Key Management & Security Standards

Private key management is the foundational security challenge of crypto asset custody. Unlike traditional financial instruments -- where ownership is recorded in centralized ledgers operated by regulated intermediaries -- crypto assets are controlled by whoever possesses the corresponding private keys. Loss, theft, or compromise of private keys results in irreversible loss of assets. This technical reality has driven jurisdictions worldwide to develop regulatory frameworks governing how custodians generate, store, use, back up, and recover cryptographic key material.

This section surveys the global regulatory landscape for key management across 20 jurisdictions, compares technology standards, evaluates industry frameworks, assesses what has worked and what has not, and proposes a tiered framework for policymakers.

The 20 jurisdictions surveyed are: in the Americas,

United States,

Brazil,

Canada,

Bermuda, and

Cayman Islands; in Asia-Pacific,

Japan,

Hong Kong,

Singapore,

South Korea, and

Australia; in Europe, the

European Union,

France,

Germany,

Switzerland, the

United Kingdom,

Liechtenstein, and

Luxembourg; and in the Middle East & Africa grouping, Gibraltar,

Bahrain, and the

UAE.

1. Global Landscape: How Jurisdictions Regulate Key Management

Regulatory approaches to key management fall into four broad models. Each reflects a different philosophy about whether regulators should prescribe specific technical implementations or define outcomes and let institutions choose their own methods. Of the 20 jurisdictions surveyed, 7 impose a prescriptive numeric cold-storage ratio (Japan, Hong Kong, Singapore, South Korea, Bahrain, Canada, and Germany -- the last as a secondary-source/market expectation rather than a codified rule), while the remaining 13 use outcome-based, technology-neutral, or self-regulatory models.

Model A: Prescriptive Cold Storage Mandates

Under this model, regulators specify a minimum percentage of customer assets that must be held in cold storage -- systems that are not connected to the internet or any other form of wireless communication. This approach provides clarity and enforceability but may constrain operational flexibility and innovation.

Japan -- 95% Cold Storage

Legal basis: Payment Services Act (PSA, since April 2017), as amended following the Coincheck hack (January 2018); Cabinet Office Ordinance on Crypto Asset Exchange Service Providers. Financial Services Agency (FSA) regulatory framework. A proposed full migration to the Financial Instruments and Exchange Act (FIEA) was approved as a Cabinet bill on 10 April 2026 (effective ~fiscal 2027 if enacted).

Requirements:

• Crypto asset exchange service providers (CAESPs) must keep at least 95% of customers' crypto assets in cold (offline) wallets -- systems not connected to the internet or any form of wireless communication. This is among the highest mandatory cold storage ratios of any major jurisdiction.
• For the remaining assets held in hot wallets (up to 5%), the operator must back every unit of hot-wallet exposure 100% with its own crypto assets ("Redemption Guarantee Crypto Assets") held in cold wallets.
• Robust key management is required (secure generation, storage, and backup); multi-signature is common practice. Mandatory black-letter technical key-management standards are NOT VERIFIED -- key management is supervised via FSA system-risk review and JVCEA rules rather than a prescribed technical standard.
• Cybersecurity / system-risk management, incident response, and vulnerability assessment are supervised via FSA inspection. The proposed FIEA reform adds new legally-mandated "safety management measures" addressing unauthorized-outflow risk.

Regulatory body: Financial Services Agency (FSA), with self-regulatory oversight from the Japan Virtual and Crypto Assets Exchange Association (JVCEA).

Sources:

• FSA Working Group report (10 December 2025; English 16 February 2026) recommending migration from PSA to FIEA
• Lexology, "Crypto Regulations in Japan 2024" (3 September 2024)
• Dzilla, "Japan's New Unified Crypto Regulatory Framework" (27 November 2025): https://dzilla.com/japans-new-unified-crypto-regulatory-framework-what-global-investors-need-to-know/
• DexSale, "Japan's Crypto Exchange Regulations" (6 April 2025): https://dexsale.com/japan-s-crypto-exchange-regulations

Singapore -- 90% Cold Storage

Legal basis: Payment Services Act 2019, Payment Services (Amendment) Act 2021 (effective 4 April 2024), Guidelines on Consumer Protection Measures by DPT Service Providers (PS-G03) (April 2024).

Requirements:

• At least 90% of customers' assets must be stored in systems not connected to the internet or any form of wireless communication (cold wallets) under PS-G03.
• Where multi-party computation (MPC) is used, key shares must be distributed among several parties so that no single party can authorize asset movements independently.
• Dual authorization required: control systems must prevent any individual from unilaterally authorizing, executing, or withdrawing customers' assets. Strict physical device access controls apply where access devices are used.
• Service providers must disclose, in writing, their storage arrangement policies, including conditions under which assets are stored outside cold wallets and mitigation measures against cyber attack risk.
• MAS Technology Risk Management (TRM) Guidelines apply for technology risk management, incident reporting, and business continuity (no specific named penetration-test mandate).

Regulatory body: Monetary Authority of Singapore (MAS).

Sources:

• Ocorian, "MAS finalises crypto segregation and custody regulations" (17 April 2024): https://compliance.ocorian.com/asia/mas-finalises-crypto-segregation-and-custody-regulations/
• FintechNews Singapore, "MAS Bolsters Crypto Payment Rules" (2 April 2024): https://fintechnews.sg/94037/digitalassets/mas-bolsters-crypto-payment-rules-heres-what-you-need-to-know/

South Korea -- 80% Cold Storage

Legal basis: Virtual Asset User Protection Act (VAUPA), enacted as Act No. 19563 on 18 July 2023, effective 19 July 2024. Supplemented by ISMS certification requirements from the Korea Internet & Security Agency (KISA).

