The Regulatory Spectrum

This analysis maps all 20 studied jurisdictions onto a six-position spectrum from least to most comprehensive crypto custody regulation. Every placement is grounded in the verified data contained in the individual country regulation files. Where a metric lacks verified data for a jurisdiction, it is marked "No data" rather than estimated.

For the overarching guidance framework that informed these dimensions, see the Guidance Framework.

1. Spectrum Definition

The spectrum captures how far a jurisdiction has progressed in building a purpose-built regulatory architecture for institutional crypto custody. Each position represents a qualitatively distinct regulatory posture.

Position 1: No Specific Framework

General corporate, property, and consumer protection law applies. No crypto-specific custody obligations exist. Regulators have not issued binding guidance on digital asset safekeeping. Crypto custodians operate in a legal grey zone, relying on general contractual and fiduciary duties.

Position 2: Emerging Framework

The jurisdiction has published consultation papers, draft legislation, or detailed regulatory guidance signalling intent to regulate crypto custody, but binding rules have not yet taken effect. Operators face uncertainty about future requirements but have visibility into the direction of travel. A jurisdiction whose primary custody statute has been enacted but has not yet commenced also sits here in terms of in-force binding rules.

Position 3: Registration-Based

Anti-money laundering (AML) registration is the primary regulatory touchpoint. Crypto custodians must register with a financial intelligence unit or equivalent body and comply with KYC/AML obligations, but are not subject to dedicated custody-specific prudential or conduct rules. This position often serves as a transitional stage.

Position 4: Licensed Activity

Crypto custody is defined as a distinct regulated financial service requiring a dedicated licence or authorisation from a financial supervisor. Licence conditions include capital requirements, fit-and-proper tests, and basic operational standards, but the regime may not yet cover the full range of prudential, conduct, and insolvency protections, and several quantitative prudential parameters may remain assessed case-by-case rather than published as fixed thresholds.

Position 5: Comprehensive Framework

Full prudential regulation (capital adequacy, liquidity, insurance or compensation), conduct regulation (asset segregation, key management standards, client disclosure), and enforcement mechanisms are in force. The custody licence is embedded within a broader financial services regulatory architecture with active supervisory oversight.

Position 6: Advanced/Integrated

Custody is embedded within a mature, integrated financial market infrastructure. Statutory insolvency protections for custodied crypto assets exist in legislation. Multiple licence tiers allow proportionate regulation. The jurisdiction has operational track record, institutional adoption at scale, and international alignment with FATF, IOSCO, and Basel standards. The framework accommodates innovation (e.g., DLT trading facilities, tokenized securities custody, staking) within a coherent legal structure.

2. Jurisdiction Mapping

Position 2: Emerging Framework

Australia

• Justification: The Corporations Amendment (Digital Assets Framework) Act 2026 is now ENACTED (Royal Assent 8 April 2026) but does not commence until 9 April 2027 with a six-month transition. Until then, the only binding custody-relevant requirement is AUSTRAC AML/CTF registration; substantive asset-holding standards (s 912BE) and transactional/settlement standards (s 912BF) await legislative instruments that have not yet been made. In terms of in-force binding custody rules, Australia remains at Position 2.
• Key regulatory mechanism: AUSTRAC DCE registration under the AML/CTF Act 2006 (mandatory since April 2018) is the only binding requirement; ASIC INFO 225 (finalised October 2025) provides guidance on custody, staking, stablecoins and token characterisation and extends an omnibus-holdings exemption; the DAF Act 2026 introduces AFSL-based Digital Asset Platform (DAP) and Tokenised Custody Platform (TCP) licensing with a statutory "on trust" mechanism.
• Verified outcome data: No specific number of licensed custody firms (DAP/TCP licensing not yet open). No AUM data for custodied crypto assets. The Block Earner appeal was heard in the High Court of Australia on 12 March 2026 (judgment reserved, not handed down as of 4 June 2026). ASIC published an 18-month implementation roadmap (April 2026); the INFO 225 class no-action position expires 30 June 2026.
• Source:
  Australia country file, Sections 1-3, 10-12.

---

Position 3: Registration-Based

United Kingdom

• Justification: Currently operates an AML-only registration regime under the MLRs (since 10 January 2020). The comprehensive FSMA-based safeguarding regime with full prudential and conduct regulation will not go live until 25 October 2027. As of June 2026, the UK is between Position 3 and Position 6 in regulatory design but remains at Position 3 in terms of binding, in-force rules.
• Key regulatory mechanism: FCA AML registration under the Money Laundering Regulations 2017. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations were made by Parliament on 4 February 2026. The Property (Digital Assets etc) Act 2025 (Royal Assent 2 December 2025) confirms digital assets as a third category of personal property in England & Wales. A bespoke CRYPTOPRU prudential regime and draft CASS 17 safeguarding rules (CP26/4) are in consultation.
• Verified outcome data: Approximately 57 crypto firms registered with the FCA; roughly 75% of initial applications rejected; four firms deregistered and eleven restricted. The FCA application gateway opens 30 September 2026 and closes 28 February 2027. The FCA commenced High Court proceedings against Huobi Global / HTX (21 October 2025) for illegal financial promotions.
• Source:
  United Kingdom country file, Sections 1-3, 10.

Brazil

• Justification: Law 14,478/2022 provides a legislative foundation, and BCB Resolutions 519/520/521 (effective 2 February 2026) create a comprehensive SPSAV authorization framework, but the 270-day adaptation period does not end until 30 October 2026. As of June 2026, the framework is in transition -- binding rules are in force but full compliance is not yet required, so Brazil sits at the registration/transitional stage building toward Position 5.
• Key regulatory mechanism: BCB SPSAV authorization in three categories (Virtual Asset Intermediary, Virtual Asset Custodian, Virtual Asset Broker); BCB Instruction 701/2026 independent technical certification gates custody/intermediation. COAF is the financial intelligence unit. Phased Travel Rule implementation through 2 February 2028.
• Verified outcome data: No specific count of authorized custody firms yet (adaptation period ongoing; deadline 30 October 2026, then 30 days to cease if non-compliant). The November 2025 reform replaced fixed per-type minimums with an activity-based capital formula set by Resolution BCB 517 and Joint Resolution 14 (both 3 Nov 2025, into which SPSAVs were folded); R$10.8M-R$37.2M is the resulting span (cost component + activities component x captation factor 1.0-1.5), with no simple category-to-figure mapping. Criminal liability for fraudulent portfolio management under Law 14,478. Basel-aligned prudential capital rules remain a DRAFT (Public Consultation 126/2025, no final norm as of 4 June 2026).
• Source:
  Brazil country file, Sections 1-3, 10-11.

