Safeguarding & Earning: How Banks Can Embrace Crypto Custody & Staking

Transcript

we're moving forward to something which is common in banking in classical traditional Banking and same exists in the crypto and blockchain World namely the issue and the solutions of how to save guard as well as earn on your assets at the same time so in the next panel we'll be hearing about how Banks can Embrace crypto custody and staking as new model of safeguarding and earning for this panel I'm honored to welcome on stage Lorenzo barbantini scanni from Colossus asmina kesani from zodia custody Adriano bertini from

Ledger Enterprise Daniel hanf from P2P and the panel will be moderated by Olga Kenova who is the chair of the crypto Valley Association Western Switzerland chapter please put your hands together for amazing panel [Applause] enjoy thank you Benedict so good afternoon everyone and Welcome to our panel discussion dedicated to crypto custody and staking um over the next 30 minutes uh we'll try to discuss how Banks can offer custody and um Stak in Services uh

securely and hopefully profitably so uh let's start we have a fantastic lineup of speakers today leaders from Colossus digital Ledger um zodia custody and p2p.ie quickly yourself and see say a couple of words about your companies okay um so first of all thank you for the invitation my name is Loreno barbantini I'm one of the founders of Colossus Colossus had quite a journey because we started as a validator so we know that business quite well and uh and then one of our institutional customers actually asked us to execute a strategy which meant setting up a custody platform or having access to the custody

platform and using assets which are staked as collateral for a hedging position and so that exposed us to the first topic which was and now how do we get these assets out of custody to staking therefore I say we became custodian by accident and so we are actually also a custodian and we're using multiple custody Solutions and basically what we've done is we've developed a solution that we I will discuss later which connects these two worlds so the world of custodians to the world of U stakers okay thank you adrano ad Bering head of strategy and go to market for Ledger Enterprise how many of you know Ledger yes few of you uh there is also a B2B arm uh so I'm

adding the strategy for the B2B arm of Ledger um there was very interesting talk before two panels before this about uh you know using external solution versus building internally uh we see specialization in the crypto space when it comes to custody of assets and uh we strongly believe that you know following the lead who specialized in the last 10 years is the right way to go and that's why we build larger Enterprise uh we do primarily custody technology that's what we build and uh in the last two years we built an off exchange trading solution uh which is a technological solution which custodian can Implement so we're not ourself providing that as an off exchange we provide the technology and

any custodian can use that and I'm looking forward to talk about that uh during this panel and thanks CVA uh for inviting me and and ledger to speak uh you know the number of people is growing by that year so great job thank you thank you um so uh my name is asina kashani I'm the general Council for zodiac custody um zodiac custody I don't know if if many of you know but it's um majority owned by standard charted Bank um it was the brainchild from standard charted Ventures about seven years ago um and I was lucky to be there at standard charted bank at the time where uh we were asked by a few innovators to create a cryp crypto custodian which

also saw the beginning of um the bank's uh journey into crypto and how it's developed into multiple other facets of the crypto um environment so um so so now we have zodia custody operating in about eight jurisdictions globally thank you thank you Danielle uh good afternoon my name is Daniel an from PTP I'm the product lead specifically for ethereum and um PTP is a staking infrastructure provider um we've got around 10 billion in Stak AUM and uh ethereum accounts for around 3 billion of that so I'll keep it simple um that's it for now yeah thank you um so let's let's get started Daniel

let's start maybe with um with you and uh let's try to set a foundation what is taken in simple words and how Banks actually can can benefit from this and how it can work as a product for banks yeah sure um I mean it's a good starting point so staking is the process of um locking up your crypto assets for chain in order to provide security or help the chain in one form or another and in return you receive rewards so for ethereum Native taking like 3.5% you've got salana at 10% um there's other chains out there but some of the key ones um essentially the way you can consider it is in itself it's a core