Requirements:

• At least 80% of customer virtual assets must be stored in cold storage (offline, hardware-secured) -- per the VAUPA Enforcement Decree, calculated on monthly economic value.
• The remaining hot-wallet exposure (≤20%) must be secured with appropriate controls.
• All VASPs must hold ISMS certification from KISA, which covers access control and authentication, encryption and key management, network security, incident detection and response, and business continuity planning.
• Mandatory insurance or compensation reserves covering potential losses from hacking, operational failures, or theft.
• A standalone custody licence is only PROPOSED (FSC report to the National Assembly, 17 March 2026; second-phase Digital Asset Basic Act).

Regulatory body: Financial Services Commission (FSC), Financial Supervisory Service (FSS), Korea Financial Intelligence Unit (KoFIU); KISA for ISMS.

Sources:

• Tokenization Compliance, "South Korea Virtual Asset Regulation: VAUPA and FSC Framework" (24 February 2026): https://tokenizationcompliance.com/jurisdictions/south-korea/
• Library of Congress, "South Korea: Act to Regulate Cryptocurrency Markets Goes into Effect" (18 July 2024): https://www.loc.gov/item/global-legal-monitor/2024-07-18/south-korea-act-to-regulate-cryptocurrency-markets-goes-into-effect/

Bahrain -- 95% Cold Storage

Legal basis: Central Bank of Bahrain (CBB) Rulebook Volume 6, Crypto-Asset Module (CRA Module), first published 2019, most recent version January 2024; Stablecoin Issuance & Offering (SIO) Module (4 July 2025). Bahrain was the first MENA jurisdiction with dedicated crypto-asset regulations.

Requirements:

• A minimum 95% of each client crypto-asset must be held in cold wallets, calculated separately per asset (CRA-8.1.9).
• Mandatory multi-signature (CRA-8.1.11, CRA-8.1.13): no sole signatory may authorize a movement and no single person may fully access private key(s); collusion-mitigation controls are required.
• Chapter CRA-5: secure generation, storage, backup, and recovery of cryptographic keys; multi-factor authentication for system access; encryption and secure storage at rest; incident reporting. A Cyber Threat Intelligence subscription and a unified private email domain are required.
• Penetration testing twice per year by external independent third parties whose personnel are certified penetration testers (CRA-5.8.13G(e); 6-month interval and CBB 2-month reporting deadline in CRA-5.8.13I) -- among the most prescriptive testing cadences surveyed.

Regulatory body: Central Bank of Bahrain (CBB), single-regulator model.

Sources:

• CBB Rulebook Volume 6 Crypto-Asset Module (CRA-5, CRA-8)
• CBB Stablecoin Issuance & Offering (SIO) Module (4 July 2025)

Canada -- 80% Cold Storage with Acceptable Third-Party Custodians

Legal basis: CSA Staff Notices 21-327 / 21-332 / 81-336; National Instrument 81-102 amendments (effective 16 July 2025); CIRO Digital Asset Custody Framework (3 February 2026); OSFI Capital & Liquidity Treatment of Crypto-asset Exposures Guideline.

Requirements:

• Crypto trading platforms (CTPs) must keep at least 80% of client crypto with Acceptable Third-party Custodians (typically cold storage); the remaining ~20% may sit in hot wallets with enhanced security controls. CIRO dealer self-custody is capped at 20%.
• Crypto must be held on an offline private cryptographic key (cold wallet) except to complete a transaction (CSA SN 81-336 / NI 81-102).
• Custodians of public crypto funds must obtain at least an annual SOC 2 Type II report (12-month coverage: security, availability, processing integrity, confidentiality, privacy).
• CIRO Tier 1 and Tier 2 custodians must undergo independent external cybersecurity reviews. The four-tier CIRO model was designed in direct response to the QuadrigaCX failure.

Regulatory body: Canadian Securities Administrators (CSA, 13 provincial/territorial regulators); CIRO (SRO); OSFI (banks); FINTRAC (AML).

Sources:

• CSA Staff Notice 81-336 / NI 81-102 amendments (16 July 2025)
• CIRO Digital Asset Custody Framework (3 February 2026)

Germany -- ~95% Cold Storage (Market Expectation, Not Codified)

Legal basis: KWG Section 1(1a) sentence 2 no. 6 (crypto custody / Kryptoverwahrgeschäft, a regulated financial service since 1 January 2020); FinmadiG/KMAG implementing MiCA; MiCA Article 67/75. BaFin is the sole competent authority.

Requirements:

• A minimum of 95% of client assets in cold (offline) storage is reported as the German market expectation -- flagged as a secondary-source / market expectation rather than a codified BaFin requirement.
• HSMs or MPC infrastructure are expected; multi-signature wallets with a minimum 3-of-5 key-holder scheme; documented key storage policies, key ceremony, and backup; air-gapped signing (these thresholds are secondary/market-expectation, not a codified BaFin rule).
• Hardware wallets with EAL 4+ certification (or equivalent FIPS 140-2 Level 3 HSMs); DORA compliance mandatory from 2025; SOC 2 Type II or ISO 27001 expected; 72+ hours DR/BCP (secondary-source thresholds).
• Quarterly penetration testing by independent third-party auditors; five-year transaction record retention; DORA ICT risk reporting.

Regulatory body: BaFin (sole competent authority for prudential and conduct supervision).

Sources:

• KWG Section 1(1a), Section 26b; FinmadiG/KMAG; MiCA Article 67/75
• Secondary-source German market-practice commentary (cold-storage and key-ceremony thresholds flagged as not codified)

Hong Kong -- 98% Cold Storage (Evolving to Outcome-Based)

Legal basis: AMLO (amended effective 1 June 2023), Securities and Futures Ordinance (SFO), SFC VATP Guidelines (2023), SFC Custody Standards Circular (15 August 2025), ASPIRe roadmap (19 February 2025). A standalone VA Custodian licence is PROPOSED (consultation conclusions 24 December 2025; bill targeted 2026).

