While initial coin offerings (ICOs) are growing in popularity amongst the startup community, challenges remain for token issuers notably in terms of regulation and cybersecurity, according to PwC.

ICO frenzy

An ICO is a form of fundraising that harnesses the power of cryptocurrencies and blockchain-based trading. Similar to a crowdfunding campaign, an ICO allocates tokens instead of shares to early investors in a business.

These tokens typically do not represent actual ownership in the company, but they often provide access to an ecosystem and can be traded on an aftermarket.

According to CB Insights, ICOs raised over US$5 billion in nearly 800 deals in 2017, surpassing early stage venture capital (VC) funding for blockchain startups. Unsurprisingly, many experts and industry observers expect ICOs to be the game changer for the fintech industry in the coming year.

Challenges remain

Despite the ICO frenzy, challenges remain for token issuers. A research published earlier this year by EY, found that out of 372 ICO projects analyzed, more than 10% of ICO proceeds (about US$400 million) were intercepted and stolen by hackers. There have also been instances of data leaks where hackers got access to investor information provided to token issuers.

“In the last one month alone, there have been three ICO hacks on consecutive days, resulting in a total loss of close to Rs 8 crore (US$1.2 million),” said Indrajeet Bhuyan, a tech blogger and security researcher. “Startups want to raise millions, but don’t want to spend on security.”

ICOs remain a largely unregulated practice in most jurisdictions. The fact that ICOs are not limited by geographic boundaries makes it difficult to regulate them. Also, there are no specific accounting standards for ICOs. These shortcomings make ICOs vulnerable to scams and frauds.

Some governments have been particularly critic over token sales. The People’s Bank of China was the first jurisdiction to ban ICOs in September 2017, calling them illegal and fraudulent. South Korea followed with a ban on raising funds through ICOs as well.

Meanwhile, countries such as Switzerland and Singapore have formulated guidelines for token issuers and ICO organizers, bringing clarity to how these are treated by financial regulators.

The governments of Canada, Hong Kong, Singapore, Switzerland and others, in similar fashion to the US, have asserted that at least some coin offerings will be subject to securities laws. The European Securities and Markets Authority (ESMA) also echoed this sentiment.

Japan has taken a different tack entirely, recognizing Bitcoin as legal tender in May 2017.

The Swiss Financial Market Supervisory Authority (FINMA) categorizes ICOs and cryptocurrencies into three groups, payment tokens, utility tokens and asset tokens. Hybrid forms are also possible.

Payment tokens and ICOs must comply with anti-money laundering regulations. Utility tokens that functions solely or partially as an investment in economic terms are treated as securities in the same way as asset tokens, which must comply with security law requirements for trading as well as civil law requirements.

Earlier this year, FINMA held a series of roundtables discussions across Switzerland to present and clarify the ICO guidelines.