Insurance & Liability

Executive Summary

Insurance and liability frameworks for institutional crypto custody remain among the most underdeveloped aspects of digital asset regulation globally. The collapse of FTX in November 2022 -- where customer assets totaling billions of dollars were commingled and misappropriated while the exchange carried only USD 7.5 million in crime insurance -- exposed the catastrophic consequences of inadequate insurance mandates and absent segregation requirements. This section provides a comparative analysis of custodian liability regimes, insurance requirements, market conditions, and coverage gaps across the 20 jurisdictions surveyed in this domain, culminating in a recommended tiered framework for policymakers.

The core tension in this domain is threefold: (1) traditional deposit guarantee schemes universally exclude crypto-assets; (2) the commercial insurance market for digital asset custody, while growing, remains capacity-constrained relative to total assets under custody; and (3) liability regimes vary dramatically -- from strict no-fault liability under the

European Union's MiCA to largely contractual limitation in most common law jurisdictions. Across the 20 jurisdictions, mandatory insurance (or an insurance-or-equivalent backstop) is now a minority feature -- present in some form in

Bahrain, the

UAE,

Cayman Islands,

Bermuda,

South Korea, the EU (MiCA), and

Hong Kong (for trading platforms) -- while the majority continue to leave coverage to market dynamics.

1. Liability Regimes

Custodian liability for loss of client crypto-assets is governed by four principal models globally. The choice of liability model has direct consequences for investor protection, market entry barriers, and the insurability of custodial risk. Several jurisdictions blend models -- for example, MiCA member states overlay strict statutory liability on a national civil-law base, and most common law jurisdictions add statutory duties on top of negligence.

1.1 Model A: Strict Liability / No-Fault (MiCA)

Legal Basis: Markets in Crypto-Assets Regulation (MiCA), Article 75(8)

Jurisdictions:

European Union member states (27 countries), with national application illustrated here by

France,

Germany,

Liechtenstein (EEA), and

Luxembourg

Description: Under MiCA Article 75(8), a crypto-asset service provider (CASP) providing custody services is liable to its clients for the loss of crypto-assets or of the means of access to the crypto-assets. This liability arises irrespective of fault or negligence -- a strict liability standard. The custodian is liable for loss "up to the market value of the crypto-asset lost, at the time the loss occurred" (Article 75(8) MiCAR). Critically, this statutory liability cannot be excluded or limited by contractual terms, overriding the prior industry practice of capping liability at total fees charged to clients. Delegation to a sub-custodian does not transfer the liability -- it remains with the authorising CASP.

National application nuance: The strictness of the standard is articulated somewhat differently across member states.

Germany (BaFin) and several commentators characterise Article 75(8) as attributability-based rather than purely no-fault, with a carve-out for DLT-inherent failures outside the CASP's control;

France overlays MiCA on a pre-existing French civil-law DASP liability regime;

Liechtenstein applies MiCAR Article 75 alongside its TVTG civil-liability provisions; and

Luxembourg applies Article 75(8) directly with no national overlay identified.

Limitations: Liability is restricted to situations "attributable to, and under the control of" the CASP. This means force majeure events or losses caused entirely by blockchain protocol failures without custodian involvement may fall outside the scope. However, the burden of proof rests with the custodian to demonstrate the loss was outside its control.

Implications:

• Provides the strongest investor protection signal of any current framework
• Creates predictable liability exposure, facilitating insurance pricing
• May increase operational costs, as custodians must price in full-value liability
• Effectively prohibits contractual liability caps that were common in pre-MiCA custody agreements

Enforcement: MiCA entered full application on 30 December 2024 for CASPs. A grandfathering period of up to 18 months (until 1 July 2026 maximum, depending on member state) allows existing providers to transition. National competent authorities (NCAs) in each member state are responsible for enforcement, with the European Securities and Markets Authority (ESMA) coordinating supervisory convergence.

Source: MiCA Regulation Guide 2026 - ComplyFactor; White & Case - MiCA Regulation; Oxford Academic - Capital Markets Law Journal

1.2 Model B: Negligence-Based Liability

Legal Basis: Common law tort of negligence; statutory duty of care obligations

Jurisdictions: United States (federal and state level), Australia, Canada, Hong Kong (current regime), Singapore (supplemented by statutory requirements); offshore common-law centres such as the Cayman Islands, Bermuda, and Gibraltar layer statutory and contractual duties over a common-law base

Description: Under negligence-based regimes, a custodian is liable for loss of client assets only where the custodian failed to exercise reasonable care. The client bears the burden of proving (1) a duty of care existed, (2) the custodian breached that duty, (3) the breach caused the loss, and (4) quantifiable damages resulted. In the

United States, this is supplemented by state-level fiduciary obligations for trust companies (e.g., New York Banking Law for entities like Coinbase Custody Trust Company) and federal guidance for qualified custodians, including the SEC's 30 September 2025 no-action letter permitting state trust companies to act as qualified custodians.

