Understanding Institutional-Grade Crypto Custody

[Music] i am uh delighted to be your moderator for the next hour and 15 minutes we're going to start right off with our esteemed panelists let's start with uh raimondo castilla from prosegur do you want to introduce yourself and just explain a little bit about what you're doing uh within the crypto space thank you very much sandra for inviting me to this fantastic event it's a real pleasure for me to be here and sharing this panel with this great colleagues my name is raymundo castilla i'm ceo of procedure crypto the brand new digital assets cost the service of the procedural group prosecutor for those that do not know it is a global leader in the security industry and one of the most trusted partners of leading financial institutions for gas management and costly services we have a presence in 26 countries five continents we hold around 400 billion under management billion euros under management we are ranked number two globally and number one in latin have more than 500 words worldwide and we serve more than 200 banks around the world for the last year we have been working on this new service and we think we have built a unique proposal of digital asset custody for the institutional market in terms of security and trust so very happy to share it with you today great well we're going to talk a lot more about that in a minute but i'm going to move over to barrett would you like to introduce yourself and your organization uh yeah absolutely thank you uh sandra um so my name is bearded foos i am the director of the fintech subsidiary of riddle and code the blockchain interface company ridling code is actually active in a variety of industries such as energy mobility materials but of course one of our main activities is in the financial industry where we provide hardware and software stacks to empower our customers which are crypto exchanges crypto funds but also more traditional financial institutions and we help them to manage all aspects of basically the digital asset life cycle from key generation custody regulatory compliance um token management and even tokenization um and and we do that with a product that tries to combine the highest levels of security with the required flexibility uh for for the product um i myself have a background in the financial industry as well i used to work in banking uh for for quite a few years uh which is also where i started working on on this topic already back in 2014 and i've been applying that experience with within riddling code for the past two years now fantastic over to you henrik yes thank you very much sandra uh henrik i'm one of the founders and co-ceo of finoa we are a cryptocustodian based out of berlin germany and yeah probably by now for the institutional market the largest player across europe um our target groups are um an institutional player in the space be it family officers crypto funds uh corporations that that move into crypto with a treasury um so serving serving the likes like deutsche telekom and the subsidiary systems or rocket internet in large venture capital firms like early bird here in germany um we provide two products we provide custody as well as staking services so for new and upcoming protocols that run on proof of stake we provide the access to staking as an additional let's say financial product for for institutional investors that move into that space and broadening our product portfolio uh to further defy use cases um to basically build the gateway for institutional investors to any digital asset financial use case that you find in the ecosystem very happy to be on this panel today thank you very much for the invitation great i appreciate that and we will definitely be touching upon defy and some related topics around staking as well so appreciate that over to you liar hi everyone i'm very honored to be here my name is leo lamesh i'm co-founder and ceo of gk8 uk it is a cyber security company that providing banks and financial institutions such as custodians hedge funds with a self-managed solution to offer the same services that they're offering today but for blockchain-based assets obviously including custody staking tokenization and more i personally earned my stripes in one of the toughest neighborhoods in the world for cyber security in the israeli prime minister's office i was part of an elite team that protected the strategic assets of the country from cyber security attacks we are very much experienced as well as the rest of the co-founders with how to protect from state-level hackers that's willing to invest a large amount of money in order to cause damage of way more than that and this is the same approach as you are bringing into the company uh we started our journey in the crypto space as uh almost three years ago we hacked one of the most secure solutions in the market that claimed to be cold and we proved it wrong and then what we realized is that any solution needs to be connected at some point to the internet in order to initiate transaction and we try to do it differently and we ended up doing exactly that we have today a solution that can make a full process of creating signing and sending production transactions without the need for being connected to the internet at all we have today client that's managing over 1.5 billion dollars in digital assets including uh etoro uh and one of our core partners is over here actually possible with the raimondo that just presented himself so i'm very honored to be here today and thank you fantastic and certainly not least francisco would you like to round us out here thank you sandra hello everyone also very honored to be here in this panel with all of you i am francesco maruto i work in bbba a bank with presence mainly in europe and central and south america but also global presence and i am part of the client solution strategy team which is the team in charge of transforming the bank and moving it to the towards the digital world and within this this space i am leading the blockchain discipline we have been quite active in this space since four or five years ago at the beginning more focused on private and private blockchains but now looking more into public blockchains and crypto and we are now in a friends and family phase with our first trading and custody solution for our bbb ba switzerland customers i'm looking forward to the conversation with all of you fantastic and i'm so glad to have all of you here and just for the audience's benefit we have quite a diverse group not in terms of just the size of the institutions and the various backgrounds but also we've got uh companies hailing from spain the netherlands germany and israel so that's fantastic um i'm going to take us back to uh the 2015-16 um years when i was at a large market infrastructure looking at crypto custody and we actually bought a crypto custody business and frankly um we were just trying to figure out how we reverse engineer to figure out how we can not only store bitcoin as they were originally coded to do but also how would we store other digital assets and i will tell you back then it was very rudimentary and frankly there are a lot of missing parts and so for the first sub-topic of today i'd like to pose the question around where are we what is the state of institutional grade crypto custody how far along have we come since you know kind of to tens and where do we need what are the gaps and what are some of the challenges that we face today and as you as providers uh and and builders uh what are some of the things that you're thinking about so i want to kick off with um just thinking eric could you talk to us is sort of the front line of working with clients um what are some of the things that you are seeing at the current state of institutional cryptocustody especially as we now go into the trillions of value in market cap yeah absolutely and and and you know i i really think and hope that um in the past five years we've we've come a long way and with we i i mean as an industry of course um we've seen interest from institutional players pick up uh in in the past months in the past year um at an increasing pace and and i think uh the growth will still continue uh uh quite a bit we're we're not there yet at the peak i think um and maybe just to start off um and i think also looking around at my my co-panelists here um there's actually two different different routes to go when you're when you're an institutional player and you're looking for something around crypto custody and