Financial product and for any banks that want to down the line release products staking is part and parcel unlike traditional Finance where you can release like lending products or whatever it might be it's part of crypto staking is in its core and I think banks definitely need like a good understanding of how staking works the risks associated with it and then ultimately how they can provide it to clients because as crypto adoption increases and uh you've got more and more I guess crypto assets being helped with banks um people are going to start asking well how can I leverage this or how can I get return on on what I'm holding in traditional Finance you don't

have people holding large sums of liquid cash in Banks and it's not going to be the case with crypto as well right so if you're getting involved in crypto custody or holding crypto assets for your clients then it's it's Paramount that you do get an understanding of staking um just as an example of how it would work is let's say you have $100 million in custody of uh salana and to keep the number simple let's say you get 10% yield on that 100 million so you're getting 10 million in rewards and then the way the bank would generate revenue is they would get a certain percentage of the rewards so let's say it's 10% obviously there' be splits between

custodies the bank the infrastructure provider but let's just say it's 10% that's 1 million in Revenue AR so that's just with a 100 million example hopefully that makes sense and then I think once you get an understanding of how Native staking works at the base level then there's layers to it so you've got liquid staking tokens you've got liquid reaking tokens additional yield you can involve in defi but just to begin I think staking definitely does need to be offered one final point I'll say on that is having just a good understanding of it and being able to offer it is essentially when it comes to new competition it's what's going to keep

existing Banks um trustworthy knowledgeable um and allow clients to have faith in them because if they don't or if they're late to the game and there's competitors already offering yields then that's definitely going to be seen as a negative yeah thank you and that brings us to the question of operational models and Len so how what do you think uh what would um uh what sten as a service models would make the most sense for for banks nowadays well I thank you for the question so I would go back to the to the original model so the first thing is that these assets are held in custody so because banks are using custody Solutions so once you have a custody solution then you need to work

with that custody solution if that custody solution supports the asset that you want to stake otherwise you given uh a number of options on how you can actually complete that transaction because at the end of the day you're going to be creating a transaction and you're going to be signing that transaction inside your custody platform so in terms of models you have staking uh sorry you have custody platforms with already staking integrated in the native UI you know Ledger and you know and many others are of course amongst these Solutions but then of course as the appetite for staking increases and there for of course all the custody Solutions

will support your basic staking tokens and then as you get more spicy if you want as your appetite for more tokens gets uh you know evolves then you're going to be faced with the challenge of creating that transaction that's kind of what we have done so if I go back to what I was saying before so that custodian by accident whatever so now what we do is that we have pivoted and we are in the middle between custody platforms and validators basically enabling those transactions now there's of course a big elephant in the room that might as well take it get rid of it right away which is R signing and so yes we are using R signing R signing is the

purest of ways of doing a transaction the thing is that rigning is also known for the retail public as blind signing but rigning doesn't need to be blind and therefore at least in our model what we do is that we enable those transaction in a clear verifiable way what does that mean I'm going to get a bit technical I'm sure Adriano is definitely you know he knows that I'm I'm a I'm an immigrant in the technical you know in the technical space but you know I I'm also a heavy user and therefore what you do is we do first of all multi-party crafting so more than one user is crafting the transaction when the transaction gets recomposed you want to be sure that it's the same transaction

if it's not the transaction will fail then you have something that we've designed which is a transaction lens that gives you the clear transaction the Json file which basically just say tells you what you're doing you're staking from a to validate to B this is you know the gas fee or whatever else is is involved and so these components so the the multi-party crafting and the transaction lens which gives you a complete view of the transaction coupled with another decoder which is kept offline so that nothing and nobody can tamper with uh you know with with with any libraries will give you the same result so one more thing and I I'll stop on this technical part but the hash is a

