MANTRA sets sights on real-world asset tokenization in Middle East and Asia

The Legal Future of South Korea’s Crypto Industry: Necessary Legislation and SystemsA recent National Assembly symposium organized by South Korea’s Digital Asset Policy Forum brought experts together to discuss the challenges and prospects of the implementation of the Virtual Asset User Protection Act at the National Assembly Members’ Office Building in Seoul on Tuesday.Photo by Tingey Injury Law Firm on UnsplashInternational modelsReferences were made to global examples, such as the Markets in Crypto-Assets Regulation (MiCA) — the world’s first standalone virtual asset legislation enacted in the EU — which ensures transparency, disclosure, authorization, and supervision of crypto-asset transactions. However, unlike the capital market, MiCA does not impose regular disclosure reporting requirements or corrections on them. Firms in Japan, on the other hand, are asked to provide disclosure under autonomous regulation through the Japan Virtual and Crypto Assets Exchange Association (JVCEA).Notably, in its recent Policy Recommendations for Crypto and Digital Asset Markets Consultation Report, the International Organization of Securities Commissions (IOSCO) states that it is “seeking to encourage optimal consistency in the way crypto-asset markets and securities markets are regulated within individual IOSCO jurisdictions, in accordance with the principle of ‘same activities, same risks, same regulatory outcomes’.” This principle refers to the concept that any crypto-asset activity that has a similar function and poses similar risks to those in the traditional financial system — such as operating a trading platform or providing custody services — is subject to regulation that ensures equivalent outcomes, as defined by the UK Parliament.The IOSCO report also suggests that crypto-asset service providers (CASPs) should disclose information regarding ownership and control of crypto-assets, issuer and business-related information, issuer management teams, transaction history and operational description of crypto-assets, token ownership concentration, transfer protocols, and a given CASP’s treatment of the client crypto-assets and their respective rights and entitlements during events like hard forks and airdrops.Hurdles to overcomeExperts at the forum reflected these considerations in their sentiments. Han Suh-hee, a lawyer at Barun Law Firm, emphasized that it is important to determine what kind of information should be disclosed. She argued that it is necessary to discuss to what extent information about virtual asset issuers should be disclosed and whether mandating firms to disclose their financial and business conditions is efficient.In particular, Han underlined the need to consider the differences between virtual assets and stocks when establishing a framework for the disclosure of virtual assets holdings. Unlike stocks, virtual assets possess distinctive characteristics like their borderless and decentralized nature, unclear issuer backgrounds, and the ability to conduct peer-to-peer (P2P) transactions.Lee Han-jin, a lawyer at Kim & Chang Law Firm, added that the enactment of Korea’s Virtual Asset User Protection Act was aimed at establishing a system directly targeted at regulating virtual assets and virtual asset service operators (VASPs) — a significant development from the Financial Transaction Reporting Act, which had until now been the only legal framework responsible for regulating VASPs along with other entities like casino business operators. Virtual assets are now subject to a more systematized regulatory approach.However, he said that the Virtual Asset User Protection Act still has its setbacks because it is undergoing a two-stage legislative process. Lee criticized the fact that the same definition of VASPs outlined in the Financial Transaction Reporting Act had been brought over, which limits their identity to transaction intermediaries, wallet operators, and custodians while overlooking their other roles like crypto management, crypto deposits, and crypto collective investments.Lee also pointed out another weakness: the scope of prohibition on using undisclosed information and market manipulation is broader in the Virtual Asset User Protection Act than in the Capital Markets Act. He argued that enforcement decrees should stipulate the definition of insiders and exceptional cases when deliberating on the prohibition of insider virtual asset trading.Lee thus emphasized the need for a clear definition of virtual assets in the Virtual Asset User Protection Act, as it is yet unclear whether they are objects or assets. All things considered, he believes there must be a law that can encompass blockchain-based decentralization, outline the similarities and differences between digital assets and financial products, and accommodate new services that utilize smart contracts.“We are in the process of creating a regulatory system similar to those being adopted in other countries based on their respective markets,” said Lee Seok-ran, head of the Financial Innovation Bureau at the Financial Services Commission (FSC). “Unlike the stock market, which is equipped with regulations to prevent fraudulent transactions and misconduct, virtual assets are traded on multiple exchanges, so we are considering how to interpret unfair trading activities and conduct market surveillance.”She explained that the commission is prioritizing user protection measures and subordinate regulations. “I believe we will be able to create a system for subordinate regulations on disclosure once an overall global trajectory is established. But before that happens, we are working on guidelines for defining unfair trading activities with regulators and the Digital Asset eXchange Alliance (DAXA).” Unfair trading activities associated with virtual assets include not only those conducted on exchanges but also under other circumstances.The FSC officer said that the financial authority is set to establish legal criteria to distinguish cases such as false statements in white papers of crypto projects. She added that enforcement decrees will define both the conditions for restricting deposits and withdrawals on crypto exchanges and the corresponding limits.