---

Position 4: Licensed Activity

Gibraltar

• Justification: Gibraltar was the first jurisdiction globally to legislate a DLT-specific regime (in force 1 January 2018), capturing custodial wallet and key-storage directly as a licensable DLT activity under a single regulator. The framework is principles-based and outcome-focused (ten regulatory principles), but several quantitative prudential parameters -- a fixed minimum capital figure and any mandatory cold-storage percentage -- remain assessed case-by-case rather than published thresholds, and there is no codified crypto-specific bankruptcy-remoteness statute, distinguishing it from the full prudential regimes at Position 5.
• Key regulatory mechanism: GFSC DLT Provider authorisation under the Financial Services (DLT Providers) Regulations 2017/2020. Principle 5 (and Guidance Note 5) requires segregation of custodial assets/monies from the firm's own; Principle 3 sets a risk-based "adequate resources" test with professional indemnity insurance expected. Travel Rule via POCA 2015 (Transfer of Virtual Assets) Regulations 2021 (EUR 1,000 threshold).
• Verified outcome data: No fixed statutory minimum capital published; insurance adequacy set case-by-case. No fixed cold-storage percentage. A separate non-custodial Virtual Asset Arrangement Provider (VAAP) category was added 27 October 2025 (Principle 5 does not apply to VAAPs). Statutory crypto-insolvency segregation: NO DATA FOUND.
• Source: Gibraltar country file, Sections 1-5, 7.

Cayman Islands

• Justification: Custody moved from registration to full licensing under Phase Two of the Virtual Asset (Service Providers) Act (in force 1 April 2025), and the February 2026 Market Conduct framework added mandatory insurance and conduct standards -- a maturing, tightening trajectory. However, several quantitative prudential parameters (a fixed minimum capital figure, a numeric cold-storage ratio) remain assessed case-by-case by CIMA rather than published, and there is no codified statutory crypto bankruptcy-remoteness provision, placing the Cayman Islands at the licensed-activity stage advancing toward Position 5.
• Key regulatory mechanism: CIMA Phase Two virtual asset service licence (custody services and trading platforms); Custody/VATP Rule (December 2024, updated February 2026) imposing regulatory capital, recovery plans and stress testing; Market Conduct RSOG (MC-RSOG, February 2026) requiring insurance; segregation via identifiable, segregated wallets; Travel Rule under Part XA of the AMLRs.
• Verified outcome data: No published fixed minimum net-worth/capital threshold (case-by-case). No mandated numeric cold-storage percentage (NOT VERIFIED). Bankruptcy-remoteness achieved via segregation, identifiable wallets and custody contracts under common-law principles, not a crypto-specific statute. CIMA named Gate.io / Gate Global Corp as unregistered/unlicensed (soft enforcement, 11 April 2025); the licence-application deadline for existing registrants expired 30 June 2025.
• Source:
  Cayman Islands country file, Sections 1-5, 7.

---

Position 5: Comprehensive Framework

European Union

• Justification: MiCA (Regulation (EU) 2023/1114) establishes the most comprehensive single-market crypto-asset regulatory framework globally. CASP authorization for custody (Title V) has been applicable since 30 December 2024, with full enforcement by 1 July 2026. It includes capital, segregation, strict liability, conduct, passporting, and enforcement provisions, complemented by DORA, TFR, and the AML package. (The EU is treated at Position 5 here as the harmonized framework; member states with deeper national track records are mapped individually.)
• Key regulatory mechanism: MiCA Title V CASP authorization (Article 63) with EU-wide passport (Article 65). EUR 125,000 minimum permanent own funds for Class 2 custody CASPs (Annex IV). Strict (no-fault) liability for loss of clients' crypto-assets under Article 75(8), capped at market value. ESMA maintains the centralized CASP register. Penalties up to EUR 5 million or 5% of annual turnover. DORA for ICT resilience; TFR for the Travel Rule (no de minimis threshold).
• Verified outcome data: A third-party tracker reported 199 authorized CASPs (171 with passporting) as of 12 April 2026 -- Germany 53, Netherlands 25, France 13, Norway 13, Malta 12, Spain 11, Lithuania 10, Austria 9 (MiCA SCAN per LegAsset). Custody is the most common service (117 of 199 CASPs, ~59%). Grandfathering ends 1 July 2026 with no extensions; custody may not be delegated to unauthorised third-country entities.
• Source:
  European Union country file, Sections 1-4, 10.

Germany

• Justification: Germany defined crypto custody as a regulated financial service (KWG Section 1(1a)) from 1 January 2020 -- among the first globally and four years ahead of MiCA. Full prudential and conduct supervision by BaFin, complemented by MiCA transition via FinmadiG/KMAG, with statutory insolvency protection (Section 46i KWG, Section 45 KMAG). The framework is prescriptive (market-expectation 95% cold storage, multi-signature, EAL 4+ hardware) and BaFin leads the EU in authorized CASPs.
• Key regulatory mechanism: BaFin Kryptoverwahrgeschaeft licence (EUR 150,000 minimum capital pre-MiCA; EUR 125,000 Class 2 under MiCA). KMAG for MiCA domestic implementation; KMZUV fast-track for pre-regulated firms. Shortened 12-month MiCA grandfathering ended 31 December 2025. DAC 8 real-time tax reporting from 1 January 2026.
• Verified outcome data: 87 firms held BaFin crypto custody licences pre-MiCA; ~27 CASPs licensed by December 2025; Germany led the EU with 53 authorised CASPs (~26% of EU total) as of 12 April 2026. EUR 48.7 billion in crypto assets held under licensed custody (June 2025, 28% YoY growth). Ethena GmbH forced wind-down (June 2025); BaFin consumer warning on DAO1/Apertum (October 2025).
• Source:
  Germany country file, Sections 1-6, 10-11.

