This document presents side-by-side comparison tables across seven regulatory dimensions for institutional crypto custody, covering 20 national jurisdictions plus IOSCO and BCBS international standards. Every cell is sourced from the individual country regulation files produced during Phase 1 research and the verified per-jurisdiction fact matrix. Where data was not available in the source files, cells are marked "No data" or "NOT VERIFIED" honestly.
For analysis of the regulatory spectrum from prescriptive to principles-based, see Regulatory Spectrum. For a synthesis of effective and ineffective regulatory approaches, see What Works & What Doesn't.
Table 1: Legal Status & Institutional Design
This table captures the foundational legal framework, primary regulator, license type, year the custody-specific framework was established, and the approximate number of licensed firms operating under that framework as of early-to-mid 2026.
For detailed licensing analysis across jurisdictions, see Licensing Frameworks.
| Country | Legal Status | Primary Regulator | License Type | Year Established | # Licensed Firms |
|---|---|---|---|---|---|
| United States | Legal; multi-agency framework; no unified federal crypto custody law | SEC, OCC, CFTC, FinCEN, state regulators | Qualified custodian (SEC); national trust bank charter (OCC); state trust charter; BitLicense (NY); SPDI (WY); broker-dealer registration | 2020 (OCC IL 1170); 2025 (major reform wave; GENIUS Act) | 5 OCC national trust banks (Dec 2025) + more approved 2026 (Coinbase Apr 2026); 2 WY SPDIs |
| European Union | Legal; harmonized under MiCA (Regulation (EU) 2023/1114); directly applicable across 27 member states + EEA; Title V applicable 30 Dec 2024, full enforcement 1 July 2026 | National Competent Authorities (NCAs) for authorization; ESMA (EU-level lead); EBA for significant stablecoins; AMLA from 2027 | CASP authorization (MiCA Article 63); passportable across EU (Article 65) | 2024 (MiCA Title V applicable 30 Dec 2024) | ~199 CASPs authorized across EEA (12 Apr 2026); custody most common service (~117 of 199) |
| Switzerland | Legal; explicit statutory framework under DLT Act; ledger-based securities recognized; proposed FinIA Crypto Institution License | FINMA (sole integrated regulator) | Banking license; FinTech license; DLT trading facility license; SRO membership; proposed crypto institution license | 2021 (DLT Act in force); 2026 (FINMA Guidance 01/2026) | 2 crypto banks (Sygnum, AMINA); 1 DLT trading facility (BX Digital); SDX; multiple SRO-supervised firms |
| United Kingdom | Legal; transitioning from MLR registration (AML only) to full FSMA authorization for "safeguarding"; full regime live 25 Oct 2027; Property (Digital Assets etc) Act 2025 | FCA (primary); PRA (for systemically important firms) | MLR registration (current); Part 4A FSMA authorization (from 25 Oct 2027) | 2020 (AML registration); 2027 (full regime commencement) | ~57 AML-registered firms; full FSMA regime not yet operational |
| Germany | Legal; crypto custody classified as regulated financial service since 2020 under KWG; transitioning to MiCA CASP; shortened grandfathering ended 31 Dec 2025 | BaFin (sole competent authority) | Kryptoverwahrgeschaft license (KWG Section 1(1a)); MiCA CASP authorization | 2020 (KWG crypto custody); 2024 (MiCA/KMAG) | 53 MiCA CASPs (12 Apr 2026; highest in EU, ~26% of EU total) |
| France | Legal; PACTE Act (2019) created DASP regime; transitioning to MiCA CASP; transition to 1 July 2026 | AMF (market conduct); ACPR (AML/prudential) | DASP registration (mandatory/enhanced/optional license); MiCA CASP authorization | 2019 (PACTE Act); 2024 (MiCA applicable) | 100+ DASPs registered under PACTE; ~dozen authorized French CASPs as of May 2026 (exact custody count NOT VERIFIED) |
| Liechtenstein | Legal; dual regime: TVTG (Blockchain Act, in force 1 Jan 2020, Token Container Model) plus MiCAR (EEA, applicable 24 Jun 2025) for in-scope custody | FMA (Financial Market Authority, integrated sole regulator) | TVTG VT service provider registration (custody = unified VT-Verwahrer category, Art. 2(1)(n), covering tokens and VT keys; TT Protector distinct); MiCAR CASP authorization (Art. 75 custody) | 2020 (TVTG); 2025 (EWR-MiCA-DG / EEA-MiCA) | 29 TVTG registrations incl. 5 banks (4 Nov 2025); Bank Frick first MiCAR custody authorization (20 Jan 2026) |
| Luxembourg | Legal; regulated principally under directly-applicable MiCAR (custody CASPs from 30 Dec 2024); Law of 6 Feb 2025 designates CSSF; distinctive EU fund-custody/depositary domicile | CSSF (Commission de Surveillance du Secteur Financier, single competent authority) | MiCAR CASP authorization (custody & administration, Art. 62/63 or Art. 60); legacy VASP (run-off to 1 Jul 2026); DLT-securities account-keeper/control-agent | 2024 (MiCAR applicable); 2025 (Law of 6 Feb 2025) | Coinbase Luxembourg S.A. authorized as CASP (30 Jun 2025; selected as EU/MiCA hub) |
| Hong Kong | Legal; VATP licensing under AMLO; standalone custody licensing proposed for 2026 | SFC (virtual assets); HKMA (stablecoins, banks) | VATP licence (AMLO, custody embedded); proposed standalone VA custodian licence; stablecoin issuer licence (HKMA) | 2023 (AMLO VATP licensing); 2025 (Stablecoins Ordinance); 2026 (custody bill targeted) | VATP licensees operating; first stablecoin issuer licences granted 10 Apr 2026 (HSBC, Anchorpoint) |
| Singapore | Legal; DPTs regulated as payment services under PS Act; not legal tender | MAS (Monetary Authority of Singapore, single integrated regulator) | Standard Payment Institution (SPI); Major Payment Institution (MPI); DTSP licence (FSMA 2022) | 2020 (PS Act); 2024 (Amendment Act expanding to custody) | 37 MPI licences for DPT services active (MAS directory, March 2026) |
| Japan | Legal; crypto assets defined as "property value" under PSA; proposed migration to FIEA (Cabinet bill 10 Apr 2026) | FSA/JFSA; JVCEA (FSA-certified SRO) | Crypto Asset Exchange Service Provider (CAESP) registration under PSA; proposed FIEA "crypto-asset business" category | 2017 (PSA); 2026 (FIEA migration proposed) | ~30 registered CAESPs |
| South Korea | Legal; VAUPA (effective 19 July 2024) establishes comprehensive investor protection; standalone custody licence proposed only | FSC (policy); FSS (supervision); KoFIU (AML); KISA (ISMS) | VASP registration with KoFIU + VAUPA compliance; ISMS certification from KISA; standalone custody licence PROPOSED (Digital Asset Basic Act) | 2021 (SFIA registration); 2024 (VAUPA effective 19 July) | 5 exchanges with full KRW trading (Upbit, Bithumb, Coinone, Korbit, GOPAX); additional crypto-to-crypto only |
| Australia | Legal; DAF Act 2026 enacted (Royal Assent 8 Apr 2026, commences 9 Apr 2027); AFSL-based custody regime not yet commenced | ASIC (financial services); AUSTRAC (AML) | AUSTRAC DCE registration (current); AFSL for Digital Asset Platform (DAP) / Tokenised Custody Platform (TCP) (from 9 Apr 2027) | 2018 (AUSTRAC registration); 2026 (DAF Act enacted, commences 2027) | No crypto-specific AFSL regime in force yet; AUSTRAC-registered exchanges operating |
| Canada | Legal; multi-layered federal/provincial framework | CSA (securities); OSFI (prudential); CIRO (SRO); FINTRAC (AML); Bank of Canada (stablecoins) | CTP restricted/investment dealer registration; provincial trust company charter; FINTRAC MSB registration; CIRO four-tier custodian framework | 2020 (CSA Staff Notice 21-327); 2026 (CIRO Digital Asset Custody Framework, 3 Feb 2026) | 1 licensed crypto trust company (Tetra Trust); multiple registered CTPs |
| Brazil | Legal; Law 14,478/2022 establishes virtual asset framework; BCB Resolutions 519/520/521 effective 2 Feb 2026 | BCB (non-security crypto); CVM (securities tokens) | SPSAV authorization (Intermediary, Custodian, or Broker categories); independent technical certification (Instruction 701/2026) gates custody | 2023 (Law 14,478 effective); 2026 (BCB Resolutions effective 2 Feb) | Transition period; authorization deadline 30 Oct 2026 |
| Bermuda | Legal; bespoke regime under Digital Asset Business Act 2018 (DABA) in operation since 2018 | Bermuda Monetary Authority (BMA, integrated sole authority) | Three-class DABA licence (Class T Test / Class M Modified / Class F Full); custody = "custodial wallet services" activity | 2018 (DABA); 2024 (Custody Code); 2025 (Custody of Client Assets Rules) | Multiple DABA licensees; first DAO-governed DABA licence to DerivaDEX (13 Nov 2025, non-custodial) |
| Cayman Islands | Legal; VASP Act (2024 Revision); phased implementation, custody licensing in force since 1 Apr 2025 | CIMA (Cayman Islands Monetary Authority, sole supervisory authority) | Phase Two virtual asset service licence (custody services and trading platforms) since 1 Apr 2025; Phase One registration for other VASP services | 2020 (VASP Act Phase One); 2025 (Phase Two custody licensing) | Custody/VATP licensees under Phase Two; existing-registrant application deadline 30 Jun 2025 (expired) |
| UAE | Legal; multi-regulator model across free zones and mainland; virtual assets a federal "Financial Product" (CMA Decision No. 4/R.M/2026) | VARA (Dubai mainland); ADGM FSRA (Abu Dhabi); DFSA (DIFC); CBUAE (federal/stablecoins); CMA (federal, ex-SCA) | VARA Custody Services license; ADGM FSRA custody authorisation; DFSA custody of crypto tokens; CMA federal Custody Services license | 2022 (VARA established); 2025 (VARA Rulebooks v2.0); 2026 (CMA federal framework) | Multiple licensed entities incl. Komainu, Laser Digital; VARA enforcement active (KuCoin cease orders Mar 2026) |
| Gibraltar | Legal; bespoke statutory DLT regime - Financial Services (DLT Providers) Regulations 2017 in force 1 Jan 2018; custody captured directly as a licensable DLT activity; principles-based | GFSC (Gibraltar Financial Services Commission, single integrated regulator) | DLT Provider authorisation (captures custodial wallet/key-storage); non-custodial Virtual Asset Arrangement Provider (VAAP) category (from 27 Oct 2025) | 2018 (DLT Providers Regulations in force) | DLT Providers supervised on par with banks; first jurisdiction globally to legislate a DLT-specific regime |
| Bahrain | Legal; comprehensive CBB Crypto-Asset (CRA) Module; single-regulator model; first MENA jurisdiction with dedicated crypto-asset regulations | Central Bank of Bahrain (CBB) | Four CASP categories; custody permitted in Category 2, 3, or 4; dedicated CRA-8 custody conduct rules | 2019 (first CRA Module; first CBB license to Rain) | Rain, CoinMENA (acquired by Paribu Dec 2025), Fasset (Cat 3, Jan 2025), and other licensed entities |
| IOSCO | International standard-setter; non-binding recommendations | N/A (130+ member jurisdictions) | Recommendation 12 (Custody & Safekeeping); Recommendation 14 (Disclosure) | 2023 (IOSCOPD747 final recommendations published Nov 16) | 12 jurisdictions with final Rec 12 measures; 11 with full Rec 14 compliance (Oct 2025 review) |
| BCBS | International prudential standard for banks | N/A (member central banks and supervisory authorities) | SCO60 (Cryptoasset exposures) capital framework; DIS55 disclosure framework | 2022 (d545 final standard Dec 16); 2024 (d579 amendments); implementation deadline Jan 1, 2026 | N/A (standard applicable to member banks globally) |
Table 2: Asset Segregation & Bankruptcy Treatment
This table captures how each jurisdiction requires custody providers to segregate client assets, the legal basis for segregation, treatment of client assets in the custodian's bankruptcy, the underlying property law framework, and notable precedent cases.