Requirements:

• Under the original VATP Guidelines (2023), a strict 98% cold / 2% hot storage ratio was mandated -- the most restrictive ratio globally. Banks (Authorised Institutions) likewise hold 98% cold for client digital assets.
• Cold wallet implementations must not include smart contracts on public blockchains to minimize attack vectors (a distinctive Hong Kong requirement).
• Per the SFC Custody Circular (15 August 2025): private keys must be generated and kept offline in certified hardware security modules (HSMs); the signing environment must be air-gapped and physically secured with multi-factor physical access control; withdrawals are restricted to whitelisted addresses only.
• 24/7 security operations center required; real-time threat detection; isolated/monitored approval devices.
• Independent third-party assessments of custody arrangements are mandatory, plus staff training to prevent blind signing.
• Under the ASPIRe roadmap (Initiative 3), the SFC signalled a shift from prescriptive hardware mandates to outcome-based holistic security with dynamic storage ratios.

Regulatory body: Securities and Futures Commission (SFC); Hong Kong Monetary Authority (HKMA) for stablecoins/banks.

Sources:

• Cointelegraph, "Hong Kong Tightens Crypto Custody Standards": https://cointelegraph.com/news/hong-kong-bans-smart-contract-cold-wallets-crypto-custody-rules
• CoinDesk, "Hong Kong Regulator Tightens Custody Standards" (15 August 2025): https://www.coindesk.com/policy/2025/08/15/hong-kong-regulator-tightens-custody-standards-for-licensed-crypto-exchanges
• SFC, "A-S-P-I-Re Roadmap Policy Statement": https://www.sfc.hk/en/News-and-announcements/Policy-statements-and-announcements/A-S-P-I-Re-for-a-brighter-future-SFCs-regulatory-roadmap-for-Hong-Kongs-virtual-asset-market

Model B: Outcome-Based Standards

Under this model, regulators define security objectives and require firms to demonstrate that their chosen technology and processes achieve those objectives. This provides flexibility for innovation while maintaining accountability through audit and oversight.

United Kingdom -- FCA Outcome-Based Regime

Legal basis: Financial Services and Markets Act 2000 (FSMA); Financial Services and Markets Act 2000 (Cryptoassets) Regulations made by Parliament 4 February 2026; Property (Digital Assets etc) Act 2025 (Royal Assent 2 December 2025); FCA Consultation Papers (CP25/14, CP25/42, CP26/4 / draft CASS 17, CP26/8, CP26/13). Full regime commencing 25 October 2027.

Requirements:

• Private keys must be generated, stored, and controlled securely throughout their lifecycle, with detailed key-mapping records linking keys to specific client holdings (CP25/14).
• Firms may use hot, warm, or cold storage methods as appropriate to their risk profile -- no specific ratio mandated.
• Multi-signature wallets, multi-party computation (MPC), and hardware security modules (HSMs) are recognized as acceptable security approaches.
• Cold storage and multi-signature protocols must meet ISO/IEC 27001 standards for information security.
• Sub-custodians are subject to due diligence and ongoing oversight under draft CASS 17 governance. A specific penetration-test cadence is not specified in the source materials.
• Operational resilience, cybersecurity, and incident-response requirements apply, covering crypto-specific scenarios (hard forks, chain splits, protocol upgrades).

Regulatory body: Financial Conduct Authority (FCA); Prudential Regulation Authority (PRA) for systemically important firms.

Sources:

• Ashurst, "FCA Unveils New Rules for Stablecoins and Crypto Custody": https://www.ashurst.com/en/insights/fca-releases-new-draft-rules-for-stablecoins-and-crypto-custody-cp25-14-cp25-15/
• Deloitte, "CASS in a Crypto World": https://www.deloitte.com/uk/en/services/audit-assurance/blogs/cass-in-a-crypto-world.html
• FCA, "CP25/14": https://www.fca.org.uk/publications/consultation-papers/cp25-14-stablecoin-issuance-cryptoasset-custody

Gibraltar -- Principles-Based DLT Regime

Legal basis: Financial Services (DLT Providers) Regulations 2017 (in force 1 January 2018; consolidated under the Financial Services Act 2019); GFSC DLT Guidance Notes (including Guidance Note 5 -- Protection of Client Assets). Gibraltar was the first jurisdiction globally to legislate a DLT-specific regime, structured around ten outcome-focused regulatory principles.

Requirements:

• Key management is governed on an outcome basis through Guidance Note 5 plus Principle 7 (cyber security), Principle 4 (risk management), and Principle 9 (resilience): adequate storage, data protection, and record-keeping, with the firm retaining accountability for any outsourcing.
• Private keys for public-network assets are held in online (hot) wallets only to the extent needed for immediate liquidity, with the remainder in cold storage. No fixed numerical cold-storage percentage is set (qualitative standard; a specific percentage is NO DATA FOUND).
• No prescriptive technical mandates -- cyber-security controls must be proportionate to value/volume (Principle 7), with resilience and contingency arrangements (Principle 9).
• A prescribed independent client-asset reconciliation cadence, and any crypto-specific proof-of-reserves / SOC-style attestation mandate, are NOT VERIFIED for Gibraltar.

Regulatory body: Gibraltar Financial Services Commission (GFSC), single integrated regulator.

Sources:

• Financial Services (DLT Providers) Regulations 2017/2020; Financial Services Act 2019
• GFSC DLT Guidance Notes (incl. Guidance Note 5 -- Protection of Client Assets)

Hong Kong -- ASPIRe Roadmap (Evolving)

As noted above, Hong Kong is transitioning from its prescriptive 98% cold storage mandate to an outcome-based framework under the ASPIRe roadmap. Initiative 3 explicitly signalled a move toward "dynamic custody technologies and storage ratios" that prioritize overall custody control over rigid percentage requirements.