France

• Justification: France pioneered a national DASP/PSAN regime under the PACTE Law (2019) with tiered registration and an optional full licence under dual AMF/ACPR supervision, and is now converging on the comprehensive EU MiCA CASP regime (transitional period to 1 July 2026). With MiCA applicable and live CASP authorizations (custody and administration), France sits at the comprehensive-framework stage among Europe's most developed.
• Key regulatory mechanism: AMF DASP registration (Tier 1), enhanced registration (Tier 2, January 2024) and optional full licence (Tier 3) under CMF Articles L.54-10-1 to L.54-10-7; transitioning to MiCA CASP via Article 63 authorization or Article 60 notification. EUR 150,000 minimum capital for licensed DASPs; EUR 125,000 for MiCA custody CASPs.
• Verified outcome data: SG Forge authorized as a MiCA CASP for custody and administration via Article 60 notification (23 October 2025), later extended to order execution (24 February 2026). Coinhouse granted full MiCA CASP authorization including custody with EU-wide passporting (7 May 2026); press cited roughly a dozen authorized French CASPs (NOT VERIFIED to an exact AMF-published custody count). AMF removed Coinbase Europe Limited from the DASP register (2 April 2026) -- a voluntary withdrawal, not an enforcement sanction.
• Source:
  France country file, Sections 1-3, 6, 10-11.

Luxembourg

• Justification: Luxembourg derives its custody substance from directly-applicable MiCAR (applicable to CASPs since 30 December 2024) rather than a bespoke national crypto statute, with the Law of 6 February 2025 designating the CSSF as competent authority. Its distinctive national lead via Blockchain Laws I-IV (control-agent model) and an unrivalled fund-custody/depositary ecosystem place it at the comprehensive, EU-harmonised stage, though stand-alone bankruptcy-remoteness is weaker than Switzerland's statutory model.
• Key regulatory mechanism: MiCAR CASP authorisation for custody and administration (Article 62/63 full or Article 60 notification); legacy VASP registration in run-off to 1 July 2026; DLT-securities account-keeper / control-agent / depositary track under Blockchain Laws. EUR 125,000 Class 2 minimum own funds (Annex IV); MiCAR Art. 75(8) liability capped at market value; Travel Rule via the EU TFR.
• Verified outcome data: CSSF authorised Coinbase Luxembourg S.A. as a CASP under MiCAR (30 June 2025), with Coinbase selecting Luxembourg as its EU/MiCA hub and passporting across 27 EU states. Blockchain Law IV (enacted 19 December 2024) introduced the control agent and extended DLT to unlisted equity securities and fund-unit tokenisation. Bankruptcy-remoteness relies on MiCAR Art. 75(7) plus national insolvency/property law (no stand-alone statutory crypto-segregation regime).
• Source:
  Luxembourg country file, Sections 1-4, 10.

United States

• Justification: Multi-layered federal/state framework covering SEC qualified-custodian pathways, OCC national trust bank charters, CFTC collateral programs, and state trust frameworks (Wyoming SPDI, NY trust/BitLicense, South Dakota). Underwent a dramatic 2025 transformation from restrictive to permissive posture. No single unified federal custody law, but overlapping comprehensive requirements across agencies; the main durability risk is that most changes were sub-legislative, with the GENIUS Act as the principal statutory anchor.
• Key regulatory mechanism: SEC Custody Rule (206(4)-2) and the 30 September 2025 no-action letter permitting state trust companies as qualified custodians; OCC national trust bank charters and 12 CFR 5.20 amendment (effective 1 April 2026, non-fiduciary custody authority); GENIUS Act for stablecoin reserve custody; FinCEN BSA obligations (Travel Rule above $3,000).
• Verified outcome data: Five national trust bank charters conditionally approved (12 December 2025): Ripple, BitGo, Fidelity Digital Assets, Paxos, First National Digital Currency Bank; further approvals in early 2026 (Stripe/Bridge, Crypto.com, Protego) and a Coinbase conditional approval (2 April 2026). Kraken Financial became the first crypto bank to receive a Fed master account (4 March 2026). SAB 121 RESCINDED via SAB 122 (issued 23 January 2025, effective 30 January 2025), removing the on-balance-sheet liability requirement. FDIC, Federal Reserve and OCC withdrew restrictive crypto guidance.
• Source:
  United States country file, Sections 1-3.

Canada

• Justification: Multi-layered framework covering CSA securities regulation, OSFI prudential guidelines, the CIRO four-tier Digital Asset Custody Framework (effective 3 February 2026), provincial trust licensing, and FINTRAC AML registration. Strong segregation norms and a risk-tiered custodian model, though regulatory fragmentation across 13 provincial/territorial regulators adds complexity.
• Key regulatory mechanism: CSA Staff Notices and NI 81-102 amendments (effective 16 July 2025) for fund custody; CIRO four-tier Digital Asset Custody Framework; OSFI Capital & Liquidity Treatment Guideline (effective fiscal Q1 2026, incorporating the BCBS standard); provincial trust licensing. CTPs must keep at least 80% of client crypto with Acceptable Third-party Custodians; CIRO dealer self-custody capped at 20%. Travel Rule and LVCTRs (C$10,000+) under PCMLTFA.
• Verified outcome data: CIRO framework published and effective 3 February 2026. OSFI raised the Group 2 exposure limit from 1% to 5% of Net Tier 1 capital (29 October 2025 letter). Binance fined C$6,002,000 by FINTRAC; CoinSeason Capital C$33,000. The Stablecoin Act (Bill C-15) received Royal Assent 26 March 2026 (Bank of Canada oversight; not yet in force pending regulations). The QuadrigaCX collapse drove stronger-than-average segregation protections.
• Source:
  Canada country file, Sections 1-4, 6, 10-11.