For detailed analysis of segregation approaches, see Asset Segregation.
| Country | Segregation Model | Legal Basis | Bankruptcy Treatment | Property Law Framework | Precedent Cases |
|---|---|---|---|---|---|
| United States | Mandatory segregation from proprietary assets; omnibus or individual wallets with reconciliation; sub-custodian rules (NYDFS Sept 2025); no commingling/rehypothecation without consent | SEC Sept 30, 2025 no-action letter; NYDFS Sept 30, 2025 guidance; GENIUS Act (stablecoin reserves); CFTC statutory trust for collateral | No single statutory crypto bankruptcy-remoteness provision; NYDFS guidance preserves beneficial ownership through insolvency; FTX/Celsius/Voyager showed contract language determines ownership | Common law; UCC Article 8 (limited applicability); no unified federal statutory framework for crypto in bankruptcy | FTX (no segregation; commingled funds); Celsius (Earn Accounts became Celsius property per ToS); Voyager (similar contractual issues) |
| European Union | On-chain: client crypto on separate addresses from CASP's own; off-chain register of positions per client; omnibus and individual both permitted; prohibition on use of client assets | MiCA Articles 70, 75; ESMA technical standards | Art. 75(7) requires segregation from custodian's estate; prompt return of crypto-assets including in CASP insolvency; omnibus clients exposed to co-mingling risk of other clients | MiCA establishes EU-level conduct rules; national insolvency law still governs property rights in bankruptcy | No major EU-specific crypto custody insolvency case yet |
| Switzerland | Individual or collective (omnibus) custody; "constant readiness" condition; statutory bankruptcy segregation; not lent/pledged without consent | DLT Act; DEBA Articles 242a-242b; Banking Act Art. 16 No. 1bis, Art. 37d | Statutory: crypto assets segregated from bankruptcy estate if conditions met (exclusive power of disposal, constant readiness, individual or pro rata attribution); foreign custody protected only if equivalence met | Civil law (DEBA); statutory provision -- among strongest globally | No major Swiss crypto custody insolvency; statutory framework considered global benchmark |
| United Kingdom | Non-statutory (bare) trust for client cryptoassets under draft CASS 17; omnibus permitted with ownership preserved; daily reconciliation | Draft CASS 17 (crypto safeguarding); Property (Digital Assets etc) Act 2025; FCA CPs | Trust-based ring-fencing: client cryptoassets legally ring-fenced in insolvency and returnable; not part of custodian's general estate; reinforced by Property (Digital Assets etc) Act 2025 | Common law; new "third category" of personal property under Property (Digital Assets etc) Act 2025 | No major UK crypto custody insolvency case; regime not yet in force (25 Oct 2027) |
| Germany | Legal and physical separation of client crypto and private keys from custodian's own; in omnibus, each customer's share determinable at any time (off-chain records) | KWG Section 26b; Section 46i KWG; KMAG Section 45; MiCA Article 70/75 | Creditors of insolvent CASP have no recourse to client crypto-assets (Art. 75(7) / Section 46i KWG); user assets returned to clients | Civil law (BGB); KWG/KMAG statutory framework | No major German crypto custody insolvency case |
| France | Client digital assets segregated from DASP's own at all times; prohibition on unauthorized use; written custody agreement; under MiCA on-DLT segregation | PACTE Act (CMF Articles L. 54-10-1 to L. 54-10-7); MiCA Art. 70/75 (post-transition) | Client assets must be identifiable and separable from custodian's estate in insolvency; under MiCA segregation strengthened; prompt return (Art. 75) | Civil law (Code monetaire et financier); transitioning to MiCA framework | No major French crypto custody insolvency case |
| Liechtenstein | Statutory: tokens/TT keys held in trust or in client's name treated as third-party assets, segregated in client's favour (Art. 25 TVTG); MiCAR Art. 75 separate holding with per-client register | Art. 25 TVTG (Token Container Model); MiCAR Art. 75; Insolvenzordnung (IO, LR 282.0) Art. 41 | Strong statutory insolvency segregation: on bankruptcy of a VT-Verwahrer (custodian) or TT Protector, clients can have tokens segregated (ausgesondert) from estate (Insolvenzordnung (IO) Art. 41); client's claim attaches to the token itself | Civil law; Token Container Model civil-law priority + Insolvenzordnung (IO) Art. 41 | No major Liechtenstein crypto custody insolvency case |
| Luxembourg | MiCAR Art. 75(7): segregate clients' crypto from CASP's own and clearly identify means of access; register of positions per client; DLT securities under dematerialised-securities regime | MiCAR Art. 75(3), 75(7); Blockchain Laws I-IV; national insolvency/property law | Art. 75(7): crypto-assets in custody legally segregated from CASP's estate "in accordance with applicable law"; creditors have no recourse, in particular in insolvency; enforceability less codified than Switzerland's statutory model | Civil law; relies on national insolvency/property law (no stand-alone statutory crypto-segregation regime) | No major Luxembourg crypto custody insolvency case |
| Hong Kong | Strict segregation: client VA and fiat separated from platform proprietary assets; wholly-owned subsidiary structure for VATP custody; trust arrangements | AMLO; SFC VATP Guidelines; proposed standalone custody regime; Stablecoins Ordinance | Trust-based protection; stablecoin holders have absolute right to redeem at par; pro rata reserve asset disposal rights in insolvency | Common law; trust law framework; Stablecoins Ordinance statutory provisions | JPEX fraud case (HK$1.6B alleged fraud; first AMLO crypto prosecution; 16 charged Nov 2025) |
| Singapore | Customer assets in a "trust account" for benefit of customers; distinct blockchain addresses for client vs firm assets; self-custody or assessed safeguarding person | PS Act (as amended 2024, s 23(14)); Payment Services Regulations 2024 | Trust-based segregation protects customer assets in insolvency; lien/right of retention only with written customer consent | Common law; statutory trust under PS Act amendments | No major Singapore crypto custody insolvency case |
| Japan | Mandatory segregation of customer crypto and fiat from operator's own; customer crypto in separate wallets; customer fiat held in trust with trust bank/trust company | Payment Services Act (since 2017 amendments) | Statutory preferential repayment rights over segregated crypto and Redemption Guarantee Crypto Assets, ahead of operator's general creditors; FTX-affiliate customers recovered relatively quickly | Civil law; PSA statutory priority framework | Mt. Gox (2014, ~$450M lost; pre-regulation); Coincheck (2018, ~$530M NEM hack); Zaif (2018, ~$60M) |
| South Korea | Customer KRW in accounts separate from operational (banks sole eligible custodians of deposits); customer VA in dedicated wallets separate from VASP's own; >=80% cold | VAUPA (effective July 2024); SFIA | VASP must "in effect possess" entrusted VA at all times and return on demand; deposits protected via bank deposit insurance; dedicated-custody bankruptcy-remoteness rules NOT VERIFIED (no standalone custody licence yet) | Civil law; VAUPA statutory framework | Terra/Luna collapse (2022; catalyst for VAUPA passage; Do Kwon arrested 2023) |
| Australia | Statutory trust: hold tokens "on trust for or on behalf of" clients; INFO 225 permits omnibus holding now; detailed s 912BE standards NOT VERIFIED (instruments not yet made) | DAF Act 2026 statutory "on trust" mechanism + s 912BE standards (to be made); AML/CTF Act 2006 (current) | Delivered via statutory "on trust" mechanism + s 912BE standards; precise insolvency treatment NOT VERIFIED at instrument level | Common law; trust law; Corporations Act 2001 | Block Earner (High Court appeal heard 12 Mar 2026, judgment reserved as of 2026-06-04) |
| Canada | Client crypto separate from proprietary; clients recorded as beneficial owners; >=80% with Acceptable Third-party Custodians; stablecoin reserves segregated under Stablecoin Act (enacted, not in force) | CSA Staff Notices 21-327/21-332/81-336; NI 81-102 amendments (July 2025); Stablecoin Act (Bill C-15) | Stablecoin Act (enacted, not in force): reserves protected from creditor claims of both custodian and issuer; for CTPs/funds, via segregation + beneficial-ownership recording | Common law (common law provinces); civil law (Quebec); beneficial ownership framework | QuadrigaCX (2019; ~C$123M lost; CEO death; directly motivated CIRO 2026 framework) |
| Brazil | Client assets (fiat BRL and crypto) segregated from firm assets at all times, demonstrable at on-chain and key-management level; no use for SPSAV's own operations | BCB Resolution 520; Law 14,478/2022; CVM Resolution 175 (investment funds) | NOT VERIFIED as a codified statutory bankruptcy-remoteness provision; protection via mandatory segregation, non-delegable custodial responsibility, and prohibition on use of client assets | Civil law; BCB regulatory framework | No major Brazilian crypto custody insolvency case |
| Bermuda | Client assets segregated from licensee's own (DABA s.17, s.18; Custody Rules 2025 r.5); pooling only with written client consent; no rehypothecation | DABA s.18(4); Custody of Client Assets Rules 2025; Digital Asset Custody Code (Feb 2024) | Statutory: DABA s.18(4) - custodied client digital asset held for the client, not property of the licensee, "not subject to the claims of creditors of the licensed undertaking"; Custody Rules 2025 add pari-passu insolvency waterfall (r.12) | Common law; DABA statutory creditor-exclusion + rules-based pari-passu waterfall | Bittrex Global (Bermuda) Ltd (Class F) orderly exit (2024) illustrating wind-down framework |
| Cayman Islands | Custodians segregate client VA from proprietary; identifiable, segregated wallets (distinct blockchain addresses); client fiat at a CIMA-regulated/non-high-risk bank; reconciliation required | VASP Act (2024 Revision); Custody/VATP Rule (Dec 2024, updated Feb 2026); Statement of Guidance | No codified statutory crypto-segregation/bankruptcy-remoteness provision; outcome (assets outside custodian's estate) achieved via segregation, identifiable wallets, and custody contracts; standard Companies Act + common-law trust/property principles apply | Common law; Cayman Companies Act + common-law trust/property principles; relies on cross-border jurisprudence | No major Cayman crypto custody insolvency case |
| UAE | VARA: client-level segregation in separate VA wallets per client; proprietary vs. client separation; proof-of-reserves; ADGM/CMA: client assets held separately, structural separation of exchange and custody | VARA Custody Services Rulebook v2.0; VARA Issuance Rulebook (9 Apr 2026); ADGM Conduct of Business Rules; CMA Decision No. 4/R.M/2026 | VARA: only licensed "qualified custodians" (multi-sig or insured vault, audit trails, proof-of-reserves) designed to protect assets in insolvency; VARA Issuance Rulebook: issuers must legally segregate Reserve Assets out of issuer's estate; CMA segregation specifics NOT VERIFIED | VARA: Dubai civil law; ADGM/DIFC: English common law | BitOasis conditional VARA license suspended (Aug 2023) for not meeting mandated conditions |
| Gibraltar | Principle 5 / Guidance Note 5: custodial assets and monies segregated from the DLT Provider's own; distinct wallets/addresses; record-keeping identifying each client's entitlement; fiat with a regulated institution | Financial Services (DLT Providers) Regulations 2017/2020 Principle 5; GFSC Guidance Note 5; general trust/insolvency law | No crypto-specific statutory bankruptcy-remoteness provision (no DEBA 242a equivalent); rests on Principle 5 operational segregation + general Gibraltar trust/insolvency law; statutory crypto-insolvency segregation NO DATA FOUND | Common law; general Gibraltar trust/insolvency law (no crypto-specific statute) | No major Gibraltar crypto custody insolvency case |
| Bahrain | Client assets in specially created, segregated accounts identified separately from licensee's own (CRA-4.5.2); client money in a separate client bank account with a Bahrain-licensed retail bank; no rehypothecation | CBB CRA Module (Volume 6); CRA-4.5.2/4.5.3; CRA-8.1.5-8.1.8 | Sub-custodian renunciation declaration (CRA-4.5.3) + CRA-8.1.6 no-encumbrance prohibition; ring-fencing intended via rulebook provisions rather than tested precedent (no published case law, NOT VERIFIED in court) | Civil law; CBB regulatory framework | No major Bahraini crypto custody insolvency case |
| IOSCO | Rec 12: adequate protection of Client Assets at all times; accurate records establishing nature, amount, location, and ownership; minimise risk of loss or misuse | IOSCOPD747 Recommendation 12 | Rec 14: clients must understand legal protections available in CASP insolvency or operational failure | Principles-based; relies on national implementation | N/A (non-binding standard) |
| BCBS | Segregated custody does not create on-balance-sheet risk; stablecoin reserves must be bankruptcy-remote | SCO60; d579 amendments | Custody on segregated basis: no credit/market/liquidity capital requirements; operational risk capital only; stablecoin reserves: bankruptcy-remote structures required | Relies on national insolvency frameworks; sets prudential floor | N/A (prudential standard for banks) |
Table 3: Key Management & Security Standards
This table covers cold storage requirements, mandated storage ratios, HSM/MPC requirements, whether the approach is prescriptive or outcome-based, and applicable audit standards.
