The Bank of International Settlement has released a report warning banks to desist from using permissionless blockchains. BIS said that the use of unknown or third-party participants in financial networks introduces significant challenges for banks when it comes to due diligence and oversight.
Since these participants are not directly controlled or thoroughly vetted by the bank, it becomes harder to assess their reliability, security practices, and potential risks. This lack of direct oversight makes it difficult for banks to predict or manage disruptions that might occur if one of these third parties fails or acts maliciously.
The Bank for International Settlements (BIS) is like a bank for central banks around the world. It helps them work together, share information, and make decisions to keep the global financial system stable. The BIS also provides research and support to help central banks manage their countries’ money and economic policies.
What’s a blockchain?
Blockchain is a type of digital ledger that stores data in a chain of blocks, each containing information such as transaction details. These blocks are linked in a specific order, creating a secure and immutable record. Since blockchain is decentralized and not controlled by a single entity, tampering with the information is difficult.
There are various types of blockchains, each serving different purposes. Public blockchains, also known as permissionless blockchains, are open networks where anyone can join, use, and help manage the system. Examples include Bitcoin and Ethereum, which allow anyone to view and contribute to the data, ensuring full decentralization.
Private blockchains are controlled by a single organization or group, restricting access to selected participants.
Permissioned blockchains blend features of both public and private blockchains. They allow access to specific individuals, similar to private blockchains, but offer more flexibility in terms of access levels.
Consortium blockchains are managed by a group of organizations that share control. This type of blockchain is useful when multiple parties need to collaborate and maintain shared control, rather than leaving it to a single entity.
Hybrid blockchains combine aspects of both public and private blockchains. They make some data publicly accessible while keeping other information private. This setup is beneficial for businesses that need to publicize certain information while securing sensitive data.
For banks, BIS views the absence of complete oversight on permissionless blockchains as a significant hurdle.
The risks
BIS identified the first risk to banks as governance risk, which arises from the decentralized nature of permissionless blockchains. In these systems, control is dispersed among many participants, making it difficult for regulated entities like banks to assign responsibility and ensure proper oversight of third parties they rely on.
Next, BIS highlighted technological risks. It explained that in blockchains, transactions are confirmed through a process called consensus. Permissionless blockchains are vulnerable to “51% attacks,” where an attacker gains control of more than 50% of the validation nodes or tokens, allowing them to dictate how new blocks are added to the blockchain. While smaller proof of work (PoW) blockchains have suffered such attacks, no proof of stake (PoS) blockchain has experienced one yet.
Can CBDCs preserve users’ privacy? A new report from the Bank of International Settlement (BIS) says it can. But do yo believe?
Additional risks mentioned include legal issues, as permissionless chains allow anonymous participants, potentially leading to fraud like money laundering. Privacy concerns also arise since public records on blockchains may expose sensitive information. Settlement risks are another concern, as transactions aren’t always final and can be reversed.
BIS also pointed out liquidity risk, where the openness of these networks might cause users to panic and withdraw funds, leading to financial instability. Furthermore, changes in laws or regulations regarding cryptoassets can lead to unexpected shifts in how blockchains operate, making them unstable.
Solving the problem
To manage the risk of a permissionless blockchain failing or facing major disruptions, issuers can employ business continuity planning (BCP). This includes using tools like off-chain databases to track ownership and recover assets in case of issues such as a blockchain split or attack. However, the effectiveness of BCP is uncertain, and moving assets can be complex.
Additionally, permissionless blockchains can utilize smart contracts to manage tokens, control access, and reverse transactions. These methods can mitigate some legal and compliance risks. Options include:
– Banks can allow only certain nodes to participate, enabling interaction with known and trusted validators, which may reduce various risks. However, this could slow down transactions by avoiding nodes operated by potentially malicious actors.
The BIS noted that advanced technologies such as zero-knowledge proofs and fully homomorphic encryption, designed to enhance privacy and confidentiality, are beneficial. These technologies might be implemented on separate chains or layers to protect user data while interacting with the primary blockchain.
Finally, the BIS explained that solutions like faster layer 1 consensus mechanisms, layer 2 chains, and sidechains can improve transaction speed. This will help alleviate the low transaction speed of popular blockchains during periods of stress, thereby reducing liquidity risks.
