A comprehensive, source-verified knowledge base of institutional crypto custody regulations across 20 jurisdictions and 5 international frameworks. Every data point is traceable to official legislation, regulatory guidance, or international standards body publications.
Start Here
New to this research? Start with the Regulatory Spectrum for a bird's-eye view, then explore What Works & What Doesn't for evidence-based conclusions. The Regulatory Guidance Framework synthesizes everything into actionable guidance for regulators and custodians.
The Regulatory Spectrum at a Glance
| Position | Examples | Outcome |
|---|---|---|
| Prohibition / No Framework | Jurisdictions without custody-specific rules | Assets held offshore; institutional capital avoids the market |
| Restrictive Licensing | South Korea, Japan | High barriers to entry; limited providers; strong consumer protection |
| Prescriptive Regulation | Germany, France, EU (MiCA), Luxembourg, Liechtenstein | Detailed custody rules; asset segregation mandates; institutional confidence |
| Balanced Regulation | US, UK, Singapore, Hong Kong, Canada, Australia, Brazil | Multiple regulatory pathways; evolving frameworks; market growth |
| Innovation-Friendly | Switzerland, UAE, Bahrain, Bermuda, Cayman Islands, Gibraltar | Bespoke digital asset regimes; competitive positioning; rapid adoption |
| International Standards | IOSCO, BCBS, FATF, FSB, Wolfsberg | Harmonization pressure; cross-border consistency; baseline requirements |
Analysis
Synthesis and cross-cutting analysis across all 20 jurisdictions.
- The Regulatory Spectrum — Maps every jurisdiction from prohibition to innovation-friendly custody regimes, with comparative outcomes
- Country Comparison Tables — Side-by-side tables covering licensing, asset segregation, key management, insurance, capital requirements, and enforcement
- What Works & What Doesn't — Evidence-based assessment of custody regulatory approaches with clear winners and failures
Guidance Documents
Regulator-grade reference documents for policymakers and custodians.
- Regulatory Guidance Framework — Master document defining core custody regulatory elements and the full regulatory spectrum
- Licensing Frameworks — Custody-specific licensing models across jurisdictions, from registration to full prudential licensing
- Asset Segregation & Bankruptcy Protection — Client asset protection, omnibus vs. segregated accounts, and insolvency treatment
- Key Management & Security Standards — Private key governance, HSM requirements, multi-signature controls, and cold storage mandates
- Insurance & Liability — Coverage requirements, liability frameworks, and loss allocation for custodied digital assets
- Capital & Prudential Requirements — Minimum capital, reserve ratios, and prudential buffers for custody providers
- Audit & Reporting Standards — Proof of reserves, SOC reporting, regulatory disclosures, and on-chain verification
- Compliance & Enforcement — AML/KYC obligations, Travel Rule implementation, and enforcement actions against custodians
- Unsaid Items & Implicit Requirements — Gaps in current frameworks, implicit expectations, and emerging regulatory trends
- Implementation Guide — Step-by-step framework for regulators designing custody oversight regimes
Country & Regional Regulations
Americas
- United States — Multi-agency oversight (SEC, OCC, CFTC, banking regulators); decisively pro-custody after SAB 121's rescission via SAB 122 (Jan 2025); SEC Sept 30, 2025 no-action letter lets state trust companies act as qualified custodians; GENIUS Act stablecoin framework; wave of OCC national trust bank charters
- Canada — CSA/CIRO oversight; NI 81-102 custody rules and CIRO four-tier Digital Asset Custody Framework (Feb 2026); 80%+ third-party cold custody; Stablecoin Act (Royal Assent Mar 2026, not yet in force)
- Brazil — BCB/CVM oversight; SPSAV authorization regime under the BVAL operational from Feb 2, 2026 (Resolutions 519/520/521); mandatory segregation, independent technical certification, phased Travel Rule