For detailed guidance on key management approaches, see Key Management.
| Country | Cold Storage Requirement | Mandated Ratio | HSM/MPC Requirements | Prescriptive vs Outcome-Based | Audit Standard |
|---|---|---|---|---|---|
| United States | No federal mandate; offline/air-gapped cold storage is industry standard; SEC requires controls "consistent with industry best practices" | No mandated ratio | No federal mandate; industry standard (HSM, MPC, multi-sig); SEC broker-dealer "physical possession" guidance requires private-key protection | Outcome-based at federal level; some state-level prescriptive requirements | SOC-1 or equivalent (SEC no-action letter); SOC-2 Type II industry standard; NYDFS 23 NYCRR Part 500 (cybersecurity) |
| European Union | Cold storage for majority of client holdings (ESMA guidance); hot wallets limited to operational minimums (best-practice, not codified ratio) | No specific mandated ratio | MPC and HSMs recognized; documented key reconstruction and incident recovery; multi-signature approval workflows | Hybrid: MiCA outcome-based principles; ESMA guidance more specific; DORA adds prescriptive ICT resilience requirements | Annual financial statement audit by independent auditor; DORA penetration testing; daily reconciliation between client registers and on-chain balances |
| Switzerland | Outcome-based expectation for robust technical infrastructure; majority cold storage is market practice but not mandated by ratio | No mandated ratio | Outcome-based: FINMA expects custody infrastructure mitigating key compromise; market practice includes HSM, MPC, multi-sig, geographic distribution | Outcome-based (FINMA Guidance 01/2026) | Annual regulatory audit by FINMA-approved audit firm; ad hoc reporting for security incidents; FINMA Guidance 03/2025 on crypto disclosure |
| United Kingdom | Hot, warm, or cold storage permitted as appropriate to risk profile; no fixed cold-storage ratio; cold storage and multi-sig must meet ISO/IEC 27001 | No mandated ratio | MPC, HSMs, multi-signature wallets recognized (CP25/14); ISO/IEC 27001 compliance expected | Outcome-based with specific security expectations; CASS 17 reconciliation requirements are prescriptive | Annual client-asset audit (CMAR); daily reconciliation (CASS 17); independent third-party assessments of sub-custodians |
| Germany | Minimum 95% of client assets in cold storage (flagged secondary-source/market expectation, not codified BaFin requirement); air-gapped signing | 95% cold storage (market-expectation, not codified) | HSMs or MPC infrastructure expected; multi-signature min 3-of-5; hardware wallets EAL 4+ (or FIPS 140-2 Level 3 HSMs) | Highly prescriptive (with some thresholds flagged as market-expectation) | Quarterly penetration testing by independent third parties; SOC 2 Type II or ISO 27001 expected; DORA compliance mandatory; annual financial audits to BaFin |
| France | Resilient and secure IT systems required; cybersecurity self-assessment questionnaire; custody-specific security under enhanced registration (Jan 2024) | NO DATA (no specific cold-storage ratio prescribed) | Internal control covering access management and key custody; MiCA custody policies for private key safekeeping (post-transition) | Mixed: PACTE more outcome-based; MiCA transition adds prescriptive elements via DORA | AMF on-site supervision; ACPR on-site AML/CFT inspections; DORA ICT risk reporting from 2025 |
| Liechtenstein | NOT VERIFIED - TVTG imposes no explicit minimum cold-storage percentage; market-driven cold-storage-dominant designs only | No mandated ratio (NOT VERIFIED) | No granular statutory standards (HSM models, ratios); multi-sig/MPC, HSM storage are market practice; MiCAR/DORA govern ICT risk | Outcome-based (TVTG organisational expectations); MiCAR/DORA layer for in-scope entities | TVTG: company-law statutory audit, event-driven supervision; MiCAR CASP: annual external audit with FMA inspection rights; DORA resilience testing |
| Luxembourg | Not prescribed by Luxembourg regulation - no national cold-storage percentage, HSM mandate, or MPC requirement; market practice only | No mandated ratio (NOT VERIFIED any CSSF quantitative ratio) | No prescriptive national technical standard; multi-sig/MPC, HSM-backed key storage as market practice; DORA operational-resilience for CASPs | Outcome-based (MiCAR Art. 75(5) custody policy); DORA prescriptive on ICT resilience | Annual statutory audit of financial statements; CSSF supervisory reporting; DORA resilience testing and ICT incident reporting |
| Hong Kong | SFC Circular (Aug 2025): cold wallets must NOT include smart contracts on public blockchains; air-gapped; certified HSMs; original VATP guideline 98% cold / 2% hot; ASPIRe moving to outcome-based | 98% cold / 2% hot (original); evolving toward risk-based under ASPIRe | Certified HSMs mandatory; keys generated offline; strict multi-factor physical access; 24/7 security operations center | Highly prescriptive (SFC Circular Aug 2025); shifting toward outcome-based under ASPIRe Initiative 3 | External audit of financial statements; independent third-party assessments of custody; monthly financial returns; daily insurance/compensation monitoring |
| Singapore | At least 90% of customers' assets in cold wallets (PS-G03 Guidelines); dual authorization for asset movements | 90% cold storage | MPC recognized (key shares distributed); dual authorization (no individual can unilaterally move assets); physical device access controls | Prescriptive on cold storage ratio; outcome-based on specific technology choices | External auditor attestation (licence applications); PSN04 regulatory returns; monthly customer statements; MAS TRM Guidelines compliance |
| Japan | >=95% of users' crypto in cold (offline) wallets - among the highest mandated globally; hot-wallet exposure (<=5%) backed 100% by operator's own crypto in cold wallets | 95% cold storage | Multi-signature common practice; secure key generation/storage/backup; mandatory black-letter technical key-mgmt standards NOT VERIFIED (supervised via FSA/JVCEA) | Highly prescriptive | Annual CPA segregation audit; FSA on-site inspections of system risk/cybersecurity; reform adds independent third-party code audits for token offerings |
| South Korea | At least 80% of customer VA in cold storage (offline, hardware-secured); per VAUPA Enforcement Decree on monthly economic value; hot wallet <=20% | 80% cold storage | ISMS certification from KISA covering access control, encryption and key management, network security, incident response, BCP | Prescriptive on cold storage ratio; detailed via ISMS certification requirements | ISMS certification renewal (periodic); FSS on-site inspections; KoFIU registration compliance; market surveillance under VAUPA |
| Australia | No fixed cold-storage percentage mandated (contrasts Japan 95%, South Korea 80%, Singapore 90%); technology-neutral | No mandated ratio | No prescribed key-management standard; technology-neutral; whether s 912BE/912BF instruments add one is NOT VERIFIED | Outcome-based; transactional/settlement standards (s 912BF) to be prescribed by legislative instrument | AUSTRAC compliance reporting + Corporations Act financial reporting now; periodic auditor review anticipated under DAF Act (NOT VERIFIED on pen-test) |
| Canada | >=80% of client crypto with Acceptable Third-party Custodians (typically cold storage); offline private cryptographic key required for fund custodians (NI 81-102) | 80% with third-party custodians (CTP requirement) | SOC-2 Type II for investment fund custodians; CIRO Tier 1/2 require independent external cybersecurity reviews | Mixed: prescriptive ratio (80%); outcome-based on technology choices | Annual SOC-2 Type II report (12-month coverage); CIRO cybersecurity reviews for Tier 1/2; CSA compliance reviews |
| Brazil | Cybersecurity measures documented; private key storage safeguards; no specific cold storage ratio; Instruction 701/2026 assesses cryptographic-key redundancy | No mandated ratio | Industry-reported MPC or HSM-backed key management with redundancy (Fireblocks, industry-reported); Resolution 520 cybersecurity (encryption, smart-contract monitoring) | Outcome-based (BCB Resolution 520) | Independent technical certification (Instruction 701/2026); independent audits to verify segregation; certifier-accreditation criteria NOT VERIFIED |
| Bermuda | No fixed cold-storage percentage - risk-assessment-based hot/cold split (Custody Code Feb 2024 s2.2); prescriptive key-management standards | No mandated ratio (risk-based) | HSMs certified to FIPS 140-2 recommended; seeds >=256-bit entropy, >=24-word mnemonic; M-of-N multi-sig with >=3 signatories; >=3-person seed ceremony | Highly prescriptive on key management (Custody Code); outcome-based on cold/hot ratio | Annual board-approved IT audit plan; key/seed processes audited at least every six months; multi-sig annually; quarterly transaction-sample audits |
| Cayman Islands | Offline (cold) storage expected as a safeguarding measure; no fixed minimum cold-storage percentage published (NOT VERIFIED that a numeric percentage is mandated) | No mandated ratio (NOT VERIFIED) | Robust private-key management with documented backup procedures and key-compromise protocols tested annually; comprehensive cybersecurity/IT expectations | Outcome-based (risk-management framework; documented procedures) | Independent third-party security audits of custody/key-management systems; annual key-compromise protocol testing |
| UAE | VARA: risk-based analysis to determine hot/cold/warm allocation; NO mandated cold storage percentage (oft-cited 95% does NOT originate from VARA); geographic key distribution | No mandated ratio (risk-based) | VARA: robust secure private-key generation; industry-standard cryptography; multi-sig where appropriate (VARA reserves right to mandate); geographic key distribution; ADGM/DFSA standard controls | VARA: prescriptive on process/documentation; outcome-based on storage ratios; ADGM: outcome-based | VARA: independent third-party wallet management audits; proof-of-reserves checks; ADGM: annual audited financial statements |
| Gibraltar | Private keys for public-network assets held in online (hot) wallets only to the extent needed for immediate liquidity, remainder in cold storage; NO fixed percentage (NO DATA FOUND) | No mandated ratio (qualitative standard) | No prescriptive technical mandates; cyber-security controls proportionate to value/volume (Principle 7); resilience/contingency (Principle 9) | Outcome-based (Guidance Note 5 + Principles 4, 7, 9) | Financial-statement audit under general law; prescribed reconciliation cadence NOT VERIFIED; crypto proof-of-reserves/SOC attestation mandate NOT VERIFIED |
| Bahrain | 95% cold storage - minimum 95% of each client crypto-asset held in cold wallets, calculated separately per asset (CRA-8.1.9) | 95% cold storage | Mandatory multi-signature - no sole signatory may authorise movement, no single person may fully access keys (CRA-8.1.11, 8.1.13); secure key generation/storage/backup (CRA-5) | Prescriptive on security controls (CRA-5, CRA-8); prescriptive cold storage ratio (95%) | Penetration testing mandatory twice per year by external certified penetration testers (CRA-5.8.13G(e); interval/reporting in CRA-5.8.13I); third-party assessment for sandbox graduates; CBB inspections |
| IOSCO | Rec 12: adequate protection reliant on strength of systems, policies, and procedures; Rec 13: operational and technological risk management | No mandated ratio | No specific technology mandates; principles-based | Outcome-based (principles-based) | Rec 12: accurate and up-to-date records establishing nature, amount, location, and ownership of Client Assets |
| BCBS | Custody on segregated basis subject to operational risk capital; operational risk frameworks must be comprehensive | No mandated ratio | Entities performing custody must have comprehensive governance framework and appropriate risk management standards | Outcome-based (prudential floor) | DIS55: annual qualitative reporting on crypto activities; semiannual quantitative disclosures on capital by asset group |
Table 4: Capital & Prudential Requirements
This table presents minimum capital thresholds, dynamic capital mechanisms, Basel framework adoption, stress testing requirements, and the prudential authority for each jurisdiction.
