Cryptoassets

KPMG technology risk insights

Introduction
Cryptoassets such as Bitcoin and Ethereum have Adoption and
made their way into the mainstream financial acceptance of
industry and are being sought out by retail
investors as well. cryptoassets have
Over the past two years, we’ve seen public accelerated at an
companies put cryptoassets on their balance incredible pace
sheets, legacy financial institutions offer their leading to a nearly
customers access to crypto-related products, and
retail investors buying them on an exchange. The
adoption and acceptance of cryptoassets have
accelerated at an incredible pace, leading to a nearly
$2.2 tril ion
$2.2 trillion market cap.*
But what exactly are cryptoassets? Broadly defined,
market cap
they are digital units of account in which
cryptography and open-source software are used to
regulate the generation and distribution of units,
which get tracked on a public ledger, known as a
blockchain.

*CoinMarketCap.com, December 12, 2021.

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 2
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
The rise of Bitcoin
The first successful cryptoasset, Bitcoin, was created in 2009 in response to the
2008 global financial crisis. Its primary objective was to solve for the monetary
debasement of fiat currencies (e.g., USD, euros, British pound, etc.), which are
Blockchain
A system in which a record of
government issued and controlled by central banks. Bitcoin is often described as
a new monetary policy. transactions is maintained across
multiple computers (nodes) that
Bitcoin’s solution to the government bailouts and dollar debasement coming out
are linked in a peer-to-peer
of the global financial crisis was to have a fixed supply (21 million) that cannot be
changed by any entity or individual. Given the history and failure of previous network. This enables digital trust
digital currency and cryptoasset projects, Bitcoin was the first to truly solve for and thus removes the need for
the double spend problem, through the use of blockchain technology. Double intermediaries such as banks or
spending involves sending the same digital payment to two different people and, brokers to serve as a trusted third
outside of blockchain-based currencies, relies on trusted intermediaries (e.g., party. Learn more by reading our
banks) to prevent this from happening. companion piece here.
Since Bitcoin’s implementation, thousands of other cryptoassets have come and Learn more about blockchain by reading our
gone. Companies have invested billions of dollars to research new and accompanying article Blockchain and Risks
innovative ways to leverage blockchain technology; however, its primary
application continues to be for the use of cryptoassets.

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 3
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Crypto adoption in the market
Over the past two years, institutional interest in crypto markets has exploded. “As of their 2021 Q3
Billionaire investors such as Paul Tudor Jones, Bill Miller, and Stanley
Drunkenmiller have each disclosed their Bitcoin positions and made public filings, Microstrategy was
comments praising its long-term outlook.1, 2 Companies such as Tesla, holding approximately
Microstrategy, Block (formerly Square), and SpaceX have purchased Bitcoin as a
reserve asset to hold on their balance sheet. As of their 2021 Q3 filings, 114,042 Bitcoin ($2.406
Microstrategy was holding approximately 114,042 Bitcoin ($2.406 billion) and billion) and Tesla was
Tesla was holding approximately $1.83 billion in Bitcoin. Additionally, legacy
financial institutions have reacted to significant demand by their wealth
holding approximately
management clients by rolling out a variety of crypto-related products such as $1.83 billion in Bitcoin. “
shares of the Grayscale Bitcoin Trust, crypto related funds, and the recently
approved Bitcoin futures ETF.
Safe to say, cryptoassets have gone mainstream. To meet this demand, crypto
native companies have grown exponentially. In the first half of 2021, venture
capital funds have poured $17 billion into businesses operating within the crypto 1 Paul Tudor Jones Calls Bitcoin a ‘Great Speculation,’ Says He Has

industry.3 Almost 2% of His Assets In It, CNBC.com, May 11, 2020.

2 Wall Street Legend Bill Miller Reveals ‘Strong’ Bitcoin

This paper will describe some of the basic traits of cryptoassets, the different Recommendation Despite Massive Price Surge, Forbes, November 9,
2020.
participants within the ecosystem, and some of the key risks that crypto 3 Venture Capital Makes a Record $17 Billion Bet on Crypto World,

companies face. We’ll then describe how the KPMG Advisory, Audit, and Tax Bloomberg, June 18, 2021.

practices can help our clients navigate the complex challenges that cryptoassets
present and how to address and mitigate these risks.