Model C: Technology-Neutral Principles

Under this model, regulators establish overarching principles for key management without specifying technical implementations, particular storage ratios, or even mentioning specific technologies. The regulated entity must demonstrate to the regulator that its systems are adequate. This is the most common model in Europe, encompassing Switzerland and the directly-applicable MiCA regime (which governs custody in the EU, France, Germany, Liechtenstein, and Luxembourg).

Switzerland -- FINMA Outcome-Based with Technology Neutrality

Legal basis: DLT Act (in force February-August 2021), DEBA Art. 242a-242b, Banking Act Art. 16 No. 1bis, FINMA Guidance 01/2026 (12 January 2026), FINMA Circular 2018/3 (Outsourcing). A proposed FinIA Crypto Institution License is under consultation (closed 6 February 2026; expected late 2026/early 2027).

Requirements:

• No prescribed cold/hot storage ratios or specific technology mandates (a technical-standards gap is noted).
• FINMA requires regulated institutions to maintain robust technical infrastructure commensurate with the volume and value of assets under custody, and to employ personnel with blockchain technology expertise.
• Appropriate custody infrastructure must mitigate private-key compromise risks -- but the choice of technology is left to the institution.
• Comprehensive cybersecurity protections, business continuity plans (BCP), and disaster recovery plans (DRP) specific to crypto custody operations are required.
• When custody operations are outsourced, FINMA Circular 2018/3 requires clear contractual regulation, control rights, data availability assurance, and cybersecurity responsibilities. There is no prescribed penetration-test cadence; FINMA relies on approved audit firms (Prüfgesellschaften) for regulatory audits.
• The regulated institution retains full accountability to FINMA regardless of outsourcing arrangements.

In practice, market participants implement multi-signature wallet architectures, HSM-based key storage, cold storage for the majority of assets, geographic distribution of key material, and MPC protocols -- as market-driven standards rather than regulatory mandates.

Regulatory body: FINMA (Swiss Financial Market Supervisory Authority).

Sources:

• FINMA, "Guidance on risks associated with the custody of crypto-based assets" (12 January 2026): https://www.finma.ch/en/news/2026/01/20260112-mm-am-01-26/
• PwC Switzerland, "New FINMA guidance on crypto custody requirements": https://www.pwc.ch/en/insights/fs/new-finma-guidance-on-crypto-custody-requirements.html
• Chambers and Partners, "Blockchain 2025 - Switzerland": https://practiceguides.chambers.com/practice-guides/blockchain-2025/switzerland/trends-and-developments

European Union -- MiCA Technology-Neutral Framework

Legal basis: Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation, "MiCA"), Articles 70 and 75; ESMA technical standards; Digital Operational Resilience Act (DORA). Title V applicable from 30 December 2024, with full enforcement deadline 1 July 2026.

Requirements:

• MiCA does not prescribe specific cryptographic standards at the regulation level. ESMA guidance recognizes multi-party computation (MPC) or equivalent cryptographic security frameworks as acceptable, and Hardware Security Modules (HSMs) for key protection.
• Documented procedures for key reconstruction and incident recovery are required, with multi-signature approval workflows and role-based access with segregation of duties.
• Cold storage must be used for the majority of client holdings, maintained separately from operational reserves, with hot wallets limited to operational minimums -- this is best-practice guidance, not a codified ratio.
• DORA imposes ICT risk management frameworks, mandatory incident reporting, digital operational resilience testing (including threat-led penetration testing for significant firms), and ICT third-party risk management. Immutable audit trails are required.
• Strict liability under Article 75(8): the custodian is liable for loss of clients' crypto-assets or means of access as a result of an incident attributable to them, capped at market value at the time of loss.

Regulatory body: National Competent Authorities (NCAs) of member states, with coordination by ESMA; EBA for significant stablecoins.

Sources:

• Freshfields, "Digital Asset Protection Under MiCA": https://technologyquotient.freshfields.com/post/102hyzl/digital-asset-protection-a-first-look-at-client-asset-rules-under-mica
• Anankai, "A Practical Guide for MiCA Crypto Custody Providers in 2026": https://www.anankai.com/mica-compliance-a-practical-guide-for-crypto-custody-providers-in-2026/
• ORWL, "How the DORA Regulation Applies to CASPs": https://www.orwl.fr/en/dora-regulation-casps-eu/

France -- AMF Resilient-Systems Standard (Transitioning to MiCA)

Legal basis: PACTE Law (No. 2019-486), CMF Articles L. 54-10-1 to L. 54-10-7, DDADUE Law (enhanced registration, January 2024), Ordonnance No. 2024-936, MiCA (EU) 2023/1114. Transitional period to MiCA CASP authorization runs until 1 July 2026.

Requirements:

• The AMF requires resilient and secure IT systems, with internal control covering access management, transaction processing, and key custody. Enhanced registration (January 2024) requires custody-specific security; under MiCA, custody policies must govern the safekeeping of keys.
• No specific cold-storage ratio is prescribed (NO DATA in the source materials).
• A cybersecurity self-assessment questionnaire is required at registration; ICT risk management and incident reporting apply under DORA (from 2025).
• AMF on-site inspections and ACPR AML/CFT inspections apply; DORA digital operational resilience testing applies from 2025.

Regulatory body: AMF (Autorité des Marchés Financiers); ACPR for AML/CFT.

Sources:

• PACTE Law (No. 2019-486); CMF Articles L. 54-10-1 to L. 54-10-7
• Ordonnance No. 2024-936; MiCA (EU) 2023/1114

Liechtenstein -- TVTG + MiCA Outcome-Based

Legal basis: TVTG (Token and TT Service Provider Act / "Blockchain Act", in force 1 January 2020, Token Container Model); EEA-MiCA Implementation Act (EWR-MiCA-DG, in force 1 February 2025); MiCA (EU) 2023/1114 (taken into the EEA Agreement 24 June 2025). Transition to MiCA by 1 July 2026.