Implications:

• Lower baseline protection for investors than strict liability
• Creates uncertainty about outcomes in litigation, particularly for novel loss scenarios (e.g., validator slashing, bridge exploits)
• Custodians may contractually limit liability further, subject to unconscionability doctrine
• In practice, the standard of care expected is evolving as regulatory guidance develops

Country-Specific Notes:

United States: Liability is primarily contractual (custody agreements) plus state law, with the SEC's 30 September 2025 no-action conditions and NYDFS guidance establishing a baseline -- no unauthorized use, rehypothecation, or pledging of client assets, and preservation of the client's beneficial interest through insolvency. State trust company charters (e.g., Wyoming SPDI, New York limited-purpose trust charter) impose higher fiduciary duties. Note the post-2025 federal shift: SAB 121 was rescinded by SAB 122 (see Section 2.2).

Canada: Canadian crypto trading platforms (CTPs) remain liable for losses from custodial failures -- unauthorized access, theft, loss of private keys -- regardless of any outsourcing to acceptable third-party custodians. CIRO's four-tier custody framework (effective 3 February 2026) imposes graduated obligations.

Australia: The Corporations Amendment (Digital Assets Framework) Act 2026 (Royal Assent 8 April 2026, commences 9 April 2027) requires Digital Asset Platform (DAP) and Tokenised Custody Platform (TCP) operators to hold an Australian Financial Services Licence (AFSL). Liability is grounded in ASIC Act consumer protections (misleading/deceptive and unconscionable conduct), trustee/fiduciary duties, design-and-distribution and product-intervention powers, and breach reporting.

Singapore: MAS requires licensed DPT service providers under the Payment Services Act 2019 to segregate customer assets and hold them on trust, with 90% in cold storage. While this creates statutory obligations, the underlying liability for breach remains negligence-based under Singapore law; providers must disclose in writing their processes for handling losses from fraud or negligence, and are prohibited from lending, staking, or pledging retail customer assets.

Cayman Islands, Bermuda, Gibraltar (offshore common law): In each, regulatory responsibility for client assets remains with the licensed/authorised provider even where functions are outsourced, with the custody agreement allocating operational, key-compromise, and cyber liability. The

Cayman Islands Market Conduct RSOG (February 2026) layers conduct-of-business duties;

Bermuda's Digital Asset Business Act keeps responsibility for outsourced custody with the licensee; and Gibraltar's DLT framework keeps accountability with the authorised DLT Provider under its outsourcing guidance.

Source: SEC - State Trust Company Qualified Custodian No-Action Letter; ASIC INFO 225 - Gilbert + Tobin; MAS - Digital Token Service Providers

1.3 Model C: Trust-Based Fiduciary Duty

Legal Basis: English trust law; FCA proposed custody rules (CP25/14, May 2025)

Jurisdictions:

United Kingdom (proposed, expected to take effect 25 October 2027). Trust-based structural protection also features in

Japan (customer fiat held in trust),

Hong Kong (assets held on trust),

Singapore (statutory trust under the PSA), and the

Australian DAF Act 2026 ("on trust for or on behalf of" clients).

Description: The UK Financial Conduct Authority (FCA) has proposed that crypto-asset custodians must hold client assets on statutory trust. Under this model, the custodian acts as trustee and owes fiduciary duties to the client as beneficiary. These duties include: (1) the duty of loyalty -- acting in the client's best interest; (2) the duty not to profit from the trust; (3) the duty to preserve trust assets; and (4) the duty of prudent investment and safekeeping. The FCA's consultation paper CP25/14 (published 28 May 2025) explicitly requires segregation, accurate record-keeping, and governance controls. The FCA imposes a continuous obligation to hold the correct cryptoassets for clients, an SM&CR duty of responsibility on senior managers, and retains firm-level responsibility even where technical aspects are outsourced.

For stablecoin issuance, the FCA further mandates that all backing assets be held on trust for coin holders, with the issuer acting as trustee with fiduciary duties, and reserves segregated from the issuer's own funds. An independent, unaffiliated third-party custodian must hold reserve assets.

Implications:

• Fiduciary duties are among the highest obligations in common law, exceeding mere negligence standards
• Trust law provides proprietary (in rem) protection -- assets held on trust do not form part of the custodian's estate in insolvency, offering bankruptcy remoteness
• Creates a well-understood legal framework with centuries of case law precedent
• May impose higher compliance costs due to trust administration requirements

Timeline: Final FCA rules expected in 2026, with the regime going live on 25 October 2027 with a transition period for existing firms.

