This guide provides policymakers with a practical, evidence-based roadmap for building a crypto custody regulatory framework from the ground up. Every recommendation is grounded in the documented experience of jurisdictions that have already implemented such frameworks, with citations to primary sources. The guide draws on the full set of 20 jurisdictions studied in this domain — anchoring its detailed case studies in Switzerland, Singapore, UAE, Germany, Hong Kong, Bermuda, and the Cayman Islands, while pulling precedents from the broader cohort (including Liechtenstein, Luxembourg, Gibraltar, Bahrain, Japan, South Korea, Canada, Brazil, France, the United Kingdom, the United States, Australia, and the EU/MiCA bloc) — and distils their successes, failures, and sequencing decisions into a replicable three-year plan.
The 20 studied jurisdictions, by canonical region, are: Americas — United States, Brazil, Canada, Bermuda, Cayman Islands; Europe — European Union, France, Germany, Switzerland, United Kingdom, Liechtenstein, Luxembourg; Asia-Pacific — Australia, Hong Kong, Japan, Singapore, South Korea; Middle East & Africa — Bahrain, UAE, and Gibraltar (tagged region/middle-east-africa though its regulation file sits under the europe/ path post-Brexit).
1. How Countries Built Their Frameworks — Case Studies
1.1 Switzerland: The DLT Act Approach
Switzerland pursued a comprehensive, principles-based legislative overhaul that adapted existing financial law to distributed ledger technology rather than creating standalone crypto legislation.
Timeline:
| Date | Milestone |
|---|---|
| December 2018 | Federal Council published analysis of the legal framework for DLT/blockchain and derived next steps |
| March 22, 2019 | Draft DLT law published for consultation |
| November 27, 2019 | Federal Council dispatch on the DLT Draft Law submitted to Parliament |
| September 2020 | Swiss Parliament adopted the Federal Act on the Adaptation of Federal Law to Developments in Distributed Ledger Technology (the "DLT Act") |
| October 19, 2020 – February 2, 2021 | Public consultation on the draft omnibus ordinance |
| February 1, 2021 | First phase entry into force — provisions enabling ledger-based securities |
| August 1, 2021 | Full entry into force of the DLT Act and associated blanket ordinance |
| September 5, 2025 | FINMA Guidance 03/2025 on disclosure of crypto-based assets in annual financial statements |
| October 22, 2025 | Federal Council opened FinIA reform consultation (new Crypto Institution License) |
| January 12, 2026 | FINMA published Guidance 01/2026 on risks associated with custody of crypto-based assets |
| February 6, 2026 | FinIA reform consultation closed; Crypto Institution License capital thresholds not yet published; expected entry into force late 2026/early 2027 |
Sequencing Decisions:
Switzerland chose to amend ten existing federal laws rather than enact a single new crypto law. This "omnibus" approach ensured legal certainty by anchoring crypto custody within established frameworks (e.g., the Banking Act, the Financial Market Infrastructure Act, the Debt Enforcement and Bankruptcy Act). The introduction of "ledger-based securities" (Registerwertrechte) as a new legal concept provided clarity on tokenized asset ownership and custody obligations. The statutory bankruptcy-protection provisions (DEBA Art. 242a–242b) codified custody-asset segregation in legislation rather than case law — the feature that makes Switzerland the global benchmark for bankruptcy-remote custody.
Institutional Design:
FINMA retained primary supervisory authority. No new regulatory body was created. A new DLT trading facility license category was established, enabling authorized platforms to offer trading, settlement, and custody of DLT-based assets under a single license. The proposed FinIA Crypto Institution License (consultation closed 6 February 2026) would add a dedicated tier and move AML supervision from self-regulatory organizations to FINMA.
Stakeholder Consultation:
The consultation period ran approximately 3.5 months for the omnibus ordinance (October 2020 to February 2021). The Federal Council explicitly sought input from financial institutions, fintech firms, legal scholars, and cantonal authorities. The 2025–2026 FinIA reform consultation continued this practice.
What Went Well:
- The phased entry into force (February 2021 for securities provisions, August 2021 for remaining provisions) allowed market participants to prepare incrementally
- Switzerland became one of the first countries globally to have statutory blockchain regulations in force
- Statutory bankruptcy protection (DEBA Art. 242a–242b) gave Switzerland the most legally certain custody framework among major financial centers
- The DLT trading facility license attracted significant interest; FINMA authorized BX Digital AG as the first such facility in March 2025
What Could Have Been Better:
- The gap between FINMA's initial framework (2021) and detailed custody risk guidance (January 2026) left a roughly five-year period where custody expectations were less explicit
- FINMA's 2026 guidance noted particular risks when custodians are located abroad and not subject to equivalent supervision, suggesting earlier attention to cross-border custody delegation would have been beneficial
Sources: Swiss Federal Council DLT page; Library of Congress — Switzerland DLT Act; PwC Swiss DLT regulations; Federal Council media release on DLT Act; FINMA Guidance 01/2026
1.2 Singapore: The Payment Services Act Evolution
Singapore adopted an incremental, activity-based regulatory approach, progressively expanding the scope of its Payment Services Act (PSA) to cover new digital asset activities including custody.
Timeline:
| Date | Milestone |
|---|---|
| January 2019 | Payment Services Act 2019 enacted, creating the licensing framework for digital payment token (DPT) services |
| January 28, 2020 | PS Act came into effect |
| January 2021 | Payment Services (Amendment) Bill passed, expanding the scope of regulated payment services |
| October 2022 | MAS issued consultation paper proposing comprehensive regulatory measures for DPT service providers |
| December 2022 | Consultation period closed |
| July 3, 2023 | MAS issued further consultation paper on proposed legislative amendments to the Payment Services Regulations |
| April 4, 2024 | Amendments took effect — expanding PSA scope to include crypto custody services, facilitating transmission/exchange of crypto, and cross-border money transfer |
| October 4, 2024 | Safeguarding amendments took effect (six months after April 4 commencement), requiring asset segregation, trust accounts, proper books and records |
| June 30, 2025 | FSMA Digital Token Service Provider (DTSP) regime effective with no transitional period; offshore-only firms must be licensed |
| March 2026 | 37 MPI licences for DPT services active (MAS Financial Institutions Directory) |
Sequencing Decisions:
Singapore deliberately separated the licensing regime (2019–2021) from custody-specific provisions (2024). The MAS first established a broad DPT licensing framework, then layered on custody, safeguarding, and consumer protection requirements once it had gained supervisory experience. This phased approach allowed the regulator to observe market developments and industry practices before imposing detailed custody rules, including the 90% cold-storage requirement under the PS-G03 Consumer Protection Guidelines.
Institutional Design:
The Monetary Authority of Singapore (MAS) — which serves as both the central bank and financial regulator — retained sole supervisory authority. No new institution was needed. MAS issued multiple Notices and Guidelines to supplement the statutory framework, and added the FSMA 2022 DTSP regime to capture offshore-only firms.
Stakeholder Consultation:
MAS conducted at least two formal public consultations:
- October–December 2022: Comprehensive consultation on DPT regulatory measures (approximately 2-month window)
- July 2023: Further consultation on specific legislative amendments
MAS explicitly incorporated industry feedback into the final regulations, particularly regarding the safeguarding timeline (providing a six-month transition period).
What Went Well:
- The two-stage consultation process allowed MAS to refine rules based on real-world feedback
- The six-month safeguarding transition period gave industry time to establish trust account structures
- Singapore's approach of bringing custody within an existing, well-understood licensing framework (rather than creating a new one) reduced legal uncertainty
What Could Have Been Better:
- The roughly five-year gap between the initial PSA (2019) and custody-specific provisions (2024) left a regulatory gap during which several crypto failures occurred globally
- Some industry participants reported that the consultation periods (approximately 2 months) were too short for the complexity of the proposals
- The FSMA DTSP regime launched with no transitional period (30 June 2025), which gave offshore-only firms little runway
Sources: CoinDesk — Singapore crypto custody licensing; Sidley Austin — Singapore custody rules; MAS media release April 2024; Bovill Newgate — MAS segregation and custody
1.3 UAE/Dubai: VARA and Rapid Framework Deployment
The UAE — specifically the Emirate of Dubai — adopted one of the most rapid regulatory deployment approaches, creating a purpose-built regulator and comprehensive rulebook within approximately one year, then maturing into a multi-regulator institutional hub.
