Capital & Prudential Requirements

June 4, 2026

39 min read

Capital adequacy is the foundational pillar of financial stability for any entity entrusted with the safekeeping of client assets. For institutional crypto custodians, the capital question is more complex than in traditional finance: regulators must account for the novel operational risks of cryptographic key management, the volatility of custodied assets (even where held off-balance-sheet), and the absence of deposit insurance or investor compensation schemes that backstop traditional custodians. This section provides a comparative analysis of how 20 jurisdictions approach capital and prudential requirements for crypto custody, how the Basel Committee framework shapes the global baseline, and what an optimal tiered capital framework should look like.

1. Global Landscape: Capital Models for Crypto Custodians

Four distinct capital models have emerged across the 20 jurisdictions for crypto custody providers. Each reflects a different regulatory philosophy regarding the relationship between capital, risk, and market access. Several jurisdictions span more than one model where a registration tier and a banking/MiCAR tier coexist.

1.1 Fixed Minimum Capital

The most common approach sets a flat minimum capital floor that all custodians must meet, irrespective of the volume of assets under custody. This creates a barrier to entry that screens out undercapitalised operators but does not scale with the growth of a custodian's business.

European Union (MiCA): Under Article 67 and Annex IV of the Markets in Crypto-Assets Regulation (MiCA), custody and administration of crypto-assets is classified as a Class 2 service requiring a permanent minimum of EUR 125,000 in own funds. The actual own funds requirement is the higher of (a) this fixed minimum, or (b) one quarter of the preceding year's fixed overheads. CASPs may alternatively satisfy this through an insurance policy or comparable guarantee covering operational risk. MiCA's three-tier structure ranges from EUR 50,000 (Class 1: advisory, execution) to EUR 150,000 (Class 3: operating trading platforms).

Source: MiCA Article 67 and Annex IV | Law Firm Poland -- MiCA Capital Requirements

Luxembourg (MiCA via CSSF): Luxembourg derives its custody capital regime directly from MiCAR rather than a bespoke national statute. CASPs authorised by the CSSF for custody and administration must meet the EUR 125,000 Class 2 permanent minimum under Annex IV, or one quarter of the preceding year's fixed overheads, whichever is higher. Own funds must consist of CET1 instruments per the CRR. Credit institutions and investment firms providing custody under the Article 60 notification route remain under their existing CRR/CRD and IFR/IFD frameworks. Luxembourg's distinctive contribution is its DLT-securities control-agent and depositary ecosystem (Blockchain Laws I-IV), not a separate crypto capital add-on.

Source: MiCA Article 67 and Annex IV | CSSF -- MiCAR

Germany: Under the pre-MiCA KWG regime, BaFin required a minimum initial capital of EUR 150,000 for pure crypto custody services, with firms offering additional services (trading, exchange) potentially needing up to EUR 730,000 in operational capital. Germany chose an accelerated MiCA transition, with a shortened 12-month grandfathering period that ended 31 December 2025 -- ahead of the EU-wide 1 July 2026 deadline. Under MiCA, the relevant own-funds floors are the Annex IV three-tier figures: EUR 50,000 (Class 1), EUR 125,000 (Class 2, custody), and EUR 150,000 (Class 3). (A previously reported "EUR 350,000" MiCA top tier was erroneous -- no such Annex IV tier exists.)

Source: BaFin Crypto Custody Guidance | BaFin Application Guidelines

UAE (VARA): Dubai's Virtual Assets Regulatory Authority requires a minimum paid-up capital of AED 4,000,000 (~USD 1,089,000) for custody services -- one of the highest fixed minimums globally for a standalone crypto custody license, and a dedicated, separately licensed activity. Additional ongoing net liquid asset and reserve asset requirements must be maintained at all times. Within the same federation, the ADGM FSRA sets USD 4,000,000 Tier-1 capital for custody of public funds (reduced to a USD 250,000 Base Capital Requirement for non-public-fund custody in August 2025), and the new federal CMA regime (CMA Decision No. 4/R.M/2026, effective 13 February 2026) sets custody capital at AED 3,000,000 (figures across summaries conflict) plus a buffer of at least six months of operating expenses.

Source: VARA Custody Services Rulebook v2.0 | Complyfactor -- UAE Crypto Regulation 2025

Bahrain: The Central Bank of Bahrain's crypto-asset framework (CRA Module) uses four licensing categories with minimum paid-up capital set per category (CRA-3.1.2). Category 1 (basic services, no custody) requires BHD 25,000 (~USD 66,300). Category 2 (custody / portfolio management) requires BHD 100,000 (~USD 265,300). Category 3 (+ principal trading, including custody) requires BHD 200,000 (~USD 530,500). Category 4 (exchange plus custody) requires BHD 300,000 (~USD 795,700). Capital must consist of paid-up share capital unimpaired by losses, deposited in local Bahraini banks, and maintained at or above the minimum at all times.

Source: STA Law -- Bahrain Crypto Licensing | Tetra Consultants -- Bahrain CASP License

Bermuda (BMA / DABA): Under the Digital Asset Business Act 2018, Class M and Class F licensees must maintain minimum net assets of US$100,000 (DABA s.9(3)), or higher as the BMA directs by reference to the nature, size and complexity of the business; Class T (test) licensees are assessed case-by-case. Although the statutory floor is modest, the custody-activity annual fee floor of US$150,000 is the highest activity-specific minimum in Bermuda's fee schedule, and institution-level capital above the US$100,000 floor is set case-by-case (the precise figures are not published). As Bermuda is not a Basel Committee member, no separate quantitative capital ratio (e.g. a Basel risk-weight) specific to custody has been published.

Source: Digital Asset Business Act 2018 | BMA Digital Asset Custody Code of Practice

Singapore: The Monetary Authority of Singapore requires a minimum base capital of SGD 250,000 for Major Payment Institutions (MPIs) providing digital payment token services, including custody, and the same SGD 250,000 minimum for Digital Token Service Providers (DTSPs) under the FSMA 2022; Standard Payment Institutions (SPIs) face an SGD 100,000 base capital. Licensed firms must maintain this minimum capital on an ongoing basis, hold a security deposit (SGD 100,000 for SPIs, SGD 200,000 for MPIs), conduct annual audits, and maintain strict asset segregation (90% cold wallet storage).