Source: Ashurst - FCA New Rules for Stablecoins and Custody; Skadden - FCA Consultation Paper; Sidley Austin - UK Cryptoasset Regulation Action Points

1.4 Model D: Contractual Liability (Limited by Terms)

Legal Basis: Freedom of contract; commercial terms of service

Jurisdictions: Historically dominant in unregulated or lightly regulated markets; still relevant where statutory regimes are absent or in transition, and now substantially constrained by the segregation, conduct, and liability rules emerging across all 20 jurisdictions surveyed

Description: Under this model, custodian liability is defined and limited primarily by the terms of the custody agreement. Prior to MiCA and similar regulations, most crypto custodians limited their liability to the total fees paid by the client -- often a fraction of the value of assets under custody. Some agreements excluded liability for losses arising from hacking, protocol failures, or force majeure events entirely.

Implications:

• Provides minimal investor protection
• Creates information asymmetry -- retail and even institutional clients may not fully understand the scope of liability exclusions
• Enables custodians to operate with minimal capital reserves and no insurance
• The FTX collapse demonstrated the catastrophic failure mode: FTX's terms of service purported to segregate customer assets, but these contractual assurances proved unenforceable when assets were commingled in practice

Trend: This model is declining as jurisdictions implement prescriptive custody regulations. MiCA explicitly overrides contractual liability caps. The UK, Hong Kong, Australia, Canada, Brazil, South Korea, and the offshore centres (Cayman, Bermuda, Gibraltar) are all moving toward statutory duty or trust frameworks that supersede pure contractual arrangements. In

Brazil, custody may be outsourced but responsibility cannot be delegated -- the SPSAV remains fully accountable, with criminal liability for fraudulent portfolio management under Law 14,478.

Source: Womble Bond Dickinson - FTX Considerations; CoinDesk - NYDFS Crypto Insolvency Guidance

2. Insurance Requirements

2.1 Jurisdictions with Mandatory Insurance (or Insurance-or-Equivalent Backstop)

Of the 20 jurisdictions surveyed, a minority impose a mandatory insurance requirement -- and several of those permit an own-funds, reserve, surety-bond, or compensation-scheme alternative in place of, or alongside, insurance. This remains a significant gap in the global regulatory framework, but the trend since 2024-2025 has been toward mandatory backstops.

2.1.1 Bahrain (Central Bank of Bahrain)

The Central Bank of Bahrain (CBB) Crypto-Asset Module (Rulebook Volume 6) requires licensed crypto-asset service providers to maintain:

• Professional indemnity insurance at a minimum of BHD 100,000 (approximately USD 265,000), arranged with an insurance firm approved by the CBB
• Cybersecurity insurance covering cyber risks and data breaches -- an explicit requirement added to address emerging digital asset risks
• Keyman insurance to ensure adequate management of operational continuity risks

Licensees bear direct responsibility for the safekeeping of client crypto-assets, with an ongoing obligation to maintain adequate capital and insurance commensurate with scale and risk. These requirements apply to all entities providing custody services under the CBB's licensing framework, which was originally introduced in February 2019 and has been amended in 2023 and 2025. Bahrain is the only surveyed jurisdiction prescribing a hard numeric insurance floor.

Source: CBB - Final Rules on Crypto-Asset Services; Al Tamimi - CBB Crypto-Asset Regulations

2.1.2 UAE (VARA and ADGM)

In the

UAE, the Virtual Assets Regulatory Authority (VARA) in Dubai does not prescribe a specific insurance amount but mandates that custodians be "qualified custodians" providing "insured vault services," alongside proof-of-reserves, audit trails, and risk management. The Abu Dhabi Global Market (ADGM) requires appropriate professional indemnity insurance or equivalent. Custodians under both VARA and ADGM bear fiduciary-like responsibility for client assets, and failure to maintain controls, segregation, or capital can result in enforcement, suspension, or licence revocation. VARA's Custody Services Rulebook was finalized in March 2025.

Source: ComplyFactor - UAE Crypto Regulation 2025; Hacken - UAE Crypto Regulation

2.1.3 Cayman Islands (CIMA)

The

Cayman Islands made insurance mandatory under its February 2026 Market Conduct framework (the Market Conduct Rule and Statement of Guidance, MC-RSOG). Insurance coverage is required, with alternative risk-mitigation measures permitted only where insurance is unavailable. Required coverage spans professional liability, theft or loss of client assets, business interruption, and cybersecurity; client fiat must be protected via a CIMA-regulated bank or a bank in a non-high-risk jurisdiction. This addition signalled a shift toward conduct-of-business supervision for custodians and trading platforms, which were moved from registration to full licensing under Phase Two (1 April 2025).

Source: CIMA - VASP Framework; Cayman Islands Monetary Authority - Market Conduct RSOG (Feb 2026)

2.1.4 Bermuda (BMA)

Bermuda imposes a statutory financial backstop under the Digital Asset Business Act 2018 (DABA), section 18(1): a licensee holding client assets must maintain a surety bond, trust account, OR indemnity insurance for the benefit of clients, in a form and amount acceptable to the Bermuda Monetary Authority (BMA). This is a true mandatory requirement, though it permits non-insurance alternatives. The form and amount are set case-by-case by the BMA (no fixed minimum is published), and the Digital Asset Custody Code of Practice (Feb 2024, paragraph 2.5) requires demonstrating appropriate insurance or financial protections; applicant-stage E&O/PI, D&O, and crime insurance are expected. Section 18(4) further excludes custodied client assets from the claims of the licensee's creditors -- a statutory bankruptcy-remoteness provision rare among the surveyed jurisdictions.