Hong Kong

• Justification: Hong Kong is among the most comprehensively regulated jurisdictions in Asia-Pacific. VATP licensing under AMLO has been operational since 1 June 2023 with embedded custody requirements; the SFC ASPIRe roadmap, the live Stablecoins Ordinance (first licences 10 April 2026), and a detailed August 2025 SFC custody circular (HSMs, air-gapping, smart-contract prohibition) create a multi-layered architecture rivalling any jurisdiction. A standalone VA Custodian licence is still pending 2026 legislation, but the in-force framework is comprehensive.
• Key regulatory mechanism: AMLO VATP licensing with a wholly-owned-subsidiary custody structure; proposed standalone VA Custodian licence (HK$10 million paid-up capital, ~US$1.28M, no grandfathering); SFC Custody Circular (15 August 2025); Stablecoins Ordinance for HKMA-licensed issuers (100% reserve backing). Full Travel Rule from 1 June 2023 with no de minimis exemption.
• Verified outcome data: Nine entities granted VATP licences under AMLO as of February 2025; consultation conclusions on dealing/custodian licensing published 24 December 2025 (scope narrowed to private-key safekeeping, expedited pathway added). HKMA granted the first stablecoin issuer licences (HSBC, Anchorpoint Financial) on 10 April 2026 out of ~36 applications; 16 individuals charged in the JPEX fraud case (November 2025).
• Source:
  Hong Kong country file, Sections 1-3, 10-11.

Singapore

• Justification: Comprehensive licensing under the Payment Services Act (as amended, effective 4 April 2024), with detailed trust-account segregation, 90% cold storage, prohibition on lending/staking retail customer assets, and consumer protection requirements. MAS maintains a high entry bar with selective licensing. An additional DTSP regime applies under FSMA 2022.
• Key regulatory mechanism: PS Act SPI/MPI licences for DPT services (MPI base capital SGD 250,000); Payment Services (Amendment) Regulations 2024 for segregation; PS-G03 Guidelines requiring >=90% cold storage; Notice PSN02 for AML/CFT (FATF R.16 Travel Rule); FSMA DTSP licence (SGD 250,000 minimum capital, no transitional period).
• Verified outcome data: 37 MPI licences for DPT services active (MAS Financial Institutions Directory, verified March 2026). 90% cold-storage requirement in force since April 2024; trust-account segregation mandatory. The FSMA DTSP regime took effect 30 June 2025 with no transitional period; offshore-only firms must be licensed (MAS "will generally not issue"). Unlicensed-DTSP penalty up to SGD 250,000 and/or 3 years (FSMA s.137(6)).
• Source:
  Singapore country file, Sections 1-7, 10-12.

Japan

• Justification: The longest-operating comprehensive crypto custody framework (PSA since April 2017; custody-only since the May 2019 amendment in force May 2020). A >=95% cold storage mandate with 100% own-asset hot-wallet backing ("Redemption Guarantee Crypto Assets"), trust-held customer fiat, and statutory preferential repayment rights produce strong bankruptcy-remoteness. FSA on-site inspections and JVCEA self-regulatory oversight. A proposed PSA-to-FIEA migration (Cabinet bill 10 April 2026) would further strengthen the framework.
• Key regulatory mechanism: PSA registration for CAESPs; >=95% cold storage; 100% own-asset hot-wallet backing; statutory preference rights over segregated/backing assets ahead of general creditors; JVCEA self-regulatory standards; APTCP Travel Rule; annual CPA segregation audit.
• Verified outcome data: Framework operational since April 2017, shaped by Mt. Gox (2014, ~USD 450M) and Coincheck (2018, ~USD 530M); Coincheck self-compensated ~JPY 46.3 billion. FSA Working Group report (10 December 2025) recommends FIEA migration (cites 13M+ accounts, JPY 5tn+ deposits), insider-trading rules, and reserve-fund/insurance accumulation extending to cold-wallet value. FSA Funds Settlement Act ordinances effective 1 June 2026.
• Source:
  Japan country file, Sections 1-7, 10-12.

South Korea

• Justification: VAUPA (effective 19 July 2024) transformed South Korea from a registration-only AML framework to comprehensive investor protection. Mandatory >=80% cold storage, mandatory insurance/compensation reserves, explicit market-manipulation prohibition, and a unique bank-partnership model providing structural KYC. No dedicated standalone custody licence yet -- a carve-out is proposed under the second-phase Digital Asset Basic Act.
• Key regulatory mechanism: VAUPA (Act No. 19563) for investor protection; SFIA registration with KoFIU for AML; KISA ISMS certification; bank-partnership real-name account requirement; >=80% cold storage; mandatory insurance/reserves; Travel Rule from March 2022 (KRW 1,000,000 threshold).
• Verified outcome data: Five exchanges with full KRW trading accounts (Upbit, Bithumb, Coinone, Korbit, GOPAX). FSC phased roadmap (13 February 2025) to permit corporate/institutional participation. The Digital Asset Basic Act missed its 10 December 2025 target amid an FSC vs Bank of Korea stablecoin-oversight dispute. FSC report to the National Assembly (17 March 2026) reviewing separation of brokerage and custody and making custody a standalone licensable line (proposal, not enacted).
• Source:
  South Korea country file, Sections 1-7, 10-12.

UAE

• Justification: Multi-regulator framework (VARA, ADGM FSRA, DFSA, CBUAE, and the new federal CMA) with purpose-built custody regulations across multiple zones. VARA Rulebooks v2.0 (June 2025) set qualified-custodian, key-management, segregation, and proof-of-reserves standards. High capital requirements signal institutional-grade intent; virtual assets are now a federal "Financial Product" via CMA Decision No. 4/R.M/2026.
• Key regulatory mechanism: VARA Custody Services Licence (AED 4,000,000 minimum capital, ~USD 1.09M, dedicated entity); ADGM FSRA custody authorisation (up to USD 4M Tier-1 for public funds; USD 250,000 BCR for non-public, reduced August 2025); DFSA Crypto Token Framework (updated January 2026); CBUAE Federal Decree-Law No. 6 of 2025; CMA federal Custody Services licence. Risk-based wallet management (no fixed cold-storage percentage).
• Verified outcome data: VARA published the Virtual Asset Issuance Rulebook (9 April 2026, legal segregation of Reserve Assets, 100% 1:1 backing, monthly ARVA audits) and the Exchange Services Rulebook update effective 31 March 2026 (the official VARA rulebook page shows only V.1 (7 Feb 2023) and V.2 (19 May 2025), so the trade-press "v2.1" label is not primary-confirmed). VARA ordered four KuCoin-brand entities to cease activity (5 March 2026). CMA Decision No. 4/R.M/2026 effective 13 February 2026 (one-year transition to 13 February 2027). VARA marketing penalties up to AED 10 million.
• Source:
  UAE country file, Sections 1-6, 10-11.