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 4
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Types of cryptocurrencies
There are a number of different types of cryptocurrencies, each of which has a different purpose and
use case:
Cryptoassets Utility Tokens SecurityTokens Stablecoins CBDCs

Assets native to Tokens issued on Security tokens Asset-backed Digital currency

Layer 1 public top of public issued through an tokens issued on issued by a central
blockchain blockchains used initial coin offering public and private bank in wholesale or
protocols used to for governance and (ICO) where tokens blockchains that retail models, many
drive network to access features represent represent the of which utilize
incentives, process within middleware ownership interest ownership interest permissioned
transactions, and and decentralized in the underlying in underlying stable blockchain or
maintain security applications security instrument assets like fiat distributed ledger
currency and technology (DLT)
precious metals

Examples: Bitcoin, Examples: Maker, Example:The Example: USD Coin, Example: Digital
Ethereum Uniswap Aspen Digital Paxos Gold Yuan (China) and
SecurityToken Digital Sand Dollar
(Bahamas)

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 5
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Types of cryptocurrencies
Despite the varying use cases described previously, the
primary cryptoassets used today are those native to layer 1
public blockchains such as Bitcoin, Ethereum, and Solana.
These assets are being sought after by both retail and
institutional investors, as they are truly decentralized assets
that are not owned or controlled by any single entity or
central bank. However, even among layer 1 protocols,
cryptoassets Bitcoin and Ethereum both have different use
cases; Bitcoin was developed to be a peer-to-peer electronic
cash system and Ethereum was developed to allow for the
creation of decentralized applications, also referred to as
smart contracts.
Both utility and security tokens are issued on top of layer 1
protocols via smart contracts. By definition, smart contracts
are computer programs stored on a blockchain that automate
the rules and interactions via source code. Since smart
contracts are stored on a blockchain, they inherit a number of
its properties such as immutability and decentralization.
However, many of these tokens have come under scrutiny
from regulators, such as the SEC who have questioned if they
represent unregistered securities.

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 6
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Stablecoins
Stablecoins initially rose in popularity given their ability to be easily
transferred from one exchange to another and used as an on-ramp
to crypto markets given that some exchanges could not initially get
banking access in the early years of trading. Additionally,
stablecoins are issued by private entities and have also come under
significant regulatory scrutiny as they represent money created
outside of the banking system. In November 2021, the President’s
Working Group (PWG) issued their report on the risks of
stablecoins and suggested that issuance should be limited to
“insured depository institutions” (e.g., banks).

Stablecoins have seen significant

growth over the past few years, and
as of the time of this paper, have a
market cap of approximately $140
billion.*
Source:

*CoinMarketCap.com, 4 CoinMarketCap.com
December 12, 2021

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 7
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Participants in the cryptoassets ecosystem
The cryptoasset ecosystem has evolved to offer many of the traditional financial services

Coin
Payments Bitpay Wirex BlockFi Celsius Compound Lending
Payments

Fidelity
Exchanges Kraken Binance Coinbase BitGo Digital Coinbase Custodians
Assets