i think the first route is is more up our alley which is a solution that allows you to um be your own custodian and and set up your own custodial services for your customers maybe or your network and on the other hand you have you know full service custodians like like finoa who have you know the entire service around it and i think a lot of that comes down to the main question of are you controlling your own private keys do you want to have that control as well as do you want to have that responsibility right with control comes responsibility and do you have the capabilities to do so and i think one of the main areas where we where the industry has really improved is in you know taking away the complexity for um you know the companies that just want to focus on on the assets and making money there and don't want to be bothered with or don't have the capacity to be bothered with the large amount of complexity that comes with custody um the security aspects the different protocols um but also the processes around it so um i think there's a lot more sophistication right now in the solutions that are out there combining let's say the the strong security that cold wallets have you know hardware-based solutions um but combining that with the flexibility and and the logic that comes with with software because as a big institution you need both you need to have that security but also a means to um you know keep operating your business the way that you are used to to make sure that your processes can be followed to make sure that you have operational efficiency scalability that you can implement compliance processes and i think this is really where solutions have become more and more sophisticated over time as well as integrations to third-party services whether that is for anti-money laundering financial services um defy services as hendrick was mentioning which are also things that we do at riddle and code because ultimately custody is i think a very important and core part uh when you want to offer services uh in and around crypto um but ultimately it's an ecosystem and i think one of the main challenges is how do you keep connecting your wallets and your custody and your other technical services to that incredibly fast growing ecosystem of very new and very exciting things that are happening um with crypto with dfi with staking etc um so there is actually a lot to keep up with and it makes it challenging but also a very interesting time to be a part of this part of this industry absolutely thanks for painting that landscape uh and and henrik do you want to add anything to what you're seeing from a client standpoint or just in terms of the services that you're expanding out to yeah yeah no um i very much agree with barrett and her analysis first of all how the market is kind of kind of set up we as we know when we started in 2018 um whether the project started in 2017 but then we incorporated in 2018 we also looked at the market and kind of wanted to understand okay what's already there like who could we partner with do we build our own uh solution and then services on top and we decided to do the letter we said okay we want to build everything and to end our service but we also want to provide the service directly to the customers and not just let's say enable other players with our technology to provide their services on top and um we did that as well because we figured that in 2018 the overall market for uh for example financial institutions that were looking into the space was just not really developed just yet so we we wouldn't really find a lot of interest in in a pure technological solution but what we saw at the same time is that a lot of players who in in 2017-18 started to get into the markets which was that's a very innovative crypto crypto investors crypto venture capital funds etc um they were looking for custody solutions but they were looking for the direct service to help them with because they and that goes back a little bit to the point that barry mentioned on private do you want to own your private key yes or no as a private individual i very much understand that you want to do that but if you are a fund manager for example and you have third-party money in your in your fund and your lp is also questioning a little bit how do you do custody i don't think that the answer is always the best to say well i have the private key and i have it here i don't know on a hardware stick or so in the vault um but i actually work with a professionalized player that really focus on on doing that on an institutional base and that kind of led us to to the to the um decision to to build this out as we know and um what we've seen over the last six to ten months is tremendous in terms of uh institutional demand in the inner space uh i mean um obviously the news that come very much from across the pond from the u.s with tesla paypal uh moving into the market be it for treasury or be for actually building out services that has incredibly helped also the conversation here in the european market because uh now everyone understands which two three years ago wasn't so clear uh that this market isn't is an asset class that's not going to go away and the financial services the d5 space it's gonna it's gonna develop um will it look the same today as in three years probably not but pieces of it and parts of it they will stay and and now every institutional investor is kind of exploring and and that obviously helps tremendously in in growing also as a new player in the space and i think some of my my co-speakers here from or more let's say traditional players who now also come into the market are just a perfect proof of this development that we've seen over the last uh last year so uh francisco i think that's directed to you i would like to get your questions on why would bbva be even interested in crypto custody i think i know the answer to that but please you know i mean i was going to to add on top of of what veritan and and and henry was talking about that they took a television so three four years ago at the beginning and i think there was a real difference between the the crypto ecosystem and the traditional institutions and when when i went to speak with a crypto company not only about custody but about any other themes and we saw that the crypto company knew a lot about crypto they were expert in the technology but they don't have that much expertise or experience in working or collaborating with institutions and on our side institutions we knew a lot about institutions but we had no idea about crypto so there was a big difference between the crypto world and institutional world and what we have seen this these years is that there has been a convergence so the crypto ecosystem has started building custody for institutions like the panelists or the companies in the represented here in the panel and we have seen how the traditional institutions have been catching up in crypto and learning how to operate and what can be the potential or the importance of this technology and answering to your question what we see is that this type of technology or these new markets could be very disruptive for the financial financial industry and that can be of interest for our customers so we want to build the capabilities in the bank so that we are able to offer access to our customers to these new markets and provide a secure and very simple access and and moving them away from all the complexities around crypto now this is what we want to provide with our new service and to the audience that's asking questions we will cover regulations so just hold off i'm not going to cover that right here i do want to go to a point that francisco made which is around the gap closing between crypto fintech firms and uh the big incumbents traditional uh players uh and the collaboration that also occurs so uh raimondo and um liar can you talk a bit about how you guys have collaborated and what that looks like and and particularly uh raimondo from your standpoint how does that help you as a large organization you're doing crypto obviously but you do represent a significant player in the security business so could you guys both talk a little bit about that in terms of the collaboration and um also what you think about the current state of the custody business definitely should i fight i'll start right sure um all right so i think that um eventually uh both possible and gk represents something very specific gk is focusing on providing the highest level of protection from cyber