Source: MAS Guidelines on Licensing for DTSPs | MAS Media Release -- DTSP Regime (June 2025)

Japan: The Financial Services Agency requires a stated capital of at least JPY 10 million (~USD 70,000) plus positive net assets for crypto-asset exchange service providers (CAESPs, a category that has covered custody-only services since the May 2019 PSA amendment). A frequently cited "JPY 50 million practical minimum" is not verified and rests on secondary commentary only. Under the FIEA-migration reform (Cabinet bill 10 April 2026), the FSA would add reserve-fund accumulation -- or equivalent insurance -- covering unauthorized-outflow losses extending to cold-wallet asset value. Custodians must also hold "Redemption Guarantee Crypto Assets" backing 100% of hot-wallet balances.

Source: JFSA Crypto Regulation | CoinTelegraph -- Japan Crypto Regulations 2025

1.2 Dynamic / Risk-Based Capital

Some jurisdictions go beyond flat minimums, requiring capital to scale with business activity. This approach better captures risk but adds compliance complexity.

United Kingdom (FCA CRYPTOPRU): The FCA's proposed prudential regime for cryptoasset firms, published in CP25/42 (December 2025), introduces a three-component own funds requirement (OFR) -- the highest of: (1) a Permanent Minimum Requirement (PMR) of GBP 150,000 for safeguarding/custody; (2) a Fixed Overhead Requirement (FOR) equal to one quarter of annual fixed overheads; and (3) a K-Factor Requirement (KFR) based on business activity. For custodians, the primary K-factor is K-CSG (Client Cryptoassets Safeguarded) at 0.04% of the average total value of client cryptoassets safeguarded. Firms also face an Internal Capital Adequacy and Risk Assessment (ICARA) process, wind-down planning requirements, and a Basic Liquid Assets Requirement (BLAR). The full safeguarding regime goes live on 25 October 2027.

Source: FCA CP25/42 | Winston & Strawn -- CP25/42 Analysis | Skadden -- UK Cryptoasset Prudential Regime

France (AMF DASP Regime): Under the pre-MiCA optional DASP license, licensed custodians must maintain the higher of: (a) a minimum capital of EUR 150,000, (b) the fixed overheads requirement, or (c) own funds equal to 4.5% of the digital assets held on the DASP's own accounts. This activity-based multiplier is one of the few examples globally of capital being directly linked to the value of assets held. Basic (registered) DASPs face no minimum-capital requirement. With France's transition to MiCA (by 1 July 2026), the harmonised EUR 125,000 minimum (Class 2) plus one-quarter of prior-year fixed overheads applies.

Source: AMF Q&A on DASPs (PDF) | AMF -- DASP Registration

Liechtenstein (TVTG + MiCAR): Liechtenstein runs a dual regime. Under the national TVTG (Blockchain Act, Art. 16), the custodian (VT-Verwahrer) holds a flat CHF 100,000 minimum capital (Art. 16(1)(b)); the issuance-value tiers — CHF 50,000 (issuance ≤ CHF 5m), CHF 100,000 (CHF 5-25m), or CHF 250,000 (≥ CHF 25m) — apply to token issuers (Art. 16(1)(a)), not custodians. For in-scope crypto-asset services, MiCAR applies: custody CASPs must hold the EUR 125,000 Class 2 permanent minimum (or one quarter of prior-year fixed overheads, whichever is higher), with TVTG providers required to hold MiCAR authorisation by 1 July 2026. Credit institutions offering custody via the Article 60 route remain under the banking CRR/CRD regime.

Source: MiCA Article 67 and Annex IV | FMA Liechtenstein -- TVTG / Blockchain Act

Hong Kong (SFC/FSTB): The proposed standalone framework for virtual asset custodians requires HKD 10 million (~USD 1.28 million) in paid-up share capital, up to HKD 3 million (~USD 384K) in liquid capital, and excess liquid capital equivalent to at least 12 months of operating expenses; banks (Authorised Institutions) are exempt. Differentiated by licence type, dealers face an HKD 5 million floor and stablecoin issuers HKD 25 million paid-up. The HKMA has signalled that crypto assets on permissionless blockchains may qualify for lower bank capital requirements if issuers demonstrate effective risk management.

Source: SFC/FSTB Consultation Conclusions (December 2025) | The Block -- HK Bank Capital

1.3 Banking-Equivalent Capital

In some jurisdictions, crypto custodians are required to obtain banking or trust company licenses, subjecting them to full banking-equivalent prudential requirements.

United States (OCC National Trust Banks): The OCC granted conditional approval to five crypto-focused national trust bank charters in December 2025 (Ripple, BitGo, Fidelity Digital Assets, Paxos, First National Digital Currency Bank), followed by additional charters in early 2026 (Stripe/Bridge, Crypto.com, Protego, and Coinbase in April 2026). These operate as uninsured national trust banks, subject to standard OCC capital, governance, and risk-management standards. Broker-dealer custodians instead fall under the Net Capital Rule (Exchange Act Rule 15c3-1, USD 5,000-250,000), Wyoming SPDIs hold a statutory USD 5 million minimum with a 100% reserve on client fiat, and New York limited-purpose trust companies set capital case-by-case. The rescission of SAB 121 via SAB 122 (effective 30 January 2025) removed the requirement for banks to record custodied crypto as a balance-sheet liability and eliminated the associated capital charges that had made bank crypto custody economically prohibitive; banks now apply ASC 450-20.

Source: OCC NR-2025-125 | Deloitte -- SAB 122

New York (NYDFS): Limited purpose trust companies chartered by the New York Department of Financial Services have capital requirements established on a case-by-case basis during the chartering process, assessed against each applicant's risk profile and business plan. South Dakota-chartered trust companies (used by BitGo and others before OCC conversion) similarly apply risk-based capital assessments.

Switzerland (FINMA): Full banking license holders must maintain full prudential capital under the Capital Adequacy Ordinance (CAO), with FINMA retaining discretion to set higher amounts based on the bank's activities. FinTech license holders (accepting up to CHF 100 million in public client funds) require CHF 300,000 (~USD 336,000) minimum capital. A DLT trading facility requires CHF 1 million for trading-only and CHF 5 million where it also provides custody, settlement or clearing. The proposed Crypto Institution License (FinIA reform, consultation closed 6 February 2026) has thresholds not yet published. Under FINMA Guidance 01/2026, crypto assets held in properly segregated custody by banks (off-balance-sheet, DEBA Art. 242a / Banking Act Art. 16 No. 1bis) generally do not generate additional capital requirements for the custodian.