Wallet Custody
BlockFi BitGo Anchorage Unbound Fireblocks BitGo
providers tech

Cipher Coin Blockchain

DeFi Compound Uniswap AAVE TRM
Trace Metrics analytics

Crypto Core
Galaxy Bitwise Grayscale Marathon R I OT Mining
funds Scientific

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 8
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Cryptoasset risk Given the potentially high value of cryptoassets and their natively
digital nature, crypto businesses and their customers are prime
targets for cybercriminals. Possession of cryptocurrencies is
considerations Securing cryptoassets based on ownership or knowledge of private keys. Since there
are no intermediaries involved with the transfer of cryptoassets,
all transactions are final and cannot be reversed. Properly
There are many challenges facing securing cryptoassets is typically viewed as the biggest risk that
organizations as they companies must address.
institutionalize cryptoassets.
Lessons learned from traditional Cryptoasset companies have been under a considerable amount
business models are still of regulatory scrutiny over the years. The SEC has challenged
applicable, but organizations will whether some cryptoassets represent unregistered securities
need to challenge these based on Compliance with (e.g., Bitcoin lending). Additionally, some states have strict
nuances that crypto presents. regulatory obligations compliance obligations such as those imposed under the New
Companies will need a York Department of Financial Service’s BitLicense. Companies
comprehensive framework and will need to properly inventory all of their regulatory obligations
to help ensure proper compliance and subsequently build out an
crypto-specific capabilities to
appropriate risk management framework.
support this transformation and
prepare for a changed future. A soft fork results from an upgrade to the protocol, but a hard
fork happens when significant changes are made and results in a
single crypto blockchain breaking into two separate chains. Forks
Fork management can have a significant impact on crypto businesses. Companies
and governance will need to decide on fork acceptance and how to continue
running effectively during and after a fork event. How does a
business manage the technological, operational, financial,
accounting, tax, and customer relationship implications of a fork?

© 2021 KPMG LLP, a Delaware limited

© 2021 KPMG liability
LLP, apartnership and a member
Delaware limited firm of the and
liability partnership KPMG global organization
a member of independent
firm of the KPMG member firms
global organization affiliated with
of independent member firms affiliated with 9
KPMG International Limited, KPMG International Limited,
a private English companyalimited
privateby guarantee.
English All rights
company reserved.
limited by guarantee. All rights reserved.
 Crypto owners are identified not by names or account numbers but by cryptographic addresses that can be
created at any time, by anyone, anywhere in the world. This presents a unique challenge to Know-Your-
Customer (KYC) programs. How does a crypto business determine asset provenance and build its KYC
KYC and cryptoasset program to prevent transactions with politically exposed persons (PEPs) and OFAC sanctioned countries?
provenance

Cryptoassets challenge traditional financial reporting boundaries, and there are currently no generally
accepted accounting principles in the United States (U.S. GAAP) specific to cryptocurrencies. The accounting
for these assets is an emerging area, and traditional cryptoassets such as Bitcoin and Ethereum are typically
Accounting and accounted for as indefinite-lived intangible assets. This means that companies carrying these assets on their
financial reporting balance sheet must carry them at cost, subject to an ongoing impairment evaluation. However, these assets
are not written back up once market prices rise.

Information regarding the tax treatment of crypto remains limited. Crypto businesses may face sizable tax
liabilities incurred on the sale or exchange of crypto and bear significant tax accounting burdens with respect
to their holdings. Unlike fiat currencies, selling a cryptoasset or using it for commerce creates a taxable
Tax implications event. What are the key tax implications for a crypto business?

© 2021 KPMG LLP, a Delaware

© 2021limited
KPMG liability
LLP, a partnership
Delaware limited
and a liability
member partnership
firm of theand
KPMG
a member
global organization
firm of the KPMG
of independent
global organization
member of firms
independent
affiliated with
member firms 10
KPMG International
affiliated with
Limited,
KPMG International Limited,
a private English company
a private limited
Englishby company
guarantee.
limited
All rights
by guarantee.
reserved.All rights reserved.
Market features and risk management
As with any asset class, understanding the market features behind crypto is necessary to
mitigate risks
Key considerations for market activity Mitigation solutions

— Changes in market depth and liquidity across assets — Monitor network activity to optimize fees
— Difficulties optimizing for transaction fees can result in price — Identify mempool congestion and mining pool activity
slippage
Public network implications — On-chain events triggering market reactions

— Infrastructure system weaknesses interfering with effective — Counterparty diversification

trade execution and asset withdrawal — Exchange due diligence
— Business continuity inefficiencies increasing likelihood that — Vendor risk assessments
Counterparty risk funds are inaccessible during periods of large market activity
— Segregation of duties during key generation ceremony
— Custody of private keys
— Multisignature (multisig) transaction requirements