Bahrain

• Justification: Bahrain was the first MENA jurisdiction with dedicated crypto-asset regulations (CBB CRA Module, 2019, latest version January 2024). Its custody conduct rules are prescriptive -- 95% cold storage, mandatory multi-signature, no rehypothecation, 1:1 holding, sub-custodian renunciation declarations, and mandatory insurance -- under a single-regulator model with lower capital barriers than the UAE, placing it firmly at the comprehensive-framework stage.
• Key regulatory mechanism: CBB CRA Module (Volume 6) with four CASP categories (custody in Cat 2/3/4); dedicated Chapter CRA-8 custody conduct rules; minimum 95% cold storage per asset (CRA-8.1.9); mandatory multi-signature (CRA-8.1.11); no-encumbrance prohibition (CRA-8.1.6); penetration testing twice per year (CRA-5.8.13G(e); interval/reporting in CRA-5.8.13I); PI insurance minimum BHD 100,000.
• Verified outcome data: Rain (first licensed crypto-asset provider in the Middle East, 2019); Binance licensed (March 2022); Fasset granted Category 3 (January 2025); CoinMENA (Category 3) acquired by Paribu for up to USD 240 million (December 2025). CBB issued the Stablecoin Issuance & Offering (SIO) Module (4 July 2025) and granted AX Coin Bahrain the first stablecoin issuer licence under it (3 June 2026).
• Source:
  Bahrain country file, Sections 1-3, 5-7, 10-11.

---

Position 6: Advanced/Integrated

Switzerland

• Justification: Switzerland offers arguably the most legally certain framework for institutional crypto custody globally. The DLT Act (in force 2021) amended ten federal laws, creating statutory bankruptcy protection for custodied crypto assets (DEBA Articles 242a-242b) -- the global benchmark, codified in statute rather than case law. A tiered licensing framework (banking, FinTech, DLT trading facility, SRO, proposed crypto institution) allows proportionate regulation. FINMA Guidance 01/2026 establishes comprehensive supervisory expectations. Institutional infrastructure (SDX, BX Digital, Sygnum, AMINA) demonstrates the framework works in practice.
• Key regulatory mechanism: DLT Act / DEBA Articles 242a-242b (statutory bankruptcy segregation); Banking Act Article 16 No. 1bis (custody-asset classification); FinTech licence (CHF 300,000 minimum capital); DLT trading facility licence (CHF 5 million for custody); FINMA Guidance 01/2026; proposed FinIA crypto institution licence; zero-threshold Travel Rule for crypto transfers (Art. 10 AMLO-FINMA).
• Verified outcome data: FINMA authorized BX Digital AG as the first DLT trading facility (March 2025); SDX operates as the world's first fully regulated digital financial market infrastructure. FINMA Guidance 01/2026 published 12 January 2026 (foreign-custodian delegation/equivalence, bankruptcy-protection equivalence). The FinIA reform consultation closed 6 February 2026 (proposed Crypto Institution License capital thresholds not yet published). OECD CARF implementation delayed to 2027.
• Source:
  Switzerland country file, Sections 1-12.

Liechtenstein

• Justification: Liechtenstein was an early mover with the first comprehensive blockchain statute (TVTG, in force 1 January 2020, Token Container Model) and provides statutory bankruptcy-remoteness (TVTG Art. 25 plus Insolvenzordnung (IO) Art. 41) -- a level of codified protection placing it alongside Switzerland as a top-tier European venue. Critically, it delivers this inside the EEA single market via MiCAR passporting (MiCAR taken into the EEA Agreement 24 June 2025), giving it the dual advantage of statutory insolvency certainty and single-market reach.
• Key regulatory mechanism: Dual regime -- TVTG registration as a TT/VT service provider (custody is a single unified category, VT-Verwahrer (Art. 2(1)(n)), covering both tokens and VT keys; TT Protector remains distinct) plus MiCAR CASP authorisation (Art. 75 custody via Art. 63 or Art. 60). Statutory segregation (Art. 25 TVTG) treats custodied tokens as third-party assets segregable on insolvency. EUR 125,000 minimum own funds for MiCAR custody; the TVTG custodian holds a flat CHF 100,000 (Art. 16(1)(b)), while the CHF 50,000-250,000 issuance-value tiers apply to token issuers (Art. 16(1)(a)). EU TFR Travel Rule via the EEA.
• Verified outcome data: Bank Frick received MiCAR authorisation (custody, order execution, transfer services) with passporting across 30 EEA states (20 January 2026). 29 TVTG registrations as of 4 November 2025 (including 5 banks offering token custody); the MiCAR transitional deadline is 1 July 2026. On bankruptcy of a VT-Verwahrer (custodian) or TT Protector, clients can have tokens segregated (ausgesondert) from the estate.
• Source:
  Liechtenstein country file, Sections 1-4, 10.

Bermuda

• Justification: Bermuda combines statutory creditor-exclusion (DABA s.18(4): custodied client digital assets are held for the client, are not the licensee's property, and are "not subject to the claims of creditors"), a mandatory financial backstop (s.18(1): surety bond, trust account, or indemnity insurance), a rules-based pari-passu insolvency waterfall (Custody Rules 2025), and a prescriptive key-management Code -- codified protection comparable to Switzerland and exceeding most jurisdictions reliant on general trust law, under a single integrated regulator (the BMA). It is on an institutional-deepening trajectory.
• Key regulatory mechanism: Three-class DABA licence (Class T / M / F) with custody as "providing custodial wallet services"; statutory segregation (s.17, s.18) and creditor-exclusion (s.18(4)); Custody of Client Assets Rules 2025 (pari-passu waterfall); Digital Asset Custody Code of Practice (February 2024: >=256-bit seed entropy, >=3-person seed ceremony, M-of-N multi-sig); minimum net assets US$100,000 (Class M/F); mandatory financial backstop (s.18(1)); FATF Travel Rule (member of CFATF).
• Verified outcome data: BMA issued the world-first DABA licence to DerivaDEX (DAO-governed, non-custodial) on 13 November 2025; published a Guidance Note for prospective applicants (8 September 2025). The Custody of Client Assets Rules 2025 took effect 12 February 2025. Bittrex Global (Bermuda) Ltd (Class F) ceased operations in an orderly exit illustrating the wind-down framework. Bermuda scored highest in the CFATF Mutual Evaluation 2020.
• Source:
  Bermuda country file, Sections 1-7, 10-11.