one-way function from a transaction you can get to to the hash you cannot get from the hash to the transaction so once this is clear it means that if you have two hashes which are the same you know that you're doing the transaction which you are intended to make so all of this is how we see how staking should be done and therefore what what basically we offer to Banks and and and to custody Partners is the connection to our platform and we enable many to many because as things evolve you know there are certain customers are going to have multiple custody Solutions and they're going to have of course multiple validators if you want to do that you need a middle platform that is going to allow you to do that so that's that's

our approach to this topic okay thank you and let's now maybe zoom out a bit and take look from regulatory perspective and to maybe asmina if you can tell a little bit more on how do different jurisdictions they treat and approach crypto custody and staking and what are the best practices that Banks can actually Implement in order to be compliant thanks alga for that question so that's quite quite a big question so I'll try to simplify it for the audience so what we've seen over the last few years and there's been an acceleration in the last year in in particular in crypto asset regulations coming into

force in most jurisdictions around the world what that means is that we're going from an AML or anti-money laundering registration process to a licensing process and this is something that banks are familiar with and very comfortable with because there'll be licensed in the jurisdictions in which they operate um and so what they need to think about when they go for their license permission for crypto Asset Services whether it be staking custody or anything else um they will have to uh apply for what we call a variation of permissions so they W most likely will not need a brand new license but what that comes with is a presentation to the regulator with um expertise so they need to demonstrate

that they have the right expertise they have to demonstrate that they have the right operational risk Frameworks and controls um and have thought about the cyber security risk and are able to present for any um future risks so that's pretty much where the banks will be and as you've heard a lot of the banks are already getting into this space so that a lot of them um I think it was in the last presentation it was uh clear stream has already got its permission um in in Germany so we're seeing that happening now so that's why you'll see like the jump to for them relatively easy in that respect the second thing that they are looking at are credential regulations and this frankly might be a little bit of a

hindrance or something that will slow them down so under the basil requirements they all have to have um limited uh exposure to crypto assets so in total 2% of their balance sheet but you can imagine banks have huge balance sheets so it's still quite a lot um but it's limited to 2% of their balance sheet so that's something that they're all thinking about although the basil requirements um are delayed somewhat in most jurisdictions I think uh in the UK it's been delayed by a year the us has said they're not ready so there are some things like that to be talking about so um the last thing I'll I'll deal with is staking so when you're looking at staking there's really just three things

to to look at and to think about when you're presenting your um solution to the regulator one is um you know where are the assets are the assets staying in the wallet or are the assets on the smart contract what is the solution and can you explain that to the regulator the second thing which is uh quite important is is the asset uh Collective investment scheme um I when so if it's a collective investment scheme it becomes a security so it becomes a different Dynamic some Regulators have clarified that it's not a collective investment scheme so that's quite important and it helps with the driving of innovation in this field so those are the sort of high

level runaround and I believe there is no Harmony in all regulation across the world no there is not but there's no Harmony in any regulation around the world so it's the same okay thank you and let's now get a bit practical now and see what does full custody look like actually so Loren adran sorry I have a question to you about um about other services that can be included in custody and maybe based on um Ledger example within the Ledger uh platform yeah so uh we have taken a very simple approach right um so asmina was talking about all the regulatory concern

right and I think it comes down to one main concern which is Preservation of assets right and we strongly believe that the biggest risk that we have uh in the market right now is counterparty risk uh that is what is actually locking collateral and is locking uh liquidity from the market we estimate to 20 30% so we think that most of it comes from security concern you look at the last by bit act you look at the last FTX the Buckle and there's a graveyard and I think if you sum it up it's double digit billion the amount of assets that have been lost mismanaged displaced so at the core of our industry

we have digital assets security we stand and as the longest uh firm in the industry for that reason we put Security First so Lorenzo before explained you know his St about row signing and everything else where Ledger stands in terms of anything related to security is the most extreme side we do not want to compromise on security ever okay so we do it with two products primarily we have multiple products but two are the the flagship product one is ledger Enterprise solution which is our custody solution uh and we sell it as a cost technology so we're not ourself a custodian uh we have custodian from 50

