As a wide range of digital assets become mainstream, organisations need to carefully assess the opportunities and risks of adoption
By Dylan Campbell, SIRM & Alexander Larsen, CFIRM
Originally published as a shorter version in the IRM’s Winter 2022 Edition magazine “Enterprise Risk”
The last few years have seen a lot of hype around the converging technologies of web3, blockchain, cryptocurrencies, NFT’s and the Metaverse. In a previous article we laid out how the Metaverse is shaping up and whilst we concluded that the Metaverse will take a while to become a reality, blockchain technology, in which much of web3 is built upon, has now risen to prominence, gaining wide spread adoption.
According to Blockdata research, 81 of the top 100 companies use blockchain technology. It was found that the technology is being used in areas such as payments, traditional finance, banking, supply chain and logistics. This is no longer a technology of the future that may or may not be useful, but a technology that is established and being developed. For more information on the Blockchain refer to a previous article here
The tumultuous rise and fall in the wider cryptocurrency market, led by Bitcoin, over the last two years has no doubt triggered renewed concerns regarding legitimacy of the asset class, with many pointing this out as proof that this is just a passing fad being fuelled by speculators. Whilst on the surface it may look this way, there are many indicators that suggest that it is actually here to stay. We will therefore take a closer look at the opportunities and risks of Bitcoin corporate adoption and review the possibilities that may exist in Web3, where cryptocurrencies, NFTs, the Metaverse, decentralised finance (Defi), community tokens and decentralised autonomous organisations (DAO’s) all converge.
What are Bitcoin and Cryptocurrencies?
Reflecting on the events of the past two years, you may be forgiven if you missed hearing about how Bitcoin has won over some of worlds best known billionaires. From technology entrepreneurs such as Jack Dorsey, Peter Thiel and Elon Musk to Wall Street legends such as Stanley Druckenmiller and Paul Tudor Jones. All have embraced Bitcoin, but why? What qualities does this relatively new, highly volatile and digitally intangible asset have that would garner such interest? To attempt to answer that question, one must first understand what Bitcoin is and what it does.
Bitcoin is a new digital form of money that is censorship resistant, seizure resistant, borderless, permissionless, pseudonymous, programmable and fully peer-to-peer. It is therefore available to everyone around the world and all that is required to interact with the network is a mobile phone and an internet connection. With Bitcoin, transactions are not managed by banks or financial intermediaries, but instead value travels directly from one person to another. Payment processing is not done by a regulated company like Visa or PayPal, but instead it is all facilitated by a decentralized global software network, with custodianship not handled by a bank but the users of the network.
Other cryptocurrencies aim to emulate these attributes.
While the wider cryptocurrency market is awash with different digital assets and tokens (over nineteen thousand of them), Bitcoin has, since inception, remained the largest cryptocurrency by market capitalization. To many investors, it’s Bitcoin’s longevity and simplicity that sets it apart from the rest of the digital asset market.
Bitcoin’s Mainstream Acceptance
A telling metric that reflects Bitcoin’s mainstream acceptance, is the increasing trend of corporate adoption. One of the most prominent examples of this was NASDAQ listed MicroStrategy Incorporated’s announcement in December 2020 that it had made more than $1B in total Bitcoin purchases in 2020, claiming that would “provide the opportunity for better returns and preserve the value of our capital over time compared to holding cash.” Following this other companies, such as Tesla, followed suit.
There may be several reasons why a company may wish to add Bitcoin to its balance sheet. This may be to leverage a potential opportunity for asymmetric risk returns observed over previous years (given its early stage of global adoption) or as a hedge against currency devaluation brought about by unprecedented state intervention in the money supply. It could be part of a corporate strategy to embrace modern, open-source technologies or to support an operational strategy that includes accepting Bitcoin as payments.
A major developing area of Bitcoin is that of energy optimisation and reduction of carbon emissions. Despite the commonly held view that Bitcoin is bad for the environment, there are a number of initiatives that are focused on using Bitcoin mining to both reduce carbon emissions and increase the use of and viability of, renewable energy. As an example, Bitcoin Mining is integrated with wind and solar farms to help balance grid loads and optimise energy generation. The weakness of solar and wind is that they are intermittent and there may be periods where supply exceeds demand, thus leading to waste. By signing agreements with Bitcoin mining companies who get exclusive rights for times of low demand and to turndown mining in periods of high demand, energy companies are able to more efficiently run their operations. The measures implemented by the Electric Reliability Council of Texas (ERCOT) is a great example of this. By augmenting power generation with Bitcoin mining energy companies’ are able to raise capital to build more infrastructure which will help speed up renewable adoption and support making grids more resilient. Some hydroelectric dams in North America are already seeing the advantage of Bitcoin mining with an increase of revenue allowing them to make repairs and upgrades and keeping them in operation.