3. Spectrum Summary Table

4. Optimal Zone Analysis

Based on the verified evidence across all 20 jurisdictions, which spectrum positions produced the best outcomes across four dimensions?

4.1 Investor Protection

Best outcomes: Positions 5-6

Jurisdictions at Positions 5-6 demonstrate the strongest investor protection track records:

• Switzerland (Position 6): Statutory bankruptcy protection under DEBA Articles 242a-242b provides the highest legal certainty. Client assets are excluded from the custodian's bankruptcy estate by law, not merely by contract or regulatory guidance.
• Liechtenstein (Position 6): TVTG Art. 25 plus Insolvenzordnung (IO) Art. 41 deliver statutory segregation of custodied tokens (ausgesonderung) on insolvency of a TT depositary -- comparable codified certainty to Switzerland, now inside the EEA via MiCAR.
• Bermuda (Position 6): DABA s.18(4) statutorily excludes custodied client assets from creditor claims, s.18(1) mandates a financial backstop (bond, trust account, or insurance), and the Custody Rules 2025 add a pari-passu insolvency waterfall.
• Japan (Position 5): The 95% cold storage mandate, 100% own-asset hot-wallet backing, and statutory preferential repayment rights were developed in direct response to catastrophic losses (Mt. Gox ~USD 450M, Coincheck ~USD 530M). Coincheck self-compensated affected users (~JPY 46.3B).
• South Korea (Position 5): VAUPA's mandatory insurance/compensation reserves and 80% cold storage were catalyzed by the Terra/Luna collapse; the bank-partnership model provides structural KYC.
• Germany (Position 5): EUR 48.7B in custodied assets under a regime with mandatory insolvency segregation (Section 46i KWG) and active enforcement (Ethena GmbH wind-down).

Weakest in-force protection: Positions 2-3

• Australia (Position 2): The DAF Act 2026 is enacted but not commenced; until April 2027 the asset-holding standards that would deliver insolvency protection (s 912BE) are NOT VERIFIED at instrument level. The Block Earner appeal (judgment reserved) highlights residual boundary uncertainty.
• UK (Position 3): The current AML-only regime provides no custody-specific investor protection; trust-based CASS 17 ring-fencing and the Property (Digital Assets etc) Act 2025 foundation will not be operative until October 2027.
• Brazil (Position 3): Segregation is mandated (Resolution 520) but bankruptcy-remoteness is NOT VERIFIED as a codified statutory provision, and the adaptation period runs to October 2026.

4.2 Market Development

Best outcomes: Positions 5-6

• European Union (Position 5): 199 authorized CASPs (April 2026 tracker), with custody the most common service (~59%) and an EU-wide passport enabling cross-border services.
• Germany (Position 5): EUR 48.7B in custodied assets (28% YoY growth) and EU-leading 53 authorised CASPs.
• Liechtenstein (Position 6): Bank Frick's MiCAR authorisation passporting across 30 EEA states demonstrates that a small jurisdiction with statutory certainty can serve the entire single market.
• France (Position 5): SG Forge and Coinhouse authorized as MiCA CASPs for custody show the framework accommodates both bank-affiliated and crypto-native institutions.
• UAE (Position 5): Multi-pathway licensing (VARA, ADGM, DFSA, CMA) attracts diverse participants; the CoinMENA acquisition (USD 240M) and active VARA enforcement signal a maturing institutional market.

Challenging trade-offs:

• Japan (Position 5): Despite the longest-running framework, approximately 90% of domestic exchanges are reportedly unprofitable under current compliance burdens (the "Innovation = 1 : Regulation = 9" characterization), suggesting Position 5 can over-index on protection at the cost of market viability.
• South Korea (Position 5): The bank-partnership requirement concentrates the market -- only five exchanges hold full KRW trading accounts.
• Cayman Islands / Gibraltar (Position 4): Both rely on case-by-case prudential calibration; the absence of published capital and cold-storage thresholds can introduce entry uncertainty even as their conduct frameworks tighten.

4.3 Innovation

Best outcomes: Positions 5-6

• Switzerland (Position 6): DLT trading facility licence (BX Digital), SDX as the world's first regulated digital financial market infrastructure, the proposed FinIA crypto institution licence, and staking guidance demonstrate innovation within a comprehensive framework.
• Luxembourg (Position 5): Blockchain Laws I-IV (the control-agent model decoupling issuance-account management from custody) and DLT fund-unit tokenisation make it an EU leader in tokenized-securities infrastructure.
• United States (Position 5): The CFTC Digital Asset Collateral Pilot Program, OCC national trust bank charters for crypto-native firms, the SEC Custody Rule Modernization discussion draft, and the GENIUS Act stablecoin framework show rapid innovation.
• Hong Kong (Position 5): The ASPIRe roadmap's shift toward outcome-based custody standards, the Stablecoins Ordinance, and SFC tokenisation circulars demonstrate a forward posture.
• Gibraltar (Position 4): As the first jurisdiction to legislate a DLT-specific regime and the first to add a market-integrity principle, its principles-based model is designed to flex with new technology, and the 2025 VAAP category extends scope to non-custodial arrangements.

Innovation challenges at extremes:

• Australia (Position 2): Lack of in-force certainty deters institutional investment pending DAF Act commencement and the s 912BE/912BF instruments.
• Japan (Position 5): While comprehensive, the current PSA framework has been described as innovation-constraining, prompting the proposed FIEA migration.

4.4 International Alignment

Best outcomes: Positions 5-6

International alignment is measured against FATF Recommendation 15/16, IOSCO principles, and Basel Committee standards on crypto-asset exposures.