For detailed analysis of capital frameworks, see Capital Requirements.
| Country | Minimum Capital | Dynamic Capital | Basel Adoption | Stress Testing | Prudential Authority |
|---|---|---|---|---|---|
| United States | WY SPDI: $5M statutory / ~$10M practical; OCC national trust banks: standard OCC; broker-dealer: $5K-$250K (Rule 15c3-1); NY trust: case-by-case | WY SPDI: 1.25%-1.75% of AUM/AUC or $10M (whichever greater) + 3 years surplus; broker-dealer net liquid assets ongoing | SAB 122 (Jan 2025) removed SAB 121 balance-sheet liability; GENIUS Act places stablecoin reserves on-balance-sheet under modified capital charge; Basel crypto adoption ongoing | No crypto-specific federal stress testing mandate | OCC (national trust banks); state banking regulators; SEC (broker-dealers, RIAs); CFTC (FCMs) |
| European Union | EUR 125,000 for custody CASPs (Class 2, Annex IV); Class 1 EUR 50,000; Class 3 EUR 150,000 (trading platform) | Higher of fixed minimum OR one quarter of prior year's fixed overheads (Article 67, reviewed annually) | CRR III incorporates Basel crypto framework with MiCA adjustments | No crypto-specific stress testing under MiCA; DORA operational resilience testing applies | NCAs (primary); ESMA (EU-level oversight); EBA (significant stablecoins) |
| Switzerland | FinTech license: CHF 300,000; DLT trading facility (trading only): CHF 1M; DLT (with custody/settlement): CHF 5M; banking license: standard bank capital; proposed crypto institution: thresholds NOT YET PUBLISHED | Banks: segregated custody assets generally off-balance-sheet (no additional capital); FINMA may impose maximum-amount limits or add-on charges | Basel III via CAO/LiqO; Basel crypto standard (SCO60) expected to be transposed as finalized | No crypto-specific stress testing; standard bank stress testing applies | FINMA (sole integrated regulator) |
| United Kingdom | Custody (safeguarding) PMR: GBP 150,000 | Own Funds = highest of PMR, Fixed Overhead Requirement (1/4 annual), or K-Factor (K-CSG: 0.04% of average client cryptoassets safeguarded) | Bespoke CRYPTOPRU regime modelled on MIFIDPRU (CP25/15, CP25/42) | ICARA process required; BLAR liquidity; wind-down planning mandatory | FCA (primary); PRA (systemically important firms) |
| Germany | Pre-MiCA (KWG): EUR 150,000 for pure crypto custody (up to EUR 730,000 with added services); Post-MiCA: EUR 125,000 (Class 2) | MiCA: higher of Annex IV minimum or 1/4 prior year's fixed overheads (Article 67(1)) | CRR III (EU Basel implementation) applies | DORA operational resilience testing; no crypto-specific stress testing | BaFin (sole competent authority) |
| France | Registered DASPs (basic PACTE): no minimum. Licensed DASPs: EUR 150,000 for custody; MiCA CASP: EUR 125,000 (Class 2) | Licensed DASPs: highest of fixed overheads, EUR 150,000, or 4.5% of own-account digital assets; MiCA: higher of class floor or 1/4 prior fixed overheads | CRR III (EU Basel implementation) applies | No crypto-specific stress testing; DORA applies | AMF (market conduct); ACPR (AML/prudential) |
| Liechtenstein | TVTG: custodian (VT-Verwahrer) flat CHF 100,000 (Art. 16(1)(b)); the CHF 50,000 / 100,000 / 250,000 issuance-value tiers apply to token issuers (Art. 16(1)(a)), not custodians; MiCAR custody CASP: EUR 125,000 | MiCAR Art. 67/Annex IV: higher of EUR 125,000 (custody) or 1/4 prior year's fixed overheads | MiCAR Art. 67/Annex IV; Art. 60 credit institutions under banking CRR/CRD | DORA operational resilience testing (MiCAR-authorised entities); no crypto-specific stress testing | FMA (integrated sole regulator) |
| Luxembourg | MiCAR Art. 67/Annex IV Class 2 (custody & administration): EUR 125,000 permanent minimum | Higher of EUR 125,000 or one quarter of preceding year's fixed overheads (Art. 67(1)); own funds = CET1 per CRR | MiCAR Art. 67/Annex IV (uniform EU); Art. 60 credit institutions/investment firms under CRR/CRD, IFR/IFD; Luxembourg-specific add-on NOT VERIFIED | No crypto-specific stress testing; DORA applies | CSSF (single integrated supervisor) |
| Hong Kong | Proposed VA custodian: HK$10M (~US$1.28M) paid-up share capital; banks (Authorised Institutions) exempt; stablecoin issuer: HK$25M | Minimum liquid capital up to HK$3M (~US$384K); excess liquid capital must cover >=12 months operating expenses; banks exempt | HKMA incorporating Basel crypto standard; potential easing for permissionless blockchain assets with effective risk management | No crypto-specific stress testing mandate stated | SFC (VA); HKMA (banks, stablecoins) |
| Japan | Stated capital >= JPY 10 million plus positive net assets (statutory floor); "JPY 50 million practical minimum" NOT VERIFIED (secondary commentary only) | Must maintain positive net assets and report to FSA; hold Redemption Guarantee Crypto Assets backing 100% of hot-wallet balances | JFSA aligned with Basel crypto standard | No data on crypto-specific stress testing | FSA/JFSA |
| Singapore | MPI/DTSP base capital SGD 250,000; SPI SGD 100,000 (PS Act / FSMA 2022) | Ongoing minimum-capital maintenance + security deposit SGD 100,000 (SPI) / SGD 200,000 (MPI) | No crypto-specific Basel adoption; prudent valuation (50% haircut) for DPT holdings | No crypto-specific stress-testing mandate | MAS (PS Act SPI/MPI) |
| South Korea | VAUPA/SFIA prescribe no specific minimum capital; de facto barriers via bank partnership, ISMS costs, insurance/reserves; dedicated-custody capital NOT VERIFIED | Effective barriers: bank partnership due diligence, ISMS certification/maintenance, insurance/compensation reserves; mandatory insurance OR reserves | No data on Basel crypto standard adoption | No data on crypto-specific stress testing | FSC (policy); FSS (supervision) |
| Australia | NOT VERIFIED - DAP/TCP-specific capital figures not yet published (instruments due roadmap months 6-12); standard AFSL RG 166 obligations apply | Standard AFSL RG 166 (positive NTA, liquid assets, cash-flow solvency); anticipated DAP/TCP liquidity + NTA requirements | No data on Basel crypto standard adoption for crypto custodians | No crypto-specific stress testing mandate | ASIC (financial services); AUSTRAC (AML) |
| Canada | Provincial trust company: C$10M (Canadian custodian) / C$100M (foreign custodian); OSFI FRFIs: operational risk capital for segregated custody; CTP: case-by-case (single published figure NOT VERIFIED) | OSFI: Group 2 exposure limit raised from 1% to 5% of Net Tier 1 capital (Oct 2025); CIRO tiered capital based on custodian tier | OSFI Capital & Liquidity Treatment of Crypto-asset Exposures (Banking) Guideline (Basel-aligned, effective fiscal Q1 2026) | Quarterly capital and liquidity reporting incorporating crypto exposures | OSFI (FRFIs); provincial securities regulators; CIRO (investment dealers) |
| Brazil | Original BVAL: R$1M (intermediary), R$2M (custodian), R$3M (broker), +R$2M for margin/staking; November 2025 reform replaced fixed per-type minimums with an activity-based capital formula (Resolution BCB 517 + Joint Resolution 14, both 3 Nov 2025), producing an R$10.8M-R$37.2M span (cost component + activities component x captation factor 1.0-1.5); no simple category-to-figure mapping | Minimum paid-in capital and net equity set by the activity-based formula (Res. BCB 517 / Joint Resolution 14), not a fixed per-SPSAV-category figure; financial institution accounting standards | Public Consultation 126/2025 proposes Basel-aligned prudential capital (RWA/LCR) - DRAFT, no final norm as of June 4, 2026 | No data on crypto-specific stress testing | BCB (VASPs); CVM (securities tokens) |
| Bermuda | Minimum net assets US$100,000 for Class M and Class F (DABA s.9(3)), or higher as BMA directs; Class T case-by-case | Floor scaled up for custodians by BMA case-by-case (NOT VERIFIED publicly); custody annual fee floor US$150,000 (highest activity-specific minimum) | Bermuda not a Basel Committee member (BCBS crypto standards do not apply directly); no separate quantitative capital ratio for custody published | No published crypto-specific stress testing; Amendment Act 2024 expanded BMA capital/solvency/liquidity powers | Bermuda Monetary Authority (BMA) |
| Cayman Islands | No published fixed minimum net-worth/capital threshold for custodians; capital adequacy assessed case-by-case by CIMA (fixed numeric minimum NOT VERIFIED) | Custody/VATP Rule imposes regulatory capital, recovery plans, and stress testing; confirmed unchanged Feb 2026 | No data on Basel crypto adoption (CIMA prudential rules case-by-case) | Stress testing required under Custody/VATP Rule | Cayman Islands Monetary Authority (CIMA) |
| UAE | VARA custody: AED 4,000,000 (~US$1.089M); ADGM custody: USD 4,000,000 Tier-1 (public funds) / USD 250,000 BCR (non-public); CMA custody: AED 3,000,000 (figures conflict per summaries) | VARA: ongoing Net Liquid Asset and Reserve Asset requirements; ADGM: 6 months operating expenses + buffer; CMA: 6 months operating expenses buffer | No data on specific Basel crypto adoption | No data on crypto-specific stress testing | VARA; ADGM FSRA; DFSA; CBUAE; CMA |
| Gibraltar | No single fixed statutory minimum capital figure published; individualised risk-based "adequate financial and non-financial resources" test under Principle 3 (case-by-case; NOT VERIFIED) | Adequate resources maintained on a continuing basis; GFSC can require more where risk warrants | Outside EU - does NOT apply MiCA CASP own-funds floors or EU CRR/IFR; no crypto-specific Basel transposition located (NOT VERIFIED) | No published crypto-specific stress testing mandate | GFSC (single integrated regulator) |
| Bahrain | Minimum paid-up capital by category (CRA-3.1.2): Cat 1 BHD 25,000; Cat 2 BHD 100,000; Cat 3 BHD 200,000; Cat 4 BHD 300,000 (custody in Cat 2/3/4) | Paid-up share capital (unimpaired by losses, deposited in local Bahraini banks) maintained at or above minimum at all times | No data on Basel crypto standard adoption | No data on crypto-specific stress testing | CBB (sole regulator) |
| IOSCO | N/A (not a prudential standard-setter) | N/A | N/A (coordinates with BCBS) | N/A | N/A |
| BCBS | Operational risk capital for segregated custody; Group 2b assets: 1,250% risk weight (dollar-for-dollar); Group 2 exposure cap: 1% of Tier 1 capital | Exposures exceeding 1% Tier 1 treated as Group 2b; at 2% threshold, all Group 2 becomes Group 2b | Sets the global Basel standard (SCO60); implementation deadline Jan 1, 2026 | Banks must notify supervisors of existing exposures; advance notification before new exposures | Member central banks and supervisory authorities |
Table 5: Insurance & Liability
This table examines the liability model applied to custodians, whether insurance is mandated, coverage requirements, deposit guarantee applicability, and the presence of strict liability provisions.
For detailed analysis of insurance and liability frameworks, see Insurance & Liability.
