After the Act: What Banks Must Build Before Entering the Virtual Asset Market — PwC at ETHTaipei 2026
On 14 September 2026, Institution Day at ETHTaipei 2026 brought banks, financial institutions and enterprise teams together around digital asset custody, RWA, stablecoins and institutional-grade applications. Neptune Chen, Executive Director at PwC Consulting Taiwan, delivered a keynote on the compliance engineering and capability building required for banks entering the virtual asset market. Our team attended the full session, and the key observations are summarised below.
On-chain payments are faster — but speed is not the whole story
Chen opened with cross-border payment efficiency. According to Swift data published in 2024, around 90% of cross-border payments reach the beneficiary bank within one hour, yet only about 43% reach the end customer's account in that time. The gap rarely comes from the transfer itself. It comes from off-chain steps at the receiving end: compliance checks, foreign exchange controls, batch processing and business hours.
That gap explains why stablecoin payments have drawn institutional attention. Settling value directly on a blockchain removes several intermediary and operational layers.
Chen then introduced a counterweight: a live test conducted by Mega Financial Holding. Mega mobilised 25 overseas locations across 17 countries, each sending 50 USDT back to a licensed Taiwanese exchange, benchmarked against a parallel traditional wire transfer. The results were mixed rather than one-sided:
Settlement time — roughly 20 minutes for stablecoins versus about two hours via SWIFT.
Small transfers (under NT$200,000) — stablecoins cost around 2 USDT plus a 0.2% trading fee, against NT$420–1,100 for a traditional wire.
Large or corporate transfers — bank fees are typically capped and negotiable, while stablecoin costs and spreads scale with size, leaving traditional rails ahead in many large-value cases.
Compliance and safety — traditional banking already has mature KYC, AML, sanctions screening and supervisory structures.
Global availability — only 12 of 25 locations completed the test; the rest were blocked by local rules, exchange restrictions or differences in accepted tokens.
Domestic transfers — both settled in about two minutes, so on-chain showed no meaningful advantage.
The conclusion is not that blockchain will replace banks. It is that on-chain rails excel in specific cross-border and small-value scenarios, and that the real question for banks is which processes are worth moving on-chain while retaining compliance, risk control and asset security.
The real time cost sits off-chain
Chen broke a compliant on-chain cross-border transaction into five stages: pre-transaction compliance (KYC/KYB, Travel Rule data, AML and VASP identification); pre-withdrawal processing (Travel Rule review, internal risk rules, withdrawal scheduling); on-chain execution (broadcast, validation, block inclusion); inbound processing (confirmation, bookkeeping, risk assessment and exception handling); and fiat conversion and local settlement.
On-chain execution typically takes minutes to tens of minutes. The stages that stretch to hours — or to the next business day — are the off-chain ones. The operational lesson is that banks cannot simply compare block times. They must redesign pre-trade, in-trade and post-trade compliance as a whole, and turn compliance from a cost line into a trust and service capability.
From registration to licensing
Taiwan's Virtual Asset Service Act passed its third reading on 30 June 2026 and was promulgated on 22 July 2026. It runs to 56 articles, with the Financial Supervisory Commission (FSC) as competent authority. The effective date is still to be set by the Executive Yuan.
Once in force, Taiwan will move from an AML-registration regime to prior licensing. Key elements include: licensing requirements covering capital, operating bonds, internal controls, information security and governance; separate authorisation by service type (exchange, trading platform, transfer, custody, underwriting, lending and other designated services); an explicit path for qualifying financial institutions to apply for concurrent operation; stronger customer asset segregation, product review, disclosure and advertising rules; a stablecoin regime requiring FSC approval — with the central bank consulted and its consent obtained before approval is granted — full reserve backing, asset segregation, trust custody, audit and disclosure, issuance and redemption at par, and no interest or yield paid to holders; and criminal liability with substantial fines for unlicensed operation and market manipulation.