Source: BMA - Digital Asset Business Act 2018; Bermuda Digital Asset Custody Code of Practice (Feb 2024)

2.1.5 South Korea (FSC)

South Korea mandates that VASPs maintain insurance or compensation reserves covering losses from hacking, operational failures, or theft attributable to the VASP's own negligence or system failures. Minimum coverage amounts are set by FSC regulation calibrated to size and risk (no specific numeric public floor located), and bank deposit insurance adds protection for KRW deposits. Where loss events fall outside insurance, financial reserves must be available to compensate customers.

Source: FSC Korea - Virtual Asset User Protection Act; Global Legal Insights - South Korea

2.1.6 European Union (MiCA)

Unlike most jurisdictions, MiCA makes insurance against liability risks a mandatory element of the prudential safeguard for custody CASPs -- crypto custodians must obtain insurance against liability risks to clients, covering loss of clients' crypto-assets or means of access, adequate to cover potential liability exposure. Critically, MiCAR (Article 67) permits a professional indemnity insurance OR equivalent own-funds route -- a hybrid that several member states implement directly.

France requires licensed DASPs to maintain at all times either professional liability insurance or adequate own funds (with PI insurance per Article 721-5 of the AMF General Regulation covering system failures, gross negligence, client-fund protection, and cybersecurity breaches).

Germany has no KWG-specific PI-insurance requirement for crypto custody, but under MiCA, custody CASPs must hold PI insurance or equivalent own funds.

Luxembourg treats Article 67(4) insurance as one permitted route to the prudential floor (the policy, if used, must cover the EU territories served, be written by a third-party EU-authorised insurer, run an initial term of at least one year with at least 90-day cancellation notice, and cover the listed risk categories including Article 75(8) liability).

Liechtenstein mandates no statutory minimum sum and allows insurance or guarantee as a prudential-safeguard alternative under MiCAR.

Source: MiCA Regulation Guide 2026 - ComplyFactor; White & Case - MiCA Regulation

2.1.7 Hong Kong (Trading Platforms; Custody Proposed)

Hong Kong's licensed VA trading platforms (VATPs) already face mandatory insurance/compensation requirements: arrangements must cover 50% of client VA held in cold storage and 100% of client VA held in hot or other storage, satisfiable through third-party insurance, demand/time deposits (up to six months), or bank guarantees, with daily monitoring of total client VA value. The proposed standalone custody regime (consultation conclusions published 24 December 2025) requires suitable insurance arrangements, with specific ratios not yet finalised, to align with the VATP regime under the "same activity, same risks, same regulation" principle. Legislation is targeted for 2026.

Source: CoinDesk - Hong Kong 2026 Legislation; Gibson Dunn - Hong Kong Consultation Conclusions

2.2 Jurisdictions Without Mandatory Insurance (Market-Driven)

The remaining jurisdictions -- including the United States, United Kingdom, Switzerland, Japan, Singapore, Australia, Canada, Brazil, and Gibraltar -- do not mandate specific custody insurance. Instead, insurance is left to market dynamics and competitive differentiation, though several impose a liability standard or reserve requirement that functions as a partial substitute.

Key observations:

• United States: No federal mandate for crypto custody insurance, and FDIC deposit insurance does not cover crypto. Coverage is determined by market practice -- crime and specie insurance via the Lloyd's market (e.g., Crypto.com USD 120M, BitGo USD 100M, Coinbase USD 255M crime policy, Bitstamp USD 300M). Correction of prior US position: the SEC's SAB 121 -- which had required custodians to record custodied crypto as an on-balance-sheet liability -- was rescinded by SAB 122 (issued 23 January 2025, effective 30 January 2025), removing the associated capital charges; banks now apply ASC 450-20. Federal qualified-custodian access was broadened by the SEC's 30 September 2025 no-action letter permitting state trust companies to act as qualified custodians.

• EU / MiCA: MiCA imposes strict liability (Article 75(8)) and -- unlike the prior version of this analysis -- a mandatory liability-risk insurance (or equivalent own-funds) requirement for custody CASPs (see Section 2.1.6). CASPs must also hold minimum capital (see Capital Requirements) and demonstrate organizational resilience.