Oil and gas companies such as Exxon, ConocoPhillips and Equinor are also exploring Bitcoin mining as part of their operations. Instead of letting excess gas be vented or flared which releases Methane (a more harmful greenhouse gas than CO2), they are looking to mine bitcoin with the excess gas which reduces emissions by up to 63% (according to Crusoe, a company dealing with Digital Flare Mitigation) whilst increases revenues (Bitcoin) allowing them to potentially invest in green initiatives or to make their operations more efficient.
Evolving landscape: From Cryptocurrencies to Web3
The past two years have been transformative when looking at the wider altcoin landscape. In the early days of Bitcoin, altcoins were largely cryptocurrencies that sought to challenge bitcoin. This is no longer the case. The concept of Web3 has risen to prominence where it’s staunchest supporters claim that we will have an “internet owned by the builders and users, orchestrated with tokens.” If Web1 was the Read internet and Web2 is the Read-Write internet, then Web3 will be the Read-Write-Own internet. In the following sections we will touch on various aspects of Web3 to understand whether this goal is being realised and what risks and opportunities may be presented.
Risks of investing in Bitcoin
Whatever the reason, holding a new asset such as Bitcoin on a balance sheet, most certainly exposes an organization to risk.
As this is a digital financial investment, it is essential that the CEO, Chief Financial Officer, Chief Risk Officer, Chief Technology Officer, Board of Directors all have a clear assessment the asset’s risk profile and where this aligns and diverges from the company’s tolerance for risk. As such risk managers are key to helping make their organizations aware of these risks so that appropriate mitigating strategies can be developed and implemented to help ensure success in this venture. Key areas of risk to consider are as follows:
* Regulatory Compliance Risk: Arguably the most important risk to consider given the relative immaturity of the asset class and the lack of firm regulatory treatment of Bitcoin and other digital assets across different jurisdictions. Not only is it important to consider the company’s regulatory obligations, but also those of it’s counter parties (e.g. exchanges or custodians). Items to consider would be KYC/AML rules, accounting rules, tax rules, commodity laws and securities laws. These should tie in with existing company Code of Conduct rules.
* Liquidity Risk: This risk seeks characterize the company’s ability to meet its day-to-day working capital requirements through deployment of cash reserves. A working capital threshold should typically be established with only cash in excess of this to be made available for digital asset investment.
* Technology Risk: While Bitcoin has a provable decades long track record of performance, it is vital that the technology be understood and monitored as it evolves. Material changes affecting the validity of the protocol are deemed to be highly unlikely (not necessarily the case with other blockchains). Nonetheless, the protocol continues to evolve, albeit at a measured pace. Incorporation of bitcoin improvement proposals (BIPs) typically take years to agree before being incorporated into the protocol. Adoption of the proposals does come with new features that allow for more functionality (e.g. BIP9, which facilitated deployment of the Lightning Network, a layer 2 solution that scales Bitcoin’s transaction throughput). These could be leveraged by the company, but may also introduce unforeseen risks.
* Custody and Information Security Risk: Thorough appreciation of the various risks associated with custody of bitcoin needs to be undertaken. This is particularly important in the face of historical high-profile hacks. There are different strategies a company may decide to follow with respect to custody of its bitcoin. Self-custody, fully outsourced custody to a trusted third party, or using some combination of the two via multi-signatory custody may be considered. Self-custody is considered harder to do securely for most organizations, but outsourced and multi-signatory custody are not without risk either. Should the latter two options be explored, secure private key storage, assurance of account statement accuracy, custodial service liquidation risk management, market volatility management (especially if the bitcoin is being rehypothecated) and information security protocols all need to be thoroughly understood and vetted.
* Transaction Control and Authorization Risk: Executing inbound and outbound transactions and cross account transfers will create several risks. Transaction workflows need to be fully understood with key controls put in place. These include documented segregation of duties outlining who has access to the accounts and clear levels of authority detailing what type and threshold of transaction each person can or cannot undertake.
* Stakeholder Risk: Bitcoin’s energy consumption has been a major point of concern raised by environmental groups and competing less energy intensive blockchains in mainstream media. While recent studies have largely refuted these claims and indeed Bitcoin has even been demonstrated to promote responsible and efficient use of energy (e.g. the one USA’s oldest running renewable energy plants was kept afloat as result of mining bitcoin during off peak demand periods, promoting grid resilience). Nonetheless, understanding and addressing stakeholder concerns with respect to adopting Bitcoin must be an imperative. This will require well thought out proactive stakeholder engagement planning.
Decentralised Finance
To understand Decentralised Finance, one must first appreciate the challenges associated the traditional (centralised) finance system. Most people can relate to the friction, inaccessibility and regulatory burden associated with interacting the current banking system. In recent years, these challenges only seem to be worsening and a trip the dentist seems preferable to a trip to the bank. In many parts of the developing world even having a bank account is a privilege.
Decentralized Finance or DeFi attempts address these challenges by allowing users to utilize financial services such as borrowing, lending, and trading without the need for a bank or financial institution. These services are provided via Decentralized Applications (Dapps), which are deployed on smart contract blockchain platforms such Ethereum, Solana or Cardano. Many have benefited from the boom in Defi. It has also however had its fair share of controversy. This ranges from abuse of smart contract bugs, Miner Extracted Value front-running, flash loan manipulation, and rug pulling. Any venture into Decentralised Finance should only be undertaken with a full understanding of all the risk categories mentioned above.