million up to billions in assets and we secure that how do we do that multiple features by primarily governance software with authorization on Hardware we are HSM based uh two personal security device our stacks and we'll talk later why this is really relevant and through three uh the um basically the ability of the client to interface uh with the with the HSM through the personal security device so those are the three components that make Ledger Enterprise custody technology then there is the off exchange solution uh the off exchange solution is fairly

recent uh we started the conceptualization of the design two years ago and in the last you know few months uh we deployed production and now we have the initial test trates from as manager with some of the custodians client that we have why are we doing off exchange and for people that don't know off exchange means you are placing assets on a collateral account and an exchange provide you liquidity at the exchange with the guarantee of those assets being pledged in collateral so now you have an additional problem and that's the reason why we build trade link now you need to preserve the collateral assets and there are two elements one we already know which is the the custody of the assets which we

already taken care of but second is the intent of the asset manager and the intent of the exchange those two intents needs to be preserved with the same level of security and we are the only one in the market that provide cryptographic proof of the intent which means that if the custodian will disappear and Ledger will disappear you still have the signing of that collateral uh pledging request and currently we are the only one providing that and we only we're the only one that provide that on a secure screen so that's in a nutshell what we do I know there are a lot of questions but uh you know maybe maybe we'll take

it afterwards yeah thank you and as you also touched the question on security issues and buybit case so let's maybe stay with you and maybe if you can comment on this case and what banks can learn from this yeah so I've been around for a while so I use like old adage and the old adage is don't trust verify that is the simple answer uh so you want to prevent that don't trust verifi and don't trust for people means different thing for us it means don't trust anything that is not a personal security device that is secure and we trust only Ledger right obviously and the reason is that we have not not because we are

complacent or anything just the opposite because we have a dedicated a team called the donjon which is a security specialist team uh that you know does uniquely uh research on um vulnerabilities and once we find vulnerabilities we patch it on our devices uh or software and we do the same for the entire industry so we do that all other devices uh we are the only one that I know in the industry that does that uh at scale um for what pertains the details of of bit or in general uh on on securing the assets and what could be the the the way you can prevent that I think there are again

three ways uh the first one is using a personal security device that is secure uh never ever trust uh any other screens uh meaning the computer screens and I'm sorry to say because there are a lot of solutions out there that do use um cell phones or mobile phone screens I mean it's very difficult to penetrate but it's not impossible right I mean it's not impossible even here but the level of security that we have here is far more advanced than on your mobile phone and unfortunately there are a lot of solutions out there that use mobile phone so this is one like secure screen uh and secure device uh two is clear signing uh and we are the only one again

in the industry that provides that uh clear sign fall on the opposite Spectrum completely of anything else that was discussed and everything else related with signing uh meaning it is the most secure way clear signing means as Loreno explained once you have the ash now we know what that Ash means and we display to you the content of that smart contract we display to you the content of that transaction now we are going a step ahead uh we're actually going to work on simulating transaction so you know what's going to happen once you do that so we we're working toward you know an even more secure way but if you use Ledger device and if you use Clear

signing uh you have a the highest level of security that you can have against those type of hacking uh the third one uh and is uniquely Ledger Enterprise is having governance uh framework and governance rules engine like we do in uh Ledger Enterprise secure by Hardware again so we have an HSM based solution so every authorization well first of all the authorization U are defined again through the HSM so if you are giving rights to create a transaction or approve a transaction needs to be approved on a hardware device which speaks directly with the HSM uh once this is done which is the

administration you have the operation and the operation is the same everything needs to go through the personal security device and the HSM now we do offer API and obviously we do that securely so you can do programmatically similar things but if you want to be the most secure we offer that those are the three ways so effectively using ler Enterprise uh to prevent what happened to buy bit and to prevent uh similar occurrences as we have seen in the last few years thank you as me and from regulatory perspective what are the key takeaways for Banks from bybit case um so I I'll just be very brief here but I mean I think um what's very interesting