security while rai and possible crypto are focusing on combining our cyber security projection along with their super expertise with physical protection and i think that this was the basic of creating this uh um super extremely secure service for uh the clients i think that eventually um banks and custodians have two options as the rest of the finals just mentioned one of them would be having a self-made solution and the other one is using a third party by having a self-made solution eventually you can have larger opportunities and different services that could be offered you can control your destiny you can control your private key and i think that it's something that's very important uh in order to create unique opportunities in order to create unique services that no one else uh can offer um yeah i mean that was the basic of why we started there's a lot more to share but let's try to take it from here great um yes we ask let's say security uh custodian specialist and um i think we we can bring newcomers in the crypto world we we bring two big things i think this is on one side this experience and on their side is leadership right um experience in terms that for more than 40 years we we were understanding and minimizing risk worldwide and adapting solutions to each situations and markets [Music] as as as we are trying to do also for in the crypto world and in this sense we have intensively trying to understand where are all the risks in the crypto d in the custody chain and um concluding that there are plenty of risks but there are two main categories the cyber and the physical right and we want to when we have built we have worked in this this last year to build what we think a unique solution that combines both things physical and cyber security risks um in what we um what we called our crypto bunker which is a let's say ultra secure offline space where not only the systems are stored but also the people managing the code custody operations are in a safe space right and what we have seen um with with some players that are starting um or that have started offering services is that they are getting aware of the importance of the physical risk and the physical risk of their teams also and the complexity of of doing it properly so i think we we have we have achieved a very interesting solution great and uh the point about security especially physical and cyber security we are going to delve much deeper into that but i do have a question from the audience which i do want to post to you guys um and then we'll move on but um let me see here it's it's actually uh directed to henrik and to raimondo but i think those all are relevant to answer are you planning on offering services for um end users i think retail consumer or is the custody plans services remain b2b yeah maybe i can start and go ahead um so yeah personally with finoa we are targeting what we call professional investors so yes we do have high net worth individuals as well um that decide they want to have an institutional great solution uh because they just say the uh the market for for b2c solutions um that is maybe not for the for the for the volume of assets that they want to want to uh store in crypto it's not the right uh service so they they do consult us as well and work with our platform um in general we tend to focus very much on the institutional space um just because that's where we see uh the majority of growth coming from also expectedly over the next uh let's say five to ten years in the market um and i personally think just from my personal experience i think there's a a lot of good uh providers already in the b2c space that you can very much work with i mean um i mean we all know i think tomorrow is the the ipo of coinbase uh scheduled um and one of the if you only are the market cap that is expected to to realize one of the largest banks in the world very much b2c focused uh now they have a b2b offering as well um and those are fantastic players right and and that's for us we will just have to define if at one point we want to bring our services and to be in the b2sp b2c aspect but for now we are very much focused on b2b our work is we are also focused on the institutional companies um but through our platform we provide also technology as b2b to see operations for for our clients so some our of our b2c clients will um will show that the call custody part is um is um let's say supported by by us so we also we also enter in b2b to c models fantastic uh barrett do you have any final words yeah exactly i i i want to actually give a similar answer to to run mundo and this is also what we see a lot so of course we provide um our solution as a technology platform is enabling um other custodians who might have institutional clients but of course also retail clients so i see that you know there's an equal interest you know among our customers um whether they are servicing institutional clients or retail clients to have that core solution custody solution behind it that offers that security um of course let's say the end processes might be slightly different um you know for a retail customer versus an institutional investor which makes sense it might be also slightly different regulation which we'll talk about later a bit as well um but our solution is being implemented by custodians who who serve both different markets so and and and it should also uh be the case anyone's cryptos should be as safe as as anyone else's right fantastic actually um as part of our solution i mean we just mentioned the cold part of our solution but we providing fully end-to-end solution that combining also the cold wall part along with multi-party computation technology so our clients can use it in order to provide services for both institutional and retail clients i think there are some different requirements eventually between the ones that looking to offer service for institutions compared to the ones that want to offer service for retail clients when it comes to the institutions there are very specific requirements that um should be in place in order to meet uh the compliance and control requirements uh such as anteman laundry and kyc insurance and so on i know that we'll get into that in detail later on while on the little side of thing there should be a technology that on the one will be secure enough but on the other end can be used in order to make a lot of transactions per second and this is where our solution as an example on the multipath the computation side can take place as in our case it can make seven thousand and five language transactions per second well learn you've done a great job of leading us right into the next sub topic which is really around security as this industry grows the security point both physical and cyber is going to be top of mind along with the compliance and regulation questions that we're getting and by the way guys this audience is very focused on regulation and uh and uh compliance so you're going to get a lot of questions and once we move on to that topic uh liar unpack for us and you know a lot of people here are not security people unpack for us what are the most challenging vulnerabilities that you see uh for cold and hot wallet solutions um how are hackers potentially you know exploiting these vulnerabilities can you just explain it to the average person and sort of what some of the issues are definitely um so first of all it's important to understand that there is a difference between compromising bank or or custody that holding traditional assets compared to the ones that holding digital assets in order to compromise the bank you need the uh um tanks and and soldiers or uh like physical power in order to get uh into it uh but when it comes to uh blockchain based assets it's different uh it should be understood that blockchain is immutable protocol it means that once hacker are taking control on the local environment of the bank he can make a transaction on his bf and steal his money and then there is no way back and that's why it's super sensitive to avoid such kind of hacking events because there is no way back and even on top of that it's easier for hackers to lose its tracks over blockchain and that's why hackers are very much incentivized if we see the past years in uh 2018 it was one billion dollar that was stolen among financial institutions that offered the crypto services mainly crypto exchanges in 2019 it was 4.6 and this problem is predicted to be even worse as hackers are becoming more incentivized because the market is