• Switzerland:

  Switzerland's FINMA Guidance 01/2026 (published 12 January 2026) addresses custody risks extensively and requires segregation under Article 16 No. 1bis and Article 37d of the Banking Act. There is no specific mandatory insurance regime analogous to deposit insurance; insurance intermediaries must hold PI insurance or equivalent surety, and institutional-grade custodians maintain coverage as a market expectation. Swiss banks benefit from bankruptcy-remote segregation of crypto-assets in custody (reducing but not eliminating the need for insurance), and the esisuisse deposit-protection scheme (CHF 100,000) does not cover segregated crypto custody assets.

• Japan: The JFSA requires 95% cold storage, customer fiat held in trust, hot-wallet exposure fully backed by the operator's own crypto (Redemption Guarantee Crypto Assets), and statutory preferential repayment rights for customers in insolvency. There is no mandatory blanket insurance currently; the November 2025 reform proposes mandatory reserve-fund accumulation OR equivalent insurance for unauthorized-outflow losses (including cold-wallet value), with legislation expected in 2026. The Coincheck precedent (self-compensation of ~JPY 46.3 billion) illustrates operator liability for hot-wallet losses.

• Singapore: MAS requires segregation and trust holding under the Payment Services Act, with 90% cold storage guidelines, but does not mandate insurance. Providers must disclose in writing their processes for handling losses from fraud or negligence.

• United Kingdom: Custody insurance is not currently mandated; the FCA is considering whether to require it, with final rules not yet published. The regime relies on trust-based ring-fencing, prudential capital, and operational resilience, and FSCS coverage for crypto custody is not confirmed.

• Australia: No standalone mandatory insurance under current law; standard AFSL professional indemnity insurance or compensation arrangements apply to DAP/TCP operators.

• Canada: No fixed insurance mandate, but CSA Staff Notice 81-336 requires custodians of public crypto funds to maintain insurance "that a reasonably prudent person would maintain," with CIRO's higher custodian tiers requiring more comprehensive coverage. The market expectation is commercial crime/fidelity, professional liability, and technology E&O coverage.

• Brazil: Specific insurance requirements for SPSAVs under the BCB framework are NOT VERIFIED in publicly available sources; the resolutions emphasize cybersecurity and operational resilience rather than prescribing insurance.

• Gibraltar: Gibraltar expects professional indemnity insurance under Principle 3 of its DLT framework, with adequacy determined case-by-case and no fixed mandatory minimum coverage figure (a mandatory minimum amount is NOT VERIFIED). No deposit-insurance-style scheme covers custodied virtual assets (the Gibraltar Deposit Guarantee Scheme does not apply to them).

Source: FINMA Guidance 01/2026; PwC - FINMA Crypto Custody; CoinDesk - Japan FSA Liability Reserves; Global Legal Insights - Japan

2.3 The Insurance Market for Crypto Custody

2.3.1 Key Providers and Brokers

The commercial insurance market for digital asset custody has matured significantly since 2019 but remains capacity-constrained relative to total industry assets under custody. The principal market participants include:

Brokers:

Underwriters and Insurers:

Source: Marsh - Global Facility Launch; Crypto.com - USD 120M Coverage; Evertas; Munich Re - Crypto Cover; Canopius - Cryptocurrency Insurance

2.3.2 Coverage Types

Crypto custody insurance is typically structured across three principal coverage categories:

1. Commercial Crime Insurance

• Covers losses from theft (internal and external), hacking, fraudulent transfer, social engineering attacks
• Typically covers assets in hot wallets and warm wallets
• Example: Coinbase maintains a USD 320M commercial crime policy (per-incident and aggregate) covering hot wallet theft, cybersecurity breaches, and fraudulent transfers across Prime Trading and Vault services
• Does NOT cover unauthorized access to individual user accounts due to user credential compromise

2. Specie / Cold Storage Insurance

• Covers physical loss, theft, or destruction of private key material stored offline
• Analogous to traditional specie insurance for precious metals or bearer instruments
• Example: Crypto.com holds USD 100M in cold storage specie coverage through Lloyd's underwriters, covering physical loss, theft, and damage
• Example: BitGo maintains up to USD 250M in insurance for assets in qualified custody cold storage through Lloyd's syndicates, with an additional USD 600M in excess coverage available to customers on a loss-payee basis

3. Errors and Omissions (E&O) / Professional Indemnity

• Covers claims arising from professional negligence, operational errors, or failure to follow procedures
• Increasingly important under strict liability regimes (MiCA) where custodians face liability regardless of fault, and under the MiCAR Article 67 PI-insurance-or-own-funds route (France, Germany, Luxembourg, Liechtenstein)
• Often combined with Directors and Officers (D&O) coverage for management liability

Source: Coinbase - Insurance; CCN - Coinbase USD 255M Program; BitGo - Insurance FAQs; Anderson Kill - BitGo USD 700M Program

2.3.3 Typical Coverage Amounts

Coverage amounts vary dramatically based on custodian size, assets under custody (AUC), and risk profile:

Industry benchmark: Major institutional custodians typically carry between USD 75M and USD 320M in primary coverage, with excess layers available for larger programs. The total insurable market capacity is estimated at USD 1-2 billion aggregate, which remains a fraction of the estimated USD 200+ billion in institutional crypto AUC globally.