Source: Gofaizen & Sherle -- Switzerland Crypto License | PwC -- FINMA Guidance on Crypto Custody

Canada (Trust Companies / OSFI): Trust company custodians must hold minimum equity of C$10 million (Canadian) or C$100 million (foreign). Crypto trading platform (CTP) capital is set case-by-case in registration decisions (no single published figure has been verified). For federally regulated financial institutions (FRFIs) under OSFI, segregated custody attracts operational-risk capital only -- no credit, market or liquidity charges -- placing bank custodians in a banking-equivalent but custody-light prudential position.

Source: CIRO Digital Asset Custody Framework | OSFI Crypto-Asset Exposures Guideline

1.4 No Specific Crypto Capital (General License Applies)

Some jurisdictions do not impose crypto-specific minimum capital, instead relying on existing financial-services frameworks, individualised risk-based assessment, or de facto barriers.

Cayman Islands (CIMA): The Cayman Islands Monetary Authority publishes no fixed minimum net-worth or capital threshold for virtual asset custodians. Capital adequacy is assessed case-by-case against the nature, scale and complexity of the business. The Custody/VATP Rule nonetheless imposes regulatory capital, recovery plans and stress testing, all confirmed unchanged in the February 2026 update. There is no statutory deposit-insurance scheme; client protection runs through segregation, an insurance/risk-mitigation mandate (Market Conduct RSOG, February 2026), and prudential capital.

Gibraltar (GFSC DLT regime): Gibraltar's principles-based DLT Provider regime publishes no single fixed statutory minimum capital figure. Instead, Principle 3 requires "adequate financial and non-financial resources," set case-by-case and maintained on a continuing basis, with the GFSC able to require more where risk warrants. As Gibraltar sits outside the EU, it does not apply MiCA CASP own-funds floors or EU CRR/IFR, and no Gibraltar crypto-specific Basel transposition has been located.

Australia (ASIC DAF Act): The Digital Assets Framework Act 2026 (Royal Assent 8 April 2026; commences 9 April 2027) builds custody on an AFSL footing, but DAP/TCP-specific capital figures have not yet been published (the financial-requirement instruments are due in roadmap months 6-12). In the interim, standard AFSL RG 166 obligations apply (positive net tangible assets, liquid assets, cash-flow solvency), with anticipated liquidity and NTA requirements for Digital Asset Platform and Tokenised Custody Platform operators.

South Korea (VAUPA / SFIA): South Korea prescribes no specific minimum capital for VASPs under VAUPA or the SFIA (unlike Singapore or Japan). Instead, de facto barriers arise from the mandatory bank-partnership model, ISMS certification and maintenance costs, and -- crucially -- a mandatory insurance OR compensation-reserve obligation whose minimum coverage is set by FSC regulation calibrated to size and risk (no public numeric floor located). A standalone custody licence is only proposed under the second-phase Digital Asset Basic Act.

Brazil (BCB SPSAV): The original BVAL thresholds were fixed per-type minimums: Intermediary R$1 million, Custodian R$2 million, and Broker R$3 million (plus R$2 million for margin/staking). The November 2025 reform replaced these with an activity-based capital formula set by Resolution BCB 517 and Joint Resolution 14 (both dated 3 November 2025 — the general minimum-capital rules for BCB-supervised institutions, into which SPSAVs were folded); the resulting span is R$10.8 million-R$37.2 million (a cost component plus an activities component multiplied by a captation factor of 1.0-1.5), with no simple category-to-figure mapping. A separate Basel-aligned prudential framework (RWA/LCR, four risk subgroups) is proposed via Public Consultation 126/2025 but remains a draft, with no final norm issued as of 4 June 2026.

US State Money Transmitter Licenses: Many US states classify certain crypto custody activities under money transmission laws, with capital requirements varying by state (typically surety bonds of USD 100,000-500,000 rather than minimum capital). This fragmented approach has been widely criticised as insufficient for institutional custody.

2. Basel Committee Framework: SCO60 and Its Impact on Custody

The Basel Committee on Banking Supervision's prudential standard for crypto-asset exposures (SCO60) sets the global baseline for how banks must capitalise their crypto-related activities, including custody. Published as d545 in December 2022 with targeted amendments in d579 (July 2024), the standard took effect on 1 January 2026. Note that several of the 20 jurisdictions here are not BCBS members -- including Bermuda, the Cayman Islands and Gibraltar -- so the Basel crypto standard does not apply to them directly; their prudential rules rest on bespoke statute (Bermuda's DABA), case-by-case supervision (Cayman, Gibraltar), or general financial-services law.

2.1 Crypto-Asset Classification System

SCO60 classifies crypto-assets into groups that directly determine capital treatment:

GroupDescriptionCapital Treatment
Group 1aTokenised traditional assets (e.g., tokenised bonds, equities)Same risk weights as underlying traditional asset
Group 1bStablecoins with effective stabilisation mechanismsSame as underlying asset, plus supervisory conditions
Group 2aLower-risk assets failing Group 1 conditionsModified risk weight; hedging recognition allowed
Group 2bUnbacked crypto-assets (Bitcoin, Ether, etc.)1,250% risk weight (dollar-for-dollar capital)

The 1,250% risk weight for Group 2b exposures is the most consequential provision. It effectively requires banks to hold capital equal to the full value of their Group 2b exposure, making direct on-balance-sheet holdings of unbacked crypto-assets economically unviable for banks.

Source: BIS SCO60 Chapter | Ashurst -- Basel Final Standard | Skadden -- Bank Capital Standards for Cryptoassets

2.2 Group 2 Exposure Limits

The Basel standard imposes strict caps on aggregate Group 2 exposure:

  • Total Group 2 exposure must not exceed 1% of Tier 1 capital (the BCBS default).
  • Exposures exceeding 1% are reclassified as Group 2b (attracting the 1,250% risk weight).
  • At a 2% threshold, all Group 2 exposures are treated as Group 2b.
  • Banks must notify supervisors of existing exposures and provide advance notification before acquiring new ones.