aggressively going now in the cyber security aspect there are two main solutions one of them is auth wallets and the second one is called wallets auto wallets means that the private key which is the signa the phrase to use in order to make a signature on a transaction uh is stored in online connected device if it's stored in online connected device it's something that's easier to hack but even the most sophisticated solution uh multi-signature or multi-party computations are not efficient they're not sufficient because eventually what hacker need to do in this case is instead of compromising one internet connected computer to compromise typically two or three different internet connected computers now based on our experience at least it's safe to assume that one million dollar would be enough in average for hacker to invest in order to compromise one internet connected computer so if all you need to do is to invest two or three millions to compromise two or three different computers it would definitely do it the roi would be positive for this hacker now on the other end there are cold solutions and we claim that the existing code solutions are not really cold because blockchain is interactive protocol that requires bidirectional connectivity there is some points where you need to take a mandatory data into the transaction structure before you can make the signature in order to get this data you need to use some kind of bidirectional connectivity so there are some solutions that using uh micro usb cables there are some others uh that hsn base that connected with the lan cable to internet connected computers or others that using some kind of stun drives or qr code cameras and so on each of them takes uh low inputs from the public internet directly to different other that's supposed to be aircraft but the instant when you take something that was connected to the internet to another computer that's supposed to be aircraft is not aircraft anymore and that's why we claim that none of these caused wallets are really cold now this is where our focus is we are tackling this men in the middle attack as uh our innovation is very much in the cryptography layer that allowing us to make the whole process of creating signing and sending the transaction without the need for receiving any input from the outside that's how we change the roi for hackers because it doesn't matter if even if we would have vulnerabilities in the solution no hackers would be able to exploit them because there is no way in now when you take this kind of solution that never connected to the internet to manage the majority of the assets along with the additional layer that manage small amount of assets that's based on multi-party computation you change the equation for hackers because hackers will not invest a large amount of money to compromise mpc and then earn small amount of money while the majority is in the cold vault that cannot be hacked so this is how gk8 is tackling this issue um yeah great thank you uh roman do you want to add anything uh on to what lior has said um yes dk has like a statement that says you can hack what you can reach and this is a statement that we follow it also in our solution we we were inspired very much for for this statement and also in the physical part what we are trying is that um our space where not only the system are stored but also the people are working on manual operations because because uh let's say code operations has to be part part of them has to be manually so people working on them not not on you know online on on the blockchain or automatic optimized um so our solution is based on that principle that says um let's say that no and unreachable and rich and let's say an a reachable space where not only the the system is unhuggable but also the space where where the systems and the people are working are unreachable so this is our what we call our crypto bunker and this this solution that seems to be is really the safest place i think where people would like to have their their crypto assets and this system um may sound to be less let's stay slow and hard to handle but what what we have designed is a dynamic process behind to manage these assets supported by an easy and safe uh communication systems for our for our customers that can be used then as a web platform and asset management for asset management or as an end user up for asset anchors so um yes this is this is the solution that we together with gp8 which is for us the securest technology that we know have built together thank you for that francisco if i may ask banks spend lots of money on security just across the board anyway but when you were thinking and designing your custody solution were there any additional thoughts that you had related to or considerations you had related to security or did you maintain the same sort of high level of security that all banks normally have anyway in this space uh we needed to have an extra an extra effort so so we have the standard that we have for the bank which is i understand that quite good because we are not stolen or hacked normally and but as it we were dealing with new assets new technology uh as the as the rest of the panelists have spoken it's it's a very fast-paced technology that is constantly changing we didn't have the complete expertise at that time of all the teams so we need to to to to do one special effort in this space and and we decided to partner with a third party with a custody provider such as the ones in the panel in this case we chose metaco which is well known in the industry and also had provided custody to financial institutions and and was based in switzerland was was something good for our our our new solution as we were building it in switzerland so so we decided to partner instead of building it in-house for the complexity and also for for getting the best bet the best practice practices into in-house and also in this space we decided to to partner with consultancy firms legal films and other providers in the space in switzerland which had this which had the expertise the best processes in order to bring them also into the solution and we have also been working in in several security audits so the whole process end-to-end uh has been audited several times all the code of not only of the costly solution but also of the transactional part for that operational part of the solution has been audited in security and a new mechanisms have been introduced into into the into the banking app in order to operate with with crypto to have extra security layer so so so to answer your question and we have done a special effort to to make it a more robust solution to custody they keep assets thanks for that um i think we could talk a lot more about this topic but i want to end with barrett and henrik before we move on to our next topic any other views that you have uh related to the security aspect of um you know the ever ever impending threat of cyber uh hackers and uh and also do you have any views on whether the current cyber security models are need to be re you know thought a lot of people are saying it's broken we've got honey pots of data all over the place and it's data becomes value why do we still have these models so any views that you may have from your perspective is welcome please go ahead yeah absolutely and and i think you know i i i really agree um of course with with what the first two gentlemen uh were saying about the importance of physical security um um supported by uh by hardware um at the same time i think there's several levels um at which you can have say security concepts um because there's also always funds that need to be readily available um and whether that is for you know automatic uh trading or for you know what whatever you you can come up with where you need really those assets to be available at at an instant um and this is why we we try to make also that combination between cold security or cold water like security which is heavily hardware based um and i think we we try to do that in two different ways first centrally uh right um with our with our platform with our wallets and we support that then with let's say decentralized hardware as well uh which are literally hardware devices that are necessary um you know for for signing transactions and and here you can literally split uh entire in the type of device but also geographically and and even socially completely different people a piece of your security um because you know not all of the threads of course are are cyber based