Requirements:

• The TVTG sets organisational / outcome-based expectations (appropriate organisational structure, internal procedures, control mechanisms); under MiCA Art. 75, custody of the means of access applies, and key-management integrity is implicit in the unified VT-Verwahrer custodian role (which covers VT-key safekeeping).
• No explicit minimum cold-storage percentage is imposed -- the TVTG does not set a statutory cold/hot ratio (NOT VERIFIED); cold-storage-dominant designs are market-driven only.
• No granular statutory technical standards (HSM models, cold/hot ratios); multi-sig/MPC and HSM storage are market practice. The MiCA/DORA layer governs ICT risk for in-scope entities.
• DORA digital operational-resilience testing and ICT third-party-risk management apply for MiCA-authorised entities; no TVTG-specific penetration-test cadence is stated.

Regulatory body: Financial Market Authority Liechtenstein (FMA), integrated sole regulator for both TVTG and MiCA.

Sources:

• TVTG (Token and TT Service Provider Act, 2020); EWR-MiCA-DG (in force 1 February 2025)
• MiCA (EU) 2023/1114 (taken into the EEA Agreement 24 June 2025)

Luxembourg -- MiCA Outcome-Based + DLT-Securities Lead

Legal basis: Directly-applicable MiCA (EU) 2023/1114 (applicable to CASPs incl. custody from 30 December 2024); national Law of 6 February 2025 designating the CSSF as competent authority; Blockchain Laws I-IV (2019/2021/2023/Law of 19 December 2024).

Requirements:

• Outcome-based MiCA obligations: the custody policy (Art. 75(5)) must minimise the risk of loss of client assets or means of access from fraud, cyber threats, or negligence; means of access (keys) must be clearly identified as client-related and segregated (Art. 75(7)); DORA ICT risk framework applies.
• No national cold-storage percentage, HSM mandate, or MPC requirement is prescribed; cold-storage-majority models are market practice only. Any CSSF circular prescribing quantitative cold-storage ratios is NOT VERIFIED.
• No prescriptive national technical key-management standard; multi-sig/MPC and HSM-backed key storage are market practice; DORA operational-resilience applies for CASPs.
• DORA resilience testing, ICT incident reporting, and third-party (sub-custodian/cloud) risk management apply; no Luxembourg-specific penetration-test cadence is stated.

Regulatory body: Commission de Surveillance du Secteur Financier (CSSF), single competent authority.

Sources:

• MiCA (EU) 2023/1114; Law of 6 February 2025 (CSSF as MiCA competent authority)
• Blockchain Laws I-IV (control-agent / DLT-securities model)

Model D: Industry Self-Regulation (No Federal Key Management Mandate)

United States -- Fragmented, No Unified Federal Standard

Legal basis: No single federal law mandates specific key management standards for crypto custodians. The framework is distributed across the SEC (Investment Advisers Act Rule 206(4)-2, Exchange Act Rule 15c3-3), OCC (Interpretive Letters), CFTC (Digital Asset Collateral Pilot Program), FDIC, Federal Reserve, FinCEN (Bank Secrecy Act), and state regulators (NYDFS, Wyoming SPDI Act). The GENIUS Act 2025 (PL 119-27) is the main statutory anchor for payment stablecoins.

Current state:

• There is no single federal key-management mandate. The SEC's broker-dealer guidance of 17 December 2025 requires controls "reasonably designed and consistent with industry best practices to protect private keys," articulating a "physical possession" standard for crypto asset securities (access/transfer capability, private-key protection, contingency planning for 51% attacks, hard forks, and freeze orders). Industry uses cold storage, multi-sig, MPC, and HSMs.
• Cold storage is not federally mandated as a fixed percentage; offline/air-gapped cold storage is the industry standard.
• A SOC-1 or equivalent control report is required for state trust company custodians under the SEC no-action letter of 30 September 2025 (which permitted state trust companies to act as qualified custodians); SOC-1/SOC-2 Type II is the broader industry standard.
• NYDFS updated its custodial-structures guidance on 30 September 2025 (sub-custodian rules), preserving beneficial customer ownership and prohibiting use of customer assets for the custodian's own purposes.
• The OCC has confirmed that national banks may hold cryptographic keys, and in late 2025 / early 2026 conditionally approved multiple national trust bank charters (Ripple, BitGo, Fidelity Digital Assets, Paxos, Anchorage, Coinbase, and others), but does not prescribe specific key-management standards.

Correction note: Earlier drafts framed the SEC Custody Rule (Rule 206(4)-2) "qualified custodian" requirement as the operative key-management touchpoint and treated SAB 121 as live. Per the fact matrix, the SEC issued SAB 122 on 23 January 2025 (effective 30 January 2025), rescinding SAB 121 and removing the on-balance-sheet liability treatment for custodied crypto (banks now apply ASC 450-20). The qualified-custodian framework now flows through the September 2025 no-action letter recognising state trust companies, and the December 2025 broker-dealer "physical possession" guidance, rather than a prescriptive technology rule.

Regulatory bodies: SEC, OCC, CFTC, FDIC, Federal Reserve, FinCEN; state regulators (NYDFS, Wyoming, South Dakota).

Sources:

• SEC SAB 122 (23 January 2025, effective 30 January 2025) rescinding SAB 121
• SEC broker-dealer "physical possession" guidance for crypto asset securities (17 December 2025)
• SEC no-action letter permitting state trust companies as qualified custodians (30 September 2025); NYDFS updated custodial-structures guidance (30 September 2025): https://www.dfs.ny.gov/industry_guidance/industry_letters/il20230123_guidance_custodial_structures
• SEC Crypto Task Force, "Custody Rule Modernization Model Framework" (19 December 2025): https://www.sec.gov/about/crypto-task-force/written-submission/custody-rule-modernization-model-framework-121925

Brazil -- Certification-Gated, No Mandated Technology

Legal basis: Law 14,478/2022 (BVAL); BCB Resolutions 519/520/521/2025 (effective 2 February 2026); BCB Instruction 701/2026 (independent technical certification).