Timeline:
| Date | Milestone |
|---|---|
| March 2022 | VARA established under Dubai Law No. (4) of 2022 (Regulating Virtual Assets in the Emirate of Dubai) |
| 2022 | Cabinet Resolution No. 112/2022: SCA delegated powers to VARA for licensing and regulation of VASPs in Dubai (excluding DIFC) |
| February 2023 | VARA issued Virtual Assets and Related Activities Regulations 2023 and associated rulebooks (the "VA Framework") |
| June 2023 | VARA Grievance Committee established for enforcement appeals |
| September 5, 2024 | SCA and VARA entered cooperation agreement delineating regulatory responsibilities |
| October 1, 2024 | Significant updates to VA Framework enforced |
| May 2025 | VARA issued Rulebook Version 2.0 (qualified-custodian mandate, proof-of-reserves, strengthened custodian requirements); ADGM FSRA amendments reduced non-public-fund custody BCR to USD 250,000 |
| June 19, 2025 | Rulebook Version 2.0 compliance deadline (after 30-day transition period) |
| September 16, 2025 | Federal Decree-Law No. 6 of 2025 (CBUAE) in effect, expanding the federal perimeter over VA payment activity |
| January 1, 2026 | SCA replaced in full by the independent Capital Market Authority (CMA) |
| February 13, 2026 | CMA Decision No. 4/R.M/2026 effective — federal activity-based VASP framework with a dedicated Custody Services license (one-year transition to 13 Feb 2027) |
| April 9, 2026 | VARA Virtual Asset Issuance Rulebook — legal segregation of Reserve Assets, 100% 1:1 backing, monthly ARVA audits |
Sequencing Decisions:
Dubai's approach was notable for creating a new, dedicated regulator (VARA) rather than assigning crypto oversight to an existing financial authority. The VARA framework covers seven specific virtual asset activities, including a dedicated Custody Services License that must be held by a separately licensed entity. The UAE also maintained separate regimes for ADGM (Abu Dhabi Global Market) FSRA and DFSA (Dubai International Financial Centre), and layered a federal overlay via CBUAE and the CMA — creating a multi-regulator environment within a single country.
Institutional Design:
VARA operates as a standalone regulatory authority within Dubai (excluding DIFC). The 2024 SCA-VARA cooperation agreement formalized responsibilities, and the 2026 CMA federal framework consolidated the national securities-regulator role under a dedicated, activity-based VASP licensing model.
Stakeholder Consultation:
VARA's consultation model was less transparent than those of Singapore or Switzerland. The initial regulations were issued relatively quickly (under one year from VARA's creation). However, the Rulebook Version 2.0 (May 2025) reflected industry feedback gathered through the first two years of operation.
What Went Well:
- The speed of framework deployment (March 2022 establishment to February 2023 full rulebook) attracted significant institutional interest
- VARA's activity-based approach provided clear expectations for custody service providers, including a dedicated custody license and qualified-custodian standards
- The Grievance Committee provided a formal appeals mechanism from the outset
What Could Have Been Better:
- The multi-regulator environment (VARA, ADGM FSRA, DFSA, CBUAE, CMA) created jurisdictional complexity within a single country
- The initial 2023 rulebooks required significant revision within two years (Version 2.0 in 2025), suggesting the first iteration was rushed
- Federal/zone perimeter overlaps continued to evolve through 2026 (CBUAE Decree-Law No. 6 of 2025; CMA Decision No. 4/R.M/2026), prolonging the period of jurisdictional layering
Sources: DLA Piper — UAE regulatory landscape for digital assets; Solidus Labs — VARA 2025 Rulebook Update; Sumsub — Crypto in the UAE; CompliFactor — UAE Crypto Regulation 2025
1.4 Germany: BaFin Crypto Custody License and MiCA Transition
Germany was an early mover in Europe, creating a specific crypto custody license category within its existing banking law framework, then managing the complex transition to the EU-wide MiCA regime.
Timeline:
| Date | Milestone |
|---|---|
| January 1, 2020 | "Act on the Implementation of the Amendment Directive to the Fourth EU Money Laundering Directive" entered into force, creating crypto custody business (Kryptoverwahrgeschäft) as a regulated financial service under the KWG |
| March 2, 2020 | BaFin published guidance notice on the statutory definition of crypto custody business |
| 2020–2024 | BaFin processed applications and issued crypto custody licenses under the national framework |
| June 29, 2023 | MiCA Regulation entered into force at EU level |
| December 30, 2024 | MiCA Title V became applicable; Germany chose a shortened 12-month grandfathering period; FinmadiG/KMAG established Germany's MiCA implementation framework |
| Mid-January 2025 | Germany among the first EU Member States to issue MiCA CASP licenses |
| December 31, 2025 | End of the shortened transitional period — all providers must hold MiCA authorization (~27 CASPs authorized as of December 2025, highest in EU) |
| January 1, 2026 | DAC 8 real-time transaction reporting to German tax authorities effective |
| April 12, 2026 | Germany led the EU with 53 authorised CASPs (~26% of the EU total of ~199); custody was the most common service (~117 of ~199 EU CASPs) |
Sequencing Decisions:
Germany's approach was distinctive in several respects:
- It was the first EU country to create a dedicated crypto custody license (January 2020), pre-empting MiCA by four years
- It embedded crypto custody within the existing Banking Act (KWG) rather than creating separate legislation
- When MiCA arrived, Germany opted for a shortened (12-month) transitional period rather than the maximum 18 months allowed, signaling confidence in its regulated entities' readiness — the grandfathering window closed 31 December 2025
Institutional Design:
BaFin served as the sole licensing and supervisory authority. The KWG framework meant that crypto custodians were subject to institutional oversight comparable to banks (with certain exemptions for custody-only providers). Section 26b KWG codified segregation, and Section 46i KWG / Section 45 KMAG provide that custodied crypto is deemed to belong to the customer.
Stakeholder Consultation:
Germany's crypto custody licensing framework emerged primarily through the legislative process for implementing the EU's Fourth Anti-Money Laundering Directive amendments. BaFin published detailed guidance notices following enactment, and industry engagement occurred through the standard German parliamentary process.
What Went Well:
- Early regulatory clarity (2020) gave Germany a first-mover advantage in Europe, attracting crypto custody businesses (EUR 48.7 billion held under licensed custody by mid-2025, 28% YoY growth)
- The simplified MiCA transition pathway (KMZÜV / Article 143(6) fast-track) recognized and preserved the value of existing national licenses
- Germany leads the EU in MiCA CASP license issuance (53 CASPs as of 12 April 2026)
What Could Have Been Better:
- The national regime (2020–2024) had to be substantially replaced by MiCA, creating regulatory transition costs for firms that had invested in BaFin compliance
- Some firms reported that the BaFin licensing process was lengthy and resource-intensive, with limited guidance on technical security standards
Sources: Norton Rose Fulbright — New regulatory regime for crypto assets in Germany; BaFin — Crypto custody business; Global Legal Insights — Blockchain Germany 2026; Skadden — MiCA Update Six Months
1.5 Hong Kong: From Sandbox to Comprehensive VASP Licensing
Hong Kong followed a deliberate, multi-stage progression: from voluntary sandbox participation to mandatory licensing, and ultimately to a comprehensive regulatory roadmap covering custody, dealing, advisory, and broader market infrastructure.
Timeline:
| Date | Milestone |
|---|---|
| 2018 | SFC included virtual asset trading platforms in its regulatory sandbox |
| November 2019 | SFC published position paper proposing "opt-in" voluntary licensing regime for VA trading platforms |
| June 1, 2023 | Mandatory VASP licensing regime came into effect under amendment to the AMLO |
| February 19, 2025 | SFC launched the "ASPIRe" Regulatory Roadmap — five pillars: Access, Safeguards, Products, Infrastructure, Relationships |
| June 27, 2025 | SFC and FSTB launched joint consultation on proposed licensing regimes for VA dealing and custodian services |
| August 1, 2025 | Stablecoins Ordinance took effect (six-month transitional period) |
| August 15, 2025 | SFC Custody Circular — tightened key management, cold wallet, and security standards (smart-contract prohibition, HSM, air-gapping) |
| December 24, 2025 | FSTB/SFC consultation conclusions on VA dealing/custodian licensing — scope narrowed to private-key safekeeping, expedited pathway added, bill targeted for 2026 |
| April 10, 2026 | HKMA granted first stablecoin issuer licences (HSBC, Anchorpoint Financial) out of ~36 applications |
| May 26, 2026 | FSTB/SFC consultation conclusions on VA advisory/management licensing; bill for all four regimes reaffirmed targeted for the 2026 LegCo session |
Sequencing Decisions:
Hong Kong's approach was deliberately incremental:
- Phase 1 (2018–2022): Voluntary sandbox/opt-in regime — gathered data on risks and business models
- Phase 2 (2023): Mandatory VASP licensing for exchanges — established baseline regulatory coverage
- Phase 3 (2025–ongoing): Dedicated custody and dealing licensing — separating custody from exchange licensing, with consultation conclusions published 24 December 2025 and a standalone VA Custodian licence under the AMLO targeted for 2026 legislation
The decision to initially treat custody as part of the VATP license, then later propose a standalone custody licence under ASPIRe, reflects an iterative learning approach.