Source: Insurance Business - Marsh Facility; Risk & Insurance - Crypto Insurance Gap

2.3.4 Coverage Gaps: What Is NOT Covered

A critical issue for policymakers is understanding the significant gaps in available crypto custody insurance:

These gaps are particularly significant because several of the largest crypto losses in history -- including the Wormhole bridge exploit (USD 320M), the Ronin bridge hack (USD 625M), and various DeFi protocol failures -- would fall outside standard custody insurance coverage.

Source: BitGo - Importance of Crypto Custody Insurance; Relm Insurance - Crypto Asset Insurance; Founders Shield - Crypto Exclusions

2.3.5 Self-Insurance and Captive Models

Given the capacity constraints and coverage gaps in the commercial market, several approaches to self-insurance have emerged. These are increasingly recognised in regulation: MiCA permits an own-funds reserve as an alternative to insurance, Bermuda permits a surety bond or trust account in place of indemnity insurance, South Korea permits compensation reserves, and Japan's proposed reform contemplates a reserve fund or equivalent insurance.

Captive Insurance: Some larger crypto firms are establishing captive insurance vehicles in favorable domiciles. Vermont, the leading US domicile for captive insurance, has explicitly encouraged crypto businesses through its insurance regulatory sandbox (deployed 2020) and empowered its insurance regulator to explore blockchain-based insurance solutions. Captive structures allow firms to retain and manage risk internally while accessing reinsurance markets for catastrophic layers.

Reserve Funds: Major exchanges maintain substantial reserve funds as a form of self-insurance. These are typically disclosed as part of proof-of-reserve attestations but lack the regulatory protections of formal insurance products. In Japan, hot-wallet exposure is fully backed by the operator's own crypto (Redemption Guarantee Crypto Assets), a regulatory variant of the reserve-fund model.

Layered Approach: Best practice emerging in the market combines captive or self-insurance for the first layer (retained risk) with commercial insurance for excess layers. This approach manages cost while providing meaningful protection for large-loss scenarios.

Market Growth: The crypto insurance market is forecast to grow at a CAGR of approximately 18% between 2025 and 2033, reflecting increasing institutional demand and regulatory pressure. Despite this, fewer than one in five cryptocurrency holders currently have insurance coverage, and overall capacity continues to lag behind total market capitalization.

Source: Relm Insurance - Crypto Asset Insurance; Risk & Insurance - USD 3.31 Trillion Market Opportunity

3. Comparative Table: Liability and Insurance by Jurisdiction

Key Finding: No jurisdiction among the 20 surveyed applies deposit guarantee or deposit insurance protections to crypto-assets. The FDIC in the

United States has explicitly stated that crypto-assets, including stablecoins, do not qualify for federal deposit insurance, even under the GENIUS Act (enacted 18 July 2025) which requires 1:1 reserve backing but provides no government guarantee. European schemes follow suit -- the EU's Deposit Guarantee Schemes, Switzerland's esisuisse (CHF 100,000), Liechtenstein's EAS (CHF 100,000), and Gibraltar's Deposit Guarantee Scheme all exclude custodied crypto, with protection instead running through statutory segregation.

Source: FDIC - Advisory on Deposit Insurance and Crypto; CCN - FDIC Stablecoins GENIUS Act; FDIC - Crypto-Related Activities Clarification

4. What Works and What Does Not Work

4.1 What Works

MiCA Strict Liability Plus Mandatory Insurance (Strong Investor Protection Signal)

The EU's approach under MiCA Article 75(8) -- now paired with a mandatory liability-risk insurance (or equivalent own-funds) requirement -- provides several clear benefits:

• Clarity: Custodians and their clients know in advance that the custodian bears liability for loss, eliminating ambiguity about fault allocation
• Incentive alignment: Strict liability creates direct economic incentives for custodians to invest in security, Key Management, and operational resilience
• Insurance market development: Predictable liability exposure facilitates insurance underwriting and pricing, potentially expanding market capacity over time
• Investor confidence: Institutional allocators, particularly pension funds and sovereign wealth funds, require clear liability frameworks before committing to crypto custody arrangements
• Backstop closes the gap: Unlike a strict-liability-only regime, MiCA's insurance-or-own-funds mandate addresses the risk that a liable custodian lacks the resources to satisfy a claim

Limitation: The PI-insurance-or-own-funds option means some CASPs may rely on internal reserves rather than transferring risk to an insurer; capital requirements under MiCA (see Capital Requirements) provide a partial backstop, but may be inadequate for catastrophic loss scenarios.

Trust-Based and Statutory Segregation (UK, Switzerland, Japan, Bermuda)

Jurisdictions that require assets to be held on trust or in segregated accounts with bankruptcy remoteness provide strong structural protection.