Existing operators will have a transition period after the Act takes effect. For banks, the meaningful deadline is not the effective date. It is now — the point at which they should map which capabilities exist, which need reinforcement, which to build internally and which to source from specialist partners.
Five capability workstreams
Chen grouped the required build-out into five areas: business planning, custody and key management, transaction monitoring, capital treatment and accounting recognition, and organisation and talent. Two are consistently underestimated.
Custody and key management. In virtual assets, control of the asset is tied directly to control of the private key, and loss or theft can be unrecoverable. Institutional custody is therefore a governance system, not a storage question. It spans segregation of client and proprietary assets, sub-ledger accounting, periodic reconciliation, cold and hot wallet allocation limits, key generation and backup procedures, multi-party authorisation and separation of duties, disaster recovery, incident reporting and external assurance. Current rules cap hot wallet holdings as a proportion of client assets. HSMs, MPC and multi-signature schemes are commonly combined to remove single-key risk. Outsourcing can transfer technical work — it does not transfer the institution's governance responsibility.
Capital treatment. The Basel Committee's cryptoasset standard, SCO60, took effect on 1 January 2026. Tokenised traditional assets and cryptoassets with an effective stabilisation mechanism may fall into Group 1 and be capitalised by reference to their underlying exposure. Everything else falls into Group 2, and Group 2b exposures attract a 1,250% risk weight — meaning every NT$1 of such exposure generates NT$12.5 of risk-weighted assets. This does not require NT$12.5 of capital directly, but it materially increases regulatory capital consumption, and it belongs in the business case alongside revenue projections.
Redesign, not a new data field
Virtual asset services differ from fiat accounts in counterparty structure, asset control and risk origin, so the three core banking journeys need rebuilding rather than extending. Onboarding must add source of funds and wealth, intended use, risk rating, product suitability and expected transaction patterns. Deposits become inbound transfers requiring sanctions screening, source-address risk scoring, counterparty identification and fund-flow tracing. Withdrawals — irreversible and cross-border by nature — need limits, manual review of large transactions, address whitelisting, cooling-off periods for new addresses, format and chain consistency checks, anti-phishing confirmation and circuit breakers.
On top of this sits a layer with no fiat equivalent: on-chain transaction monitoring (KYT), wallet risk analysis and continuous exposure tracking. On the AML/CFT side, banks must meet FATF expectations on virtual asset transfer transparency and Taiwan's phased Travel Rule adoption — counterparty VASP identification, originator and beneficiary information exchange, Travel Rule matching, exception handling, unhosted wallet treatment, suspicious transaction reporting and full audit trails. Retrofitting these after go-live produces manual review backlogs; embedding them at the design stage does not.
Why now
Four forces are pushing banks off the sidelines. Corporate clients are already using or evaluating stablecoins for cross-border payment and treasury; if their bank cannot handle receipt, custody or conversion, demand moves elsewhere. The supervisory framework is clearer, shifting the market conversation from whether to how. Taiwanese institutions have begun research and proofs of concept, and early builders will move from pilot to production faster. And from stablecoins to RWA and tokenised deposits, every model ultimately depends on secure custody, monitoring, identity and compliance infrastructure — making these foundational capabilities rather than product-specific tooling.
Our view
Promulgation of the Act is not the finish line. It is the starting point of an engineering programme. The question has moved past whether to participate, to which business line to enter first, which capabilities to build in-house, which to deliver with specialist partners, and how to embed compliance directly into transaction flows and system architecture.
Custody and key governance, Travel Rule, on-chain monitoring, capital treatment, accounting and operational resilience each cut across business, legal, risk, security and IT at the same time. The real barrier is not connecting to a blockchain. It is bringing virtual assets inside an existing governance framework in a way that is controllable, traceable and auditable. The next phase of competition will not be won by whoever launches first, but by whoever first assembles a complete capability covering asset security, transaction efficiency, regulatory compliance and operational governance.