Institutional Design:
The SFC remained the primary regulator for securities-related VA activities; the HKMA regulates stablecoins and banks. The HKSAR Government (through FSTB) led legislative preparations. The SFC's ASPIRe roadmap applies the "same business, same risks, same rules" principle to ensure parity between VA service providers and traditional financial intermediaries.
Stakeholder Consultation:
Hong Kong conducted multiple rounds of consultation:
- 2019 position paper with public feedback period
- 2023 consultation into proposed updates to VASP guidelines
- June 2025 joint SFC/FSTB consultation on VA dealing and custodian licensing, with conclusions published 24 December 2025
What Went Well:
- The voluntary sandbox (2018–2023) provided real-world supervisory experience before mandating compliance
- The ASPIRe roadmap provided a clear, public-facing strategic vision, giving industry predictability
- Hong Kong's commitment to a two-tier market structure (separating trading and custody) represents an advanced approach to custody risk management
- By December 2025 the custody-licensing consultation had moved from open question to published conclusions, with a clear legislative target
What Could Have Been Better:
- The five-year gap between the voluntary regime (2018) and mandatory licensing (2023) allowed unlicensed operators to serve Hong Kong residents
- As of mid-2026 the standalone custody licence is still pending enactment — the consultation conclusions (24 December 2025) confirm direction, but pure-play custodians lack a live, dedicated regulatory pathway until the 2026 bill passes
Sources: SFC — ASPIRe Regulatory Roadmap; Norton Rose Fulbright — Crypto asset regulation in Hong Kong; Davis Polk — HK FSTB and SFC consult on VA dealers and custodians; National Law Review — Hong Kong SFC ASPIRe Roadmap
1.6 Bermuda: Statutory Creditor-Exclusion in a Small Jurisdiction
Bermuda built a bespoke digital asset regime early (the Digital Asset Business Act 2018, "DABA"), then deepened it into one of the most codified small-jurisdiction custody frameworks — combining statutory creditor-exclusion, a mandatory financial backstop, and a prescriptive key-management code.
Timeline:
| Date | Milestone |
|---|---|
| 2018 | Digital Asset Business Act 2018 (DABA, 2018:28) in operation — three-class licence (Class T Test / Class M Modified / Class F Full) |
| February 2024 | Digital Asset Custody Code of Practice — detailed key-management, multi-sig, cold-storage, proof-of-reserves, and audit standards |
| 2024 | Digital Asset Business Amendment Act 2024 — added lending/repo as licensable activities, mandatory wind-down plans, expanded BMA capital/solvency rule-making |
| February 12, 2025 | Custody of Client Assets Rules 2025 in force — mandatory segregation, written-consent pooling, annual qualified-person review, pooling-event/pari-passu insolvency waterfall |
| September 2025 | Operational Resilience & Outsourcing Code finalised (implement by 31 March 2028); BMA published Guidance Note for prospective DAB licence applicants |
| November 13, 2025 | BMA issued a world-first DABA licence to DerivaDEX (DAO-governed decentralised derivatives exchange; non-custodial) |
Sequencing Decisions:
Bermuda created a single bespoke statute (DABA) under one integrated regulator (the Bermuda Monetary Authority), then sequenced detailed custody substance through subsidiary instruments: the Custody Code (2024) for technical key-management standards, and the Custody of Client Assets Rules 2025 for segregation and a rules-based pari-passu insolvency waterfall. Statutory creditor-exclusion (DABA s.18(4)) — custodied client assets are not the property of the licensee and "not subject to the claims of creditors of the licensed undertaking" — anchors the regime.
Institutional Design:
The BMA is an integrated financial regulator and the sole authority for digital asset business, supervising through dedicated FinTech, AML, and Cybersecurity units. Bermuda is not a Basel Committee member, so BCBS crypto standards do not apply directly; capital is set as a net-assets floor (US$100,000 for Class M/F) plus proportionate, institution-specific BMA direction.
What Went Well:
- Statutory bankruptcy-remoteness (s.18(4)) plus a mandatory financial backstop (s.18(1): surety bond, trust account, OR indemnity insurance) gave codified protection comparable to Switzerland and exceeding jurisdictions reliant on general trust law
- The prescriptive Custody Code (≥256-bit entropy seeds, ≥3-person seed ceremony, M-of-N multi-sig, FIPS 140-2 HSMs) provided clear technical expectations rare for a small jurisdiction
- The wind-down framework operated in practice (Bittrex Global (Bermuda) Ltd's orderly Class F exit)
What Could Have Been Better:
- Several quantitative parameters (insurance form/amount, institution-level capital above the floor) remain set case-by-case by the BMA rather than published, reducing ex-ante certainty for applicants
- Detailed custody substance arrived through 2024–2025 instruments, six-plus years after the 2018 statute
Sources: Mirrored from the verified per-jurisdiction fact matrix (DABA 2018; DAB Amendment Act 2024; DAB (Custody of Client Assets) Rules 2025; Digital Asset Custody Code of Practice, Feb 2024). See Bermuda regulation file.
1.7 Cayman Islands: Phased VASP Act and the Move to Conduct Supervision
The Cayman Islands implemented its Virtual Asset (Service Providers) Act in phases, moving custody from registration to full licensing, then layering on a market-conduct framework — a useful template for a jurisdiction sequencing AML coverage first and prudential/conduct depth later.
Timeline:
| Date | Milestone |
|---|---|
| October 31, 2020 / January 31, 2021 | Phase One of the VASP Act commenced (registration; AML/CFT; enforcement provisions) |
| October 27, 2023 | Cayman Islands removed from the FATF grey list |
| December 13, 2024 | CIMA gazetted the Statement of Guidance and published the Rule for Virtual Asset Custodians and Trading Platforms |
| April 1, 2025 | Phase Two commenced — custodians and trading platforms brought into the licensing regime (three-director/independent-director rule; fiat segregation at regulated banks; enhanced prudential obligations) |
| June 30, 2025 | Deadline for existing registrants performing custody/VATP activities to file licence applications (90 days from 1 April 2025) |
| February 2026 | CIMA issued the Market Conduct RSOG (MC-RSOG) and updated the Custody/VATP Rule/SOG — added insurance (professional liability, theft/loss, business interruption, cybersecurity); confirmed prudential rules (capital, recovery plans, stress testing) unchanged |
Sequencing Decisions:
Cayman ran AML-registration coverage first (Phase One, 2020–2021), gained FATF credibility (grey-list removal, October 2023), then moved custody from registration to full licensing (Phase Two, April 2025), and finally added conduct-of-business supervision and an insurance mandate (MC-RSOG, February 2026). CIMA is the sole supervisory authority.
What Went Well:
- The phased approach let Cayman build AML credibility before imposing prudential and conduct depth, and the FATF grey-list exit (2023) preceded the licensing upgrade
- The February 2026 Market Conduct framework added an insurance mandate (with an alternative-risk-mitigation carve-out where insurance is unavailable), signalling a shift toward mature conduct supervision
What Could Have Been Better:
- Several quantitative prudential parameters (minimum capital, cold-storage ratio) remain assessed case-by-case rather than published as fixed thresholds — leaving applicants with less ex-ante certainty than in MiCA or Bahrain
- The Cayman regime relies on common-law trust/property principles and Companies Act insolvency rather than a codified crypto-specific bankruptcy-remoteness statute
Sources: Mirrored from the verified per-jurisdiction fact matrix (VASP Act 2024 Revision; Custody/VATP Rule Dec 2024, updated Feb 2026; MC-RSOG Feb 2026; AMLRs Part XA). See Cayman Islands regulation file.