| Country | Liability Model | Insurance Mandate | Coverage Requirements | Deposit Guarantee | Strict Liability |
|---|---|---|---|---|---|
| United States | Primarily contract + state law; SEC no-action conditions and NYDFS guidance establish baseline (no unauthorized use/rehypothecation/pledging; preserve beneficial interest) | No federal mandate; market-driven commercial crime/specie insurance | Market practice: Crypto.com $120M (Lloyd's); BitGo $100M; Coinbase $255M; Bitstamp $300M | FDIC does not cover crypto; OCC national trust banks are uninsured trust structures | No federal strict liability standard; liability governed by contract and state law |
| European Union | Strict (no-fault) liability under MiCA Article 75(8): custodian liable for loss of clients' crypto-assets or means of access attributable to it; delegation does not transfer liability | Yes (mandatory insurance against liability risks to clients under MiCA) | Adequate to cover potential liability exposure; capped at market value of lost assets at time of loss; no consequential damages | Crypto not covered by Deposit Guarantee Schemes Directive | Yes -- Article 75(8): no-fault liability; overrides contractual exclusions |
| Switzerland | Contract-based; regulated custodians remain fully liable for client assets regardless of outsourcing/sub-custody (FINMA Guidance 01/2026) | No specific mandatory insurance for crypto custody; adequate operational risk coverage expected; insurance intermediaries must hold PI insurance/surety | No prescribed minimum; institutional-grade custodians maintain coverage as market expectation | esisuisse covers bank deposits to CHF 100,000; segregated crypto custody assets NOT covered (protected instead via DEBA segregation) | No statutory strict liability for crypto custody; contractual and regulatory liability |
| United Kingdom | Continuous obligation to hold correct cryptoassets for clients; SM&CR duty of responsibility; firm bears responsibility even where outsourced | Not currently mandated; FCA considering whether to require specific custody insurance (final rules not published) | None mandated; reliance on trust-based ring-fencing, prudential capital, operational resilience | FSCS coverage for crypto custody NOT confirmed | No strict liability standard; trust-based model provides structural protection |
| Germany | MiCA Art 75(8) attributability-based liability (not no-fault; carve-out for DLT-inherent failures outside CASP control), capped at lost asset's market value | No statutory PI-insurance requirement under KWG; under MiCA, custody CASPs must maintain professional indemnity insurance OR equivalent own funds | MiCA: PI insurance or equivalent own funds; BaFin expects coverage for system failures, gross negligence, cybersecurity breaches | No crypto deposit guarantee | Attributability-based via MiCA Article 75(8) (with DLT-inherent-failure carve-out) |
| France | Licensed DASPs bear liability for loss of client digital assets from custodian negligence or security failures (CMF); MiCA adds Art. 75(8) liability post-transition | Yes for licensed DASPs (Article 721-5 AMF General Regulation): professional liability insurance OR adequate own funds | PI insurance covering system failures, operational disruptions, gross negligence, client fund protection, cybersecurity breaches | No crypto deposit guarantee | MiCA Art. 75(8) liability applies post-transition (basic PACTE registration not subject to PI requirement) |
| Liechtenstein | TVTG civil liability for custody/organisational breaches; MiCAR Art. 75 - custody CASP liable to clients for loss of custodied crypto up to market value, save events beyond reasonable control; sub-custodian liability stays with authorising CASP | No statutory minimum crypto-custody insurance sum (NO DATA FOUND for a statutory minimum amount); MiCAR allows insurance/guarantee as prudential-safeguard alternative | None mandated; institutional custodians carry market-driven crime/specie insurance; deposit-guarantee scheme (EAS, CHF 100,000) covers bank fiat only | EAS deposit-guarantee scheme (CHF 100,000) covers bank fiat deposits only, not custodied crypto (protection via statutory segregation) | MiCAR Art. 75(8) attributability-based liability (save events beyond reasonable control) |
| Luxembourg | MiCAR Art. 75(8): CASP liable to clients for loss of crypto-asset or means of access attributable to it, capped at market value at time of loss; cannot be excluded by contract; delegation does not transfer liability | No mandatory minimum crypto-custody insurance amount prescribed; insurance is one permitted route to meet the Art. 67 prudential floor (Luxembourg-specific overlay NOT VERIFIED) | Art. 67(4) insurance policy (if used): EU-authorised insurer, >=1 year initial term, >=90-day cancellation notice, covers Art. 75(8) liability; no deposit-guarantee coverage for custodied crypto | No deposit-guarantee coverage for custodied crypto | MiCAR Art. 75(8) attributability-based liability; cannot be excluded by contract |
| Hong Kong | Daily monitoring of total client VA value to maintain coverage; senior management accountable for custody controls | Yes (mandatory for VATPs); proposed custody regime requires suitable insurance (specific ratios not finalised) | 50% of client VA in cold storage + 100% in hot/other storage; forms: insurance, demand/time deposit (<=6 months), bank guarantees | No crypto deposit guarantee | No data on strict liability standard; insurance/compensation framework provides functional equivalent |
| Singapore | Disclosure of loss-handling for fraud/negligence; prohibition on lending/staking/pledging retail customer assets; conflict-of-interest management | No specific insurance mandate for DPT service providers | Not mandated; providers must disclose in writing processes for handling losses from fraud or negligence | No crypto deposit guarantee | No strict liability standard; disclosure-based framework |
| Japan | Customer statutory preferential repayment rights in insolvency; operator liability for hot-wallet losses (Coincheck precedent ~JPY 46.3bn); reserve/insurance for unauthorized outflows under reform | No mandatory blanket insurance currently (NOT VERIFIED); reform proposes mandatory reserve-fund accumulation OR equivalent insurance for unauthorized-outflow losses incl. cold-wallet value | Hot-wallet exposure fully backed by operator's own crypto (Redemption Guarantee Crypto Assets); reserves/insurance supplement | No crypto deposit guarantee; customer statutory priority claim in bankruptcy | No explicit strict liability; hot wallet backing creates functional guarantee |
| South Korea | Insurance must cover losses attributable to VASP's own negligence or system failures; financial reserves for uncovered loss events | Yes (mandatory under VAUPA) - insurance OR compensation reserves covering hacking, operational failures, theft | Minimum coverage set by FSC regulation calibrated to size/risk (specific numeric floor NO PUBLIC FIGURE LOCATED); bank deposit insurance for KRW deposits | Customer KRW deposits benefit from bank deposit insurance framework (bank partnership model) | No data on explicit strict liability; mandatory insurance provides functional coverage |
| Australia | ASIC Act consumer protections (misleading/deceptive, unconscionable conduct); trustee/fiduciary duties; DDO and product intervention powers; breach reporting | No standalone mandatory insurance under current law; standard AFSL PI insurance / compensation arrangements apply to DAP/TCP operators | Professional indemnity insurance or compensation arrangements (AFSL standard) | No crypto deposit guarantee | No strict liability standard; fiduciary duties under trust law where applicable |
| Canada | CTPs remain liable for losses from custodial failures (unauthorized access, theft, loss of keys) regardless of outsourcing; CSA expects "reasonably prudent" insurance | No specific mandatory amount; CSA expectation for custodians of public funds; CIRO Tier 1/2 require comprehensive insurance | Commercial crime/fidelity, professional liability, technology E&O coverage expected; CIRO tiered (Tier 1/2 most comprehensive) | No crypto deposit guarantee; stablecoin reserves protected from creditor claims under Stablecoin Act (enacted, not in force) | No explicit strict liability; CTP retains liability regardless of outsourcing |
| Brazil | SPSAV retains full accountability; responsibility cannot be delegated even when custody outsourced; criminal liability for fraudulent portfolio management (Law 14,478) | Specific insurance requirements for SPSAVs NOT VERIFIED in publicly available sources; resolutions emphasize cybersecurity and operational resilience | NOT VERIFIED | No crypto deposit guarantee | No data on strict liability; criminal liability for fraud |
| Bermuda | Regulatory responsibility for outsourced custody remains with the licensee; custody agreements allocate operational/key-compromise/cyber liability | Statutory - DABA s.18(1): licensee holding client assets must maintain a surety bond, trust account, OR indemnity insurance for the benefit of clients, in form/amount acceptable to BMA (a true mandatory requirement) | Form and amount set case-by-case by BMA (no fixed minimum published, NOT VERIFIED); applicant-stage E&O/PI, D&O, crime insurance expected | No crypto deposit guarantee | No explicit strict liability; statutory creditor-exclusion (s.18(4)) provides functional protection |
| Cayman Islands | VASPs must manage conflicts of interest and treat clients fairly; MC-RSOG governs client agreements and public disclosures allocating liability for operational failures | Mandatory under Feb 2026 Market Conduct framework (MC-RSOG) - insurance coverage required, with alternative risk-mitigation permitted where insurance is unavailable | Professional liability, theft or loss of client assets, business interruption, cybersecurity; fiat protection via CIMA-regulated/non-high-risk bank | No statutory deposit-insurance scheme | No explicit strict liability; insurance-or-alternative mandate provides functional protection |
| UAE | Custodians under VARA and ADGM bear fiduciary-like responsibility; failure to maintain controls/segregation/capital can result in enforcement, suspension, or revocation | VARA: "qualified custodians" with "insured vault services" required (amount not prescribed); ADGM: appropriate professional indemnity insurance or equivalent | VARA insured vault services (amount not prescribed); ADGM professional indemnity or equivalent | No crypto deposit guarantee | No data on explicit strict liability; enforcement via license suspension/revocation |
| Gibraltar | Liability for client assets remains with the authorised DLT Provider, including where functions are outsourced; contractual liability allocated in custody agreement | Professional indemnity insurance expected under Principle 3, adequacy case-by-case; no fixed mandatory minimum coverage figure (NOT VERIFIED) | PI / comprehensive risk-management insurance (case-by-case); no deposit-insurance-style scheme for custodied virtual assets | Custodied virtual assets not covered by Gibraltar Deposit Guarantee Scheme | No explicit strict liability; firm retains accountability under outsourcing guidance |
| Bahrain | Licensees bear direct responsibility for safekeeping client crypto-assets; clear contractual obligations defining scope and liabilities | Mandated - professional indemnity insurance minimum BHD 100,000 from a CBB-approved insurer; keyman insurance; cybersecurity insurance | Professional indemnity (>= BHD 100,000 ~$265,250); keyman; cybersecurity insurance | No crypto deposit guarantee | No data on explicit strict liability |
| IOSCO | Rec 12: adequate protection at all times; minimize risk of loss or misuse; Rec 14: clients must understand protections in insolvency | Principles-based; left to national implementation | N/A (national discretion) | N/A | N/A |
| BCBS | Operational risk capital for custody; stablecoin reserves: bankruptcy-remote structures | N/A (prudential capital standard, not insurance standard) | N/A | N/A | N/A |
Table 6: AML/KYC/Compliance
This table covers Travel Rule thresholds, monitoring requirements, sanctions screening obligations, unhosted wallet rules, and key penalties for AML non-compliance.
For detailed compliance and enforcement analysis, see Compliance.
| Country | Travel Rule Threshold | Monitoring Requirements | Sanctions Screening | Unhosted Wallet Rules | Key Penalties |
|---|---|---|---|---|---|
| United States | $3,000 (FinCEN); proposed reduction to $250 for cross-border CVC (pending) | Risk-based AML program (CIP, CDD, ongoing monitoring); SARs for $2,000+ suspicious; CTRs for $10,000+ cash; GENIUS Act extends BSA/sanctions to stablecoin issuers | OFAC sanctions list screening (mandatory) | No specific federal unhosted wallet rule; FinCEN proposed but not finalized | FinCEN/DOJ enforcement (Paxful $3.5M + $4M, Dec 2025); criminal prosecution |
| European Union | EUR 0 (all crypto transfers regardless of amount under TFR (EU) 2023/1113) | Risk-based CDD (standard/SDD/EDD); identity verification before business relationship; 5-year retention; STRs to national FIU; AMLA direct supervision of high-risk CASPs from 2027 | EU sanctions list screening; sanctions compliance mandatory within AML/CFT framework | TFR applies information requirements to transfers involving unhosted wallets | CASP violations: up to EUR 5M or 5% annual turnover; ART/EMT violations: up to EUR 5M or 12.5% annual turnover |