Switzerland's approach under Articles 16 and 37d of the Banking Act, where segregated crypto-assets do not form part of the custodian's insolvency estate, effectively eliminates the primary FTX-style risk without requiring insurance.

Bermuda goes further with a codified statutory creditor-exclusion (DABA s.18(4)) plus a mandatory financial backstop (s.18(1)) and a pari-passu insolvency waterfall.

Japan's statutory preferential repayment rights produced relatively quick recovery for FTX-affiliate customers. The UK's proposed trust model builds on centuries of trust law jurisprudence, providing legal certainty.

Mandatory Insurance Minimums and Backstops (Bahrain, UAE, Cayman, South Korea)

Bahrain demonstrates that a hard numeric insurance minimum (BHD 100,000 PI plus cyber and keyman cover) is implementable and establishes a clear regulatory floor. The

UAE (VARA insured vault services; ADGM PI or equivalent),

Cayman Islands (MC-RSOG, with alternatives only where insurance is unavailable), and

South Korea (insurance or compensation reserves) show that even where no fixed figure is published, a mandatory insurance-or-equivalent backstop signals to the market that risk transfer is a necessary component of custodial operations, not an optional differentiator.

4.2 What Does Not Work

No Insurance Mandate + No Segregation (The FTX Scenario)

The FTX collapse represents the catastrophic failure mode of inadequate insurance and liability frameworks:

• FTX US carried only USD 7.5 million in crime insurance (arranged by Aon) for hot/warm wallets, while managing billions in customer assets
• Cold storage was delegated to BitGo with reliance on BitGo's insurance
• Customer assets were commingled with the firm's own assets and with Alameda Research despite purported segregation in terms of service
• The CFTC noted that "basic regulatory tools -- governance, customer protections, and surveillance that exist to identify misconduct and prevent collapse -- were simply not there"
• The resulting USD 12.7 billion CFTC judgment against FTX and Alameda underscores the scale of harm

Lesson: Contractual assurances of segregation are worthless without regulatory verification, audit requirements, and meaningful insurance or liability backstops. The combination of (a) no mandatory insurance, (b) no verified segregation, and (c) contractual liability limitation creates a systemic vulnerability. Several jurisdictions added since -- notably Japan's quick FTX-affiliate recovery via statutory preference rights, and Cayman's post-Phase-Two conduct framework -- illustrate the corrective direction.

Source: CFTC - USD 12.7 Billion Judgment; Insurance Journal - FTX Considerations

Contractual Liability Caps Without Regulatory Override

Pre-MiCA, many custody agreements limited liability to total fees charged. For a custodian charging 50 basis points annually on USD 100 million AUC, this would cap liability at USD 500,000 -- less than 0.5% of client assets. This arrangement systematically transferred risk to clients without adequate disclosure. MiCA's override of such caps, the UK's continuous-holding obligation, Canada's non-delegable liability for custodial failures, and Brazil's non-delegable accountability are all necessary corrections.

4.3 Mixed: High Insurance Requirements

High mandatory insurance requirements (such as the UAE's insured-vault expectation or comprehensive AUC-linked benchmarks) present a genuine policy trade-off:

Benefits:

• Meaningful protection for clients in loss scenarios
• Filters out undercapitalized or unserious market entrants
• Aligns custodian incentives with risk management

Risks:

• Creates significant barriers to entry, potentially concentrating the market among a small number of incumbents
• Insurance premiums for crypto custody remain high (estimated 1-5% of coverage limits annually, depending on risk profile and coverage type), making high coverage requirements expensive
• May incentivize regulatory arbitrage toward jurisdictions with lower requirements -- and the spread in this survey, from Bahrain's hard BHD 100,000 floor to the many case-by-case or NOT VERIFIED regimes, gives firms that latitude
• The insurance market may lack capacity to serve all custodians at required levels, particularly in emerging markets; this is precisely why MiCA, Bermuda, South Korea, and Japan's proposed reform all permit own-funds, surety, reserve, or guarantee alternatives

5. Recommended Framework: Tiered Insurance and Liability

Based on comparative analysis, the following tiered framework balances investor protection with market accessibility. This framework should be implemented in conjunction with Asset Segregation requirements and Capital Requirements.

5.1 Tier 1: Minimum (All Licensed Custodians)

Applicable to: All entities holding crypto-assets on behalf of third parties under any licensing regime (see Licensing Frameworks)

5.2 Tier 2: Standard (Custodians Holding > USD 100M AUC)

Applicable to: Custodians exceeding USD 100 million in assets under custody

5.3 Tier 3: Enhanced (Systemic Custodians > USD 5B AUC)

Applicable to: Custodians designated as systemically important or exceeding USD 5 billion in AUC

5.4 Implementation Considerations

Phased Implementation: Jurisdictions should allow a 24-month transition period for Tier 1 requirements, 36 months for Tier 2, and 48 months for Tier 3, aligned with Licensing Frameworks transition timelines.

