Crypto regulatory affairs: FSB, HKMA and FCA spell out AI accountability for financial firms

In this second October edition of crypto regulatory affairs, we will cover:

• More regulatory focus on AI accountability
• OCC issues final GENIUS Act rule, leaving yield debate unresolved
• UK looks to address DeFi risks
• Other regulatory and policy news

More regulatory focus on AI accountability

Financial sector supervisors and standard setters are ramping up the call for regulated firms to ensure accountability when using artificial intelligence (AI) — building on a trend we highlighted in our last fortnightly update. 

On October 15, the Financial Stability Board (FSB), an international body associated with the G20 and the Bank for International Settlements (BIS), issued its final report on Sound Practices for Responsible Adoption of Artificial Intelligence (AI), which draws on findings from a public consultation held earlier this year. The report sets out twelve sound practices designed to assist financial institutions in harnessing the benefits of AI while managing risks, and serves as a set of recommended practices that institutions can draw upon voluntarily. 

Recognizing that AI has potentially significant benefits for the financial sector in terms of enabling enhanced productivity and efficiency in use cases including fraud detection, Know Your Customer (KYC) workflows, insurance claims handling and asset management, the FSB’s report also indicates that the use of AI in the financial sector also presents risks to financial stability. In particular, it notes that the “high levels of autonomy that AI agents or agentic AI systems can create or amplify certain risks, which can materialise at great speed,” including risks of unauthorized or erroneous actions, data breaches, disruptions to connected systems and challenges in maintaining human oversight. 

The FSB’s twelve sound practices serve to assist financial institutions in addressing these and other risks. The twelve practices fall within two broad categories: 

1. Organization-wide AI governance. The FSB stresses that firms should ensure board and senior management oversight of AI arrangements, establish appropriate governance arrangements for AI systems, conduct risk assessments of documented AI uses cases and adjust their oversight arrangements as their use of AI evolves. 
    
2. AI lifecycle management. According to the FSB, firms should not treat AI governance as a one-time exercise that ends with deployment, but should rather respond to distinct challenges and risks across the AI lifecycle from initial inception through to deployment, ongoing monitoring and retirement of systems. This includes establishing effective data governance arrangements for the ongoing testing and use of AI systems, implementing effective human oversight arrangements of AI systems and ensuring the transparency and explainability of AI systems.

While not binding upon financial sector participants, the FSB’s practices are nonetheless an important indication of emerging global accountability standards on the use of AI by regulated firms, and serves as an important foundation for firms seeking to develop their own governance arrangements. 

Building upon these efforts, on the same day that the FSB released its report, the Hong Kong Monetary Authority (HKMA) announced the roll-out of its Accountability, Resilience, and Trust (ART) Framework for supporting the Hong Kong banking sector’s responsible adoption of AI. In its announcement, the HKMA indicates that the emergence of agentic AI systems that have greater autonomy and access to banks’ data and workflows requires a focus on ensuring robust governance and operational resilience. HKMA is undertaking three key initiatives under the ART Framework to promote these objectives: 

1. Issuing an updated version of its Supervisory Guidance for Responsible Adoption of Artificial Intelligence, which describes the obligations of HKMA-supervised firms to ensure adherence to the ART principles. The guidance includes clarification that firms’ board and senior management are responsible for approving and overseeing AI strategies and governance arrangements, requires that firms must assign an owner to each AI use case and ensure human oversight of each AI system and the obligation to ensure testing and validation of each AI system used, among other obligations. 
    
2. Establishing an AI training data sharing platform to be used for ensuring data quality governance. 
    
3. Testing agentic AI applications in banking through a GenAI Sandbox++, which will inform an upcoming discussion paper on a proposed regulatory framework for agentic AI governance. 

Regulators in the United Kingdom are also working to promote accountability in the use of AI. On October 19, the UK’s Financial Conduct Authority (FCA) published its findings on examples of good and bad practice in the use of AI in financial services. Part of the FCA’s efforts to promote the responsible use of AI where it can benefit consumers, firms, and financial markets, the publication draws on the FCA’s observations from its AI Lab initiatives, including its Supercharged Sandbox. 