• Switzerland (Position 6): FATF-compliant AML with a zero-threshold Travel Rule (stricter than the FATF standard); Basel III via the CAO; OECD CARF adopted (delayed to 2027).
• European Union (Position 5): The TFR implements the Travel Rule across all member states with no de minimis; DORA aligns with cyber-resilience expectations; the AML package (AMLR from July 2027) provides FATF-aligned AML.
• Liechtenstein / Luxembourg (Positions 6 / 5): Both apply the EU TFR via the single market and the MiCAR/DORA stack, inheriting harmonized FATF and operational-resilience standards.
• Canada (Position 5): OSFI capital treatment follows the BCBS framework; FINTRAC AML aligns with FATF; the CIRO tiered model aligns with IOSCO custody principles.
• Bermuda / Cayman Islands (Positions 6 / 4): Both implement the FATF Travel Rule (CFATF members); Bermuda scored highest in the CFATF Mutual Evaluation 2020 and Cayman was removed from the FATF grey list in 2023.

5. Comparative Outcomes Matrix

6. Movement Trends

Jurisdictions are not static on the spectrum. The following movement trends are documented in the country regulation files:

Upward Movement (Toward More Comprehensive Regulation)

Australia: Position 2 toward Position 5

The DAF Act 2026 (enacted, commences 9 April 2027) introduces AFSL-based Digital Asset Platform and Tokenised Custody Platform licensing with a statutory "on trust" mechanism. Once the asset-holding (s 912BE) and transactional/settlement (s 912BF) instruments are made and the regime commences, Australia will move from an AML-only posture to a comprehensive activity-based custody regime aligned with Singapore's approach.

Evidence: Royal Assent 8 April 2026; commencement 9 April 2027 with a six-month transition; ASIC 18-month implementation roadmap (April 2026). --

Australia Sections 2-3, 11.

United Kingdom: Position 3 toward Position 6

The UK is building one of the most comprehensive forthcoming custody regimes among the jurisdictions studied. With the Cryptoassets Regulations made by Parliament (4 February 2026), the Property (Digital Assets etc) Act 2025 common-law foundation, draft CASS 17 trust-based safeguarding, and a bespoke CRYPTOPRU prudential regime, the UK will move from Position 3 toward the advanced end on commencement.

Evidence: FSMA Cryptoassets Regulations made February 2026; FCA application gateway 30 September 2026 to 28 February 2027; full regime commences 25 October 2027. --

United Kingdom Sections 2-3.

Brazil: Position 3 toward Position 5

BCB Resolutions 519/520/521 (in force 2 February 2026) provide the operational framework for a comprehensive regime. Once the adaptation period ends (30 October 2026) and full compliance is required, Brazil will have capital requirements, segregation mandates, phased Travel Rule compliance, and enforcement powers placing it at Position 5; Basel-aligned prudential rules remain a draft (Public Consultation 126/2025).

Evidence: Resolutions entered force 2 February 2026; compliance deadline 30 October 2026. --

Brazil Sections 2-3, 11.

Cayman Islands: Position 4 toward Position 5

The February 2026 Market Conduct framework (MC-RSOG) added mandatory insurance and conduct-of-business standards on top of Phase Two licensing, signalling a shift toward full conduct supervision. Should CIMA publish fixed capital and cold-storage thresholds, the Cayman Islands would cross fully into Position 5.

Evidence: Phase Two commenced 1 April 2025; MC-RSOG and updated Custody/VATP Rule issued February 2026 (prudential rules confirmed unchanged). --

Cayman Islands Sections 2-3, 11.

France: Position 5, Consolidating under MiCA

The MiCA transition (deadline 1 July 2026) elevates France's framework from a tiered national DASP system to the EU-wide CASP regime, with mandatory capital requirements for all custody providers; live CASP authorizations (SG Forge, Coinhouse) confirm the consolidation is underway.

Evidence: Transitional period ends 1 July 2026; AMF authorizing CASPs through 2026. --

France Sections 2, 11.

Hong Kong: Position 5, Adding a Standalone Custody Licence

The FSTB/SFC consultation conclusions (24 December 2025) confirm a dedicated VA Custodian licence (HK$10 million paid-up capital, no grandfathering, expedited pathway for associated entities), with a bill targeted for 2026. This deepens an already comprehensive framework rather than changing spectrum position.

Evidence: Consultation conclusions December 2025; bill for all four regimes reaffirmed targeted for 2026 LegCo (May 2026). --

Hong Kong Sections 3, 11.

Lateral Movement (Within Position, Deepening Framework)

Switzerland: Position 6, Deepening

The proposed FinIA reform (crypto institution licence) would add a dedicated regulatory category, transfer AML supervision from SROs to FINMA, and remove the FinTech licence deposit cap. This deepens the existing Position 6 framework without changing spectrum position.

Evidence: FinIA consultation closed 6 February 2026; expected entry into force late 2026/early 2027. --

Switzerland Section 11.

Liechtenstein: Position 6, Layering MiCAR onto TVTG

The dual-regime structure crystallised when MiCAR was taken into the EEA Agreement (24 June 2025), layering EU-harmonized CASP authorisation and passporting on top of the statutory TVTG protections. In-scope TVTG providers must hold MiCAR authorisation by 1 July 2026, completing the integration of statutory bankruptcy-remoteness with single-market reach.

Evidence: MiCAR EEA applicability 24 June 2025; transitional deadline 1 July 2026; Bank Frick MiCAR authorisation January 2026. --

Liechtenstein Sections 1, 10.

Bermuda: Position 6, Deepening

The Digital Asset Business Amendment Act 2024 added lending and repo as licensable activities, mandated wind-down plans, and expanded BMA capital/solvency rule-making; the Custody of Client Assets Rules 2025 codified the pari-passu insolvency waterfall. These deepen an already advanced statutory framework.

Evidence: Amendment Act 2024; Custody Rules 2025 in force 12 February 2025; Operational Resilience & Outsourcing Code (implement by 31 March 2028). --

Bermuda Section 11.

Japan: Position 5, Deepening

The proposed PSA-to-FIEA migration (Cabinet bill 10 April 2026) would reclassify crypto as financial instruments, introduce insider-trading rules, extend reserve-fund/insurance accumulation to cold-wallet assets, and increase penalties -- deepening an already comprehensive framework.