1.8 Comparative Summary
The seven detailed case studies span the full design space; the table below summarises their sequencing choices. The broader 20-jurisdiction cohort supplies additional precedents drawn on throughout this guide.
| Dimension | Switzerland | Singapore | UAE/Dubai | Germany | Hong Kong | Bermuda | Cayman Islands |
|---|---|---|---|---|---|---|---|
| Approach | Omnibus law amending 10 existing acts | Activity-based licensing expansion | New regulator + comprehensive rulebook | New license in existing banking law | Sandbox to mandatory licensing | Bespoke statute + subsidiary codes/rules | Phased VASP Act (register → licence → conduct) |
| Time from initiation to operational framework | ~3 years (2018–2021) | ~5 years (2019–2024) | ~1 year (2022–2023) | ~0 years (immediate on KWG amendment) | ~5 years (2018–2023) | Statute 2018; custody substance 2024–2025 | ~4.5 years (2020 register → 2025 licence) |
| New institution created? | No (FINMA retained authority) | No (MAS retained authority) | Yes (VARA) | No (BaFin retained authority) | No (SFC retained authority) | No (BMA integrated authority) | No (CIMA sole authority) |
| Consultation periods | 3.5 months (ordinance) | 2 months per round (multiple rounds) | Limited formal consultation | Standard legislative process | Multiple rounds over years | Guidance-note-led, applicant guidance 2025 | Gazetted rule + SOG (2024); MC-RSOG (2026) |
| Custody-specific provisions | Phased (2021 law + 2026 guidance) | Dedicated (2024) | Embedded in rulebook (2023) + qualified-custodian (2025) | Dedicated license (2020) | Consultation conclusions Dec 2025; bill targeted 2026 | Custody Code 2024 + Custody Rules 2025 | Custody/VATP Rule 2024; full licensing Apr 2025 |
| Statutory bankruptcy-remoteness? | Yes (DEBA Art. 242a–242b) | Trust-based (not stand-alone statute) | Segregation + qualified-custodian (rulebook) | Yes (KWG s.46i / KMAG s.45) | Trust-based | Yes (DABA s.18(4)) | No (common-law trust/property + segregation) |
| Supranational transition | N/A | N/A | N/A | MiCA transition (2024–2025) | N/A | N/A | N/A |
Additional European precedents — Liechtenstein (statutory bankruptcy-remoteness via TVTG Art. 25 + Insolvenzordnung (IO) Art. 41 inside the EEA single market) and Luxembourg (custody substance from directly-applicable MiCAR plus a Blockchain-Laws-I–IV DLT-securities lead) — show how an EEA member can pair statutory or harmonised custody protection with single-market passporting. Gibraltar (first DLT-specific regime globally, in force 1 January 2018, principles-based) illustrates the early-mover/principles-based pattern outside MiCA post-Brexit.
2. Stakeholder Consultation Models
Effective stakeholder consultation is a prerequisite for building a workable custody framework. The evidence from leading jurisdictions demonstrates that consultation quality directly affects regulatory quality.
2.1 Published Consultation Documents
The following jurisdictions published formal consultation documents for their crypto custody frameworks:
| Jurisdiction | Document | Date | Consultation Period |
|---|---|---|---|
| Singapore | MAS Consultation Paper on DPT Regulatory Measures | October 2022 | ~2 months |
| Singapore | MAS Consultation on PSA Legislative Amendments | July 2023 | ~3 months |
| Switzerland | Federal Council DLT Omnibus Ordinance Consultation | October 2020 | 3.5 months |
| Switzerland | Federal Council FinIA Reform (Crypto Institution License) Consultation | October 22, 2025 | To February 6, 2026 (~3.5 months) |
| European Union | ESMA First MiCA Consultation Package | July 2023 | ~3 months |
| European Union | ESMA Second MiCA Consultation Package | October 2023 | ~3 months |
| European Union | ESMA Third MiCA Consultation Package | Q1 2024 | Until June 25, 2024 |
| United Kingdom | FCA CP25/14 — Stablecoin Issuance and Cryptoasset Custody | May 28, 2025 | ~4.5 months (to October 10, 2025) |
| United Kingdom | FCA CP26/4 — Draft CASS 17 Safeguarding Rules | January 23, 2026 | To March 12, 2026 |
| Hong Kong | SFC/FSTB Joint Consultation on VA Dealing and Custodian Licensing | June 27, 2025 | Conclusions published December 24, 2025 |
| Brazil | BCB Public Consultation 126/2025 — Basel-aligned prudential capital rules | October 29, 2025 | Comments closed January 30, 2026 |
| Australia | Treasury Consultation Paper on Regulating Digital Asset Platforms | October 16, 2023 | ~6 weeks (to December 1, 2023) |
| Australia | ASIC Consultation Paper 381 (updates to INFO 225) | December 2024 | Finalised INFO 225 published October 2025 |
| Abu Dhabi (ADGM) | FSRA Consultation Paper No. 9 of 2025 on Fiat-Referenced Tokens | 2025 | UNVERIFIED |
Sources: MAS media release April 2024; FCA CP25/14; ESMA MiCA page; Australian Treasury consultation
2.2 Consultation Period Duration — Best Practices
Based on the evidence:
- Minimum effective period: 2 months (Singapore's initial consultation)
- Recommended period: 3–4.5 months (Switzerland, EU ESMA, UK FCA)
- Extended periods for complex frameworks: 4.5+ months (UK FCA CP25/14)
The United Kingdom's FCA set the most generous consultation windows (4.5 months), while Australia's Treasury provided only six weeks — the shortest among major jurisdictions and a period criticized by industry as insufficient.
2.3 How Industry Input Was Incorporated
- Singapore (MAS): Conducted a two-round consultation process (2022 and 2023), with the second round explicitly incorporating feedback from the first. The six-month safeguarding transition period was a direct response to industry concerns about implementation timelines.
- European Union (ESMA): Structured its consultation in three sequential packages, allowing stakeholders to engage on progressively more detailed technical standards. ESMA published final reports summarizing responses and explaining how feedback influenced the final rules.
- United Kingdom (FCA): Published an explicit "Crypto Roadmap" alongside its consultations, indicating where further consultation would follow, and committed to publishing policy statements through 2026 incorporating feedback (CP26/4 draft CASS 17 closed 12 March 2026).
- Hong Kong (SFC/FSTB): Published consultation conclusions on VA dealing/custodian licensing (24 December 2025) that narrowed scope to private-key safekeeping and added an expedited pathway — a documented example of feedback reshaping the proposal.
2.4 Role of Industry Associations
Industry associations played significant roles in multiple jurisdictions:
- United States: The American Bankers Association, Bank Policy Institute, and Financial Services Forum jointly submitted detailed comment letters to the SEC on custody rules, urging application of "proven safeguards" to crypto custody. The Wolfsberg Group (12 major global banks) issued principles for banking stablecoin issuers relevant to custody.
- Australia: Crypto for Innovation submitted a detailed response to the Treasury Proposal Paper on regulating digital asset platforms.
- European Union: Industry bodies engaged extensively through the three ESMA consultation rounds on MiCA technical standards.
Sources: Bank Policy Institute — Banks urge SEC on crypto custody; Crypto for Innovation — Australian Treasury response
3. Institutional Infrastructure Needed
Building an effective crypto custody regulatory framework requires more than legislation. Jurisdictions that have succeeded invested in institutional capacity across four dimensions.
3.1 Regulatory Body Capacity
Staff and Expertise Requirements:
Crypto custody supervision requires specialized knowledge that traditional financial regulators rarely possess at the outset:
- Cryptographic key management: Understanding of public/private key infrastructure, multi-signature schemes, threshold cryptography, hardware security modules (HSMs), and cold/hot wallet architecture
- Distributed ledger technology: Ability to evaluate on-chain vs. off-chain custody models, smart contract risks, and protocol-level vulnerabilities
- Cybersecurity: Capacity to assess penetration testing results, incident response plans, and digital forensic capabilities
- Financial regulation: Traditional expertise in capital adequacy, liquidity management, and prudential supervision
Country Precedent — Germany: BaFin integrated crypto custody licensing into its existing banking supervision division. This avoided creating a new organizational unit but required significant upskilling of existing examiners. BaFin's guidance notes (published March 2020) served as both industry guidance and internal supervisory reference.
Country Precedent — UAE/Dubai: VARA was established as a new, purpose-built authority, which allowed recruitment of staff with crypto-native expertise but required building institutional credibility from scratch.
Country Precedent — Bermuda: The BMA built dedicated FinTech, AML, and Cybersecurity units inside an integrated regulator, enabling it to author a prescriptive Custody Code (key ceremonies, HSM certification, multi-sig audit cadence) despite the jurisdiction's small size.