Requirements:

• No single mandated key-management technology. Industry-reported expectation (via Fireblocks; not verbatim regulatory text) is MPC or HSM-backed key management with key redundancy. BCB Instruction 701/2026 assesses cryptographic-key redundancy as a certification criterion.
• No fixed cold-storage percentage is specified in the resolutions.
• An independent technical certification (Instruction 701/2026) covers asset segregation, proof of reserves, risk management, internal controls, and cryptographic-key redundancy; Resolution 520 imposes cybersecurity requirements (identity management, BCP/incident response, encryption, smart-contract monitoring).
• Independent audits are mandatory to verify segregation; certification is by an accredited certifier (certifier-accreditation criteria NOT VERIFIED).

Regulatory body: Banco Central do Brasil (BCB); CVM for securities-classified tokens.

Sources:

• Law 14,478/2022 (BVAL); BCB Resolutions 519/520/521/2025
• BCB Instruction 701/2026 (independent technical certification)

Australia -- Technology-Neutral, Standards Pending

Legal basis: Corporations Amendment (Digital Assets Framework) Act 2026 (Royal Assent 8 April 2026; commences 9 April 2027); Corporations Act 2001; ASIC INFO 225 (October 2025).

Requirements:

• No prescribed key-management standard -- the approach is technology-neutral. Whether the forthcoming s 912BE / 912BF legislative instruments will add one is NOT VERIFIED.
• No fixed cold-storage percentage is mandated (contrasting Japan 95%, Singapore 90%, South Korea 80%).
• Transactional and settlement standards (s 912BF) are to address operational resilience, to be prescribed by legislative instrument.
• A specific penetration-test mandate is NOT VERIFIED; periodic auditor review is anticipated under the forthcoming financial requirements.

Regulatory body: ASIC (financial services); AUSTRAC (AML/CTF).

Sources:

• Corporations Amendment (Digital Assets Framework) Act 2026
• ASIC INFO 225 (October 2025)

Bermuda -- Prescriptive Key-Management Code (Outcome-Based Cold Storage)

Legal basis: Digital Asset Business Act 2018 (DABA); DAB (Custody of Client Assets) Rules 2025; Digital Asset Custody Code of Practice (February 2024); Cyber Risk Code/Rules. The BMA is an integrated regulator and the sole authority for digital asset business.

Requirements:

• Bermuda is one of the most prescriptive key-management regimes surveyed. Per the Custody Code (February 2024): seeds must have ≥256-bit entropy, with a ≥24-word mnemonic hashed to ≥512-bit; a ≥3-person seed ceremony is required, with no single person holding the entire seed; M-of-N multi-signature with ≥3 signatories applies.
• No fixed cold-storage percentage -- a risk-assessment-based hot/cold split (Code §2.2).
• HSMs certified to FIPS 140-2 are recommended; the seed must be split into ≥2 parts stored separately; a quorum must be impossible from keys held in a single location; collusion-mitigation controls apply.
• A board-approved annual IT audit plan is required; key/seed generation and management are audited at least every six months; multi-sig is audited annually; quarterly transaction-sample audits and quarterly access recertification apply, with five-year retention.

Regulatory body: Bermuda Monetary Authority (BMA), integrated sole authority.

Sources:

• Digital Asset Business Act 2018; DAB (Custody of Client Assets) Rules 2025
• Digital Asset Custody Code of Practice (February 2024)

Cayman Islands -- CIMA Robust-Key-Management Expectation

Legal basis: Virtual Asset (Service Providers) Act (2024 Revision); Custody/VATP Rule (December 2024, updated February 2026); Statement of Guidance; Market Conduct RSOG (February 2026). CIMA is the sole supervisory authority; custody licensing has been in force since 1 April 2025.

Requirements:

• Custodians must maintain robust private-key management with documented backup procedures and key-compromise protocols tested annually, alongside comprehensive cybersecurity / IT integrity expectations.
• Offline (cold) storage is expected as a safeguarding measure, with clients warned of withdrawal delays; no fixed minimum cold-storage percentage is published (NOT VERIFIED that a numeric percentage is mandated).
• Independent third-party security audits of custody/key-management systems are required, within a risk-management framework covering client-asset, operational, and reputational risk.

Regulatory body: Cayman Islands Monetary Authority (CIMA), sole supervisory authority.

Sources:

• VASP Act (2024 Revision); Custody/VATP Rule (December 2024, updated February 2026)
• CIMA Statement of Guidance; Market Conduct RSOG (February 2026)

UAE -- Multi-Regulator Risk-Based Key Management

Legal basis: Dubai Law No. 4 of 2022 + VARA Rulebooks v2.0 (May 2025); ADGM FSRA framework (amended June 2025); DFSA Crypto Token Framework (updated January 2026); Federal Decree-Law No. 6 of 2025 (CBUAE); CMA Decision No. 4/R.M/2026 (effective 13 February 2026).

Requirements:

• VARA Custody Rulebook Part III requires robust secure private-key generation, industry-standard cryptography, geographically dispersed encrypted key backups, access control and monitoring, segregation of duties, and regular backup/recovery testing.
• VARA does NOT mandate a specific cold-storage percentage (the often-cited 95% does not originate from VARA); it requires a risk-based analysis to determine hot/cold/warm storage with documented methodologies.
• VARA may require multi-signature schemes where appropriate; ADGM and DFSA apply standard financial-services controls.
• Wallet-management mechanisms and transfer procedures are subject to audit by an independent third-party auditor, with periodic proof-of-reserves checks (Part II.A.2).