Evidence: FSA Working Group report 10 December 2025; Cabinet bill submitted 10 April 2026; effective ~fiscal 2027 if enacted. --

Japan Section 11.

South Korea: Position 5, Deepening

The second-phase Digital Asset Basic Act is under consideration, expected to add a standalone custody licence, stablecoin regulation, and corporate/institutional participation, alongside ownership caps on major exchanges.

Evidence: FSC report to the National Assembly 17 March 2026 (custody as a standalone licensable line, proposal not enacted); Digital Asset Basic Act delayed into 2026. --

South Korea Section 11.

Convergence Pattern

A clear convergence pattern emerges: jurisdictions are moving toward Position 5 (Comprehensive Framework) from both directions, and the spectrum's middle has thinned. Those below (Australia, UK, Brazil) are building comprehensive regimes; those at Position 4 (Gibraltar, Cayman Islands) are adding the conduct and insurance layers that distinguish Position 5. Twelve jurisdictions already sit at Position 5, and three (Switzerland, Liechtenstein, Bermuda) sit at Position 6 on the strength of statutory bankruptcy protection.

Position 6 is no longer a Swiss monopoly: Liechtenstein (TVTG Art. 25 + Insolvenzordnung (IO) Art. 41, now inside the EEA) and Bermuda (DABA s.18(4) creditor-exclusion + pari-passu waterfall) have replicated statutory insolvency certainty through their own legislative routes. The convergence target remains a regime that includes: (a) dedicated custody licensing, (b) capital adequacy requirements, (c) mandatory asset segregation, (d) prescriptive or outcome-based key-management standards, (e) AML/Travel Rule compliance, (f) enforcement powers with a demonstrated track record, and (g) alignment with FATF/IOSCO/Basel standards.

By 2028, based on announced timelines, at least 18 of the 20 studied jurisdictions are expected to be at Position 5 or above.

7. Key Findings

Finding 1: Position 5 is the Global Convergence Target

The data shows unambiguous convergence toward comprehensive frameworks. No jurisdiction is moving backward on the spectrum. The only question is speed of arrival; Australia, the UK, and Brazil all have enacted or near-final regimes scheduled to reach Position 5 by 2027-2028.

Finding 2: Statutory Insolvency Protection Is the Position-6 Differentiator -- and It Is Spreading

Position 6 now rests on statutory bankruptcy protection achieved through three distinct legislative routes: Switzerland's DLT Act (DEBA Articles 242a-242b), Liechtenstein's TVTG Art. 25 plus Insolvenzordnung (IO) Art. 41, and Bermuda's DABA s.18(4) creditor-exclusion reinforced by the Custody Rules 2025 pari-passu waterfall. The EU's MiCA Art. 75(7), the UK's proposed CASS 17, Germany's Section 46i KWG, and Japan's statutory preference rights approach this through different mechanisms but stop short of the same standalone codified certainty. The differentiator is no longer unique to Switzerland, but it remains the dividing line between Positions 5 and 6.

Finding 3: Cold Storage Mandates Cluster at 80-98%

Among jurisdictions that prescribe cold-storage ratios, the range is narrow: Hong Kong (98% original VATP), Japan (95%), Bahrain (95% per CRA-8.1.9), Singapore (90%), South Korea (80%), and Canada (80% with third-party custodians). The outliers use outcome-based or risk-based approaches (Switzerland, UAE, Bermuda, Gibraltar, Cayman Islands, and EU member-state discretion).

Finding 4: Market Development Tracks Position 5+

No jurisdiction at Position 2 or 3 has generated significant verified institutional custody AUM data. Germany at Position 5 (EUR 48.7B) is the only jurisdiction with a verified aggregate AUM figure, and the EU's 199 CASPs (with custody the most common service) concentrate in Position 5 member states -- suggesting comprehensive regulation is a prerequisite for institutional-scale custody markets. Small Position-6 jurisdictions (Liechtenstein via Bank Frick's 30-EEA-state passport) show statutory certainty plus single-market reach can substitute for domestic market size.

Finding 5: Over-Regulation Has Costs

Japan's experience (90% unprofitable exchanges; the "Innovation = 1 : Regulation = 9" characterization) and South Korea's concentrated market (five exchanges with full KRW access) demonstrate that Position 5 frameworks can impose costs that limit market participation. Conversely, the case-by-case prudential calibration at Position 4 (Gibraltar, Cayman Islands) trades published-threshold certainty for supervisory flexibility -- a different cost borne by applicants seeking predictability.

For further analysis of these trade-offs, see What Works & What Doesn't and Country Comparison Tables.

Verification Notes

This analysis synthesizes data exclusively from the individual country regulation files, the verified cross-country fact matrix, and the guidance documents produced during the research and refresh phases. No new unverified claims were introduced, and no web sources were consulted for this refresh. All jurisdiction placements, outcome data, and metrics are traceable to the source country files at content/deep-research/crypto-custody/regulations/. Where the matrix records a fact as "NOT VERIFIED" or "No data" (for example, several Position-4 capital and cold-storage thresholds, Brazil insurance requirements, and Australia's not-yet-made s 912BE/912BF instruments), that status is reflected honestly rather than estimated.

This refresh (modified 2026-06-04) integrated five new jurisdictions -- Liechtenstein, Luxembourg, Gibraltar, Bermuda, and the Cayman Islands -- across every table, list, prose bucket, and spectrum position, and recomputed all "X of N" aggregates for N=20. Spectrum placements were re-derived from each jurisdiction's matrix spectrum_position: Hong Kong, France, and Bahrain were moved up from the prior Position 4 to Position 5 to reflect their now-comprehensive in-force frameworks; Gibraltar and the Cayman Islands populate Position 4 as licensed-activity regimes with case-by-case prudential parameters; and Liechtenstein and Bermuda join Switzerland at Position 6 on the strength of statutory bankruptcy protection. The United States entry was corrected to reflect that SAB 121 was rescinded by SAB 122 (effective 30 January 2025) and that state trust companies may now act as qualified custodians under the 30 September 2025 SEC no-action letter.