| Switzerland | CHF 0 for blockchain transfers (all crypto transfers regardless of amount); CHF 1,000 for virtual-currency exchange transactions | CDD; EDD for high-risk; transaction monitoring; SARs to MROS; wallet-verification requirement | Swiss sanctions screening mandatory; stablecoin issuers must implement freeze-and-block capability | Intermediaries must verify external wallet transferees have authority to dispose via appropriate technical measures | FINMA enforcement: declaratory orders, cease-and-desist, license withdrawal, activity bans, criminal referrals |
| United Kingdom | All transfers record sender/beneficiary names and wallet addresses; cross-border >EUR 1,000 additional info | Full AML programme: risk assessment, CDD, transaction monitoring, internal controls; fit-and-proper management; SARs to NCA | Sanctions screening mandatory; FATF-aligned (Recommendations 15, 16) | Travel Rule applies to all transfers; collection requirements differ by transaction type/direction | Criminal offence to operate without FCA registration; High Court proceedings vs Huobi/HTX (Oct 2025) |
| Germany | EUR 1,000 (full originator/beneficiary information for crypto transfers at or above threshold, aligned with FATF) | CDD; transaction monitoring; SARs to FIU (Zentralstelle fur Finanztransaktionsmeldungen); DAC 8 reporting from Jan 2026 | EU and national sanctions screening | GwG Section 15a (2025): obliged entities must assess ML risk of transfers from/to unhosted wallets and take mitigating steps | BaFin: forced shutdown, fines, criminal prosecution; Ethena GmbH forced wind-down (2025) |
| France | FATF-aligned (national implementation via EU TFR); applies to all crypto transfers; full info >= EUR 1,000 | CDD; ongoing monitoring; STRs to TRACFIN; asset-freezing compliance; ACPR assent on AML/CFT required before launching custody | Sanctions screening mandatory; ACPR supervised | No specific national unhosted wallet provision beyond EU TFR requirements | DASP register withdrawal; up to 2 years imprisonment + EUR 30,000 fine for non-compliance post-transition; AMF warnings |
| Liechtenstein | EU recast TFR ((EU) 2023/1113) via EEA - originator/beneficiary information must accompany crypto-asset transfers between providers | CDD at onboarding/ongoing; EDD triggers include crypto transfers above EUR 1,000 and occasional transactions exceeding CHF 15,000; SARs to FIU | Sanctions screening required | NFT trading-platform operators explicitly brought within due-diligence duty (Art. 3(1)(t) DDA) | FMA enforcement under DDA/SPG; obliged-entity sanctions |
| Luxembourg | EU TFR ((EU) 2023/1113): CASPs collect/transmit originator/beneficiary info for crypto transfers; full info >= EUR 1,000 (de-minimis simplifications below) | CDD at onboarding/ongoing; EDD for higher-risk; STRs to Luxembourg FIU (CRF); CSSF AML/CFT circulars 25/878 and 25/879 (per practitioner guidance) | Sanctions screening and record-keeping | EU TFR information requirements apply to transfers involving unhosted wallets | CSSF AML/CFT enforcement; obliged-entity supervision |
| Hong Kong | All VA transfers require Travel Rule info; reduced info under HK$8,000 (~$1,000); full info for HK$8,000+ | CDD incl. ongoing monitoring; EDD for high-risk; STRs to JFIU; AML/CFT under AMLO Schedule 2 | Sanctions screening mandatory | Due diligence on VA transfer counterparties required to identify AML/CFT risks | Operating without VASP licence: up to HK$5M fine and 7 years imprisonment; JPEX case (HK$1.6B alleged) |
| Singapore | Travel Rule implemented via PSN02 (FATF R.16); thresholds aligned with FATF (specific SGD figure not stated) | CDD; transaction monitoring; STRs to Suspicious Transaction Reporting Office; agent due diligence (from Apr 2024); group-wide AML/CFT; external auditor attestation | Sanctions screening mandatory under PSN02 | No specific published unhosted wallet rules | Unlicensed-DTSP penalty up to SGD 250,000 and/or 3 years (FSMA s.137(6)); licence revocation |
| Japan | FATF Travel Rule implemented; statutory footing via Foreign Exchange and Foreign Trade Act amendments (2023); JVCEA coordinates | Full identity verification (name, address, DOB, ID docs); EDD for PEPs/high-risk; real-name verification; STRs to JAFIC; 7-year retention | Sanctions screening mandatory | No specific published unhosted wallet rules | Business improvement orders; licence revocations; proposed FIEA: up to 5 years imprisonment / ~$35K fine for unregistered operations |
| South Korea | KRW 1,000,000 (~$750) threshold since March 2022 | Full CDD/identity verification incl. real-name bank account verification (dual: bank + exchange); continuous monitoring; STRs to KoFIU | Sanctions screening mandatory | No specific published unhosted wallet rules | FSC fines and criminal sanctions; market-manipulation prohibition under VAUPA; Terra/Luna prosecution |
| Australia | FATF Travel Rule committed; implementation being progressed via AML/CTF amendments (not yet fully in force) | AUSTRAC DCE registration; KYC at onboarding; transaction monitoring; SMRs; TTRs; IFTIs; 7-year record retention | Sanctions screening mandatory | No specific published unhosted wallet rules | AUSTRAC: registration cancellation; significant enforcement capability |
| Canada | FINTRAC Travel Rule: originator/beneficiary data for virtual currency transfers above prescribed threshold | MSB/Foreign MSB registration (renewal every 2 years); compliance officer; risk assessment; KYC; LVCTRs for C$10,000+; STRs; 5-year retention | Sanctions/AML obligations under PCMLTFA | No specific published unhosted wallet rules | Binance C$6,002,000 penalty; CoinSeason Capital C$33,000; cease-trade orders |
| Brazil | Phased (Resolution 520): Phase 1 (Feb 2026-Feb 2027) identify originators/beneficiaries; Phase 2 (Feb 2027-Feb 2028); full compliance from Feb 2, 2028 | KYC (CPF verification); risk-based CDD; EDD for high-risk; SARs to COAF within 24 hours; UN sanctions compliance; 5-year retention | UN sanctions screening | Resolution 521: SPSAVs must identify owners of self-hosted wallets controlling private keys | Criminal: 4-8 years for crypto fraud; enhanced ML penalties; BCB authorization revocation |
| Bermuda | Implements FATF Travel Rule (originator/beneficiary information, FATF Recommendation 16); member of CFATF | Risk-based CDD/EDD; ongoing monitoring; SARs; record-keeping and employee training (no specific numeric KYC threshold cited) | International sanctions in effect in Bermuda screened; scored highest in CFATF Mutual Evaluation 2020 | No specific published unhosted wallet rule cited | POCA 1997 / AML-ATF enforcement; BMA AML/ATF supervision |
| Cayman Islands | Implemented under Part XA of the AMLRs (FATF Recommendation 16); originator/beneficiary names + account numbers + originator address/ID; both VASPs retain info >=5 years | Risk-based CDD/KYC at onboarding and ongoing; digital identity verification permitted; transaction monitoring; SARs to Financial Reporting Authority; AMLCO + MLRO + Deputy MLRO required | Compliance with Cayman Islands sanctions obligations | No specific published unhosted wallet rule cited (Part XA covers transfers) | CIMA enforcement; public notice naming unregistered entities (Gate.io, Apr 2025) |
| UAE | FATF Travel Rule applies; CBUAE Virtual Assets Travel Rule guidance requires originator/beneficiary information for VA transfers | VARA: comprehensive AML/KYC, CDD, STRs; ADGM: AML & Sanctions Rules; CBUAE: federal AML framework (no specific numeric KYC threshold stated) | Federal and zone-specific sanctions screening mandatory; ADGM Sanctions Rules | No data on specific unhosted wallet rules | VARA marketing violations up to AED 10M; cease orders (four KuCoin entities, Mar 2026); active enforcement |
| Gibraltar | Transposed via POCA 2015 (Transfer of Virtual Assets) Regulations 2021; EUR 1,000 threshold; full compliance mandatory from 22 Sept 2022 | CDD/EDD; transaction monitoring; SAR to GFIU; locally resident MLRO; Principle 8 (financial crime) | Sanctions screening required; SAR to Gibraltar Financial Intelligence Unit (GFIU) | At or above EUR 1,000: obtain and transmit payer's/payee's name and account/wallet information immediately by secure means | GFSC enforcement; "relevant financial business" registration under POCA Registration Regs 2021 |
| Bahrain | AML/CFT aligned with FATF standards (FATF-aligned framework; no specific crypto Travel Rule threshold figure stated) | CDD/KYC incl. identity verification and beneficial ownership; transaction monitoring; STRs; record-keeping; sandbox participants comply at all times | Ongoing sanctions screening against applicable lists; member of MENAFATF | No data on specific unhosted wallet rules | CBB: license suspension/revocation; fines; cease-and-desist; measured enforcement approach |
| IOSCO | Coordinates with FATF; does not set own AML thresholds | Rec 12-14 focus on custody/disclosure; defers AML to FATF framework | Defers to FATF | Defers to FATF | N/A (non-binding; relies on national enforcement) |
| BCBS | Defers to FATF Travel Rule | Banks must comply with FATF AML/CFT requirements including Travel Rule | Mandatory for banks providing custody | Defers to FATF | N/A (prudential standard; enforcement via national supervisors) |
Table 7: Audit & Reporting
This table covers audit requirements, audit frequency, proof of reserves mandates, tax reporting obligations, and regulatory reporting requirements.
For detailed analysis of audit standards, see Audit & Reporting.
| Country | Audit Requirement | Frequency | Proof of Reserves | Tax Reporting | Regulatory Reporting |
|---|---|---|---|---|---|
| United States | RIAs with custody: annual surprise examination (Form ADV-E within 120 days); SOC-1/SOC-2 Type II industry standard; state trust custodians furnish SOC-1 or equivalent | Annual (surprise exam / SOC); ongoing compliance reports | No general federal mandate; GENIUS Act requires monthly public reserve composition reports examined by registered accounting firms for stablecoin reserve custodians | IRS Form 1099-DA broker reporting (2025 gross proceeds, 2026 cost basis); GENIUS Act monthly reserve reports | OCC Call Reports (national trust banks); quarterly for banking entities; CFTC pilot balance reports; NYDFS 23 NYCRR Part 500 |
| European Union | Annual independent audit of financial statements (Article 68); national arrangements may permit supervisor validation as alternative | Annual (financial audit); continuous (daily reconciliation); quarterly client position statements minimum | Not a named statutory proof-of-reserves regime; daily reconciliation between client position registers and on-chain balances required | DAC 8: crypto transaction reporting to tax authorities (member state implementation, e.g., Germany from Jan 2026) | ESMA data standards (RTS on order book records, JSON/ISO 20022); iXBRL white paper format from 23 Dec 2025; automated reporting to NCAs |
| Switzerland | Dual supervisory model - FINMA relies on approved audit firms for full regulatory audits; banking/FinTech/DLT trading facility: regulatory audit; SRO: SRO compliance audit | Annual + ad hoc (banking, DLT trading facility); annual (FinTech); ad hoc incident reporting | NO DATA - no proof-of-reserves regime stated; crypto-based custody assets no longer reported in corresponding supervisory-reporting section (FINMA Guidance 03/2025) | OECD CARF implementation delayed to 2027; existing Swiss tax obligations apply | Annual reporting to FINMA; ad hoc incident reporting; FINMA Guidance 03/2025 on crypto-based asset disclosure |
| United Kingdom | Annual client-asset audit by appointed auditor producing a Client Assets Report (CMAR); designated CASS oversight officer; CRYPTOPRU capital adequacy reporting | Daily (reconciliations); regular (capital adequacy/liquidity); annual (client-asset audit, ICARA sign-off) | Sub-custodians may be subject to independent audit verification of Proof of Reserves methodology; no general PoR mandate for primary custodian | UK tax obligations apply; no crypto-specific reporting regime yet | FCA regulatory returns; breach reporting; CASS 17 reconciliation records; ICARA submissions |
| Germany | Annual audited financial statements to BaFin; quarterly third-party penetration testing; DORA ICT risk reporting; SOC 2 Type II or ISO 27001 expected | Annual (financial); quarterly (penetration testing); real-time (DAC 8 from Jan 2026) | NO DATA - no proof-of-reserves regime stated; internal controls/audits to verify segregation | DAC 8: real-time transaction reporting to Bundeszentralamt fur Steuern from 1 Jan 2026 | Ongoing supervisory reporting to BaFin; material-change notifications; DORA ICT incident notification |
| France | AMF ongoing supervision incl. on-site inspections; ACPR AML/CFT inspections; licensed DASPs maintain internal control incl. compliance and internal audit | Ongoing (AMF/ACPR supervision); incident-based inspections; DORA ICT reporting from 2025 | NO DATA - no proof-of-reserves regime stated in the file | French tax obligations apply; no crypto-specific reporting regime identified | MiCA prudential reporting/incident notification to AMF (post-transition); DORA ICT risk reporting |
| Liechtenstein | TVTG: company-law statutory audit, event-driven (ad hoc) supervision - not under continuous prudential supervision; MiCAR CASP: annual external audit with full FMA audit/inspection rights | TVTG: ad hoc/event-driven; MiCAR CASP: periodic regulatory reporting + ad hoc/incident (DORA) | NOT VERIFIED - no explicit proof-of-reserves mandate stated; custody-position records per client (MiCAR Art. 75) | Existing Liechtenstein tax obligations apply; no crypto-specific reporting regime identified | TVTG ad hoc reporting to FMA; MiCAR CASP periodic + DORA incident reporting; annual AML/CFT reporting and SARs to FIU |