threats and there's also things like social engineering uh plain human error etc um so you know i think part of security is also um being able to have processes in place to prevent these type of attacks from happening um so you know coming back to multi-party computation being able to set up a variety of multi-signature schemes based on you know thresholds location uh maybe even uh 24-hour volumes or you know anything that you that you can think of i think this type of flexibility and support from a product can protect against a lot of other um security issues as well um and um i think you know to the to the other extent uh what we've seen in the past and i think we still see it quite a bit today of course is that the more assets you put in a single wallet the more attractive that wallet obviously is for tech so i think also more decentralized architectures um you know of the wallets themselves um are you know a piece of the puzzle in in uh you know protecting assets from from from hackers um obviously that means that you have to have a solution that is able to manage um a large quantity of wallets but still in a in an easy and uh let's say error-proof way are you also good buried by the way may i jump in quickly um the way that we are tackling this issue is uh managing the majority of the assets in the cold vault that is not connected to the internet differently in a way that is never receiving the input while the second part is based on multi-party computation which is the keyless technology means that the private key is not by itself in any single place together and the way that we are making the risk-based approach is that small percent is managing the mpc like three percent is configurable while the rest is in the cold vault and the system can make automatic reconciliation automatically balancing it means that when you use the mpc for high frequency transaction and you reach a specific threshold that the bank decide that according to each different supports it's too much there is automatically balancing back to the cold vault obviously without compromising the security yeah and exactly and these levels obviously should be set by the institution themselves everyone has different risk appetites of course um so so in our case you know these thresholds are completely configurable and i think that's also what you said leo you know enabling different types of businesses with different types of risk profiles but taking into account that you need to layer um your your processes and and your security as well i thank you guys for answering some of the questions that came in through the chat already about the flexibility of being able to access your assets when you're trading especially if you're day trading it's quite um difficult if it's just sitting out there and you can't access it very quickly henrik any final thoughts from you about um you know how you guys approach security i would imagine it's fairly similar but any final thoughts before we move on to regulation and compliance yeah i mean most of the topics have been touched by my co-speakers but i mean what's very true is that you have different let's say requirements and needs of the users in in the market right i mean when we look back um how actually custody started it we went from from a very hot market whole wallet market into a complete cold wallet market uh we had companies like zappo which were very successful for for a while and then they got required by by by um i think was bitco and um and and they basically did code storage in in swiss voids uh in the in the in the apps right so it had a lot of physical security aspects but then uh again the question came okay but now if i wanna have liquidity what do i do so i think what we learned here as well is this mix of um of hot and cold combinations sometimes people like to call it warm uh some something in the middle that that combines the two um is the key and they're not for everyone liquidity is important you know for a lot of people they literally just as a as physical gold they like to put it into a into a into a vault and don't touch it for for 10 years typical in the market and for others they want to rebalance rather quickly and then i think the service portfolio what we will see in the market as well i think we will see specialists for each of the different customer types but then we will also see within the providers we will see the the different layers that that you have different let's say wallet layers different accessibility layers multi-signature we've seen that a lot also in this talk already which plays a role how to access the assets and especially how do you also identify that the user who wants to access the asset is actually intending to access the asset i mean that's one of the biggest uh um problems that the market is solving as well is like that we are actually sure that this is really the intention because it's only as valuable even if you have the perfect cold wallet uh solution if that user authentication somehow broke in on the way there then that doesn't help either right because we really we only want to execute transactions that the user is actually willing to do and intending to do and i think um we could spend probably another hour on this but i think we from the questions that i see we have a lot more to talk about yeah yeah we could spend another hour on this um i want to address the audience related to quantum computing it comes up a lot uh we actually collaborated with a group looking at cyber security and there are a couple reports on the guc council's website so please take a look at the papers on quantum resistant or quantum safe block chains and what cyber security firms are doing around quantum computing and encryption so um we won't cover that here but i just wanted to say there are resources and reports on the topic i'm sure you guys have also um given thought to that as well but we are going to move on to regulation and custody because that is a lot of the questions that are coming up today um francisco let's start with you and talk about your custody solution it is based in switzerland uh could you give us a little bit of the backstory on why you chose that jurisdiction and obviously you're a highly regulated entity so what were some of the considerations you had to really think about as a bank offering this kind of service so the in first place as we are highly regulated institutions we had to to to find a place where regulation was was as at least covering the crypto space and the crypto custody so we started looking in the countries that we had presence in our footprint looking at will which one would be the best place to start to start offering crypto to our customers because we wanted to be there we wanted to to start this business and to give access to these new markets to our customers not only looking in a cryptocurrency but looking forward into the tokenization of bonds securities and other assets and that's where we think the future might be and where we want to be so we looked at the different places and we realized that in switzerland the different cantona governments were pushing forward blockchain policies or at least they were crypto friendly as they said in the date and and um it's also interesting that in in switzerland you know they have this decentralized political system with all the cantons so it's it was also the perfect place to start exploring and working with blockchain we went to switzerland we visited a sag the crypto valley and we realized that it was not only a crypto ecosystem it was a more general ecosystem where different types of companies institutions and public and private institutions were getting involved in the crypto space in the blockchain space and we saw that there was already not only the the it capabilities around custody and trading and but also all the the accessory services that you need for building these type of services we saw that we had legal firms that had already built a banking and standard crypto services now in switzerland we saw that the consultancy films there really had executed projects and they not only had the the you know the theory or the or the the authority theoretical knowledge but also the expertise and uh by having touched crypto in the past and so so we decided that it was the perfect the perfect place to start we also had a a good bank with enough resources to to achieve this type of project and and also it was the target customers that we were looking for we saw that there was a lot of interest from the