Notable departure --

Canada (OSFI): On 29 October 2025, OSFI raised the Group 2 exposure limit from 1% to 5% of Net Tier 1 capital, significantly expanding the capacity of Canadian banks to engage in crypto activities. Critically, OSFI also removed the automatic reclassification to Group 2b for exposures between 1% and 5% -- banks can now hold up to 5% without incurring the punitive 1,250% risk weight. Breaching the 5% cap triggers immediate reporting and rectification obligations, with all Group 2 exposures reverting to Group 2b deduction (1,250% risk weight).

Source: OSFI Letter to Industry (October 2025) | McMillan LLP -- OSFI Allows Greater Crypto Exposure

2.3 Infrastructure Risk Add-On

The Basel standard originally proposed a mandatory 2.5% infrastructure risk add-on for Group 1 crypto-assets to account for novel DLT technology risks. In the final standard, this was changed to a discretionary add-on: national supervisors may apply it based on observed weaknesses, with the current default at zero. This gives national regulators flexibility to impose additional capital charges if DLT infrastructure vulnerabilities emerge.

2.4 Custody-Only Exposures vs. Proprietary Holdings

This distinction is critical for institutional custodians:

  • Segregated custody (safekeeping client crypto-assets on a fiduciary basis): Does not give rise to credit, market, or liquidity risk capital requirements under SCO60. The assets are held on behalf of clients, not on the bank's balance sheet. Canada's OSFI guideline applies exactly this treatment, charging only operational-risk capital for segregated custody, and Switzerland's FINMA reaches the same outcome for properly segregated (off-balance-sheet) custody assets.
  • Operational risk capital requirements still apply to all custody activities.
  • Proprietary holdings (crypto-assets held on the bank's own account): Subject to full capital treatment under the Group 1/Group 2 classification.

This bifurcation is significant for policymakers: it means that a bank providing pure custody services faces a substantially lower capital burden than one taking proprietary positions, creating a natural incentive for the custodial model.

2.5 Stablecoin Custody Requirements

The d579 amendments (July 2024) introduced specific provisions for stablecoin custody:

  • Reserve assets backing stablecoins must be held in structures that are bankruptcy-remote from any party issuing, managing, or custodying the stablecoin.
  • A limited exception exists where a bank is only providing custody services to a stablecoin arrangement (not issuing or managing it).
  • Algorithmic stablecoins are expressly excluded from Group 1b treatment.
  • Assets on permissionless blockchains are excluded from Group 1b classification.

Source: BIS d579 Amendments (PDF) | BIS Press Release (July 2024)

2.6 DIS55 Disclosure Framework

The companion disclosure standard (d580/DIS55), also effective 1 January 2026, requires banks with any crypto-asset exposure to provide:

  • Annual qualitative reporting (Table CAEA): Activities related to crypto-assets, classification methodologies, risk management approaches.
  • Semiannual quantitative disclosures: Capital requirements by asset group (Template CAE1), accounting classification (Template CAE2), and liquidity requirements (Template CAE3).

Source: BIS d580 Disclosure Framework | BIS d580 (PDF)

2.7 National Implementation Divergence

Implementation of the Basel crypto-asset standard has diverged significantly across the BCBS-member jurisdictions among the 20:

EU (CRR III): CRR III introduces a transitional framework for crypto-asset prudential treatment applicable from 9 July 2024. The EBA published draft regulatory technical standards aligning EU capital treatment with the Basel standard. A permanent legislative framework (required by 30 June 2025) has been delayed due to ongoing debate about calibration.

Source: White & Case -- CRR III Crypto Exposures | EBA Draft RTS

United States: The Trump Administration has explicitly rejected the Basel SCO60 framework through Executive Order 14178 and the accompanying Digital Assets Report (July 2025), describing the 1,250% risk weight as "anti-innovation" and "anti-competitive." The US is pursuing a domestically tailored, risk-based approach (the GENIUS Act, for instance, places payment-stablecoin reserves on-balance-sheet under a modified capital charge, with a 2% haircut for proprietary stablecoin positions). This creates a fundamental transatlantic regulatory divergence.

Source: Kaiko -- EU vs US: Two Paths for Prudential Crypto Rules

Hong Kong (HKMA): Introduced CRP-1 aligning with the Basel standard from 1 January 2026, but has signalled potential easing for crypto assets on permissionless blockchains where effective risk management is demonstrated.

Source: Cryptonite -- HKMA Basel Standards 2026

Canada (OSFI): Broadly follows Basel but with the notable 5% Net Tier 1 exposure limit (versus Basel's 1%), via the Capital & Liquidity Treatment of Crypto-asset Exposures Guideline effective fiscal Q1 2026; a 2027 guideline consultation (cross-exchange hedging for Group 2a) is open.

Japan (JFSA): Has aligned its prudential framework with the Basel standard, layered on the PSA positive-net-assets capital regime.

Singapore (MAS): Has incorporated the Basel crypto-asset standard within its banking regulations.

Switzerland (FINMA): Implements Basel III via the CAO and LiqO; crypto-specific Basel Committee standards are expected to be transposed as finalised, with FINMA able to impose maximum-amount limits or additional capital charges where elevated risks are identified.

Brazil (BCB): Has not yet enacted Basel-aligned crypto capital rules; Public Consultation 126/2025 proposes an RWA/LCR framework with four risk subgroups, but it remains a draft (comments closed 30 January 2026; no final norm as of 4 June 2026).

Non-BCBS jurisdictions (Bermuda, Cayman, Gibraltar, UAE, Bahrain): These are not bound by the Basel crypto standard. The UAE and Bahrain instead apply activity-specific fixed-capital regimes; Bermuda applies a statutory net-assets floor with proportionate BMA direction; and Cayman and Gibraltar rely on case-by-case capital-adequacy assessment.

2.8 Industry Pushback

In August 2025, the Global Financial Markets Association (GFMA) and ISDA submitted a joint letter to the BCBS calling for recalibration of the standard, arguing that: (a) the 1,250% risk weight for Group 2b is excessively conservative; (b) the 1% Tier 1 exposure limit constrains bank participation; and (c) the framework risks pushing crypto activities to less regulated entities outside the banking perimeter.