Regulatory body: Multi-regulator -- VARA (Dubai mainland), ADGM FSRA, DFSA (DIFC), CBUAE (federal), CMA (federal).

Sources:

• VARA Custody Rulebook Part III; VARA Rulebook v2.0 (May 2025)
• ADGM FSRA framework (amended June 2025); CMA Decision No. 4/R.M/2026

Comparative Summary

Of the 20 jurisdictions, 7 impose a numeric cold-storage ratio (Japan 95%, Hong Kong 98%, Singapore 90%, South Korea 80%, Bahrain 95%, Canada 80%, and Germany ~95% as a non-codified market expectation). The remaining 13 use risk-based, outcome-based, technology-neutral, or self-regulatory approaches with no fixed percentage.

2. Technology Standards Comparison

2.1 Cold / Warm / Hot Wallet Architecture

Crypto custody infrastructure is typically organized into three tiers based on internet connectivity and transaction signing speed:

Jurisdictional cold storage ratios:

Japan's requirement that hot wallet exposure be backed 100% by the operator's own crypto assets ("Redemption Guarantee Crypto Assets") is a distinctive mechanism that effectively creates a financial guarantee for the most vulnerable portion of customer assets. Bahrain's per-asset 95% calculation and Bermuda's prescriptive seed-ceremony Code are the most granular technical mandates among the smaller jurisdictions.

2.2 Multi-Signature vs. MPC: Regulatory Treatment

Multi-signature (multi-sig) and multi-party computation (MPC) are the two dominant cryptographic approaches for eliminating single points of failure in key management.

Regulatory treatment by jurisdiction:

• Japan: Multi-signature is common practice under the PSA framework; MPC is not explicitly addressed and multi-sig is the regulatory default.
• Singapore: MAS PS-G03 explicitly recognizes MPC, requiring that key shares be distributed so that no single party can authorize asset movements independently.
• South Korea: Encryption and key management are governed via KISA's ISMS certification; no specific multi-sig/MPC mandate is named.
• Australia: Technology-neutral; no prescribed key-control mechanism (forthcoming s 912BE/912BF instruments NOT VERIFIED).
• United Kingdom: FCA CP25/14 recognizes both multi-signature wallets and MPC as acceptable security approaches.
• European Union: ESMA guidance under MiCA recognizes MPC or equivalent cryptographic security frameworks, with multi-signature approval workflows.
• France /
  Liechtenstein /
  Luxembourg: Under the MiCA framework, multi-sig/MPC and HSM storage are recognized as market practice; no national prescriptive mandate.
• Germany: HSMs or MPC infrastructure are expected, with multi-signature wallets at a minimum 3-of-5 key-holder scheme (flagged as market expectation, not a codified BaFin rule).
• Switzerland: Multi-sig, HSM, and MPC are market-driven standards, not mandated by FINMA.
• Hong Kong: The SFC Custody Circular requires independent checks and multi-factor controls; both multi-sig and MPC are acceptable implementations.
• Bahrain: Mandatory multi-signature (CRA-8.1.11/.13) -- no sole signatory and no single person with full key access.
• Bermuda: M-of-N multi-signature with ≥3 signatories required under the Custody Code (February 2024).
• UAE: VARA may require multi-signature schemes where appropriate.
• Brazil: Industry-reported expectation of MPC or HSM-backed key management (via Fireblocks; not verbatim regulatory text).
• Cayman Islands /
  Canada / Gibraltar: No specific multi-sig/MPC mandate; robust key control expected within outcome-based frameworks.
• United States: No federal regulatory preference. Both approaches are used by regulated custodians (e.g., Coinbase uses MPC; BitGo uses multi-sig).

Sources:

• Fireblocks, "MPC vs Multi-Sig": https://fireblocks.com/blog/mpc-vs-multi-sig/
• Singapore MAS PS-G03 (April 2024); UK FCA CP25/14 (May 2025); Bahrain CBB CRA Module; Bermuda Custody Code (February 2024)

2.3 Hardware Security Module (HSM) Standards

HSMs are tamper-resistant hardware devices designed to generate, store, and manage cryptographic keys. Two primary certification standards apply:

FIPS 140-2 / FIPS 140-3

The Federal Information Processing Standard (FIPS) 140 series, published by the U.S. National Institute of Standards and Technology (NIST), establishes security requirements for cryptographic modules across four ascending security levels:

FIPS 140-2 Level 3 has become the de facto institutional standard for crypto custody HSMs. At this level, the module must detect physical tampering attempts and respond by zeroing (deleting) all plaintext cryptographic keys and critical security parameters. Identity-based authentication is required (rather than role-based).

FIPS 140-3 (effective September 2019, mandatory for new validations since April 2022) updates the standard with alignment to ISO/IEC 19790:2012 and ISO/IEC 24759:2017, introducing more rigorous testing requirements.

Jurisdictional treatment:

• Hong Kong: The SFC Custody Standards Circular (August 2025) requires certified hardware security modules for cold wallet key generation and storage.
• Bermuda: The Custody Code recommends HSMs certified to FIPS 140-2, with the seed split into ≥2 separately-stored parts.
• Germany: Hardware wallets with EAL 4+ certification (or equivalent FIPS 140-2 Level 3 HSMs) are expected (market expectation).
• European Union (and the MiCA jurisdictions
  France,
  Liechtenstein,
  Luxembourg): ESMA guidance recommends HSM usage; DORA requires ICT risk management frameworks that implicitly favor certified hardware.
• UAE /
  Brazil: HSM-backed key storage is expected (VARA "industry-standard cryptography"; Brazil industry-reported), without a named certification mandate.
• United States: Federal banking regulators (OCC, FDIC) expect institutions to follow NIST standards; NYDFS expects HSMs in practice.
• Other jurisdictions (
  Switzerland, Gibraltar,
  Cayman Islands,
  Canada,
  Japan,
  Singapore,
  South Korea,
  Australia,
  Bahrain): HSMs are not mandated at the regulatory level but expected by institutional clients as an industry standard (Bahrain mandates secure key generation/storage under CRA-5 without naming a certification level).