As examples of good practice, the FCA highlighted firms that:

• Design and continuously test controls aimed at mitigating AI risks such as bias or inaccuracy
• Clearly defining use cases and objectives prior to deploying AI systems
• Ensuring AI systems only draw on approved material and high quality data to reduce the risks of AI hallucinations
• Maintaining clear and comprehensive records of AI-assisted decisions and outcomes
• Routinely testing AI models against human-led processes to ensure accuracy and effectiveness
• Establishing well-defined and centralized governance arrangements for oversight of AI
• Embed risk-based arrangements for ensuring the challenge, testing, and approval of AI arrangements before deployment
• Provide staff with training to enable them to ensure the effective human oversight of AI systems

Conversely, the FCA observed instances of poor practice among firms that included weak, poorly defined, or reactive governance arrangements, over-reliance on staff oversight of AI systems while failing to adequately test underlying models, and a lack of clarity about staff responsibility for AI systems.

These and other recent efforts by regulators and standard setters around the world point to a growing consensus regarding the need for accountability when using AI systems in financial services. At Elliptic, we believe this commitment to accountability is essential, which is why we developed the Elliptic Standard, which sets out eight principles for ensuring the effective governance of agentic on-chain risk management systems that we are adhering to as we build agentic solutions for our customers. The Standard’s eight principles align to those set out by the FSB, HKMA, FCA and other bodies, and cover areas including the need for exceptional data quality, model validation and testing, human accountability, business resilience and the management of AI risks. 

Recognizing that regulators now expect firms to ensure the effective governance of AI systems, the Elliptic Institute has released the first certification in governing AI agents for on-chain risk and financial crime compliance. The Certified agentic on-chain risk practitioner (CAORP) covers key areas of AI governance, including the different models of human oversight, and is free and open to anyone in the industry. Sign up for the course here.  

OCC issues final GENIUS Act rule, leaving yield debate unresolved

The US Office of the Comptroller of the Currency (OCC) has issued its final rules implementing the GENIUS Act, paving the way for the January 2027 roll-out of the US stablecoin regulatory regime. 

The 721-page document, which reflects input from public comments submitted earlier this year, sets out rules applying to national banks, federal savings associations, foreign payment stablecoin issuers, certain state-qualified issuers and nonbank entities seeking approval to issue payment stablecoins under the GENIUS Act. It sets out detailed obligations that permitted payment stablecoin issuers (PPSIs) will need to follow when the GENIUS Act takes effect from January 18, 2027, including: 

• Maintaining adequate reserves backing their stablecoin
• Honoring the redemption rights of token holders
• Establishing effective governance and risk management arrangements 
• Ensuring proportionate and effective audit and reporting arrangements

One ongoing issue of debate the OCC’s rule has not resolved relates to the payment of yield on stablecoins. Over the past year, the banking and cryptoasset industries have engaged in a highly charged debate over whether market intermediaries, such as cryptoasset exchanges, should be permitted to offer interest on stablecoins their customers hold. While the GENIUS Act forbids stablecoin issuers from paying interest to holders, it does not directly address the question of whether intermediaries may do so. The US banking industry has consequently argued that Congress should close this ostensible gap, which they claim could undermine community banks and lending activity. The cryptoasset industry counters this claim and argues that US consumers should be able to benefit from interest payments on stablecoin holdings — but the debate has remained unresolved and has contributed to the US Congress’s failure to pass crypto market structure legislation. 

The OCC’s guidance addresses the matter, but hardly resolves it for good. In its final rule, the OCC indicates that it will assess the facts and circumstances of individual stablecoin yield payment arrangements to determine whether any particular arrangement that involves third party payments runs contrary to the GENIUS Act’s intent. Consequently, existing stablecoin rewards programs that certain exchanges or other platforms offer may or may not be assessed as permitted under the Act, but the OCC has not offered specific examples of acceptable yield arrangements.  

With the official implementation date for the GENIUS Act only three months away, firms that are already offering stablecoins in the US will need to ensure they have submitted applications well ahead of the January 18 commencement date to continue operating. The OCC has indicated that it will likely provide firms who have submitted complete and thorough applications ahead of the implementation date with a waiver to continue operating in the US while their applications are under review. 

The OCC’s final rule does not cover matters related to financial crime risk management and compliance with anti-money laundering (AML) or sanctions obligations — matters that the US Department of the Treasury has been addressing through separate proposals and is expected to finalize in the near future. To learn more about the GENIUS Act and its implications for the US stablecoin landscape, see our previous analysis here. 

UK looks to address DeFi risks

The UK has proposed new guidance for cryptoasset market participants that could have important implications for the decentralized finance (DeFi) space. 

On October 21, the FCA commenced a consultation on proposed guidance on DeFi that accompanies the FCA’s broader guidance on the cryptoasset perimeter designed to facilitate the implementation of the UK’s expanded regulatory regime that will go live from October 2027. The guidance on DeFi applies to regulated firms that may offer or facilitate their customers’ use of DeFi services, and focuses on the operational resilience and financial crime implications of DeFi-related activity. 