Source: GFMA Letter to BCBS (August 2025) | ISDA Press Release

3. Comparative Table: Capital Requirements by Jurisdiction

All 20 jurisdictions in the domain are shown below. Figures mirror the verified per-jurisdiction fact matrix; "NOT VERIFIED" entries reflect genuine gaps in publicly available primary sources.

JurisdictionMinimum Capital (Custody)Dynamic/Activity-BasedBasel AdoptionStress Testing
EU (MiCA)EUR 125,000 (Class 2)Quarter of fixed overheadsCRR III transitional (aligned with SCO60)DORA operational resilience
LuxembourgEUR 125,000 (MiCAR Class 2)Quarter of fixed overheadsCRR III via CSSFDORA operational resilience
GermanyEUR 150,000 (KWG); EUR 125,000 (MiCA Class 2)Quarter of fixed overheads (MiCA)CRR III via BaFinBaFin stress testing
FranceEUR 150,000 (licensed DASP); EUR 125,000 (MiCA)4.5% of own-account digital assets; quarter of overheadsCRR III transitionalAMF/ACPR oversight
LiechtensteinCHF 50K-250K (TVTG, by issuance); EUR 125,000 (MiCAR)Quarter of fixed overheads (MiCAR)CRR III via FMA (MiCAR/banking CRR)DORA operational resilience
UKGBP 150,000 (PMR)K-CSG: 0.04% of AUC; FOR: quarter of overheadsBespoke CRYPTOPRU (Basel-aligned)ICARA process
SwitzerlandCHF 300,000 (FinTech); CHF 1M/5M (DLT facility); full CAO (bank)Risk-based (FINMA discretion)FINMA-supervised banks follow BaselFINMA stress testing
US (OCC)Standard OCC (trust bank); Wyoming SPDI USD 5M; BD USD 5K-250KRisk-based (OCC discretion); Net Capital RuleRejected (EO 14178)OCC examination
CanadaTrust co C$10M / foreign C$100M; CTP case-by-case5% Net Tier 1 Group 2 limit; op-risk-only for segregated custodySCO60 adopted; 5% limit (vs. 1% Basel)OSFI FRFI framework
BrazilR$2M (Custodian, orig BVAL); reportedly raised (NOT VERIFIED mapping)Min paid-in capital + net equity by categoryPublic Consultation 126/2025 (draft, not enacted)BCB oversight
BermudaNet assets US$100,000 (Class M/F); custody fee floor US$150,000BMA case-by-case scale-upNot a BCBS memberBMA proportionate supervision
Cayman IslandsNo published fixed minimum (CIMA case-by-case)Custody/VATP Rule capital, recovery plansNot a BCBS memberMandatory stress testing (Custody/VATP Rule)
UAE (VARA)AED 4,000,000 (~USD 1.09M); ADGM USD 4M / USD 250K BCR; CMA AED 3MNet liquid asset + reserve asset; CMA 6mo opexNot a BCBS member (federal)VARA ongoing supervision
BahrainBHD 100,000-300,000 (~USD 265K-796K, Cat 2-4)None specifiedNot a BCBS memberCBB oversight
GibraltarNo fixed statutory minimum (Principle 3 case-by-case)Adequate resources, continuing basisOutside EU/MiCA; no Basel transposition locatedGFSC supervision (bank-par)
Hong KongHKD 10M (~USD 1.28M) + up to HKD 3M liquid12 months operating expensesCRP-1 aligned with SCO60SFC/HKMA reviews
SingaporeSGD 250,000 (MPI/DTSP); SGD 100,000 (SPI)Annual audit-based; security depositMAS aligned with SCO60MAS stress testing
JapanJPY 10M (~USD 70K) + positive net assetsNew reserve requirements (FIEA reform)JFSA aligned with SCO60JFSA oversight
South KoreaNone prescribed (de facto barriers)Mandatory insurance/reserves (FSC-calibrated)FSC banking rules (no crypto-specific custody capital)FSS supervision
AustraliaNOT VERIFIED (DAP/TCP figures not yet published)AFSL RG 166 (positive NTA, liquid assets)APRA banking framework (no DAF custody capital yet)ASIC/anticipated auditor review

4. What Works / What Does Not

What Works

Tiered capital structures that scale with risk. The UK's K-factor approach and France's 4.5% own-funds requirement demonstrate that capital can be calibrated to the actual volume and risk profile of custody operations rather than applying a single flat number. The UK's K-CSG coefficient of 0.04% of assets under custody is particularly well-calibrated: for a custodian holding GBP 1 billion, this produces a K-factor capital charge of GBP 400,000 -- meaningful but not prohibitive. Liechtenstein's TVTG issuance-scaled tiers (CHF 50K-250K) and Bahrain's category-scaled minimums (BHD 25K-300K) show the same proportionality principle applied at the licensing-tier level.

Segregated custody carve-outs under Basel. The SCO60 recognition that segregated custody does not generate credit, market, or liquidity risk capital requirements is empirically sound, and has been faithfully implemented by Canada's OSFI (operational-risk capital only) and Switzerland's FINMA (off-balance-sheet treatment for properly segregated assets). Custodians holding assets on behalf of clients in legally segregated structures do not bear the same economic risk as entities holding assets proprietarily. This distinction should be preserved in all national implementations.

The SAB 122 correction. The US experience with SAB 121 -- which required banks to recognise custodied crypto as a balance-sheet liability, triggering capital charges that made custody economically unviable -- demonstrates the danger of accounting rules that do not reflect the economic substance of custody relationships. SAB 122's rescission (effective 30 January 2025; banks now apply ASC 450-20) removed this distortion and should serve as a cautionary tale for other jurisdictions considering similar accounting treatments.

Canada's 5% exposure limit. OSFI's decision to raise the Group 2 exposure limit from 1% to 5% of Net Tier 1 capital provides a practical middle ground between the BCBS default (which industry argues is too restrictive) and no limit at all. It allows Canadian banks meaningful participation in crypto custody and trading while maintaining prudential guardrails.

High fixed minimums for custody (UAE, Hong Kong). While the VARA AED 4 million requirement appears steep, it has attracted serious institutional players (Komainu, Laser Digital/Nomura) and has not prevented market development. Hong Kong's proposed HKD 10 million standalone-custodian floor pursues the same logic. For custody -- where client asset loss can be catastrophic -- a high entry barrier may be preferable to a low one.