- Bermuda — BMA-supervised Digital Asset Business Act 2018; statutory creditor-exclusion (DABA s.18(4)), mandatory financial backstop, pari-passu Custody of Client Assets Rules 2025, and prescriptive key-management Code
- Cayman Islands — CIMA VASP Act; Phase Two custody/trading-platform licensing live since 1 April 2025; Feb 2026 Market Conduct framework (MC-RSOG) adds mandatory insurance and conduct standards
Europe
- European Union — MiCA custody provisions (Title V); CASP authorization with passporting; strict (no-fault) liability, mandatory insurance, mandatory asset segregation; full enforcement deadline 1 July 2026
- Switzerland — FINMA-regulated; statutory bankruptcy protection (DLT Act / DEBA Art. 242a–242b) — global benchmark; proposed FinIA Crypto Institution License under consultation
- United Kingdom — FCA safeguarding regime brought into FSMA (full regime live 25 Oct 2027); trust-based ring-fencing reinforced by the Property (Digital Assets etc) Act 2025; bespoke CRYPTOPRU prudential regime
- Germany — BaFin Kryptoverwahrgeschäft license (dedicated category since 2020); MiCA transition via FinmadiG/KMAG; EU leader with 53 authorised CASPs (Apr 2026)
- France — AMF DASP/PSAN regime under PACTE Law transitioning to MiCA CASP; dual AMF/ACPR supervision; transitional period to 1 July 2026
- Liechtenstein — FMA-supervised dual regime: TVTG Blockchain Act (Token Container Model, statutory insolvency segregation) plus MiCAR CASP authorization via the EEA; top-tier bankruptcy-remote venue alongside Switzerland
- Luxembourg — CSSF-supervised; custody under directly-applicable MiCAR plus the Blockchain Laws I–IV DLT-securities (control-agent) framework; dominant EU fund-custody/depositary domicile
- Gibraltar — GFSC principles-based DLT Provider regime (world-first, in force Jan 2018); custody captured directly as a licensable activity under ten regulatory principles; outside MiCA post-Brexit
Asia-Pacific
- Hong Kong — SFC VATP licensing with embedded custody; Aug 2025 custody circular (HSM, air-gapping, smart-contract prohibition); standalone VA Custodian licence targeted for 2026 legislation; Stablecoins Ordinance live
- Singapore — MAS Payment Services Act; custody as a DPT service with trust-account segregation and 90% cold storage (PS-G03); FSMA DTSP regime live since 30 June 2025
- Japan — FSA registration under the PSA; 95%+ cold storage with 100% own-asset hot-wallet backing; statutory preference rights; Cabinet-approved FIEA migration bill (effective ~fiscal 2027 if enacted)
- South Korea — FSC/FSS oversight; VAUPA investor-protection regime (in effect July 2024); 80% cold storage, mandatory insurance/reserves, bank-partnership model; standalone custody licence proposed under second-phase Digital Asset Basic Act
- Australia — ASIC oversight; Digital Assets Framework Act 2026 enacted (Royal Assent Apr 2026, commences 9 Apr 2027); AFSL-based DAP/TCP custody regime with statutory trust, substantive standards pending instruments
Middle East & Africa
- UAE — Multi-regulator hub (VARA, ADGM/FSRA, DFSA, CBUAE, CMA); dedicated custody licences; qualified-custodian mandate with proof-of-reserves; new federal CMA VASP framework effective Feb 2026
- Bahrain — CBB Crypto-Asset Module (first MENA mover); prescriptive custody rules (95% cold storage, mandatory multi-sig, no rehypothecation, 1:1 holding); Stablecoin Issuance & Offering Module (2025)
International Frameworks
- IOSCO — Policy recommendations for crypto-asset custody; client asset protection principles; cross-border standards
- Basel Committee — Prudential treatment of crypto-asset exposures; capital charges for custodial holdings
- FATF — VASP classification for custodians; Travel Rule obligations; risk-based AML/CFT guidance
- FSB — High-level recommendations for crypto-asset activities; systemic risk monitoring; cross-border coordination
- Wolfsberg Group — Financial crime compliance standards; correspondent banking due diligence for digital asset custodians
Last Updated: June 2026
Items
3 items under this folder.