In the guidance document, the FCA acknowledges that DeFi can offer innovation and efficiency in financial services, but warns that firms offering DeFi-related products and services must still apply with all relevant regulatory requirements. The FCA indicates that firms should consider, firstly, whether they are able to adequately identify, assess and manage the risks of DeFi services they offer. If they cannot do so, they should assume that those services are unlikely to be suitable for their customers. 

Secondly, the FCA indicates that firms should not assume that a service is not subject to existing regulatory requirements simply because it is carried out via DeFi arrangements, which involve the use of automated “smart contracts” to execute financial transactions without the presence of a centralized intermediary. In the FCA’s words, “The use of software, smart contracts, DLT or other decentralised arrangements does not, by itself, determine whether an activity is regulated.” The guidance points out the even where DeFi services may technically be exempt from the full scope of the FCA’s forthcoming regulatory regime for cryptoassets, firms offering those services may still be subject to the UK’s financial promotion and money laundering regulations, and should seek approval from the FCA accordingly. 

When offering DeFi services, the FCA expects firms to take account of operational resilience risks they may pose, such as that customers might face financial losses where DeFi services are targeted in cybercrime, including via theft and hacking, or the potential for disruptions on the underlying blockchain network that can disrupt a firm’s ability to meet obligations to clients. The FCA also expects firms to assess the financial crime risks arising from DeFi services they offer or that their customers interact with, including risks of enhanced anonymity, cross-jurisdictional money laundering activity or the lack of KYC information on counterparties. It also indicates that firms should assess whether interactions with DeFi arrangements impact their ability to implement the Travel Rule, and that they are expected to appropriately mitigate the risks of interacting with unhosted wallets used in DeFi arrangements as part of their Travel Rule obligations.

While the FCA’s guidance applies to regulated firms interacting with DeFi rather than to the developers of the technology, it has important implications for the DeFi space. Where regulated firms are obliged to exercise an enhanced level of scrutiny and due diligence when interacting with DeFi arrangements, that has the potential to drive demand for compliant DeFi services that are more aligned with regulatory expectations around transparency — including by ensuring that DeFi activity can be screened for indicators of on-chain risk. To learn more about the FCA’s forthcoming cryptoasset regulatory regime, see our previous analysis here.

Other regulatory and policy news

The past two weeks saw other important developments impacting the cryptoasset space, including:

• Switzerland approves first Bitcoin ETF. On October 20, the Swiss Financial Market Supervisory Authority (FINMA) approved a retail Bitcoin exchange traded fund (ETF) for the first time. The Bitcoin Fund ETF will be managed by Bit Asset Management AG and is expected to launch on the SIX Swiss Exchange from November, where it will be available to retail investors. In its announcement on the approval, FINMA indicated that the ETF is subject to measures requiring mitigation of operation and custody risks, and that investors face greater protections and transparency when investing in a Bitcoin ETF than they do when purchasing cryptoassets directly. 
   
• France to introduce crypto-stablecoin swap tax. On October 16 the French National Assembly narrowly voted to adopt an amendment to the 2027 budget that would require the payment of capital gains taxes when cryptoassets such as bitcoin or ether are swapped for stablecoins authorized under the EU’s Markets in Crypto-assets (MiCA) Regulation. The amendment, which must undergo further approval as part of the legislative process before coming law, aims to ensure that revenue authorities can collect tax on cryptoasset swaps involving MiCA-approved stablecoins, such as Circle’s dollar-and euro-backed stablecoins that the French regulators approved for issuance under MiCA earlier this year. Some critics have warned, however, that the measure may discourage innovation via stablecoins issued in the EU and could result in investors seeking to trade in less transparent and unapproved tokens. 
   
• South Korea seeks to regulate stablecoins as a payment instrument. South Korea’s central bank, the Bank of Korea, is proposing an amendment to the country’s Foreign Exchange Transactions Act that would regulate the use of stablecoins as a means of cross-border payment. According to press reports from October 23, the Bank of Korea indicated its intention in response to an audit from the country’s National Assembly, which is currently attempting to progress the Digital Asset Basic Act, which would create a licensing and supervisory framework for stablecoin issuance. The Bank of Korea’s proposed amendment would complement that framework and would bring stablecoins within the same set of supervisory expectations that currently govern fiat currency wire transfers. 

Source: www.elliptic.co