| Luxembourg | CASPs (CSSF-supervised) subject to annual statutory audit of financial statements and CSSF supervisory reporting; control agents reconcile DLT-security quantities | At least quarterly client statements (Art. 75(4)); MiCAR ongoing reporting; annual AML/CFT reporting | No explicit proof-of-reserves mandate stated; periodic client statements (Art. 75(4)) at least quarterly | Existing Luxembourg tax obligations apply (DAC 8 framework); no crypto-specific overlay identified | MiCAR ongoing reporting and EU RTS/ITS; DORA ICT incident reporting; annual AML/CFT reporting to CSSF and STRs to CRF; Luxembourg-specific MiCAR form details NOT VERIFIED |
| Hong Kong | External audit of financial statements; independent third-party custody assessments; regular internal audits | Annual (external audit); monthly (financial returns); daily (insurance/compensation threshold monitoring) | No current mandate; ASPIRe Initiative 9 signals straight-through reporting/surveillance | Hong Kong tax obligations apply; no crypto-specific tax reporting regime identified | Monthly financial returns; annual returns via WINGS-LIC; senior management exposure reports; SFC surveillance |
| Singapore | External auditor attestation (business activities + AML/CFT) at licensing; annual statutory audit; PSN04 regulatory returns | At licensing (attestation); from 1 Jan 2025 (PSN04 returns); monthly (customer statements) | No proof-of-reserves attestation named; books/records of customer asset positions maintained | Singapore tax obligations apply; no crypto-specific reporting regime identified | PSN04 regulatory returns; periodic compliance review; TRM technology-risk reporting |
| Japan | Mandatory annual CPA audit of customer-asset segregation; FSA on-site inspections; JVCEA compliance audits with sanction power | Annual (CPA audit); regular (FSA inspections); periodic (JVCEA); immediate (incidents) | CAESP must in effect hold the segregated/backing assets (records of individual customer positions); no separate proof-of-reserves attestation named | Japanese tax obligations apply; ruling-party discussions consider flat 20% separate taxation (proposed, not enacted) | Periodic financial reports to FSA (net-asset/capital-adequacy + segregation statements); prompt incident reporting |
| South Korea | ISMS certification renewal with ongoing security audits; FSS supervision incl. on-site inspections; KoFIU registration-compliance | Periodic (ISMS renewal); ongoing (FSS supervision); continuous (market surveillance under VAUPA) | VASP must "in effect possess" entrusted VA at all times and maintain individual records; reserve/insurance status disclosed; no formal PoR attestation named | Korean tax obligations apply; no crypto-specific reporting regime identified | VAUPA disclosure: material info, listing/delisting criteria, fees, reserve/insurance status; market surveillance |
| Australia | AUSTRAC compliance reporting + Corporations Act financial reporting now; periodic auditor review anticipated under DAF Act financial requirements | Ongoing (AUSTRAC); annual (corporate); frequency for DAP/TCP NOT VERIFIED | Not specified; s 912BE asset-holding standards to require reconciliation/reporting of client assets (detail NOT VERIFIED) | ATO tax obligations apply; no crypto-specific reporting regime identified | Standard AFSL reporting; breach reporting; DDO compliance; DAP/TCP-specific attestation standard NOT VERIFIED |
| Canada | Investment fund custodians: annual SOC-2 Type II report; fund financials audited by independent auditor; CTPs provide compliance reports and submit to CSA reviews | Annual (SOC-2); regular (CTP compliance); quarterly (OSFI); stablecoin issuers (enacted, pending) report to Bank of Canada | Custodian records must reflect fund as beneficial owner; reconciliation/record-keeping required; no explicit proof-of-reserves mandate cited | CRA tax obligations apply; no crypto-specific tax reporting regime identified | CSA compliance reviews; CIRO compliance monitoring; FINTRAC record-keeping; OSFI quarterly capital/liquidity reports |
| Brazil | Independent audits to verify segregation, governance/risk-management, accuracy of financial statements; industry-reported cadence biennial (Fireblocks; NOT VERIFIED against Resolution 520 text) | Annual/biennial (independent audit, cadence NOT VERIFIED); ongoing (record-keeping) | Industry-reported monthly public proof-of-reserves disclosures; BCB declined to mandate a single PoR technical standard (industry-reported; NOT VERIFIED against official text) | RFB: capital gains taxed 15%-22.5%; BRL 35,000 monthly exemption; cross-border/capital-market reporting from 4 May 2026 | CVM fund reporting (separate bookkeeping/financial statements per share class, independently audited) |
| Bermuda | Custody Rules 2025 r.3: client-asset controls reviewed annually by a qualified person with report to BMA; Custody Code s5: annual IT audit plan; key/seed processes audited at least every six months; multi-sig annually | Annual (qualified-person review, IT audit plan, multi-sig); six-monthly (key/seed processes); quarterly (transaction-sample) | DABA s.18(3) requires maintaining "a sufficient amount of each type of digital asset" (statutory basis for proof-of-reserves); Custody Code s2.6 accurate accounting records | Bermuda tax obligations apply (no personal income tax) | Annual prudential return (Prudential Standards (Annual Return) Rules 2018); Accounts Rules 2021; cyber-event reporting to BMA; audit logs retained >=5 years |
| Cayman Islands | Audited financial statements may be required (case-by-case by CIMA); annual accounts available to CIMA on request; independent third-party security audits of custody/key-management systems | Case-by-case (audited financials); ongoing (Custody/VATP Rule notifications); annual (key-compromise testing) | Reconciliation/record-keeping of each client's positions required; no explicit proof-of-reserves mandate cited | Cayman tax obligations apply (no direct taxation) | Ongoing reporting/notifications under Custody/VATP Rule (risk reporting, material-change); trading platforms report suspected market abuse to CIMA immediately |
| UAE | VARA: independent third-party wallet-management audits; proof-of-reserves checks; comprehensive risk-management framework; ADGM: annual audited financial statements | VARA: periodic (proof-of-reserves, policy reviews); ADGM: annual (audited financials); monthly (stablecoin/ARVA reserve audits) | Yes (VARA mandatory periodic proof-of-reserves under Rulebook 2.0); VARA Issuance Rulebook: monthly ARVA audits; CMA: monthly audits for fiat-backed stablecoins | UAE tax obligations apply (no personal income tax; corporate tax from June 2023) | VARA: risk-management framework reporting; ADGM: regulatory returns and prudential reporting |
| Gibraltar | DLT Providers supervised on par with banks (periodic returns and inspections); financial-statement audit under general Gibraltar company/financial-services law; crypto-specific PoR/SOC mandate NOT VERIFIED | Ongoing GFSC supervision incl. periodic returns; prescribed reconciliation cadence NOT VERIFIED | NOT VERIFIED - no crypto-specific proof-of-reserves mandate located for Gibraltar | Gibraltar tax obligations apply; no crypto-specific reporting regime identified | Ongoing GFSC supervision incl. periodic returns; Principle 5 record-keeping/reconciliation; no crypto-specific attestation standard (NOT VERIFIED) |
| Bahrain | Regular financial reporting incl. audited financial statements and regulatory returns to CBB; CBB inspections; sandbox graduates engage a third-party consultant | Annual (financial statements); at least twice/year (penetration testing); upon sandbox graduation (third-party assessment) | No explicit proof-of-reserves mandate stated; 1:1 holding requirement (CRA-8.1.5) and segregation underpin client-asset integrity | Bahrain tax obligations apply (no personal income tax) | CBB inspections; compliance/incident reporting; periodic management reports on operational performance |
| IOSCO | Rec 12: accurate and up-to-date records of Client Assets; Rec 14: disclosure of custody arrangements in clear, non-technical language | As determined by national implementation | Not specifically addressed | Not specifically addressed | National discretion; thematic review process (first pilot Oct 2025, 20 jurisdictions assessed) |
| BCBS | DIS55: qualitative reporting on crypto activities and classification methodologies; quantitative disclosures on capital by asset group | Annual (qualitative); semiannual (quantitative) | Not specifically addressed | Not specifically addressed (defers to national tax frameworks) | Banks must notify supervisors of existing crypto exposures; advance notification before new exposures; standardised tables and templates |
Cross-Cutting Observations
Regulatory Maturity Spectrum
The 20 jurisdictions covered in these tables span a wide range of regulatory maturity:
- Most mature / advanced frameworks: Japan (PSA since 2017), Germany (KWG since 2020), Switzerland (DLT Act 2021), EU (MiCA 2024), Hong Kong (AMLO 2023 + ASPIRe 2025), Gibraltar (DLT Providers Regulations 2018), Bermuda (DABA 2018), Liechtenstein (TVTG 2020), Bahrain (CRA Module 2019)
- Comprehensive / rapidly developing: United Kingdom (full regime 25 Oct 2027), South Korea (VAUPA 2024), Singapore (PS Act amendments 2024), Canada (CIRO framework 2026), Brazil (BCB resolutions 2026), Luxembourg (MiCAR + Blockchain Laws), Cayman Islands (Phase Two 2025), UAE (VARA v2.0, CMA federal 2026)
- Emerging/transitional: Australia (DAF Act 2026 enacted, commences 9 Apr 2027), United States (multi-agency reforms ongoing, GENIUS Act the main statutory anchor)
Cold Storage Requirements by Stringency
- Hong Kong: 98% cold / 2% hot (original SFC guideline; evolving under ASPIRe)
- Japan: >=95% cold storage mandatory
- Bahrain: 95% cold storage mandatory (per client crypto-asset, CRA-8.1.9)
- Germany: 95% cold storage (market-expectation, not codified BaFin rule)
- Singapore: 90% cold storage
- South Korea: 80% cold storage
- Canada: 80% with third-party custodians
- No mandated ratio (risk-based or outcome-based): United States, European Union, Switzerland, United Kingdom, France, Australia, Brazil, Bermuda, Cayman Islands, UAE, Gibraltar, Liechtenstein, Luxembourg
Capital Requirements by Magnitude
- Canada (foreign custodian): C$100,000,000
- Canada (Canadian custodian): C$10,000,000
- Switzerland (DLT with custody): CHF 5,000,000
- ADGM (public fund custody): USD 4,000,000
- UAE VARA (custody): AED 4,000,000 (~USD 1,089,000)
- UAE CMA (custody): AED 3,000,000 (figures conflict per summaries)
- Hong Kong (proposed custodian): HK$10,000,000 (~USD 1,280,000)
- US Wyoming SPDI: ~$10,000,000 (practical minimum)
- Bahrain (Category 4): BHD 300,000 (~USD 795,700)
- Switzerland (FinTech license): CHF 300,000 (~USD 336,000)
- Singapore (MPI / DTSP): SGD 250,000
- Bermuda (Class M/F net assets floor): USD 100,000 (scaled up for custodians by BMA)
- UK (custody PMR): GBP 150,000
- Germany (KWG): EUR 150,000
- France (licensed DASP): EUR 150,000
- Liechtenstein (TVTG top tier / MiCAR custody): up to CHF 250,000 (TVTG) / EUR 125,000 (MiCAR)
- EU MiCA / Germany (post-MiCA) / France (MiCA) / Luxembourg (custody CASP): EUR 125,000
- Case-by-case (no published fixed minimum): Gibraltar, Cayman Islands, South Korea, Australia (NOT VERIFIED), Japan (>= JPY 10M statutory floor)
Travel Rule Threshold Comparison
- EU, Switzerland (blockchain), Liechtenstein, Luxembourg: EUR/CHF 0 baseline (all crypto transfers; EU/EEA TFR), with full-information thresholds at EUR 1,000
- UK: All transactions recorded; additional data for cross-border above EUR 1,000
- South Korea: KRW 1,000,000 (~USD 750)
- Hong Kong: All transfers (reduced info under HK$8,000; full info above)
- Germany, Gibraltar, Liechtenstein/Luxembourg (full-info point): EUR 1,000
- United States: USD 3,000 (proposed reduction to $250 for cross-border)
- Brazil: Phased implementation through Feb 2028
- Bermuda, Cayman Islands, Bahrain, UAE: FATF Recommendation 16-aligned (no single jurisdiction-specific numeric threshold stated; Cayman via AMLRs Part XA)
Strict Liability Adoption
Only a small number of jurisdictions have adopted explicit strict (no-fault) or attributability-based liability for crypto custodians:
| Jurisdiction | Strict Liability | Basis |
|---|---|---|
| European Union | Yes (no-fault) | MiCA Article 75(8): custodian liable for loss attributable to them, no-fault standard |
| Germany | Attributability-based (via MiCA) | MiCA Article 75(8) with carve-out for DLT-inherent failures outside CASP control |
| France | Attributability-based (via MiCA) | Post-MiCA transition, Article 75(8) applies |
| Liechtenstein | Attributability-based (via MiCAR) | MiCAR Article 75(8): liable save events beyond reasonable control |
| Luxembourg | Attributability-based (via MiCAR) | MiCAR Article 75(8): cannot be excluded by contract |
| Japan | Functional equivalent | Hot wallet backing at 100% by operator's own crypto creates loss absorption guarantee |
| South Korea | Functional equivalent | Mandatory insurance/compensation reserves calibrated to VASP size |
| All others | No | Contractual liability, fiduciary duties, or trust-based protection instead |
The EU's strict liability regime under MiCA Article 75(8) represents the strongest custodian accountability standard globally. It overrides contractual exclusion clauses that many pre-MiCA custodians relied upon, and it is capped at the market value of assets lost at the time of loss. MiCAR-applying EEA jurisdictions (Liechtenstein, Luxembourg) and MiCA member states (Germany, France) inherit an attributability-based variant.