Market Capacity: Regulators should monitor insurance market capacity and adjust minimum thresholds if market capacity proves insufficient. A standing working group with insurance industry representatives (Lloyd's, IUA, NAIC) is recommended.

Equivalence: Cross-border custodians should benefit from mutual recognition of insurance arrangements meeting equivalent standards, reducing duplicative coverage requirements. This is particularly important given the global nature of crypto custody operations and the prevalence of offshore custody hubs (Cayman, Bermuda, Gibraltar) serving clients in onshore markets.

Proportionality: Requirements should be proportionate to AUC, with annual reassessment. Custodians whose AUC grows beyond a tier threshold should have 12 months to comply with the higher tier's requirements.

6. Decision Matrix

The following matrix assists policymakers in selecting the appropriate combination of liability model and insurance requirements based on their jurisdiction's priorities and market conditions.

6.1 Liability Model Selection

6.2 Insurance Mandate Selection

6.3 Combined Framework Decision Tree

START: Does the jurisdiction have a developed insurance market for digital assets?
|
|-- YES --> Is the custodial sector concentrated (>50% AUC in <3 firms)?
|    |
|    |-- YES --> Tier 3 requirements for systemically important custodians
|    |           + Tier 2 for standard custodians
|    |           + Strict liability model
|    |
|    |-- NO  --> Tier 2 requirements for custodians >USD 100M AUC
|                + Tier 1 for all others
|                + Strict liability or trust-based model
|
|-- NO  --> Is the jurisdiction seeking to attract crypto custody business?
     |
     |-- YES --> Tier 1 minimum requirements for all custodians
     |           + Disclosure-based approach for higher tiers
     |           + Negligence + statutory minimums model
     |           + Insurance market development incentives
     |
     |-- NO  --> Tier 1 requirements with mandatory PI + crime insurance
                 + Strict liability or trust-based model
                 + Consider bilateral recognition agreements with mature markets

6.4 Key Policy Recommendations Summary

1. Adopt strict liability or trust-based fiduciary duty as the minimum liability standard. Contractual liability caps for client asset losses should be prohibited.

2. Mandate minimum insurance at Tier 1 level for all licensed custodians, permitting a MiCAR/Bermuda-style own-funds, reserve, or surety alternative where the insurance market lacks capacity. Professional indemnity and commercial crime insurance (or their funded equivalents) should be non-negotiable.

3. Scale requirements proportionally using AUC-based thresholds. Systemic custodians require enhanced coverage, stress testing, and resolution integration.

4. Require public disclosure of insurance coverage types, limits, and material exclusions. Institutional and retail clients should be able to assess custodian resilience.

5. Mandate Asset Segregation as a complement to insurance -- not a substitute. Insurance addresses residual risk after segregation; it cannot replace structural protections.

6. Engage with the insurance industry to develop standardized policy wordings, expand capacity, and address coverage gaps (smart contract risk, protocol failures, DLT-inherent failures). A regulatory sandbox for parametric or DeFi-native insurance products may be warranted.

7. Clarify that deposit guarantee schemes do not apply to crypto-assets. Regulators should proactively communicate this to avoid consumer confusion, as the FDIC has done in the United States and as the EU, Switzerland, Liechtenstein, and Gibraltar schemes confirm by exclusion.

8. Coordinate internationally through bodies such as IOSCO, the FSB, and the Basel Committee to develop minimum insurance standards that facilitate cross-border custodial operations and mutual recognition -- especially relevant given the role of offshore hubs (Cayman, Bermuda, Gibraltar) serving onshore institutional clients.

Verification Notes

All factual claims in this document mirror the canonical per-jurisdiction fact matrix (crypto-custody-fact-matrix.json) covering all 20 jurisdictions, last reconciled 4 June 2026. Underlying claims were originally verified through web searches; aggregate "X of 20" statements are derivations from the matrix. "NOT VERIFIED" is reflected honestly where the matrix records no public source.

Note on Coinbase Coverage: Earlier reports cited USD 255M (2019), while more recent sources reference USD 320M. The fact matrix records the USD 255M crime policy as a historical market example; the USD 320M figure represents the current (2025) policy limit per Coinbase's own insurance page. Both figures are cited with their respective time contexts.

Note on BitGo Coverage: The USD 700M total figure (USD 100M base + USD 600M excess) was announced in 2021; the matrix records BitGo's US market example at USD 100M, while current qualified custody coverage is stated as "up to USD 250M" on BitGo's website. The discrepancy may reflect restructuring of the program or changes in available capacity. Both figures are cited with their respective time contexts.

Note on Gibraltar region mapping: The fact matrix tags Gibraltar under "Middle East & Africa," but its regulatory profile and content file sit under the canonical europe region; wikilinks therefore use the europe/gibraltar path.