private banking and and family office space around in crypto a small percentage of the portfolio in crypto they were interested in in the starting exploring these high yield markets and so so in the end regulatory wise customer segment-wise and capabilities needed to start there we had everything and this is why we decided to start in switzerland and regarding the special considerations that we had to make apart from the i.t and all the complexity that we have been speaking about cyber security etc etc and building the infrastructure and the service a very relevant if not the most important part was building the control framework so i started building all the processes around this service all the first line of defense the second line of defense the third line of defense all it getting them in line organizing how all this was going to be controlled as it was a new service for all the bank not only for bbs switzerland how so we had to make a huge effort of awareness and training not only for the previous switzerland employees but also for the holding employees so that everyone in the different lines of defense were comfortable with the service that we were building and were willing to move forward and in this effort we also had to go through different approval processes in the bank you can imagine there were no there were not few of them there were a lot different approval processes that we have to go through and in all these processes we have to do the same awareness and training effort you know so that everyone could approve and could know what what we were proposing so it has been a very interesting journey and i think that we have been able to build a very robust and and and complete solution for customers in switzerland fulfilling all the regulation that in switzerland is more advanced than in other geographies and they also the supervisors and the public institutions involved in in the financial system they know they know a lot about crypto they understand it very well so so it was quite easy to work there and to build the service there absolutely um i think your point about the challenges of in a large institution doing something so significant and new like that on top of also um finding the right ecosystem to be able to build is a very important point and um i want to really uh you know pose the question now to the rest of the group around uh you have regulation and you are you know you do need to uphold certain compliance and regulatory regime mika micah however you want to say it it is coming down the pipe for europe uh henrik you are regulated in germany can you talk a little bit initially about your current state and then how you see uh the regulation increased regulation content coming down the pipe yeah absolutely um i might have to oppose front a little bit uh on on the that switzerland is the most advanced i think that germany actually last year in 2020 very much progressively introduced crypto assets as financial instruments in the german banking act so very much i made henry just to apologize i was thinking two or three years ago when we started thinking about studying the brain now i understand that germany is moving forward faster in europe than anyone else and i agree with a good point i i love the healthy uh bit of uh banter competition it's good uh it's a good thing to hear so hey everybody yes yeah so uh actually in fact finora started in switzerland because we had the same opinion back in the day and then we moved into germany because we saw the regulation just moves a bit faster and what they did they introduced financial crypto assets as financial instruments in the german banking act which is the very traditional regulation for for financial institutions for any bank in germany same requirements applied for crypto players uh which is any crypto custody player any crypto exchange uh they have to follow the rules of the german banking act plus the additional rules that were introduced because of the differences that crypto assets bring bring to the market and they keep on reiterating of course because i mean this is also new for a regulator to to suddenly have a completely new technology stack a completely kind of asset uh within their regulatory regime but now they keep on innovating as as we go um when they introduced that in 2020 it was obviously for a lot of players it was quite a shock because it came very quickly within a few quarters they just introduced this and put it in place and then you had to follow up with your compliance organization you had to follow up with your it organization to make sure that you that you comply with it with the local regulation but what it did as well is that it tremendously helped in the in the german and i think also in the in the european context i'm getting to mika in a second that uh traditional players who before very often used also to us very often use the argument yeah it's an unregulated market i don't want to touch it even if i had the perfect partner to work with as long it's unregulated i don't want it um that kind of was that argument disappeared from one day to another at least for the for the german environment because it is regulated players that are here are regulated they have to follow the standards and if they don't they they will disappear right and and that in the institutional conversation helped us tremendously moving forward what we now see with mika um to my point of view it's a bit too narrow in a sense that it focuses very much on stable coins and and cbdc in a sense um and and not so much on the broader crypto asset ecosystem so the agility token be paid um payment token cryptocurrencies um but what it does it's basically it takes um at least from how we look at it it takes a lot of the rather strict regulation that we have seen here in germany it pulls it on a european level and adds obviously the complexity of the of the european landscape as well and we very much support that because i mean obviously being regulated in germany is great but we would love to to operate with the same license across all european borders and right now we can only do that through reverse solicitation so when the customers come to us and they say hey you guys in berlin i want to use your service and great we can do that so it's a freedom of contract but to really approach other markets there's different regimes everywhere in some countries you have to only register for example in france uh in other countries you have to apply for the license as in germany and that just brings complexity that doesn't help us as a provider but also doesn't really help the customer um when they have several offices or several funds across the european uh countries and i think that harmonization is very important to follow through absolutely uh barrett do you have any um thoughts on from your perspective um you know you are obviously looking at regulatory and compliance issues as well as a business um how do you see mika micah um and in your work in europe and your business in europe well actually i would i would even still like to take a little bit of um um of a step back and so of course we we we try to tackle compliance issues uh basically on a daily basis we have customers operating in a variety of jurisdictions across europe and and a matter of fact is that today um there's still quite some differences between these different jurisdictions both in majority of regulation as well as an interpretation of regulation i think the netherlands is an interesting example um there would encourage people to to have a look at um you know how in the netherlands the registration is taking place for crypto service providers there was a very interesting lawsuit happening actually um uh last week there and there was a ruling also from from the court in in favor of the crypto exchange versus the dutch central bank um but it's too much detail to go into right now um but um you know what what we see is that you know on one end we have to provide that flexibility because uh not only are the differences between countries but it's also still very much in in flux new regulation is still coming up mike is an example um of that um and and what we try to do is is again approaches on on different levels right so um at least for me compliance has is is first of all about knowing what's what's happening and what what we're trying to do there is um mostly integrate with third-party services for example on you know chain analytics or a kyc um um having information on counterparties for for transactions where