The Securities Commission Malaysia (SC), the statutory body tasked with regulating and developing capital markets within the Southeast Asian nation, has published a consultation paper in an effort to garner public feedback on potential enhancements to its crypto regulatory framework. In a press release published to its website on June 30, the SC claimed that its proposals seek “to enhance competitiveness of Malaysia’s regulated digital asset market, improve investor protection and strengthen the resilience and integrity of [Digital Asset Exchange] operators.”Photo by Vlad Shapochnikov on UnsplashEasing listing requirementsIn the event that the proposals are adopted, one key change would see a liberalization of the listing requirements for digital assets. Where certain key eligibility criteria have been met, the regulator would allow the listing of digital assets on digital asset exchanges without prior SC approval. The regulator stated that it wants to make this change in order to speed up the time taken to get digital assets to market as they emerge. By setting out additional criteria, there will be greater exchange operator accountability. Exchange operators would bear responsibility for listing tokens in compliance with the requirements set out by the regulator.  Assets could only be listed once those assets and the underlying protocol and network had undergone security audits which had been carried out by an independent and qualified blockchain security auditor, with the audit results made public.  For the purposes of the “Liberalised Listing Framework,” the asset must have been trading on a Financial Action Task Force (FATF)-compliant virtual asset service provider (VASP) platform for a minimum of one year. The regulator believes that easing the listing requirements will result in a broader digital asset product offering being made available in Malaysia. Last month, Thailand’s Securities and Exchange Commission (SEC) started a public consultation process aimed at revising token listing rules. Coin listing processes have also come under scrutiny from the authorities in South Korea recently. Segregating client assetsAmong the proposals is a plan to oblige exchange platforms to properly segregate client assets from operational funds and assets held by the exchange business. In recent years, many failed crypto exchange platforms, most notably FTX, got into difficulty by co-mingling customer funds with operational funds. Furthermore, the regulator doesn’t want any cross-over of assets between the local exchange operator and any overseas affiliate companies it may have.The SC stated that it is cognizant of recent global exchange failures, which has led it towards further enhancing crypto exchange operational governance and controls. It suggests that only 10% of client assets should be held by a Malaysian exchange in hot wallets, with the remaining 90% held in cold or offline wallets. The SC said that it welcomes feedback from members of the various stakeholder groups on the proposals outlined. The public consultation period runs from June 30 through Aug. 11.  Malaysia is expected to have 4.74 million crypto users by 2026. That would equate to 13% of Malaysians using crypto by then.

Akira ransomware, responsible for stealing $42 million from over 250 organizations across North America, Europe and Australia in just a year, is now targeting businesses in Singapore. In response, Singaporean authorities have issued a joint advisory warning local businesses about the increasing threat posed by a variant of this ransomware.Photo by Mike Enerio on UnsplashAlert follows complaintsThe alert follows multiple complaints from victims, prompting agencies like the Cyber Security Agency of Singapore (CSA), the Singapore Police Force (SPF) and the Personal Data Protection Commission (PDPC) to take action. These agencies emphasize the urgency of recognizing and combating this threat. How Akira operatesAkira affiliates employ various techniques to infiltrate a victim's network. These include exploiting known vulernabilities. For example, that could mean the targeting of services like Cisco virtual private networks (VPNs) that have been configured without multi-factor authentication (MFA). Another approach that the ransomware incorporates is attacking external-facing services such as the Remote Desktop Protocol (RDP) via brute force. Social engineering is another tool within its repertoire. This involves tricking victims into downloading malicious software or entering credentials on phishing websites. There is a marketplace for compromised credentials in the dark web. Akira also relies on such data, acquiring it from access brokers who sell network access.  Once inside a network, Akira affiliates often create new domain accounts to maintain persistent access, even after reboots. They use numerous tools to steal user credentials, escalate privileges and spread throughout the network. Detection and prevention measuresThe Singaporean advisory outlines several strategies for detecting, deterring and neutralizing Akira attacks. Authorities strongly advise against paying ransoms, on the basis that doing so does not guarantee data recovery or prevent future attacks. Authorities also warn that paying ransoms can encourage further attacks. The FBI has noted that Akira operators do not contact victims. Instead, they expect victims to initiate contact. Payment in BitcoinThe advisory outlines how Bitcoin is implicated in the ransomware scam. It states:”Ransom payments are requested in Bitcoin, which are directed to cryptocurrency wallet addresses specified by the affiliates. The TOR site (.onion) where victims contact the affiliates, contains stolen information and a list of the affected organisations.” It’s not the first time that Singaporean authorities have issued warnings that have implicated Bitcoin and crypto. In January, the CSA and SPF, in a joint advisory, suggested that people should use hardware wallets in an effort to guard against crypto-related malware and phishing attacks. A number of weeks prior to that, Singapore’s former Prime Minister, Lee Hsien Loong, took to Facebook to issue a warning with regard to a crypto scam that involved the use of deceptive content generated using artificial intelligence (AI). Mitigation techniquesBusinesses are being urged by the authorities to adopt best practices to mitigate the Akira ransomware threat. They suggest the implementation of a recovery plan alongside the use of multi-factor authentication (MFA) in order to secure data and the access to that data.  They also suggest filtering network traffic as it helps in identifying and blocking malicious activities. Meanwhile, disabling unused ports and hyperlinks curbs the risk further as it reduces the attack surface. Lastly, the authorities suggested the use of system-wide encryption to protect data even if it is accessed by unauthorized entities.