Technology Infrastructure:
Regulators need:
- On-chain monitoring and analytics capabilities (to verify proof of reserves, track suspicious transactions)
- Secure communication systems for receiving confidential licensing applications
- Database infrastructure for managing license applications, examination schedules, and enforcement actions
3.2 Examination and Inspection Framework
A credible custody framework requires active supervision, not merely paper-based licensing. Key elements include:
| Element | Description | Country Precedent |
|---|---|---|
| On-site inspections | Physical examination of security controls, key management facilities, and operational procedures | Switzerland — FINMA's 2026 guidance established detailed expectations for custody risk assessment |
| Proof-of-reserves verification | Ability to independently verify that custodied assets match client records | UAE — VARA mandates periodic proof-of-reserves under Rulebook 2.0; Bermuda — DABA s.18(3) statutory "sufficient amount of each type of digital asset" basis |
| Third-party audit review | Capacity to evaluate and challenge external audit reports | Germany — BaFin reviews annual audit reports; Bermuda — Custody Rules 2025 annual qualified-person client-asset controls review to the BMA |
| Incident reporting review | Systems to receive, analyze, and respond to security breach notifications | Singapore — MAS requires DPT service providers to report incidents; EU — DORA ICT incident reporting |
| Cross-border custody delegation review | Ability to assess risks when custody is sub-delegated to foreign entities | Switzerland — FINMA's 2026 guidance addresses foreign custody risks; EU — ESMA confirmed custody may not be delegated to unauthorised third-country entities even within a group |
See also Audit & Reporting for detailed standards.
3.3 Licensing Processing Infrastructure
Based on the experience of early movers:
- Application processing time: Germany's BaFin crypto custody licensing process took many months in practice, with some firms waiting over a year. Jurisdictions should plan for 3–6 month processing timelines and staff accordingly.
- Interim/transitional regimes: Germany (KMZÜV/Article 143(6) fast-track for MiCA, ending 31 December 2025), the EU broadly (transitional/grandfathering periods ending 1 July 2026), Cayman (90-day filing window from 1 April 2025), and Liechtenstein/Luxembourg (VASP/TVTG-to-MiCAR transition to 1 July 2026) all implemented transitional arrangements to avoid market disruption. By contrast, Singapore's FSMA DTSP regime (30 June 2025) launched with no transitional period.
- Application templates and guidance: BaFin's publication of detailed application guidance (March 2020) and Bermuda's BMA applicant Guidance Note (September 2025) significantly reduced incomplete applications and processing delays.
See also Licensing Frameworks for detailed licensing category design.
3.4 Cross-Border Cooperation Agreements
Crypto custody is inherently cross-border. Key infrastructure includes:
- Memoranda of Understanding (MOUs): The UAE's SCA-VARA cooperation agreement (September 2024) demonstrates the need even within a single country. Cross-border MOUs between financial regulators enable information sharing and coordinated supervision.
- Passporting and equivalence: The EU/EEA MiCA passport (Article 65) lets a CASP authorised in one member state serve all others — Liechtenstein's Bank Frick (MiCAR authorisation with passporting across 30 EEA states, January 2026) and Luxembourg's Coinbase hub (passporting across 27 EU states) show the single-market reach. Switzerland's DEBA framework protects foreign custody only where supervision-and-bankruptcy-protection equivalence is met.
- FATF alignment: Hong Kong's August 2025 AMLO amendments, the Cayman Islands' Part XA Travel Rule, Gibraltar's POCA Travel Rule (EUR 1,000 threshold, in force from 22 September 2022), and Bermuda's CFATF membership were all explicitly driven by FATF compliance — a reminder that FATF alignment is a prerequisite for international regulatory cooperation.
- FSB coordination: The Financial Stability Board's thematic review (2025) found that global crypto regulation remains fragmented despite market growth, and called for jurisdictions to develop bilateral and multilateral arrangements for effective cross-border oversight.
Sources: Elliptic — FSB thematic review 2025; Chainalysis — 2025 Crypto Regulatory Round-Up
4. Recommended 3-Year Phased Plan
The following three-year plan synthesizes the successful elements of the studied jurisdictions into a sequential implementation roadmap. Each element cites the country or countries that provide the precedent.
Year 1: Foundation (Months 1–12)
Q1–Q2: Legal Framework Design and Stakeholder Consultation
| Action | Detail | Precedent |
|---|---|---|
| Define "crypto custody" in statute | Adopt a technology-neutral definition covering the safekeeping, administration, and safeguarding of crypto assets or private cryptographic keys on behalf of others | Germany — KWG Section 1(1a) sentence 2 no. 6 definition of Kryptoverwahrgeschäft; Gibraltar — custody captured directly as a licensable DLT activity |
| Establish licensing categories | Distinguish between full custody (institutional-grade, cold storage dominant), limited custody (hot wallet, retail), and sub-custodian roles | Hong Kong — ASPIRe two-tier market structure separating trading and custody; Bermuda — three-class DABA licence (Test / Modified / Full) |
| Launch formal stakeholder consultation | Publish consultation paper with minimum 3-month response window | Switzerland — 3.5-month consultation on DLT ordinance; United Kingdom — FCA's 4.5-month consultation window |
| Engage industry associations | Establish formal dialogue channels with crypto industry bodies, banking associations, and legal/accounting profession | United Kingdom — FCA Crypto Roadmap publication alongside consultation papers |
See also Licensing Frameworks for detailed licensing design guidance.
Q3–Q4: Interim Registration and AML/KYC Baseline
| Action | Detail | Precedent |
|---|---|---|
| Implement interim registration regime | Allow existing custody providers to register and continue operating while full licensing is developed (with basic requirements) | Germany — grandfathering for existing operators; Hong Kong — deemed licensing for existing VATP operators; Cayman — Phase One registration (2020–2021) before Phase Two licensing |
| Establish AML/KYC baseline | Require all registered custodians to implement customer due diligence, transaction monitoring, suspicious transaction reporting, and the FATF Travel Rule | Singapore — AML/CFT from the initial PSA framework (2019); Gibraltar — POCA registration + Travel Rule (EUR 1,000, from 22 September 2022) |
| Publish licensing guidance | Release detailed guidance on the full licensing application requirements, timeline, and process | Germany — BaFin guidance notices (March 2020); Bermuda — BMA applicant Guidance Note (September 2025) |
| Begin regulatory capacity building | Recruit or upskill staff in cryptography, DLT, cybersecurity, and digital forensics | UAE — VARA recruited crypto-native expertise; Bermuda — BMA FinTech/AML/Cybersecurity units |
See also Compliance for AML/KYC framework details.
Year 2: Build-Out (Months 13–24)
Q1–Q2: Full Licensing Operational
| Action | Detail | Precedent |
|---|---|---|
| Open licensing gateway | Begin accepting and processing full custody license applications | United Kingdom — FCA application gateway opens 30 September 2026 (closes 28 February 2027); Cayman — Phase Two custody licensing from 1 April 2025 |
| Set application processing targets | Commit to a processing timeline (e.g., 3–6 months from complete application to decision) | Germany — BaFin experience suggests planning for 6+ month processing times initially |
| Transition from interim registration | Set a clear deadline for interim registrants to obtain full licenses or cease operations | Germany — shortened MiCA grandfathering ended 31 December 2025; EU/Liechtenstein/Luxembourg — transitional periods end 1 July 2026 |
Q2–Q3: Capital and Prudential Requirements
| Action | Detail | Precedent |
|---|---|---|
| Implement minimum capital requirements | Set capital adequacy requirements appropriate to the scale and risk profile of custody activities | EU/MiCA — EUR 125,000 own funds for custody CASPs (Class 2, Annex IV); UAE — AED 4M (VARA custody) / up to USD 4M (ADGM public-fund custody); United Kingdom — FCA CRYPTOPRU regime (PMR GBP 150,000 + K-CSG factor) |
| Require asset segregation | Mandate legal and operational separation of client assets from custodian proprietary assets | Singapore — 2024 trust-account safeguarding; Switzerland — DEBA Art. 242a; Bahrain — CRA-4.5.2 segregated accounts; Bermuda — DABA s.17/s.18 + Custody Rules 2025 |
| Establish bankruptcy protections | Ensure client assets held in custody are protected from custodian insolvency | Switzerland — DEBA Art. 242a–242b; Germany — KWG s.46i / KMAG s.45; Liechtenstein — TVTG Art. 25 + Insolvenzordnung (IO) Art. 41; Bermuda — DABA s.18(4) statutory creditor-exclusion |
See also Capital & Prudential Requirements and Asset Segregation & Bankruptcy for detailed standards.