Decentralised Autonomous Organisations (DAOs)
As with Defi, let’s start with a definition. A DAO is a digitally native community that centres around a shared mission and whose assets are managed by the community’s contributors. A DAO is code committed to a public ledger and the blockchain guarantees user accessibility, transparency and rights. The DAO’s token determines its voting power, allocation of funds to achieve the groups goals, incentivizes participation, and punishes anti-social behaviour.
DAOs can be set up for a variety of purposes where groups of individual need to raise funds to achieve a goal. Some examples of this include Uniswap, a decentralized cryptocurrency exchange built on the Ethereum blockchain worth $ billions; and UkraineDAO, a fundraising DAO set up to collect and distribute donations to assist those affected by the war in Ukraine.
A significant advantage of DAOs over traditional organisations is the lack of trust needed between two parties with no leader or board making decisions. DAOs are however not without risk. The now famous Ethereum DAO hack highlighted the importance of ensuring Technology risk is properly managed. A bug in the DAO’s code led to the theft of $60 million worth of Ethereum tokens. Regulatory Compliance risk would be another area that will require detailed understanding as regulators seek to define how these entities should be treated.
The Metaverse, Cryptocurrencies, NFTs and Community Tokens
In a previous article we already highlighted all the opportunities and risks of the Metaverse and its important to highlight that if the Metaverse becomes a reality and widespread, the use of cryptocurrencies and NFT’s will boom. Cryptocurrencies is the main way in which people will conduct financial transactions in the metaverse whilst NFTs will be the items you buy.
Whilst the Metaverse will ensure widespread adoption, NFTs don’t require the metaverse to have a use case. They can be, and are being adopted right now for university degrees, house ownership, artwork purchases and any other real-world item that is unique and requires ownership proof that can be stored and found securely on the blockchain.
Some organisations are developing their own Cryptocurrencies or NFTs in order to reward customers or staff and tie them into their own ecosystem. JPMorgan developed one to make global transfers cheaper and faster whilst Amazon have developed one to work as a store card. Binance, a cryptocurrency exchange that allows users to trade various tokens, have their own cryptocurrency to reward users for using their services and helps provide a competitive advantage against the competition. Football clubs have developed NFTs for fans, allowing them access to players and allowing them to vote on things such as what song to be played when a player scores a goal and this could be extended to much more serious votes in the future. Expect the emergence of cryptocurrencies and NFTs being created by companies to increase further with Google and Facebook expected to launch too in the near future.
What about Central Banking Digital Currency (CBDC)?
Central banks have been providing money to the citizens of the respective countries for centuries. To keep pace with a rapidly changing world and pursue their digital public policy objectives, some central banks are actively investigating offering their own digital currencies to the public
CBDC’s are being considered as a future for the national currency by some central banks. Where previously we had paper money and money sitting in our bank accounts, some central banks are now looking at creating CBDC’s which are essentially centralised cryptocurrencies. They claim it has a number of benefits from reducing tax evasion to understanding population spending habits and reducing fraud and the funding of illicit activities. The potential risks it poses however include the ability of a government to fully monitor the population and restrict access to their funds or what they can spend their money on. Currently countries like the UK and USA are already reviewing the concept and have plans to implement them whilst the e-Krona in Sweden is already under testing and countries like the Bahamas have already adopted it. Whether benefits outweigh the risks remain to be seen and it is likely that CBDC’s will live alongside their decentralized counterparts such as Bitcoin.
Conclusion
Despite the concerns and scepticism associated with of Bitcoin, NFTs and altcoins, it is clear that adoption is happening, and it is likely only going to become more wide-spread. The question is what involvement should an organisation looking to get involved have? From investment to developing their own cryptocurrency or investing in the ecosystem, there is plenty to explore, and as with all initiatives that have high rewards, they come with plenty of risk.
Alignment with the organisations vision, mission and values would be the starting point, followed by development of a digital asset strategy. Once this is in place a thorough assessment of the opportunities and risks needs to be undertaken with particular emphasis on where these converge and diverge with the company’s risk tolerance.
Written By
Alexander Larsen, CFIRM – Founder of Risk Guide & Chair of the IRM Energy & Renewables SIG
Dylan Campbell, SIRM – Secretary IRM Energy & Renewables SIG
Last year, China took a definitive stand on regulation on crypto currencies which sent shockwaves through the market. Some feel it was perhaps heavy handed with ICO’s being banned, bank accounts being frozen, bitcoin miners being kicked out and nationwide banning on the internet of cryptocurrency trading related sites. Others however believe that it has been a positive step, and has encouraged other governments to take regulation seriously and hopefully take a more balanced approach. It certainly isn’t in the interest of governments to stop ICO’s, which provide many positives including innovation, but they should certainly regulate them from a consumer protection, taxation and organised crime standpoint.
A Guide to Risk Management 