Skip to main content

Cryptocurrency: Risk management overview

Cyber Risk Management

By Ciara Moloney | February 15, 2019

Cryptocurrencies have many risk management concerns. Businesses must evaluate current/new insurance policies for risk mitigation of crypto-related business activity.

Willis Towers Watson has formed IDEA (Insights for Digital Exposure and Assets), an integrated team of global experts in the area of digital assets, known also as cryptocurrency. Combining subject matter experts from cyber and privacy liability, crime & extortion, property, financial institution/trading errors & omissions and directors & officers liability, the IDEA team will advise clients on new and emerging risks and opportunities associated with cryptocurrency and will work to create innovative insurance and risk management solutions. IDEA will also partner with external centers of influence to ensure that we are abreast of relevant developments and consistently delivering cutting-edge solutions for its clients. The team will reside within the Financial & Executive Risks Practice of Willis Towers Watson’s Corporate Risk & Broking Segment.

Cryptocurrencies have carried plenty of risk and risk management concern since the first digital currency, Bitcoin, was introduced to the public. The original perceived exposures might be loosely characterized as speculative risks, not something a traditional insurer might worry about. A decade later, however, the risk management landscape is taking a more recognizable form.

Over the last two years, insurance carriers have cautiously expanded underwriting appetites to provide coverage for crypto exposures. But so-called crypto coverage isn’t cheap, and underwriting remains hamstrung by the unsettled and even precarious state of cryptocurrencies as well as the lack of historical loss data. Lloyd’s recent decision to consider underwriting crypto-related risks came with a warning that its managing agents should “proceed with a level of caution.”

The original intention of Bitcoin was to create a means of peer-to-peer exchange, effectively skirting if not disrupting traditional banking and financial networks. But a decade later, thousands of other cryptocurrencies have been created, each of which has varying degrees of consumer security and often experience volatile price fluctuations.

The most consistent interest in risk transfer opportunities has been driven by exchanges, investors, traditional financial institutions and fintech start-ups focused on cryptocurrencies. Underwriters have shown an openness toward traditional financial institutions with established regulatory and compliance frameworks that are now either using cryptocurrency as a commodity or providing custodial services to clients.

Insurers have been more willing to consider coverage for conventional institutions with crypto exposure as it comes as a small part of a much larger risk profile. While not precluded from the crypto insurance market, start-ups or firms dedicated to the crypto industry undergo a more detailed due diligence process in order for underwriters to achieve a level of comfort.

One thing is clear: An increasing number of companies are introducing cryptocurrency into their business models and, in the process, are creating new levels of risk that may be under-insured or even wholly uninsured by today’s market standard. Many of these new business activities require a re-examination of the way current insurance policies react and exploration of new emerging policies that can mitigate the risks associated with crypto-related business activity.

Cryptocurrency risk exposures

As underwriters look to familiarize themselves with the new exposures arising from cryptocurrencies, here are some of the risks:

gavel icon
Unclear regulation

Industry growth has been highly reliant upon unregulated companies, which, from an underwriting perspective, raises questions about the level of oversight and proper internal controls.

Such risks have been overcome before; for example, a common anti-money-laundering (AML) approach among payment and alternative remittance companies was established. Several insurers are declining to write coverage for any client engaging in cryptocurrency or related business until regulatory standards are in place.

This lack of regulation is evident in the initial coin offering (ICO) market, a crypto version of an initial public offering to raise investment capital. In their first five years, ICOs raised close to $6 billion by one estimate, with total market capitalization of cryptocurrency reaching approximately $260 billion. While investors may be lured by such big numbers, the U.S. Securities & Exchange Commission (SEC) and other regulators have flagged ICOs for fraud potential, with one study indicating that most ICOs are scams.

More broadly, in the eyes of the SEC, cryptocurrency can fall in the cracks between stock and commodity regulations. Outside of the U.S., various regulations are being developed to achieve differing goals. Some countries may block any use of cryptocurrency, while others, such as China, attempt to restrict use to financial institutions. Israel is developing regulations designed to treat cryptocurrency as a sector of its financial services industry, with guidelines that will force transparency and provide consumer protections while reducing opportunities for money laundering and other illegal activity. This approach to “normalize” cryptocurrency may also promote more effective insurance underwriting.

lock in an atom icon

Some industry observers have concluded that future growth of the cryptocurrency industry depends heavily on improved custody for both “hot” (online) and “cold” (offline) storage, including security involving solution providers and platforms.

