Review finds crypto firms sloppy with KYC too

The review looked at the firms’ account opening procedures, their adherence to investment limits imposed by regulators to guard against excessive investor losses (limiting investors to risking either $30,000 or $100,000 per year, depending on the firm’s model and client status) and the setting of client-specific limits.

Among other things, the regulator’s review found instances where crypto firms “took a mechanical ‘tick box’ approach” to collecting client information “without following up on any inconsistencies or otherwise conducting a meaningful assessment” to determine whether accounts are appropriate for certain investors. Such an assessment would be based on factors such as clients’ crypto knowledge and experience, risk tolerance, and financial circumstances.

“These failures sometimes resulted in accounts being opened or maintained for clients where the account was not appropriate for the client,” the notice said. The OSC added that some firms also didn’t update this information on an ongoing basis, which risks basing these determinations on outdated information.

The review also examined the firms’ compliance with investment limits set by regulators, which found that firms seem to be complying with those restrictions.

“Staff did not identify any instances where [crypto firms] failed to discharge their obligation to limit a client’s purchases of cryptoassets to the applicable maximum,” it said.

However, when it came to setting individual client limits, the regulator reported that it found “numerous instances where [firms] assigned client limits that were not meaningfully tailored to each client’s individual circumstances.”

The OSC found that these limits were sometimes set based on a limited set of considerations.

“For example, staff noted that some firms used risk tolerance as the sole [factor] in determining a tailored client limit, which does not provide a complete picture of the client’s circumstances,” the notice said.

The regulator also found instances where client limits were “based on arbitrary and dynamic factors” such as specific cryptoasset prices or set shifts in the value of client portfolios.

“In staff’s view, such approaches do not appropriately consider and reflect the client’s ability to tolerate losses and are not meaningfully tailored to each client’s individual circumstances,” the OSC said.

Further, the regulator found instances of firms not properly monitoring client limits or not acting appropriately when those limits are breached, enabling investors to keep trading without their dealer taking action to prevent further losses.

In the notice, the OSC set out added guidance to crypto firms on complying with the regulator’s requirements.

For instance, when it comes to dealing with client limits, the notice said crypto firms “are expected to demonstrate on a reasonable efforts basis that meaningful interventions have been added to protect clients in situations where their losses on the platform appear to be disproportionately detrimental relative to their individual circumstances.”

It also warned firms against providing investors with notifications that could be considered straying into the provision of advice.

“Notifications should be used to point to the losses accumulated to date at the time of the notification and educate clients on how they can reduce further losses,” the notice said.

“Account appropriateness, investment limits and client limits are all essential measures to protect investors,” said Matthew Onyeaju, senior vice president of registration, inspections and examinations at the OSC, in a release.

“While some of the findings were positive, it’s clear additional guidance is needed. We encourage [crypto firms] to review and assess their practices against the guidance we issued today,” he added.