uh a lot of times you have to rely on on parties who specialize uh in in that for the ecosystem and i think the second thing that's important for our customers when it comes to to compliance is um having the ability to take action and and that not being let's say voluntarily but enforce action being taken and this is something that uh you know goes back to what francisco mentioned mentioned about a risk model and processes um but if you then even take those processes and put them into what we call cryptographically secure policies that enforce these processes to be followed and then even log uh these processes because i think that's that's the third layer is um being able to audit what's what's going on uh with with crypto transactions and um we work uh closely together uh both with our customers as well as with auditors and and regulators i think in 2018 um we went through a really extensive process and audit with a customer in switzerland uh where the solution and the setup was also accepted by and financial market authorities there and since then we've gone through many many audits um uh in in different countries to to ensure that our customers are operating their services according to the law and one of the main aspects there of course is also the auditability and transparency there is is not enough you could say i can just you know go into a blog explorer check the transactions but there's actually a lot of other metadata that is relevant for uh auditors to to verify that everything happened in in compliance um and then the last piece of that is actually not just giving access or creating a report for your auditor but being able to prove that what's in that report is actually correct and um again this is where we extended our solution not just with those policies but with an immutable audit ledger that you could even give a regulator access to and i think making that more and more sophisticated and involving auditors and regulators in those processes so that they get more familiar with what can and cannot be done when it comes to crypto and how to interpret that data will help i think the understanding on both sides the service providers and the regulators and and create let's say a future in which um um regulation can can help the the crypto industry and and not um hold it back i think that's absolutely not necessary barrett you make an excellent point and for any of you who are not familiar uh new york state department of financial services for the first time uh put together a tech sprint a couple weeks ago and they invited the crypto community to specifically solve for crypto reporting using blockchain and or any other you know innovative ideas to solve for better reporting and so this is again engaging the crypto community to find problems to solve problems that the regulatory environment has and perhaps in europe they could do similar i'm going to leave you on the regulation compliance side with a wish list or a wish i think henrik would like harmonization or you can add something else if you would like henrik but if each of you could ask the regulators to do x what would that be is it clarity is it harmonization uh is it more innovation hub sandboxes uh please if you have a view what would help your business grow in our case as european player harmonization in europe is will be a very good thing uh we will also bet for being a regulated custody player um and when mika comes we will be there we want to be there we want to have our organization and processes comply and we will start by trying to get the german license to so that when it comes to mika that it we get it rapidly right so this is our plans yeah i would yeah sorry good i had leah please um so on the other side of partners with the institution that need to be comply uh with these requirements uh eventually i think that if the regulators would be uh opened for being education uh but such providers that are existing in the market for a long time they will be able to move a faster and more sophisticated decisions we find ourselves in the past years in a lot of conversations with different countries either in asia in europe or in the us in order to educate them mainly on the security side and the usability on top of that um so i think that each of the countries would be if each of the countries would be more open for these ongoing discussions uh and maybe even put a timeline to collect all of this data from the players in the market and then make a decision that's uh for sure would be something that would accelerate the market i would say that on other on our side by the way in addition to providing the technology stack we understand that there are multiple of partnerships that should be in place so the institutions will be able to comply with these requirements uh so for example uh the insurance is something that's very important for these institutions that we are working with or in discussions with um we spend a lot of time and efforts with our partners in uh london uh for mayon in order to create uh the insurance in the market of 500 million dollars per bank that's using our solution to manage its digital assets by himself uh we combine it with a unique attestation crypto service that we have with ernest and young uh along with partnership with uh analysis for anti-man laundering so this combination along with the technology by itself that comply with the requirements of either the occ or fema in switzerland or baffin in germany can make the full picture work and this is where our intention is excellent um you you actually said the magic word which i wanted to move to next which was insurance people don't talk about it enough it's actually a requirement for many institutions it's a problem in the market um full disclosure i work with the startup looking at crypto insurance right now and the market is um niche at best because it's specialized knowledge um it's slow the incumbents in terms of their innovation pace and there is growing demand on the crypto side so i would love to post to you all insurance for crypto how much of a problem is it um do you think it is being solved and would love to get your views around crypto insurance or insurance on digital assets in crypto by mundo or um francisco yes um we were able also to offer uh to agree with an insurance company first of insurance company to offer insurance to cover up to one percent of the assets uh holding with us um for our customers um but it was a difficult task um and i think it has to evolve in all terms and i think it will evolve accordingly to the regulation because as regulation also touch responsibilities insurance options has have to be there and it will we evolve accordingly with that yeah i think you mentioned a lot of uh points i think difficult is a nice uh description i mean it's it's an it's a very niche market in a sense i mean you already heard today how many different like kind of approaches to crypto custody are are available and then you think about traditional insurance companies i mean in theory you can ensure everything but it comes at a price of course right and um if you just you know insurance companies work with statistics and there's no real statistics in a completely new market especially if it's innovating so fast then which statistic do you take based on the premium and the pricing that you want to bring to the to the user so it's um i mean it's very difficult and even the largest players in the market like like coinbase etc for custody um they have just small parts of the assets and the custody uh completely in short you know because it's just if they if they did 100 then then the pricing would quadruple in that they would have to charge through to the customer and then the customer again doesn't really want to pay as much for the service so it's i think it's a mix of what does the customer want again it's the same with the security standards what does the customer really want how important is yield versus pricing and then the regulators i fully agree with there with raymundo i think this is also part where they have to probably set the boundaries a bit because i mean in the traditional financial system that we have in germany we have pretty clear uh investor protection at least in the b2c space you know like if you invest uh 10 000 euro or if you have 10 000 euro with your bank in germany and the bank goes bankrupt whatsoever up to 100k it's protected you know by by no association between the banks and supported by by the regulator and uh that doesn't exist for crypto