Q3–Q4: Examination Program and Insurance Framework
| Action | Detail | Precedent |
|---|---|---|
| Launch examination program | Conduct first on-site inspections of licensed custodians | Switzerland — FINMA supervisory approach detailed in Guidance 01/2026; Bermuda — Custody Rules 2025 annual qualified-person review |
| Require proof-of-reserves attestation | Mandate regular independent verification that custodied assets match reported holdings | UAE — VARA periodic proof-of-reserves (Rulebook 2.0); Bermuda — DABA s.18(3) statutory holding basis |
| Establish insurance/liability framework | Require custody providers to maintain adequate insurance or equivalent financial protections against loss of client assets | EU/MiCA — mandatory liability insurance (or own-funds equivalent); Bermuda — DABA s.18(1) mandatory surety bond/trust/indemnity; Cayman — MC-RSOG insurance mandate (Feb 2026); Bahrain — PI insurance ≥ BHD 100,000 |
See also Insurance & Liability for detailed insurance framework guidance.
Year 3: Maturation (Months 25–36)
Q1–Q2: Enhanced Technical Standards
| Action | Detail | Precedent |
|---|---|---|
| Issue detailed key management standards | Publish binding guidance on private key generation, storage, backup, recovery, and rotation procedures | Switzerland — FINMA Guidance 01/2026; Bermuda — Custody Code (≥256-bit seeds, ≥3-person seed ceremony, M-of-N multi-sig, FIPS 140-2 HSMs); Hong Kong — SFC Custody Circular (HSM, air-gapping, smart-contract prohibition in cold wallets) |
| Set cold-storage and storage-ratio expectations | Decide whether to mandate a numeric cold-storage ratio or adopt a risk-based, outcome-focused standard | Mandated ratios — Japan ≥95%, Bahrain 95%, Singapore ≥90%, South Korea ≥80%, Canada ≥80% with Acceptable Third-party Custodians; risk-based/no fixed ratio — UAE (VARA), Switzerland, EU, United Kingdom, Gibraltar, Bermuda |
| Set audit and reporting standards | Require annual external audits by qualified auditors with crypto-specific competencies | Germany — BaFin annual audit reports; Canada — SOC-2 Type II for public crypto fund custodians; Bermuda — annual qualified-person client-asset controls review |
| Mandate incident reporting | Require timely notification of security breaches, key compromises, and operational failures | Singapore — MAS incident reporting; EU — DORA ICT incident reporting |
See also Key Management and Audit & Reporting.
Q2–Q3: Cross-Border and Systemic Oversight
| Action | Detail | Precedent |
|---|---|---|
| Negotiate cross-border cooperation agreements | Establish MOUs with regulators in major crypto custody jurisdictions; consider passporting/equivalence where part of a single market | UAE — SCA-VARA cooperation agreement (2024); EU/EEA — MiCA passporting (Liechtenstein, Luxembourg); FSB recommendation for bilateral/multilateral arrangements |
| Assess sub-custody delegation risks | Establish requirements for due diligence when custody is delegated to foreign entities | Switzerland — FINMA 2026 guidance on foreign custody/equivalence; EU — ESMA bar on delegating custody to unauthorised third-country entities even within a group; Liechtenstein — outsourcing/sub-custody to unregulated providers not permitted |
| Designate systemically important custodians | Establish criteria for identifying custodians whose failure could pose systemic risk, and apply enhanced requirements | South Korea — Upbit/Bithumb classified critical infrastructure; inspired by traditional-finance SIFI designation principles |
Q3–Q4: Review and Adjust
| Action | Detail | Precedent |
|---|---|---|
| Conduct framework review | Assess the effectiveness of the licensing regime, identify gaps, and plan amendments | UAE — VARA Rulebook Version 2.0 (May 2025) after two years of operation; Cayman — MC-RSOG conduct layer (Feb 2026) after Phase Two licensing |
| Publish updated guidance | Issue revised guidance reflecting lessons learned from initial licensing and supervision cycles | Switzerland — FINMA's 2026 custody guidance arrived five years after the DLT Act, reflecting accumulated supervisory experience |
| Engage in international standard-setting | Contribute to FATF, FSB, and IOSCO efforts on global crypto custody standards | FSB thematic review (2025) called for enhanced regulatory alignment |
See also Unsaid Items for emerging areas that frameworks should anticipate.
5. Common Implementation Mistakes
The following mistakes are documented from specific jurisdictions and should be actively avoided.
5.1 Failure to Mandate Asset Segregation (United States — FTX)
What happened: FTX did not maintain proper segregation of customer assets. Customer deposits were redirected to Alameda Research without disclosure or consent. An estimated US$10 billion in client assets went missing due to the absence of basic protections like asset segregation. Custody and trade execution functions were not separated, and commingled funds were misused with limited oversight or audit.
Lesson: Asset segregation requirements — including legal separation via trust structures and operational separation of custody from trading — must be mandated from the outset, not treated as an advanced requirement for later phases. The UAE's dedicated-entity custody requirement (custody cannot be combined with other VA activities) is a direct structural response to this failure mode.
Source: Coalition Greenwich — FTX collapse and custody; Taylor Wessing — FTX collapse and safeguarding
5.2 Regulation by Enforcement Rather Than Clear Rules (United States — SEC)
What happened: Under SEC Chair Gary Gensler (2021–2025), the U.S. adopted an approach of "regulation by enforcement" — bringing enforcement actions against crypto firms without first publishing clear rules or guidance on custody obligations. This approach:
- Created regulatory uncertainty that drove firms offshore (including FTX itself)
- Deterred qualified traditional custodians (banks, broker-dealers) from entering the market
- Failed to prevent the very collapses it was nominally policing
Additionally, SEC Staff Accounting Bulletin 121 (SAB 121) required banks to record custodied crypto assets on their own balance sheets — a departure from how all other custodied assets are treated — effectively blocking banks from offering crypto custody at scale.
Correction (status as of 2026): The U.S. reversed course. The SEC issued SAB 122 on January 23, 2025 (effective January 30, 2025), rescinding SAB 121 and removing the on-balance-sheet liability requirement; banks now apply ASC 450-20. The SEC's September 30, 2025 no-action letter permits state trust companies to act as qualified custodians (paired with NYDFS custodial-structures guidance the same day). Multiple OCC national trust bank charters were approved through 2025–2026, and the GENIUS Act (signed 18 July 2025) created a federal payment-stablecoin framework. The qualified-custodian rule itself is being modernized: the SEC Crypto Task Force published a Custody Rule Modernization discussion draft (19 December 2025), with an NPRM projected for 2026 but not yet issued as of June 2026.
Lesson: Clear, prospective rules and guidance (as Germany, Singapore, and Switzerland provided) are far more effective than reactive enforcement actions. The post-2025 U.S. reversal — rescinding SAB 121 and opening qualified-custodian and trust-bank pathways — also illustrates a durability risk: most of the change came via interpretive letters, staff guidance, and no-action letters rather than durable legislation (the GENIUS Act being the main statutory anchor).
Source: PIFS — Implementing an effective cryptoasset regulatory framework in the US; SEC — Crenshaw statement on crypto custody
5.3 Sub-National Custody Licensing Without National Standards (United States — Prime Trust, Fortress Trust)
What happened: Prime Trust and Fortress Trust, both crypto-native custodians chartered as Nevada state trust companies, failed and lost customer assets. The state trust company charter provided a custodial framework, but without national-level standards for crypto custody, the level of oversight, capital requirements, and operational controls was insufficient.
Lesson: Where custody licensing exists at sub-national levels, minimum federal or national standards are essential. State-level or provincial licensing alone is insufficient for crypto custody, given the cross-border and technologically complex nature of the activity. Canada's QuadrigaCX legacy similarly drove the CIRO four-tier national custody framework (February 2026) to avoid relying on uneven provincial oversight.
Source: State Street — Future of digital asset custody; SEC — Crenshaw statement
5.4 Rushing the Rulebook (UAE/Dubai — VARA)
What happened: VARA deployed its complete VA Framework in under one year from establishment (March 2022 to February 2023). While this speed attracted business, the initial 2023 rulebooks required significant revision — VARA issued Version 2.0 of its entire rulebook framework in May 2025, just over two years after the initial release. This imposed transition costs on regulated entities that had invested in compliance with the original rules.