The SEC is among the regulatory agencies keeping sharp eyes on custody arrangements. At a 2018 investment conference, SEC Chairman Jay Clayton said that custody offerings still need to be “improved and hardened” even as he acknowledged the growth of cryptocurrency custody solutions.

These solutions, despite a ragged start, are shaping up in ways that more directly address security and other underwriting concerns. Well-established financial institutions continue to enter the niche. Late last year, for example, Fidelity Investments launched Fidelity Digital Asset Services to provide cryptocurrency custody and trade execution for institutional investors. In making the announcement, Fidelity Investments said it would “continue investing and experimenting, over the long-term, with ways to make this emerging asset class easier for our clients to understand and use.”

Japanese bank Nomura also announced plans in May to offer cryptocurrency custody with their combined expertise in fund management, digital asset security, asset administration and banking. Citigroup and other financial companies reportedly are taking similar steps.

Due to the ging volume of requests they are seeing, underwriters are attempting to standardize cold storage placements. Underwriters are designing coverage that can protect against loss or damage caused by employee theft, collusion and extortion events.

computer with a shield on the monitor icon
Cyber security

Cryptocurrency-related crime was projected to surpass all other cyberattacks in 2018, according to some cybersecurity experts.

While demand for skills in cryptocurrencies is ging, security expertise isn’t keeping up, according to a report by Trend Micro. Businesses and individual investors alike are dealing with large disappearances, complex ransomware, extortion events and artificial intelligence-powered bots scouring the internet looking for weak links. Similar to cyber threats on different industries, hackers are finding the people, servicing function and storage areas to be easy prey.

When cryptocurrency firms operate in a centralized manner, like most traditional firms, they risk losing the main security feature offered by blockchain technology. Blockchain can provide a high degree of security, but by reverting to centralization, clever hackers are finding ways to penetrate the wall of algorithms and other data-protection methodologies.

bank with a dollar sign icon
Volatility and illiquidity

Because cryptocurrency isn't backed by a central bank, insurers are concerned about systemic risk of the cyrptocurrency industry, credit risks, currency inconvertibility, the ability for participants to exit the market and more.

In particular, cryptocurrency exchanges that pay customers out of their own funds upon transaction request and then approach the market to sell are seen as having higher risk profiles due to potential market runs and little-to-no credit access.

A U.S. Treasury-supported study, Risks and Vulnerabilities of Virtual Currency, concluded that large-scale use of cryptocurrencies and greater interconnectedness with the financial sector could create systemic financial risks. The study, which drew on conclusions from the International Monetary Fund, cited two examples — threats to banking revenues from cheaper and less-regulated crypto competitors and vulnerability to cryptographic risks.

Illiquidity of cryptocurrency is worsened by regulatory and technical barriers to entry along with thinly traded markets. The volatility of Bitcoin and other cryptocurrencies greatly decreases their usefulness as a currency, further contributing to illiquidity issues. The IMF also notes that credit and liquidity risks may occur for cryptocurrencies held by third-party institutions that may fail to meet their obligations or provide liquidity to users when needed.

shield with a check icon
Business and reputational risks

In addition to the risks outlined above, firms engaging in cryptocurrency carry additional business risks.

Companies, and financial institutions in particular, have pressures to make the right bets in terms of a cryptocurrency strategy and the scale of investment that may ultimately be required if and when cryptocurrency goes mainstream.

There is also considerable risk to the reputation and brand. Although established financial institutions engaging in cryptocurrency-related activities may be attracting a new customer base by deploying a crypto strategy, current clients may be frightened or dismayed by the divergence from traditional services. Any negative or adverse regulatory event could trigger a further loss of confidence in the engagement of cryptocurrency. Having said this, leading banks are dipping their toes into cryptocurrency water.

Some of the world’s largest banks, such as JP Morgan Chase and Morgan Stanley, have hired fintech and crypto experts to develop and lead their strategies. This may be seen as a defensive move as the banks brace to adapt to the new financial services, platforms and products, but it also opens traditional firms up to potential new revenue streams and partnerships.

As the cryptocurrency industry continues to develop and mature, it is only natural that insurer appetite for cryptocurrency and other digital asset-related risks will continue to broaden as underwriters become more familiar and comfortable with these evolving exposures.

The risks outlined above may not fit neatly into traditional insurance policies, creating the need to develop and tailor new products to fit this ging need. Additional value will be brought to companies in the cryptocurrency industry by brokers with the right combination of technology experts and experienced insurance professionals.

Title File Type File Size
Cryptocurrency: Risk management overview PDF .6 MB
Contact Us