assets for example in germany yet um in the b2b space it's anyhow a different question but uh even for b2c doesn't exist and i think um there is a lot still to be to be defined which includes the providers as us the insurance companies on the running side but then the regulators as well and at the end the customer also will have to tell us uh what he wants to like pay any premium for for 100 insured solution for example yeah he has to to go to add on top of this so i agree it has to mature the market of the insurance in this space what we see in the current offering is that sometimes you have to be very careful with the terms and conditions of the insurance because it may only cover one part of the custody process or one part of but not everything so you might have the false and confidence that you are secure or insured but it's not real because you are only ensuring a part of the whole process so so yeah it needs to mature and going back very quickly to regulation i would say that not only harmonization at the european level but also a global level so so it's important that we have the same regulation regarding compliance eml custody market abuse et cetera et cetera in the different geographies otherwise we can see a regulatory arbitrage and companies operating from these jurisdictions and not from the others and also it's important to address the gray areas so so mika is not going to cover everything it will address some things but not everything and we will still have some grey areas where you don't know if you can do it or not and and you know for for regulated institutions it's very difficult to operate in these grey spaces maybe for a fintech they are more willing to do it but for us it's complicated so it's important that regulators and they are doing it i mean in europe there are several and questions to the general public to different institutions about if there is a need to change the securities laws if there is a need to adapt the payments loss in order to uh you know to fulfill the whole picture of the crypto of the new world that is being created in around crypto absolutely why not work yeah yes please i very much agree with the enrique and francisco i think the best approach to take is the combination that this the service provider will be open-minded in order to make insurance on specific amounts so it will be reasonable a surprise for them clients and on the other end providers like gk8 should make the artwork with the insurance in order to prove uh the risk assessment and what's different about it in order to make the insurance feel comfortable to offer the services of insurance for such a technology it's very important as francisco mentioned to understand that the terms are very important uh in our case we work very hard in order to position it that it's covering unauthorized transfer from the cold vault uh there are some insurances that not really covering what you need but if you have the right terminology and you're focusing on proving uh that you have the right technology to solve the security issues is something that should work out and the combination of the two should be something something sufficient for them clients great thank you very much guys uh we could talk about insurance as a whole another segment but we've got seven minutes left and we need to cover beyond crypto uh digital assets in general and custody and defy where i'm gonna start with barrett barrett when you think about um securing digital assets beyond the cryptocurrencies or crypto assets um is it any different to you um in its core uh no right so if if we if we tokenize any other asset um it is a token that lives on a blockchain protocol it behaves um exactly like you know any of the other coins um you need a wallet you have your your private keys in order to sign for transactions so you know managing all of that is is i think absolutely the same i think processes let's say there's some additional processes that become relevant um especially around the creation of those assets um with riddling code for example we are also heavily involved in industrial tokenization um even you know automatically tokenizing um you know output of energy from solar panels um so you know having some kind of control at the source is is highly important to prevent you know random tokens being created that have no underlying value there so the process becomes a little bit more complex a little bit longer but ultimately these are assets that represent a certain value um that ideally would also get access to you know the markets and the infrastructure that crypto has so that they can be traded um so that they can be held um so i think for for for the pure custody um a lot of it is is this is the same um and it would be really good if we could see those worlds uh merging um of course we see that happening in the financial industry already where financial assets are being tokenized um but again um it's it's that's largely a different infrastructure there's different marketplaces from from crypto and for industrial tokenization that's it's even a little bit further away so i think uh i didn't express a wish around the regulatory uh topic but my wish for this area would be that these worlds start to merge and that we can build bridges um that you know any asset can be tokenized and digitized and can benefit from the same markets and infrastructure and innovative products and processes around it great thank you convergence absolutely and the question from the audience did allude to nft specifically i put that in the digital asset category so henrik any views uh on you know do you treat nfts or other digital assets differently in terms of custody yeah we do not provide uh nft custody services just yet i mean obviously it's a tremendously interesting market as it's exploding at the moment uh it's still rather b2c driven if you look at the participants and then also the the use cases like nba top shot for example which which is which is going through the roof with depth labs although i mean finoa is providing as the only institutional custodian globally custody for the flow blockchain for example so there we work closely with dapper labs the nft use cases are built on top of flow so logically i'm pretty sure that at one point we will provide a product um for this ecosystem um but still to be seen if this is something where um b2b and institutional players will also move into i mean if it just develops like the traditional uh i call it already traditionally like like bitcoin um um and and maybe the first d5 use cases you had first seen uh retail space attacking it and now you see the institutional space following through um probably with nft is going to be something similar and hence uh totally interesting just for now not our target market yet thank you for that uh liar raimondo front uh francisco do you have any views on securing digital assets i i would say as a customer of the department for the fellow panelists i would say that i would need a custody provider that is it's fast in implementing these new type of assets and being able to add nfts securities bonds or whatever it comes into their solution and even looking one step further if they are able to connect the custody solution and enable us access to maybe d5 protocols and and that would be great in the future if we are able and regulation allows it obviously so francis i think we should talk um in in our case on the solution provider kind of thing our innovation is on the cryptographic layer more specifically on the signature algorithm and in our case this is something that can be used for different kind of assets inx is an example of one of our clients that have security tokens and nft is just as another example of just other token uh that's represented or depends on the project itself but uh probably on one of the popular assets so as long as you have the support for tokens in large or smart contracts in large uh even more specifically on your c20 this is something that can be used uh either for nft or even for d5 um so great well look guys i can't believe this but we've blown through an hour and 15 minutes and you've got daniel here telling us we need to wrap it up so i want to thank each of you it's been incredible to talk with practitioners builders pioneers leaders in the space we have a lot of work to do and frankly we didn't get to all the questions in the q a apologies for that but thank you for joining us and thank you to the panelists for your time and expertise it was really great over to you daniel