Lesson: Allow sufficient time for stakeholder consultation and iterative rule development. Speed of deployment must be balanced against rule quality to minimize revision costs. A phased rollout (as Switzerland, Singapore, and the Cayman Islands implemented) is preferable to a "big bang" approach.
5.5 Multi-Regulator Fragmentation (UAE)
What happened: The UAE created a complex multi-regulator environment: VARA (Dubai), ADGM FSRA (Abu Dhabi), DFSA (DIFC), CMA (federal securities, ex-SCA), and CBUAE (central bank) all have overlapping or adjacent jurisdictions over crypto assets. The SCA-VARA cooperation agreement was not formalized until September 2024 — over two years after VARA's creation — and federal/zone perimeters continued to shift through 2026 (CBUAE Decree-Law No. 6 of 2025; CMA Decision No. 4/R.M/2026), creating a prolonged period of jurisdictional layering.
Lesson: Designate a single primary regulator for crypto custody from the outset. If multiple regulators must be involved, formalize cooperation agreements and jurisdictional delineation before licensing begins, not after. Single-regulator jurisdictions (Bahrain/CBB, Bermuda/BMA, Cayman/CIMA, Gibraltar/GFSC, Liechtenstein/FMA, Luxembourg/CSSF, Singapore/MAS) avoided this complexity entirely.
Source: DLA Piper — UAE regulatory landscape; CompliFactor — UAE Crypto Regulation 2025
5.6 Delayed Custody-Specific Guidance (Switzerland — FINMA)
What happened: Switzerland enacted the DLT Act in 2020/2021 but FINMA did not publish detailed guidance on crypto custody risks until January 2026 — a roughly five-year gap. During this period, supervised entities had statutory obligations regarding custody but limited regulatory guidance on how FINMA expected those obligations to be met, particularly regarding foreign custody delegation, private key management, and cybersecurity standards.
Lesson: Statutory provisions should be accompanied by regulatory guidance within 6–12 months. Detailed technical guidance on key management, cybersecurity, and sub-custody delegation should not be delayed for years. Bermuda's sequencing (statute 2018, then Custody Code 2024 and Custody Rules 2025) shows the same lag risk even for small, well-resourced regulators.
Source: FINMA Guidance 01/2026; PwC — FINMA crypto custody requirements
5.7 Overly Short Consultation Periods (Australia)
What happened: Australia's Treasury published its consultation paper on regulating digital asset platforms on October 16, 2023 with a closing date of December 1, 2023 — approximately six weeks. Industry participants and associations criticized this as insufficient time for the complexity of the proposals. The framework eventually advanced (the Corporations Amendment (Digital Assets Framework) Act 2026 received Royal Assent on 8 April 2026 and commences 9 April 2027), but substantive standards still await legislative instruments — a long path partly attributable to a rushed initial consultation.
Lesson: Consultation periods for novel regulatory frameworks should be a minimum of 3 months. The UK FCA's approach (4.5 months for CP25/14) and Switzerland's approach (3.5 months) are better models.
Source: Clayton Utz — Treasury consults on AFSL for crypto; Gilbert + Tobin — Blockchain & Cryptocurrency Regulation 2026 Australia
6. Decision Matrix
The following decision matrix helps policymakers navigate key design choices when building a crypto custody framework, based on the evidence from this guide across the 20 studied jurisdictions.
6.1 Framework Architecture Decisions
| Decision | Option A | Option B | Option C | Recommendation |
|---|---|---|---|---|
| Legislative approach | Amend existing financial law (Germany, Switzerland) | Enact standalone crypto/DLT legislation (UAE/Dubai, Bermuda DABA, Gibraltar DLT Regs) | Expand existing licensing act (Singapore) | Option A or C preferred — embedding custody within existing financial law reduces legal uncertainty and leverages established supervisory infrastructure. Option B can work well where paired with statutory bankruptcy-remoteness (Bermuda DABA s.18(4)) but risks isolation from broader financial regulation if not. |
| Regulatory authority | Assign to existing/integrated regulator (Germany/BaFin, Singapore/MAS, Switzerland/FINMA, Bermuda/BMA, Cayman/CIMA, Gibraltar/GFSC, Liechtenstein/FMA, Luxembourg/CSSF) | Create new dedicated authority (UAE/VARA) | Split between multiple regulators (UAE federal/zone) | Single existing/integrated regulator strongly preferred — most successful small and mid-size jurisdictions used a single integrated regulator. Creating a new authority (VARA) is fast but raises institutional-credibility challenges; multi-regulator approaches create fragmentation. |
| Custody licensing | Dedicated custody license (Germany's Kryptoverwahrgeschäft; UAE/VARA Custody Services License) | Custody as activity within a broader VASP license (Singapore, Bahrain Cat 2/3/4) | Custody embedded in existing securities/banking license (Hong Kong VATP; Luxembourg via MiCAR Art. 60) | Dedicated custody license recommended — Germany's and VARA's models provide the clearest expectations for custody-focused firms; Hong Kong's consultation conclusions (Dec 2025) move toward a standalone licence. Activity-based approaches are a workable alternative. |
| Consultation approach | Single comprehensive consultation (Australia) | Multiple sequential consultations (Singapore, EU/ESMA) | Parallel consultations on related topics (UK FCA) | Multiple sequential consultations recommended — Singapore's two-round approach and ESMA's three-package approach allowed iterative refinement. Single consultations risk gaps. |
6.2 Timeline Decisions
| Decision | Faster Approach | Balanced Approach | Deliberate Approach | Recommendation |
|---|---|---|---|---|
| Initiation to framework | <1 year (UAE/VARA) | 2–3 years (Switzerland, Germany) | 5+ years (Hong Kong, Singapore) | 2–3 years recommended — fast approaches (UAE) require significant post-launch revision. Very slow approaches (Hong Kong) leave regulatory gaps that bad actors exploit. |
| Consultation period | 6 weeks (Australia) | 3–3.5 months (Switzerland, EU) | 4.5 months (UK FCA) | 3–4 months recommended — shorter periods produce lower-quality rules and less industry buy-in. Longer periods improve rule quality without excessive delay. |
| Transition period for existing providers | None (Singapore FSMA DTSP, 2025) | 6–12 months (Germany shortened MiCA grandfathering; Singapore safeguarding; Cayman 90-day filing) | 12–18 months (MiCA maximum; EU/Liechtenstein/Luxembourg to 1 July 2026) | 12 months recommended — provides adequate time for compliance preparation while maintaining urgency. Germany's shortened 12-month MiCA window (ended 31 Dec 2025) is a good model; a zero-transition launch risks orderly-exit problems. |
6.3 Substantive Standards Decisions
| Decision | Minimum Standard | Intermediate Standard | Maximum Standard | Recommendation |
|---|---|---|---|---|
| Asset segregation | Operational segregation only | Operational + legal segregation (trust accounts) | Statutory creditor-exclusion + per-client/pari-passu protection | Intermediate-to-maximum recommended — Singapore's trust-account model provides strong protection; the strongest regimes add statutory bankruptcy-remoteness (Switzerland DEBA Art. 242a–242b; Liechtenstein TVTG Art. 25 + Insolvenzordnung (IO) Art. 41; Germany KWG s.46i; Bermuda DABA s.18(4)). Per-client on-chain segregation may be impractical at scale; a pari-passu insolvency waterfall (Bermuda Custody Rules 2025) is a pragmatic alternative. |
| Capital requirements | Flat minimum (e.g., MiCA EUR 125,000 for custody CASPs) | Scaled by assets under custody / activity tier | Risk-weighted capital similar to banking | Scaled-by-AUC or activity-tier recommended — a flat minimum is insufficient for large custodians (UK FCA K-CSG factor and UAE/Bahrain activity-tiered capital both calibrate to scale). Full risk-weighted capital may be disproportionate. Several jurisdictions (Cayman, Gibraltar, Bermuda above the floor) set capital case-by-case — workable but less transparent. |
| Insurance requirement | No insurance mandate | Insurance or equivalent (flexible) | Mandatory minimum insurance coverage | Insurance or equivalent (flexible) recommended — EU/MiCA (insurance or own-funds equivalent), Bermuda (surety bond/trust/indemnity), and Cayman (MC-RSOG with alternative-risk-mitigation carve-out) all allow flexibility, recognising limited crypto insurance-market capacity. Bahrain's fixed PI floor (≥ BHD 100,000) shows a minimum-coverage option where the market supports it. |
| Key management standards | Principles-based guidance | Prescriptive technical requirements | Certified hardware/process requirements | Principles-based initially, evolving to prescriptive — Switzerland's progression (DLT Act 2021 principles → FINMA Guidance 01/2026 detail) shows the right sequencing; Bermuda's Custody Code and Hong Kong's SFC Custody Circular show the prescriptive end (seed ceremonies, HSM certification, air-gapping). |
| Cold-storage ratio | No fixed ratio (risk-based) | Risk-based with documented methodology | Fixed numeric minimum | Context-dependent — jurisdictions split clearly: fixed ratios (Japan ≥95%, Bahrain 95%, Singapore ≥90%, South Korea ≥80%, Canada ≥80%) give certainty and a hard floor; risk-based/no fixed ratio (UAE, Switzerland, EU, UK, Gibraltar, Bermuda) accommodates diverse custody models. A fixed floor is recommended for retail-facing custody; a risk-based standard for institutional/diversified custody. |
See also Key Management, Capital & Prudential Requirements, Insurance & Liability, and Asset Segregation & Bankruptcy for detailed treatment of each topic.