— External events triggering market reactions — Adequate staffing to meet global trading needs
— On-chain events — Effective automation of algorithmic trading
— Noise trader risk fueling volatility
Asset class volatility

— 24-7 market hours strain resource requirements to effectively — Adequate resources to meet global trading needs
maximize gains — Currency and jurisdictional due diligence
— Broader country risk to consider depending on regulatory — Regulatory inventory review per jurisdiction
Global nature of crypto climate of individual jurisdictions

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 11
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Custodians and Key considerations for custody and mitigation solutions
cryptoasset Next-gen security — Layered security and operational defenses

platforms have a and resilience — Balance key security and availability

number of custody
models to choose Comprehensive
compliance
— Regulation-compliant processes
— Adaptable systems to react to regulatory changes

from in order to
manage network and Third-party — Proof of reserve reporting

market risks trust — Independent auditor attestation

Value-adding and — Integrate into existing infrastructure

scalable systems — Support participation in network activities

© 2021 KPMG LLP, a Delaware limited

© 2021 KPMG liability
LLP, apartnership and a member
Delaware limited firm of the and
liability partnership KPMG global organization
a member of independent
firm of the KPMG member firms
global organization affiliated with
of independent member firms affiliated with 12
KPMG International Limited, KPMG International Limited,
a private English companyalimited
privateby guarantee.
English All rights
company reserved.
limited by guarantee. All rights reserved.
Custodians and cryptoasset platforms have a number of custody models
to choose from in order to manage network and market risks
Custody Solutions Map

Qualified custodians Crypto exchanges Self-custody

Technology Enablement

Software browser |
Wallet type Hot Warm Cold
mobile | desktop

Storage Software/ hardware

Software Hardware Hardware
mechanism

Network Internet connected Network

Air gapped offline Physical backup
connectivity segmented

Cryptographic
Multisig HSM (Multisig) Multiple HSMs
protection

Commercial crime insurance Specie insurance

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 13
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
How KPMG KPMG offers a broad set of services to help enable our clients to identify, manage, and mitigate
risks posed by the adoption of cryptoassets. Whether it be legacy companies who are routinely
subjected to regulatory compliance activities or start-ups looking to build out their risk management

can help framework, our extensive experience in this space can accelerate your company’s crypto strategy
and help ensure that risk is aligned with business objectives.

Internal Audit and Enterprise Risk

Technology Risk Management Management
SPAC & IPO readiness Risk, Controls, and Readiness and gap assessments
assessments Compliance (GRC) Programs — Key risk and control assessments
— SPAC and IPO readiness assessments
Strategy and Technology Risk
governance Intelligence and automation Audit lifecycle
— Audit planning and execution
Risk-based IT audit (IT Internal Audit) — Risk matrix
— Strategy alignment

Cyber Security Services FS Regulatory and Compliance

Third-party Identity and access Privacy and Filing and registrations
security management data security — BitLicense — Money transmitter license
— OCC charter — Broker-dealer
Threat Key management Smart contract — SPDI
management assessment assessment
Establish AML/BSA Custodial risk Board
Cyber program development and KYC policies assessments reporting
— Strategy — Defense — Response and programs

© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with 14
KPMG International Limited,
a private English company limited by guarantee. All rights reserved.
Contact us
For more information, visit read.kpmg.us/TRM.

Brian Consolvo Ahmed Saleh Nana Amonoo-Neizer

Managing Director Director Director
Technology Risk Management Technology Risk Management Technology Risk Management
T: 804-782-4215 T: 402-637-5014 T: 402-661-5316
E: [email protected] E: [email protected] E: [email protected]

Some or all of the services described herein may not be permissible for KPMG audit clients
and their affiliates or related entities.
kpmg.com/socialmedia

The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely
information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without
appropriate professional advice after a thorough examination of the particular situation.
© 2021 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English
company limited by guarantee. All rights reserved. The KPMG name and logo are trademarks used under license by the independent member firms of the KPMG global organization.