in relation to to biit is that um all of our institutional clients have already been sitting around analyzing this because they've been asked by The Regulators how are you dealing with this and is this a risk to you given that a number of our clients are not mass users of crypto they're analyzing the hack risk and and looking at it across their entire Payment Systems so there's learnings in relation to that so I think it's important to know that The Regulators are actually very well educated on this subject and they fully understand in particular because this is a third hack of exactly the same type by the Lazarus Project the bybit hack was the largest hack so um th those that's quite important and I think what The

Regulators would probably be looking at are things that the banks called operational risk controls framework so things like for example it's unlikely that a bank would have a 1.5 billion concentration risk in one spot right that's available for everyone to see on online that that would have been picked up by risks and controls and ensure that would never have happened so I think in fact the banks are probably a lot more prepared than you think and they're probably gearing up to be able to deal with that when um they have to present to The Regulators thank you yeah you want to add something yeah now we're very looking forward you know to regulation that also on the security

front because you know and you know obviously there are multiple discussions around that but if you tackled that from the technology perspective and there was discussion again before in two panels ago before hours um where they were saying should we use like an you know a specialized provider of security or we should build internally right so even if you build internal you should have some standard so we're looking uh you know for collaboration with Regulators to to to build that standard yeah lence I know that Colossus also done some internal research and investigation on bybit case do you have anything to to add uh well I mean I very little to what was already said by my colleagues but uh yeah the it's basically understanding what you're doing because the the real

issue is that if you're not checking and so Adriano said it before so verify don't trust so if you're verifying it means that you know what you're doing and you know what the expected result is if the expected result is anything but what it's supposed to be there is a problem and so the simulation which is something that also we are doing there's there's products that will do it for you of course then it's a product and it's something else that can be tampered with so everything that you touch needs to be in a secure environment and so you know if if you do a simulation and that simulation engine is hacked then you have another problem but regardless you need to have multiple sources the multiple sources need to be secured and you know the operator that that is doing

that transaction needs to have a clear path and needs to know what the result is and that's all about education and that's about explaining to people what you're doing uh you know before you know we never we never said it but we're we're actually talking about either delegator proof of stake or proof of stake which we didn't say but you know in the delegator proof of stake assets are not moving and so for example using The Ledger Enterprise solution you can do very interesting trades where the assets don't leave the bank so the assets stay in the bank and you get leverage you get you know you can do staking you can do products around this but it all requires the operators to know what they're doing and to be you know to to be skilled for for this to

happen because I mean unfortunately reading the the bybit hack I mean it seemed like somebody was kind of not a lot of attention was given there you know to say the least yeah thank you so and to to close this um Loop Danielle um let's go back to Stak in economics so how actually Banks can balance potential taking rewards and the risks associated associated with the managing of crypto assets uh yeah I'll we we're short in time so I won't keep the answer too long but um essentially the first thing the first step is is the banks need to make a decision on um on the fact that they are

going to offer certain product and let's start with staking so that's step one right and then you get into the specifics of what architecture and then what security um sort of implementations you need to make uh and security needs to be at at the core of everything right so what banks are doing today um the products they're releasing the financial instruments they they're releasing to enable their customers um to Access Financial products that they want to access it's the same thing but with a different asset right um and uh yeah you'd want to Banks would still want to create the same financi products the same uh yield opportunities for their clients um but once that decision is

made that you know this is a real thing and we want to move forward with it that's when you get into the specifics of like the complexity of the architecture or how you approach that but I think the decision needs to be made first um and there's some extremely extremely good Solutions existing Solutions on the market from like zodia you've got Ledger and Colossus all of them um help you to help you to ultimately achieve that that full user flow okay okay thank you and I believe We R out of time thank you thank you for to our panelist and thank you to being here enjoy the rest of the event thank you