EU watchdogs mapped crypto rule gaps and urged a common approach

The European Banking Authority and the European Securities and Markets Authority issued coordinated crypto-asset assessments on January 9, 2019, telling European Union institutions that the bloc’s financial rulebook covered only part of the emerging market and that the gaps warranted an EU-level response.

The documents did not create a cryptocurrency law, ban an asset or classify every token. They were formal advice: the EBA addressed banking, payments and electronic-money law, while ESMA examined securities rules and initial coin offerings. Together, they gave policymakers a map of where existing legislation applied and where consumers, investors and market integrity remained exposed.

One market, two regulatory perimeters

ESMA said a crypto-asset that qualified as a financial instrument under the Markets in Financial Instruments Directive could trigger the full body of relevant EU financial rules. That did not make implementation simple. Requirements written for conventional securities could need interpretation or reconsideration when applied to distributed ledgers, token custody and novel trading arrangements.

Assets that did not qualify as financial instruments presented the opposite problem: much of the financial-services framework did not apply. ESMA recommended, at minimum, anti-money-laundering requirements for all crypto-assets and related activities, together with risk disclosures so purchasers could understand the hazards before committing funds. It also warned that separate national regimes could undermine a level playing field in a cross-border market.

The EBA reached a parallel conclusion within its remit. It found that crypto-asset activity typically did not constitute a regulated service under EU banking, payment-services or electronic-money law. The authority said consumer risks were therefore not addressed consistently at EU level and identified money laundering as an additional concern.

Advice, not immediate legislation

The EBA asked the European Commission to conduct a comprehensive cost-benefit analysis before deciding what EU action, if any, was required. It also advised the Commission to consider the Financial Action Task Force’s October 2018 recommendations on virtual-asset activity and to promote consistency in crypto-asset accounting. For 2019, the EBA planned additional monitoring of regulated institutions’ crypto activity and consumer-facing disclosures.

ESMA similarly placed the next decision with the Commission, Council and Parliament. Its core distinction was functional rather than promotional: legal rights and the characteristics of a token determined whether securities rules applied. Hybrid features meant there was no single classification answer for every crypto-asset.

This procedural status is important. On January 9, 2019, neither report was binding legislation, an authorization for an exchange or an enforcement order. A recommendation for common rules established the regulators’ diagnosis and policy direction; it did not settle the future scope, legislative text or timetable.

Market context and limits

ESMA’s advice said more than 2,050 crypto-assets were outstanding and estimated their aggregate reported market capitalization at about €110 billion at the end of December 2018, down from more than €700 billion in January 2018. Bitcoin represented just over half of the end-December total, and the five largest assets about 75%.

Those figures were ESMA’s market snapshot, based on reported capitalization data available for the stated dates. They were not audited valuations, did not resolve liquidity or exchange-data quality, and did not measure a January 9 price reaction. ESMA also judged the sector modest enough that it did not then raise a financial-stability issue, while identifying fraud, cyberattacks, money laundering and market manipulation as major investor-protection and market-integrity risks.

The development mattered because two EU supervisory authorities had aligned around the same institutional problem: applying existing law where token characteristics brought activity inside the perimeter, and considering proportionate EU-wide safeguards where they did not. What remained uncertain on January 9 was whether lawmakers would act, which activities they would cover and how any framework would reconcile investor protection with the possible benefits of tokenization.