in mind um eventually um in continue to uh what our colleagues just said the point is that the institution shouldn't be in a point where they develop technology that they are not familiar with where there are associ associated associated risks right if there are the infrastructure that built off um the layer of the private Keys management the layer of the wallets management the layer of the internal procedures management like the policy engine um it make them be in a position where they can continue to manage their Fiat assets uh the same way to manage digital assets and that's exactly um as Pepe mentioned before a very crucial thing um and that's a very meaningful thing second um this institution since it's a new technology for them they need to work with a team of experts that already um in action working with Organization for years right for example we're in the market since 2018 uh we we've been working with a large number of organization that already managed more than $1 billion with our solution um so they need to work with the team of experts that will support them in building the business case building the internal procedures to make sure that on top of the technology to manage the private keys there are also the procedures to control it properly according to the internal organization uh procedures um in addition to all of that uh there is a peace of mind aspect that could be obtained either by partnership with the insurance uh for example uh we partnered uh with Aon and USI so any of our client can have access to up to $1 billion of insurance on assets on the impenetrable Vault and up to 125 million on assets on the MPC um and also as us being part of a Bly traded company um also provide a lot of peace of mind um we've been acquired last year by Galaxy digital as I mentioned before and I think for an institution to work with a vendor that has earning calls and everything is transparent and there are no any surprises um the reputational uh uh factor is coming into play and it's helped help them a lot to understand that we are here to stay for the long term so then last question as we as we as we start to run out of time for our panel we said the r word regulation at the beginning but what is really interesting to me is actually in our conversation it hasn't Arisen and I think that's actually a good thing because it showed that we were going to everything we talked about is doing the right thing for the customer doing the right outcome for for for the customers which is great but last question for you all panel members if you had an ask if you had one thing that you could click your fingers and change be it regulation or be it uh you know whatever out there laws or anything or Mika or Mika 2 or whatever what would it be if you had the ability to change it should we start this time with you sir um all right interesting question um so one of the things that we've seen as private keid uh technology providers is there is that there are some Regulators that um Force for example crypto exchanges to hold at least uh 95% of their Assets in Cold Storage right so for example in Japan this is the case the problem and it's not only in Japan it's also in Israel by the way is that they don't um Define what a cold wallet is see what I mean so there are a lot of companies a lot of vendors that claim to be called but actually they use some technologies that connected to the internet at some point with the micro USB cable stand Drive Right Kon and cameras so once they do that the call becomes hot so it's really missing the point so if I would be able to do one thing is to include in all of these Regulators uh where they Define a certain amount of asset that should be uh defined in cold wallet the definition will be the impenetrable wallet the one that never received input from the internet that's how you can really ensure that the assets of your clients are really safe and cannot be hacked from cyber attacks brilliant stain well yeah we we didn't mention regulation because it's already so natural that we are regulated Brian it's a prerequisite um and I wouldn't say if I had one wish I would drop regulation to be honest but what I would say is even more clarity on crypto asset topics right I mean MAA how long did it take until M came along and we had in Europe that uncertainty what are we going to do how many clients did we have that said look there is some uncertainty I still wait until a Europe regulation came along right so they should be the regulator should be much more agile and I would wish for a technology neutral regulation that is clear and that is also adaptive to a bit right and um doesn't move that slow because it's not only about crypto we will see so many technology jumps in the future and it will go faster and faster and if the regulator takes for every jump 10 years to think about how they're going to regulate it I mean it will really be cumbersome right so for me it would be like more clarity regulation is fine we can deal with that but more clarity and a little bit fter faster get it done let's talk we're here right so I think it's a bilateral negoti not a negotiation but at least some brainstorming with The Regulators how can we achieve something brilliant thank thank you Mo so the Utopia one no more scams no more fraud to live a more relaxed life yep the real life one um I we see that a proactive approach from regulator can play a pivotal role in being more effective faster and uh this is a good wish I believe that now with merer we have a huge chance to work closer with Regulators uh I it's going to it's going to happen thank you and last but not least Pepe um I I was thinking how many how many regulation process we are involved in a lot uh so my my first my first approach is if I can ask for a wish modify the staff the people of the supervision and regulation uh entities but it's not because not because it's the short term the short term I agree with you that that we in the future when regulation is done what we need is Clarity so my wish is to modify the thinking of the CEOs of the banks to see that putting an incentive something in the people of the business development of the banks of the financial institutions that this year you have to have a product of crypto running in production this should be happening today but it's not happening this slow speed of the financial entities is because the culture of the financial entity doesn't have any incentives for for having crypto today cool well thank you very much we we out of time uh I'm I've got two more things to do one is to thank my brilliant panel panel members for for their contributions today secondly it's to apologize to all the women in the audience this is a all male panel I did point that out to the uh to the uh organizers a month ago they it took too long to change I apologize to all the women in the audience any of you could have been here today any of you could have taken my place I hope that this isn't what we see next year and I hope that we have the organizers next time thinking about that in the future as well thank you everybody and good evening [Applause]