Insurance Mandates Across Jurisdictions
| Jurisdiction | Insurance Mandated | Type Required |
|---|---|---|
| European Union | Yes | Insurance against liability risks to clients |
| Hong Kong | Yes | 50% cold + 100% hot/other storage coverage; insurance, deposits, or bank guarantees |
| South Korea | Yes | Insurance or compensation reserves for hacking/operational failures |
| France | Yes (licensed DASPs) | Professional liability insurance or own funds |
| Bahrain | Yes | Professional indemnity (min BHD 100,000); keyman; cybersecurity |
| Germany | Yes (via MiCA) | Professional indemnity or equivalent own funds |
| UAE (VARA / ADGM) | Yes | VARA insured vault services (amount not prescribed); ADGM professional indemnity or equivalent |
| Bermuda | Yes (statutory) | DABA s.18(1): surety bond, trust account, OR indemnity insurance (form/amount acceptable to BMA) |
| Cayman Islands | Yes (Feb 2026 MC-RSOG) | Insurance coverage required, with alternative risk-mitigation permitted where unavailable |
| Liechtenstein | No statutory minimum | MiCAR allows insurance/guarantee as a prudential-safeguard alternative; market-driven crime/specie |
| Luxembourg | No mandatory minimum | Insurance is one permitted route to meet the MiCAR Art. 67 prudential floor |
| United States | No federal mandate | Market-driven; $100M-$300M commercial crime policies common at institutional level |
| Switzerland | No specific mandate | Adequate operational risk coverage expected |
| United Kingdom | Under consideration | Not yet mandated; trust + capital provide alternative |
| Gibraltar | Expected (Principle 3) | PI insurance expected, adequacy case-by-case; no fixed mandatory minimum |
| Singapore | No mandate | Disclosure of loss handling required |
| Japan | Expected | Proposed mandatory reserve-fund or equivalent insurance under FIEA reform |
| Canada | Expected (CSA) | "Reasonably prudent" insurance; CIRO Tier 1/2 comprehensive insurance |
| Australia | No current mandate | Standard AFSL professional indemnity / compensation arrangements |
| Brazil | NOT VERIFIED | Not identified in available sources |
Regulatory Authority Models
Jurisdictions adopt fundamentally different institutional designs for crypto custody oversight:
Single-regulator / integrated models:
- Switzerland (FINMA)
- Bahrain (CBB)
- Singapore (MAS)
- Japan (FSA/JFSA with JVCEA as SRO)
- Liechtenstein (FMA)
- Luxembourg (CSSF)
- Gibraltar (GFSC)
- Bermuda (BMA)
- Cayman Islands (CIMA)
Dual-authority models:
- France (AMF for market conduct + ACPR for AML/prudential)
- South Korea (FSC for policy + FSS for supervision)
- Australia (ASIC for financial services + AUSTRAC for AML)
Multi-regulator models:
- United States (SEC, OCC, CFTC, FDIC, Fed, FinCEN, state regulators)
- UAE (VARA, ADGM FSRA, DFSA, CBUAE, CMA)
- Canada (CSA/13 provincial regulators, OSFI, CIRO, FINTRAC, Bank of Canada)
Supranational with national execution:
- European Union (ESMA/EBA/AMLA at EU level + 27 NCAs)
- United Kingdom (FCA with proposed PRA involvement for systemic firms)
Single-regulator and integrated models (now spanning nine of the 20 jurisdictions, heavily weighted toward small advanced financial centres) provide the clearest compliance pathway. Multi-regulator models create the highest compliance burden but may offer more specialized oversight. The US model is the most fragmented, with no unified federal framework.
Passporting and Cross-Border Recognition
| Jurisdiction | Cross-Border Mechanism | Scope |
|---|---|---|
| European Union | Full passporting across 27 member states + EEA (MiCA Article 65) | All authorized CASP services |
| Liechtenstein | MiCAR passporting across 30 EEA states (e.g., Bank Frick, 20 Jan 2026) | All authorized CASP services (EEA) |
| Luxembourg | MiCAR passporting across 27 EU states (e.g., Coinbase EU/MiCA hub) | All authorized CASP services (EU) |
| United Kingdom | No passporting (post-Brexit); separate UK authorization required | UK only |
| Switzerland | No automatic passporting; foreign custody equivalence assessment (FINMA Guidance 01/2026) | Bilateral |
| United States | OCC national trust bank charter allows national operation; state charters may operate nationally | Domestic only; no international passporting |
| Hong Kong | No passporting; proposed custody regime has no transitional period | Hong Kong only |
| Singapore | No passporting; June 2025 mandate requires licensing even for firms solely serving customers outside Singapore | Singapore only (extraterritorial reach) |
| Bahrain | No passporting; Rain expanded to ADGM via separate FSRA approval | Bilateral (MENA region) |
| Brazil | No passporting; foreign entities must establish local subsidiary or partner with licensed SPSAV | Brazil only |
| Gibraltar | No passporting (post-Brexit, outside MiCA); separate Gibraltar authorisation required | Gibraltar only |
| Bermuda | No passporting; standalone DABA licence required | Bermuda only |
| Cayman Islands | No passporting; standalone CIMA licence required | Cayman Islands only |
The EU's passporting mechanism is by far the most powerful cross-border tool, enabling a single CASP authorization to serve 450+ million consumers across 30 countries. The EEA MiCAR centres (Liechtenstein, Luxembourg) plug directly into this single market; no non-EEA jurisdiction offers anything comparable.
Proof of Reserves Requirements
Only a small number of jurisdictions mandate proof of reserves:
| Jurisdiction | Proof of Reserves | Basis |
|---|---|---|
| UAE (VARA) | Yes (mandatory) | VARA Custody Services Rulebook v2.0; monthly ARVA audits (Issuance Rulebook) |
| Bermuda | Statutory basis | DABA s.18(3): maintain "a sufficient amount of each type of digital asset" |
| United States | Yes (stablecoin reserve custodians) | GENIUS Act: monthly public reserve composition reports examined by registered accounting firms |
| United Kingdom | Proposed (for sub-custodians) | CP25/14 suggests PoR methodology audit |
| Brazil | Industry-reported (NOT VERIFIED) | Reported monthly disclosures; BCB declined to mandate a single PoR technical standard |
| All others | No regulatory mandate | Market-driven voluntary disclosures |
The UAE under VARA remains the clearest general custody proof-of-reserves mandate; Bermuda's DABA s.18(3) supplies a statutory basis, and the US GENIUS Act mandates reserve reporting specifically for payment-stablecoin reserve custodians.
Key Enforcement Actions Shaping Regulation
Several enforcement events and market failures have directly shaped regulatory frameworks across jurisdictions:
| Event | Year | Impact on Regulation |
|---|---|---|
| Mt. Gox collapse (Japan) | 2014 | Catalyst for Japan's 2017 PSA crypto framework; strengthened global awareness of custody risk |
| Coincheck hack (Japan) | 2018 | Led to strengthened cold storage and segregation requirements; FSA-wide inspections |
| QuadrigaCX collapse (Canada) | 2019 | Directly motivated CIRO 2026 Digital Asset Custody Framework |
| FTX bankruptcy (global) | 2022 | Exposed total failure of asset segregation; accelerated regulatory reform in US, EU, France, Hong Kong |
| Celsius/Voyager bankruptcies (US) | 2022-2023 | Demonstrated that "custody" labeling without legal segregation is meaningless in bankruptcy |
| Terra/Luna collapse (South Korea) | 2022 | Key catalyst for VAUPA passage in South Korea |
| JPEX fraud (Hong Kong) | 2023 | HK$1.6B alleged fraud; first AMLO crypto prosecution; accelerated ASPIRe roadmap |
| SAB 121 era / SAB 122 rescission (US) | 2022-2025 | SAB 121 made bank crypto custody uneconomic; rescission via SAB 122 (Jan 2025) reopened market |
| Bittrex Global (Bermuda) orderly exit | 2024 | Illustrated DABA wind-down framework in practice |
Regulatory Timeline: Year Custody-Specific Framework Established
| Year | Jurisdictions |
|---|---|
| 2017 | Japan (PSA) |
| 2018 | Gibraltar (DLT Providers Regulations in force); Bermuda (DABA) |
| 2019 | France (PACTE); Bahrain (first CBB license) |
| 2020 | Germany (KWG crypto custody); United Kingdom (AML registration); Singapore (PS Act); Liechtenstein (TVTG); Cayman Islands (VASP Act Phase One) |
| 2021 | Switzerland (DLT Act); South Korea (SFIA registration) |
| 2022 | Brazil (Law 14,478); UAE (VARA established) |
| 2023 | Hong Kong (AMLO VATP licensing); IOSCO (CDA recommendations); EU (MiCA adopted) |
| 2024 | EU (MiCA Title V applicable); South Korea (VAUPA); Singapore (PS Act amendments); Germany (KMAG/MiCA); Bermuda (Custody Code); Luxembourg (MiCAR applicable, Blockchain Law IV) |
| 2025 | United States (major reform wave: SAB 122, OCC charters, GENIUS Act); Hong Kong (Stablecoins Ordinance); UAE (VARA v2.0, CBUAE law); Cayman Islands (Phase Two custody licensing); Liechtenstein (EEA-MiCA); Luxembourg (Law of 6 Feb 2025) |
| 2026 | Canada (CIRO framework); Brazil (BCB resolutions effective); UAE (CMA federal framework); proposed: Hong Kong (custody bill); Japan (FIEA migration) |
| 2027 | Australia (DAF Act commences 9 Apr 2027); United Kingdom (full FSMA regime commences 25 Oct 2027); EU AMLA direct supervision begins |
Segregation Model Approaches
Jurisdictions broadly fall into three categories for how they approach client asset protection in custody:
Statutory segregation (strongest protection):
- Switzerland: DEBA Articles 242a-242b provide statutory exclusion from bankruptcy estate
- Liechtenstein: Art. 25 TVTG + Insolvenzordnung (IO) Art. 41 - tokens segregated (ausgesondert) from estate
- Bermuda: DABA s.18(4) statutory creditor-exclusion + Custody Rules 2025 pari-passu insolvency waterfall
- Japan: Statutory priority claim for customers over other creditors
- South Korea: VAUPA mandatory segregation with bank deposit protection for KRW
Trust-based segregation:
- United Kingdom: Non-statutory (bare) trust under draft CASS 17, reinforced by Property (Digital Assets etc) Act 2025
- Hong Kong: Trust arrangements for VATP client assets; statutory trust for stablecoin reserves
- Singapore: Trust account requirement under PS Act amendments
- Australia: Statutory "on trust" mechanism for DAP/TCP operators under DAF Act 2026
- Canada: Beneficial ownership framework; stablecoin reserve trust (Stablecoin Act, enacted not in force)
Regulatory/contractual segregation:
- European Union: MiCA on-chain and off-chain segregation with register of positions
- Luxembourg: MiCAR Art. 75(7) segregation relying on national insolvency/property law
- Germany: KWG/KMAG mandatory legal and physical separation
- France: PACTE/MiCA segregation with written custody agreements
- Brazil: BCB Resolution 520 mandatory segregation with independent audit verification
- UAE: VARA client-level wallet segregation with proof-of-reserves
- Bahrain: CBB CRA Module segregated accounts + sub-custodian renunciation
- Cayman Islands: CIMA identifiable segregated wallets relying on common-law trust/property principles
- Gibraltar: GFSC Principle 5 operational segregation relying on general trust/insolvency law
- United States: Contractual (custody agreements); NYDFS guidance on beneficial ownership
The Swiss statutory model under the DLT Act is widely regarded as the global benchmark for legal certainty, now joined at the top tier by Liechtenstein's TVTG + Insolvenzordnung (IO) Art. 41 and Bermuda's DABA s.18(4) statutory creditor-exclusion. The trust-based models (UK, HK, SG) provide strong protection through established common law principles. The contractual/regulatory models carry more risk, as demonstrated by the FTX, Celsius, and Voyager bankruptcies where contractual language determined ownership rather than marketing or labeling.
Methodology
All data in these tables was extracted from individual country regulation files produced during Phase 1 research, located at /content/deep-research/crypto-custody/regulations/, and reconciled against the verified per-jurisdiction fact matrix. Each cell reflects information available in those source documents and the matrix as of June 4, 2026. Where information was not present in the source files, cells are marked "No data" or "NOT VERIFIED" rather than estimated or interpolated. Capital figures are presented in the local currency of each jurisdiction with approximate USD equivalents where available. Regulatory frameworks described as "proposed" or "draft" have not yet been enacted into law.
For the comprehensive guidance framework synthesizing these comparisons into actionable recommendations, see Guidance Framework.
Verification Notes
All data in these comparison tables was reconciled against the verified per-jurisdiction fact matrix covering all 20 national jurisdictions (refreshed June 4, 2026). This refresh integrated five new jurisdictions - Liechtenstein, Luxembourg, Gibraltar, Bermuda, and Cayman Islands - into every table and cross-cutting bucket, and corrected facts where the matrix now states them differently (notably US SAB 121 rescission via SAB 122 and the GENIUS Act stablecoin framework, the US SEC Sept 2025 no-action conditions in place of the prior "Custody Rule 206(4)-2" framing, Canada's enacted-but-not-in-force Stablecoin Act, Australia's enacted DAF Act 2026, and Germany's attributability-based (not pure no-fault) MiCA liability). No new unverified claims were introduced during table compilation. Where a data point was not available in the source material, the cell is marked "No data" or "NOT VERIFIED" rather than estimated or interpolated. "X of N" aggregates are derived from the 20-jurisdiction matrix (IOSCO and BCBS are international standards, not counted among the 20). Capital requirement figures are presented in the local currency of each jurisdiction as documented in the source files and matrix.