Verification Notes
This appendix documents the verification status of each major factual claim in this document. All facts mirror the verified per-jurisdiction fact matrix for the 20 studied jurisdictions; no claim has been introduced that is not in the matrix or the existing source files.
Switzerland
- DLT Act timeline (2018–2021): VERIFIED via Library of Congress, Swiss Federal Council media release, and PwC Swiss DLT regulations
- FINMA Guidance 01/2026 (January 12, 2026) and FinIA reform consultation (closed 6 Feb 2026): VERIFIED via FINMA official announcement; statutory bankruptcy protection (DEBA Art. 242a–242b) mirrored from the fact matrix
Singapore
- PSA 2019 enactment, 2020 commencement, and 2021 amendment: VERIFIED via CoinDesk and MAS media release
- April 4, 2024 custody provisions and October 4, 2024 safeguarding commencement: VERIFIED via MAS official media release and Bovill Newgate; FSMA DTSP regime (30 June 2025, no transition) and 37 MPI licences (March 2026) mirrored from the fact matrix
UAE/Dubai
- VARA established March 2022; VA Framework February 2023; Rulebook v2.0 (May 2025, effective June 19, 2025); SCA-VARA cooperation agreement (September 5, 2024): VERIFIED via DLA Piper and Solidus Labs
- CBUAE Federal Decree-Law No. 6 of 2025; CMA Decision No. 4/R.M/2026 (eff. 13 Feb 2026); VARA Issuance Rulebook (9 Apr 2026): mirrored from the fact matrix
Germany
- January 1, 2020 crypto custody license under KWG; BaFin guidance notice March 2, 2020: VERIFIED via Norton Rose Fulbright and BaFin official page
- Shortened 12-month MiCA grandfathering ending 31 Dec 2025; 53 CASPs (12 Apr 2026, EU leader): VERIFIED via Global Legal Insights — Germany 2026 and Skadden — MiCA update
Hong Kong
- 2018 SFC sandbox; June 1, 2023 mandatory VASP licensing under AMLO: VERIFIED via Norton Rose Fulbright and Hacken
- February 2025 ASPIRe roadmap; June 2025 SFC/FSTB consultation; December 24, 2025 consultation conclusions (custody bill targeted 2026); 10 Apr 2026 first stablecoin issuer licences: VERIFIED via SFC official announcement and Davis Polk; December 2025 conclusions and April 2026 stablecoin licences mirrored from the fact matrix
Bermuda
- DABA 2018; DAB Amendment Act 2024; Custody of Client Assets Rules 2025 (in force 12 Feb 2025); Digital Asset Custody Code of Practice (Feb 2024); statutory creditor-exclusion (s.18(4)) and mandatory financial backstop (s.18(1)): mirrored from the verified per-jurisdiction fact matrix; see Bermuda regulation file
Cayman Islands
- VASP Act (2024 Revision); Phase One registration (2020–2021); FATF grey-list exit (Oct 2023); Custody/VATP Rule (Dec 2024); Phase Two licensing (1 April 2025); MC-RSOG insurance mandate (Feb 2026): mirrored from the verified per-jurisdiction fact matrix; see Cayman Islands regulation file
Liechtenstein, Luxembourg, Gibraltar (precedents)
- Liechtenstein: TVTG (Blockchain Act, in force 1 Jan 2020) + EEA-MiCAR (applicable 24 Jun 2025); statutory bankruptcy-remoteness (TVTG Art. 25 + Insolvenzordnung (IO) Art. 41); Bank Frick MiCAR authorisation with EEA passporting (20 Jan 2026) — mirrored from the fact matrix; see Liechtenstein regulation file
- Luxembourg: MiCAR-derived custody substance; Law of 6 February 2025 (CSSF competent authority); Blockchain Laws I–IV control-agent model; Coinbase Luxembourg CASP authorisation (30 Jun 2025) — mirrored from the fact matrix; see Luxembourg regulation file
- Gibraltar: Financial Services (DLT Providers) Regulations in force 1 January 2018 (first DLT-specific regime globally); principles-based; Travel Rule (EUR 1,000) fully enforceable from 22 September 2022; no codified crypto-specific bankruptcy-remoteness statute (NO DATA FOUND) — mirrored from the fact matrix. Gibraltar's regulation file sits under the europe/ path though it is tagged region/middle-east-africa; see Gibraltar regulation file
United States / Implementation Failures
- FTX asset commingling and ~$10 billion loss; Prime Trust and Fortress Trust failures: VERIFIED via Coalition Greenwich, Taylor Wessing, and SEC Commissioner Crenshaw statement
- SAB 121 rescinded by SAB 122 (issued 23 Jan 2025, effective 30 Jan 2025); SEC 30 Sep 2025 no-action letter on state trust companies as qualified custodians; Custody Rule Modernization discussion draft (19 Dec 2025); NPRM projected 2026 (not yet issued as of June 2026); GENIUS Act (18 July 2025): CORRECTED to mirror the fact matrix (prior text described SAB 121 as still in force). See Bank Policy Institute and PIFS
UK FCA
- CP25/14 published May 28, 2025; CP26/4 draft CASS 17 (23 Jan 2026, closed 12 Mar 2026); application gateway opens 30 Sep 2026; full regime live 25 Oct 2027: VERIFIED via FCA CP25/14 page and Ashurst analysis; CP26/4 and 2027 commencement mirrored from the fact matrix
MiCA / EU
- ESMA three-package consultation structure; MiCA Title V applicable 30 Dec 2024; full enforcement deadline 1 July 2026; ~199 CASPs (12 Apr 2026); custody is the most common CASP service: VERIFIED via ESMA MiCA page and Skadden — MiCA update; 2026 CASP counts mirrored from the fact matrix
Australia
- Treasury consultation paper October 16, 2023 (closing December 1, 2023); ASIC CP 381 and finalised INFO 225 (Oct 2025); DAF Act 2026 Royal Assent 8 Apr 2026, commences 9 Apr 2027: VERIFIED via Australian Treasury and Clayton Utz; DAF Act enactment/commencement mirrored from the fact matrix
Cold-Storage Ratios and Other Cross-Jurisdiction Data
- Mandated cold-storage ratios (Japan ≥95%, Bahrain 95%, Singapore ≥90%, South Korea ≥80%, Canada ≥80%) and risk-based/no-fixed-ratio jurisdictions (UAE, Switzerland, EU, UK, Gibraltar, Bermuda, Liechtenstein, Luxembourg): mirrored from the verified per-jurisdiction fact matrix
- Capital figures (MiCA EUR 125,000 custody; UK PMR GBP 150,000 + K-CSG; UAE AED 4M / USD 4M; Bahrain BHD 100,000 PI floor): mirrored from the verified per-jurisdiction fact matrix
Cross-Border Cooperation
- FSB 2025 thematic review finding fragmented regulation: VERIFIED via Elliptic
- EU/EEA MiCA passporting (Liechtenstein Bank Frick across 30 EEA states; Luxembourg Coinbase across 27 EU states); Switzerland foreign-custody equivalence: mirrored from the verified per-jurisdiction fact matrix
Items Marked UNVERIFIED
- Abu Dhabi ADGM FSRA Consultation Paper No. 9 of 2025: exact publication date and consultation window not confirmed in primary sources
- France exact AMF-published custody-CASP count (press cited "roughly a dozen" as of May 2026): not verified to an exact published figure