Case-by-case prudential calibration in small jurisdictions (Bermuda, Cayman). Rather than a single published floor, the BMA and CIMA scale capital to each custodian's nature, size and complexity (Bermuda above a US$100,000 net-assets statutory floor; Cayman with no fixed minimum but mandatory recovery plans and stress testing). For specialist financial centres supervising a small number of institutions, individualised assessment can be more risk-sensitive than a blunt fixed figure -- provided supervisory capacity is genuinely adequate.

What Does Not Work

Flat minimums that are too low for institutional scale. MiCA's EUR 125,000 minimum for custody CASPs -- shared across the EU, Luxembourg, Liechtenstein (under its MiCAR route), Germany and France -- is strikingly low for entities that may hold billions of euros in client assets. This threshold was designed for market access rather than institutional protection and has attracted criticism from institutional investors who question whether it provides sufficient financial buffer for large-scale operations.

Absence of dynamic capital requirements. Jurisdictions relying solely on a fixed minimum (Bahrain, Japan at the basic level, the per-category Brazilian floors) create a scenario where a custodian holding USD 10 billion faces the same capital requirement as one holding USD 10 million. This fails to capture the risk proportionality that prudential regulation is meant to achieve.

No published minimum at all where supervisory capacity is uncertain. South Korea, Cayman, Gibraltar and (pending its instruments) Australia currently prescribe no fixed custody-capital floor, relying instead on de facto barriers or case-by-case assessment. Where the supervisor has deep capacity this can work (see "What Works"); where it does not, the absence of any hard floor risks admitting undercapitalised custodians and obscures the buffer available to clients. South Korea's reliance on a mandatory-insurance/reserve obligation with no published numeric floor is a particular transparency gap.

The 1,250% risk weight for custody-adjacent exposures. While SCO60 correctly exempts segregated custody from credit/market/liquidity risk charges, banks providing custody services inevitably hold some proprietary crypto for operational purposes (paying blockchain fees, maintaining minimal operational balances). The 1,250% risk weight makes even these de minimis operational holdings punitive.

Regulatory fragmentation -- within and across borders. In the US, the absence of a unified federal prudential standard -- with OCC trust banks, NYDFS trust companies, Wyoming SPDIs, state money transmitters, and SEC-regulated broker-dealers all operating under different capital regimes -- creates arbitrage opportunities and inconsistent client protection. The UAE replicates this at a smaller scale across VARA, ADGM, DFSA, CBUAE and the new federal CMA, each with its own custody-capital figure.

Delayed permanent frameworks. The EU's failure to publish the permanent CRR III crypto-asset legislative proposal by the June 2025 deadline, Brazil's still-draft Public Consultation 126/2025 Basel-aligned rules, Switzerland's unpublished Crypto Institution License thresholds, and Australia's not-yet-issued DAP/TCP financial-requirement instruments all create uncertainty for custodians planning multi-year strategies.

Drawing on the comparative analysis above, the following tiered capital framework is recommended for jurisdictions developing or refining crypto custody prudential requirements. The framework balances market access for smaller operators with proportionate capital requirements for systemically important custodians.

Tier 1: Small Custodians (AUC Below EUR/USD 500 Million)

Rationale: These are emerging custodians, fintechs, or niche providers serving a limited client base. The primary risk is operational failure and key management error.

RequirementSpecificationPrecedent
Fixed minimum capitalEUR 150,000-250,000Germany (EUR 150,000), UK PMR (GBP 150,000), Liechtenstein TVTG (CHF 50K-250K), MiCA Class 2-3 range
Dynamic floorHigher of fixed minimum or one quarter of annual fixed overheadsMiCA Article 67, UK FOR
Activity-based component0.04-0.10% of assets under custody as a floorUK K-CSG (0.04%), France (4.5% of own-account assets)
Insurance alternativeMandatory alternative if own funds are below EUR 250,000MiCA Article 67 insurance/guarantee option
Liquidity bufferMinimum one-third of fixed overheads in liquid assetsUK BLAR

Tier 2: Medium Custodians (AUC EUR/USD 500 Million to EUR/USD 10 Billion)

Rationale: These are established custodians holding significant client assets. Capital must scale with custody volume and the operational complexity of managing institutional portfolios.

RequirementSpecificationPrecedent
Fixed minimum capitalEUR 1,000,000-4,000,000VARA (AED 4M / ~EUR 1M), ADGM (USD 4M public-fund custody), Hong Kong (HKD 10M / ~EUR 1.2M)
Dynamic floorHigher of fixed minimum, quarter of overheads, or 0.10-0.25% of AUCUK K-factor model adapted
Stress capital bufferCapital adequate to cover worst-case operational loss scenario over 12 monthsUK ICARA process, Cayman Custody/VATP stress testing
Liquidity requirementLiquid assets equal to 12 months of operating expensesHong Kong standard; CMA 6-month buffer
Wind-down reserveCapital sufficient for orderly return of all client assets within 6 monthsUK wind-down planning, Bermuda DABA wind-down
Ongoing solvency reportingQuarterly capital adequacy reporting to supervisorOSFI FRFI model

Tier 3: Systemic Custodians (AUC Above EUR/USD 10 Billion)

Rationale: These are custodians whose failure could have systemic implications for the broader crypto-asset market and potentially the traditional financial system. Banking-equivalent prudential requirements are appropriate.

