The Biggest Bank Heist in History Is Coming

In February, the Office of the Comptroller of the Currency’s acting head Michael Hsu announced plans for new rules on operational resilience for large banks with critical operations, including third-party service providers. Critically, he did not discuss how these rules will treat the use of permissioned networks by the big banks to tokenize real world assets and liabilities, an omission that neglects critical new vulnerabilities for the global financial system.

As Hsu pointed out, bank call report data show that the top four custodian banks alone now safeguard over $108 trillion in assets. These assets are in the process of being tokenized by the big banks, which is the process of creating digital representations of real world assets and liabilities on blockchain. These banks have been piloting the tokenization of bank deposits and will soon turn to tokenizing U.S. Treasuries and corporate debt.

Regulators acknowledge this tokenization trend. The Fed’s Vice-Chair Michael Barr announced last September the launch of the Fed’s Novel Activities Supervision Program while allowing state-member banks to also explore tokenization if they demonstrate sufficient risk management. In November, Hong Kong’s Securities & Finance Commission issued regulatory guidance on the tokenization of securities, and the OCC held a symposium on tokenization in February.

Encouraging the use of permissioned networks over permissionless blockchains will inevitably lead to cybersecurity attacks

This mainstreaming of crypto by traditional financial institutions and regulators is exciting. But these banks are mostly tokenizing on permissioned networks, which regulators are encouraging. In December, while announcing plans to revise its bank capital standard for crypto-assets, the Basel Committee on Banking Supervision stated that since permissionless blockchains “create risks that cannot be sufficiently mitigated at present”, the highest bank capital requirements would be retained for crypto-assets held on permissionless blockchains. The Committee probably concluded this because permissionless blockchains are maintained by thousands of validators that are not subject to regulatory authorities, while permissioned networks would be controlled by banks.

In his keynote speech at last month’s OCC symposium on…