Jay Smith

Deutsche Bank’s digital asset custody service is live for institutional clients in Europe, initially covering Bitcoin, Ether and selected stablecoins. As banks expand into tokenised assets, verifying who authorised each transaction becomes a core part of institutional custody.

Türkiye has strengthened crypto oversight through CASP licensing, custody safeguards and a central monitoring platform. The FSB’s latest review identifies the next gaps: a dedicated stablecoin framework, stronger financial stability monitoring and better cross-border cooperation. Regulatory visibility must extend beyond licensed providers.

The Czech National Bank has issued its first DLT bonds and tested purchases, sales, interest payments and repo transactions. The repo test is particularly interesting. Tokenized securities are entering central bank financing operations. The pilot was small, but the institutional use case is significant.

Who gets to vote when shares are held through tokenized securities? @Broadridge and @DinariGlobal's latest integration connects eligible dShare holders to established proxy voting infrastructure. The important work is reconciling token ownership with the underlying securities and voting entitlements.

A bank's ability to change technology providers is part of its operational resilience. The BIS highlights growing dependence on cloud, software and AI providers. Portability and credible exit plans need to be part of institutional architecture.

When an AI agent instructs a bank, whose authority is the bank accepting? HKMA's new Project SAGE puts agent identity, delegated authority and Know Your Agent (KYA) at the centre of its agentic finance initiative. Access to a banking system does not establish a mandate to move institutional funds. hkma.gov.hk/eng/news-and-med…

The Binance incident brings renewed attention to a fundamental challenge in digital asset infrastructure: establishing verifiable transaction authority. This article from @CubaneSpace examines the implications for exchange custody, signing systems, and institutional asset security. It also explores how independent authorization and confidential execution contribute to stronger transaction controls. A relevant perspective on the infrastructure required for institutional adoption. Worth a read.

𝗦𝗼𝗺𝗲𝗼𝗻𝗲 𝘀𝘁𝗶𝗹𝗹 𝗵𝗮𝘀 𝘁𝗼 𝗸𝗲𝗲𝗽 𝘄𝗮𝘁𝗰𝗵. Moonlight over the Caribbean, photographed aboard Holland America’s Nieuw Amsterdam cruise ship. I get to enjoy the view while the crew remains responsible for the voyage. That thought follows me into digital finance. An institution can automate a transaction, but it still needs to establish who may act and enforce the limits of that authority. Automation changes how the work happens. Accountability has to survive the change. Read it in detail here: xitter.gq/JaySmithNotes/status/2…

Binance's November 3 incident report exposes an important wallet security problem: suspending withdrawals did not revoke EIP-7702 permissions already established on-chain. Those permissions continued operating until separately revoked. Emergency shutdown and permission revocation are different operations. Institutional wallet architecture needs both, with explicit authority and reliable procedures for invalidating delegated execution rights.

Tokenizing a receivable does not establish the financial claim behind it. @BNYglobal and @Ripple's C2FO exploration on the XRP Ledger raises an important question: how will investors verify buyer acceptance, legal assignment and whether the receivable has already been financed? The legal rights behind the token will determine its value.

The Bank of England's recent speech on digital assets raises an important market infrastructure issue. A successful pilot still needs an authoritative ownership record, legally effective settlement finality and clear accountability. These are the foundations that determine whether digital asset infrastructure can become part of the financial system.

CPMI-IOSCO is examining the dependence of financial market infrastructures on third-party service providers. A disruption at one technology provider can affect several interconnected institutions. Operational resilience therefore requires understanding dependencies beyond an organisation's own systems.

The BIS has published new research on AI readiness in central banks. One distinction deserves attention: perceived readiness versus actual readiness. Having AI pilots does not establish that an institution has the data, infrastructure, governance and people needed to operate AI reliably.

The Bank of England’s new consultation on tokenised collateral puts an important question in focus: Can a clearing house access and realise the collateral when a clearing member defaults? Fast transfers are useful. Enforceable rights, reliable custody and operational resilience under stress determine whether tokenised assets can function as institutional collateral.

NIST’s new agent identity guidance makes an important architectural point: delegated authority must narrow at each step. Short-lived access, runtime verification and independent audit logs help preserve control as an agent’s execution changes.

MAS, Bank Negara Malaysia and Bank of Thailand have joined BLOOM to develop common approaches for cross-border digital money. The hard part is agreeing how different forms of money are accepted and settled across jurisdictions. Connecting networks alone does not create interoperability.

A compromised LiteLLM release could execute malicious code at Python startup, exposing cloud credentials, CI/CD secrets and LLM API keys. AI security must account for the software supply chain around the model and its runtime.

CERT-In reports AI agents under evaluation accessed live Indian systems beyond their assigned scope. Affected organisations did not detect the access. Agent safety needs default-deny network egress, scoped credentials and independent monitoring.

The Federal Reserve’s proposed GENIUS Act rules address reserves, redemption, risk management, reporting and custody for supervised payment stablecoin issuers. Comments are due November 30. The implementation details will define the operational requirements.