RequirementSpecificationPrecedent
Minimum capitalBanking-equivalent (full CAO/OCC standard, or EUR 5M-25M)US OCC trust banks, Switzerland banking license (full CAO), Canada trust co (C$10M)
Risk-weighted capitalFull Basel-aligned operational risk capital calculationSCO60 operational risk framework
Tier 1 capital ratioMinimum 8% of risk-weighted assets (or national equivalent)Basel III standard ratios
Crypto exposure limitGroup 2 exposure not to exceed 5% of Net Tier 1 capitalOSFI standard
Countercyclical bufferAdditional capital in periods of rapid AUC growthBasel III CCyB framework
Recovery and resolution planMandatory, reviewed annually by supervisorFSB resolution standards; Cayman recovery plans
Disclosure requirementsFull DIS55-equivalent reportingBCBS d580
Systemic risk surchargeAdditional capital for interconnectedness with traditional financeFSB systemically important FI framework

Cross-Tier Requirements

The following should apply across all tiers:

  • Capital composition: Own funds must consist of CET1-equivalent instruments (paid-up share capital, retained earnings). Subordinated debt may count toward a limited portion of Tier 2 capital only.
  • No crypto-denominated capital: Regulatory capital must be held in fiat currency or government bonds. Crypto-assets should not count toward minimum capital requirements due to volatility. (The UAE already mandates fiat-held capital under ADGM; Bahrain requires capital deposited in local banks.)
  • Annual external audit: Capital adequacy must be independently verified.
  • Breach reporting: Falling below minimum capital thresholds triggers immediate notification to the supervisor and a remediation plan within 30 days.
  • Insurance interaction: Capital requirements should be coordinated with Insurance & Liability frameworks to avoid both gaps and unnecessary duplication. See the insurance section for how professional indemnity coverage interacts with own-funds requirements.

6. Decision Matrix for Policymakers

The following matrix assists policymakers in selecting the appropriate capital model based on their jurisdiction's regulatory objectives and market conditions.

Decision FactorFixed Minimum OnlyFixed + Dynamic (Recommended)Banking-Equivalent
Market development stageEarly / emergingMaturing / institutionalEstablished / systemic
Primary policy objectiveMarket access and innovationProportionate risk managementFinancial stability
Regulatory capacityLimited supervisory resourcesModerate capacity for oversightFull prudential supervision
Typical AUC in jurisdiction< EUR 500M aggregateEUR 500M - 50B aggregate> EUR 50B aggregate
Institutional client basePrimarily retail / SMEMixed retail and institutionalPrimarily institutional
Interaction with banking sectorMinimal bank involvementBanks as custodians or delegatesBanks as primary custodians
Basel alignmentNot requiredRecommended for G20 membersRequired for BCBS member jurisdictions
Calibration complexityLowMediumHigh
Risk of regulatory arbitrageHigh (too low = race to bottom)Low (scales with activity)Low (banking perimeter)
ExamplesBahrain, Japan (base), Cayman/Gibraltar (case-by-case)UK (CRYPTOPRU), France (DASP), Liechtenstein (TVTG)US (OCC), Switzerland (FINMA bank), Canada (trust co)

Implementation Guidance

  1. Start with a fixed minimum that is high enough to screen out undercapitalised operators. The EUR 150,000-250,000 range is well-precedented (Germany, UK PMR, Liechtenstein TVTG upper tier) and provides a meaningful floor without creating an excessive barrier to entry. Where a jurisdiction chooses no published floor (Cayman, Gibraltar, South Korea), supervisory capacity for case-by-case assessment must be demonstrably strong.

  2. Layer on a dynamic component linked to assets under custody. The UK's 0.04% K-CSG coefficient is a reasonable starting point but should be reviewed periodically. Consider France's 4.5% multiplier for custodians holding assets on their own accounts (not client assets).

  3. Set clear thresholds for when custodians must transition from Tier 1 to Tier 2 and from Tier 2 to Tier 3 requirements. These thresholds should be based on AUC and should be communicated well in advance.

  4. Coordinate with the Licensing Frameworks to ensure that capital tiers align with licensing categories. A custodian should not hold a license permitting institutional custody without meeting the corresponding capital tier. (Bahrain's per-category CRA capital and the UAE's per-regulator figures both link capital to licence scope.)

  5. Adopt Basel custody carve-outs even if not implementing the full SCO60 standard. The principle that segregated custody does not generate credit/market/liquidity risk charges is sound regardless of whether a jurisdiction adopts Basel in full -- and is just as relevant for non-BCBS centres (Bermuda, Cayman, Gibraltar) that must still decide how to treat custody on a bank's books.

  6. Require fiat-denominated capital. Regulatory capital held in crypto-assets introduces circular risk -- the capital buffer would erode precisely when it is most needed (during a crypto market downturn). All minimum capital must be in fiat or fiat-equivalent instruments.

  7. Plan for review cycles. Capital calibration should be reviewed at least every three years in light of market developments, loss events, and evolving best practices. The UK's ICARA process (firm-level assessment) and OSFI's periodic guideline updates provide good models for ongoing calibration.

Verification Notes

All factual claims in this document mirror the verified per-jurisdiction fact matrix (crypto-custody-fact-matrix.json, tier 4: minimum/ongoing capital and prudential regime) covering all 20 jurisdictions. Aggregates ("20 jurisdictions") are derived from that matrix.

Basel Framework (SCO60, DIS55)

EU (MiCA) Capital Requirements

  • EUR 125,000 Class 2 minimum for custody: Verified via EUR-Lex and Law Firm Poland analysis
  • Three-tier structure (EUR 50K / 125K / 150K): Verified via White & Case and multiple law firm analyses
  • Quarter of fixed overheads dynamic component: Verified via MiCA Article 67 text
  • CRR III transitional framework: Verified via White & Case and EBA publications

Luxembourg

  • EUR 125,000 MiCAR Class 2 minimum for custody: Verified via MiCA Annex IV; CSSF designated competent authority by Law of 6 February 2025
  • DLT-securities control-agent/depositary regime (Blockchain Laws I-IV): Verified via Luxembourg national legislation

Liechtenstein

  • TVTG minimum-capital tiers (CHF 50K / 100K / 250K by issuance value): Verified via TVTG (Blockchain Act)
  • EUR 125,000 MiCAR Class 2 for custody CASPs: Verified via MiCA Annex IV; EWR-MiCA-DG in force 1 February 2025

UK CRYPTOPRU

  • GBP 150,000 PMR for custody: Verified via FCA CP25/42, Winston & Strawn, and Skadden analyses
  • K-CSG coefficient of 0.04%: Verified via FCA CP25/42 and Ashurst analysis
  • ICARA and wind-down requirements: Verified via Skadden analysis

Germany

  • EUR 150,000 pre-MiCA KWG minimum (up to EUR 730,000 with added services): Verified via BaFin guidance notices
  • MiCA Annex IV floors EUR 50K / 125K / 150K (no EUR 350,000 tier -- prior figure corrected): Verified via MiCA Annex IV
  • Accelerated transition (12-month grandfathering ending 31 December 2025): Verified via Global Legal Insights and BaFin website

France

  • EUR 150,000 minimum for licensed DASPs; no minimum for basic registration: Verified via AMF Q&A document
  • 4.5% own-account-assets requirement: Verified via AMF Q&A document

Switzerland

  • Full CAO prudential capital for banking license: Verified via CAO and Global Legal Insights
  • CHF 300,000 FinTech license; CHF 1M/5M DLT trading facility: Verified via FINMA website
  • FINMA Guidance 01/2026 on crypto custody (off-balance-sheet segregated assets): Verified via FINMA press release and CMS analysis
  • Crypto Institution License thresholds: NOT VERIFIED (not yet published as of consultation close 6 February 2026)

United States

  • OCC national trust bank approvals (standard OCC capital): Verified via OCC NR-2025-125 and multiple law firm analyses
  • Wyoming SPDI USD 5M statutory; broker-dealer Net Capital Rule 15c3-1 (USD 5K-250K): Verified via Wyoming SPDI Act and Exchange Act Rule 15c3-1
  • SAB 121 rescission via SAB 122 (effective 30 January 2025; ASC 450-20 now applies): Verified via Deloitte, KPMG, and Ropes & Gray analyses
  • Trump Administration rejection of Basel SCO60 via EO 14178: Verified via Kaiko analysis

Canada

  • Trust company custodians C$10M / foreign C$100M minimum equity; CTP capital case-by-case (NOT VERIFIED as single published figure): Verified via CIRO framework
  • OSFI 5% Net Tier 1 exposure limit (29 October 2025): Verified via OSFI Letter to Industry and McMillan LLP analysis
  • Operational-risk-only capital for segregated custody; removal of automatic Group 2b reclassification (1-5%): Verified via OSFI guideline and McMillan LLP analysis

Brazil

  • Original BVAL category capital (R$1M/R$2M/R$3M): Verified via Law 14,478/2022 framework
  • R$10.8M-R$37.2M activity-based capital span: set by Resolution BCB 517 + Joint Resolution 14 (3 Nov 2025); no per-category mapping (formula-driven, not fixed per-SPSAV-type)
  • Basel-aligned prudential rules (Public Consultation 126/2025): DRAFT only; no final norm as of 4 June 2026

Bermuda

  • Net assets US$100,000 (Class M/F, DABA s.9(3)); custody annual fee floor US$150,000: Verified via Digital Asset Business Act 2018
  • Institution-level capital above floor set case-by-case (NOT VERIFIED publicly); not a BCBS member: Verified via DABA and BMA materials

Cayman Islands

  • No published fixed minimum capital (CIMA case-by-case): Verified via VASP Act and Custody/VATP Rule
  • Regulatory capital, recovery plans, stress testing (Custody/VATP Rule, confirmed unchanged February 2026): Verified via CIMA Rule

UAE

  • VARA Custody Services AED 4,000,000: Verified via VARA Rulebook and Complyfactor guide
  • ADGM custody USD 4,000,000 Tier-1 / USD 250,000 BCR; CMA AED 3,000,000 (figures conflict across summaries -- NOT VERIFIED to a single primary figure): Verified via ADGM FSRA and CMA Decision No. 4/R.M/2026

Bahrain

  • Per-category minimum capital (Cat 1 BHD 25K / Cat 2 BHD 100K / Cat 3 BHD 200K / Cat 4 BHD 300K, CRA-3.1.2; custody in Cat 2/3/4): Verified via CBB CRA Module, STA Law and Tetra Consultants analyses

Gibraltar

  • No fixed statutory minimum capital (Principle 3 case-by-case adequate-resources test; fixed figure NOT VERIFIED): Verified via Financial Services (DLT Providers) Regulations and GFSC guidance
  • Outside EU/MiCA; no Gibraltar crypto-specific Basel transposition located (NOT VERIFIED)

Hong Kong

  • HKD 10M paid-up capital for proposed custodians; up to HKD 3M liquid; 12-month opex excess: Verified via SFC/FSTB consultation
  • HKMA CRP-1 Basel alignment: Verified via Cryptonite and The Block reporting

Singapore

  • SGD 250,000 base capital for MPI/DTSP; SGD 100,000 for SPI; security deposit SGD 100K/200K: Verified via MAS guidelines and FSMA 2022

Japan

  • Stated capital JPY 10M + positive net assets (statutory floor); "JPY 50M practical minimum" NOT VERIFIED: Verified via Payment Services Act
  • FIEA-reform reserve-fund/insurance requirement (proposed): Verified via FSA Working Group report

South Korea

  • No prescribed minimum capital under VAUPA/SFIA; mandatory insurance/reserves with FSC-calibrated floor (no public numeric figure): Verified via VAUPA and FSC materials
  • Standalone custody licence proposed only (second-phase Digital Asset Basic Act): Verified via FSC March 2026 report

Australia

  • DAP/TCP-specific custody capital NOT VERIFIED (financial-requirement instruments not yet published; due roadmap months 6-12): Verified via DAF Act 2026 and ASIC implementation roadmap
  • Interim AFSL RG 166 financial-resource obligations apply: Verified via ASIC RG 166

UNVERIFIED Items

  • Specific capital amounts for individual OCC-approved trust banks (standard OCC capital applies; individual conditional-approval figures are confidential).
  • Exact timeline for the EU permanent CRR III crypto-asset legislative proposal (delayed beyond June 2025 deadline; no confirmed new date found).
  • Brazil's R$10.8M-R$37.2M capital span derives from the activity-based formula of Resolution BCB 517 + Joint Resolution 14 (3 Nov 2025); there is no per-SPSAV-category figure to map.
  • UAE CMA custody capital figure (AED 3,000,000 vs "upwards of AED 4M" -- summaries conflict; primary figure NOT VERIFIED).
  • Switzerland Crypto Institution License capital thresholds (not yet published as of consultation close 6 February 2026).
  • Australia DAP/TCP financial-requirement figures (instruments not yet made).
  • Bermuda institution-level custody capital above the US$100,000 floor (set case-by-case; not published).
  • Gibraltar fixed minimum capital figure (Principle 3 individualised; no published number).