Source:

• NIST, "FIPS 140-2: Security Requirements for Cryptographic Modules": https://csrc.nist.gov/publications/detail/fips/140/2/final

Common Criteria (ISO/IEC 15408)

Common Criteria Evaluation Assurance Level 4+ (EAL4+) is an international standard for IT security evaluation. Some institutional custodians require EAL4+ certification for HSMs, providing independent verification that the module has been methodically designed, tested, and reviewed. Germany's market practice expects hardware wallets at EAL 4+ (or equivalent FIPS 140-2 Level 3 HSMs).

2.4 Air-Gapped Environments and Key Ceremony Requirements

A key ceremony is a formalized process for generating, distributing, and activating cryptographic keys. Institutional-grade key ceremonies typically involve:

• Air-gapped computing environment: The key generation device has never been and will never be connected to any network.
• Multi-party participation: Multiple authorized individuals participate, with no single individual having complete access to the generated key material.
• Tamper-evident procedures: Sealed bags, serial-numbered devices, witnessed logging.
• Geographic distribution: Key shares or backup materials stored at multiple physically separate, secured locations.
• Auditable record: Written logs, photographs, or video recordings documenting every step.

Jurisdictional treatment:

• Hong Kong: The SFC Custody Standards Circular explicitly requires air-gapped environments for cold wallet key signing operations.
• Bermuda: The Custody Code mandates a ≥3-person seed ceremony with no single person holding the entire seed -- the most explicit key-ceremony requirement surveyed.
• Germany: A documented key ceremony, key storage policies, and air-gapped signing are expected (market expectation, not codified).
• UAE: VARA requires geographically dispersed encrypted key backups with segregation of duties and regular backup/recovery testing.
• United Kingdom: FCA CP25/14 requires strategies to mitigate loss or compromised access to private keys -- key ceremonies are an industry-standard implementation.
• Japan: JVCEA operational standards require secure key generation and backup processes.
• Cayman Islands: Robust private-key management with documented backup procedures and annually-tested key-compromise protocols.
• Other jurisdictions: Not explicitly mandated but expected as institutional best practice.

2.5 Disaster Recovery and Key Backup/Recovery Procedures

Loss of private keys results in permanent loss of assets. Regulators therefore impose requirements for key backup and recovery:

2.6 SOC 2 Type II for Key Management Operations

SOC 2 Type II (System and Organization Controls) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA) that evaluates an organization's controls over a period of time (typically 6-12 months) against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

For crypto custody, SOC 2 Type II audits typically cover:

• Key generation, storage, and usage controls
• Access management and authentication systems
• Change management for custody infrastructure
• Incident detection and response
• Physical security of key storage facilities
• Monitoring and logging of all custody operations

Regulatory treatment: SOC 2 Type II is a de facto institutional requirement, and several jurisdictions now reference SOC-family attestations directly. Canada requires custodians of public crypto funds to obtain at least an annual SOC 2 Type II report (NI 81-102 / CSA SN 81-336). The United States requires a SOC-1 (or equivalent) control report for state trust company custodians under the September 2025 SEC no-action letter, with SOC-1/SOC-2 Type II as the industry standard. Germany expects SOC 2 Type II or ISO 27001 as a market norm. The United Kingdom FCA references ISO/IEC 27001 (which overlaps with SOC 2 criteria), and South Korea's KISA ISMS certification covers similar territory. Major custodians such as Coinbase Custody, Gemini, BitGo, Fireblocks, and Anchorage Digital all maintain SOC 2 Type II certifications.

3. Industry Standards (Not Legally Mandated but Expected)

3.1 CryptoCurrency Security Standard (CCSS)

Developer: CryptoCurrency Certification Consortium (C4)

What it covers: CCSS is a framework specifically designed to protect digital assets by addressing security risks unique to cryptographic key material. Unlike general IT standards (ISO 27001, SOC 2), CCSS targets the specialized requirements of blockchain and cryptocurrency systems.

The standard addresses six major aspects:

1. Key Material Generation -- ensuring randomness and unpredictability of cryptographic keys
2. Wallet Generation -- establishing secure signing configurations
3. Key Material Storage -- protecting encrypted backups and access controls
4. Key Material Access -- managing personnel onboarding and authorization
5. Key Material Usage -- preventing compromise during transaction signing
6. Data Sanitization -- removing key material from decommissioned devices

Additional operational aspects cover security testing, monitoring, governance, and compromise response procedures.

Certification levels: Three ascending levels, with Level 3 representing the highest attainable certification. In 2024, Fireblocks became the first organization certified under CCSS Version 9.0 at Level 3.

Who uses it: CCSS certification is held by major institutional custodians and infrastructure providers. It is commonly cited as evidence of security posture in institutional due diligence processes and regulatory examinations.

Regulatory treatment: No jurisdiction mandates CCSS compliance. However, it is referenced in industry due diligence frameworks and may be cited by applicants during licensing examinations in jurisdictions such as Singapore, Hong Kong, the United States (particularly in NYDFS applications), and the Gulf and offshore centres (Bahrain, UAE, Bermuda, Cayman Islands).

Source:

• CryptoCurrency Certification Consortium (C4), "CryptoCurrency Security Standard (CCSS)": https://cryptoconsortium.org/ccss/

3.2 ISO/IEC 27001 for Crypto Operations

Developer: International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)

ISO/IEC 27001 is the globally recognized standard for information security management systems (ISMS). It provides a systematic approach to managing data risks based on three foundational principles: confidentiality, integrity, and availability.

Application to crypto custody:

• Provides the overarching ISMS framework within which crypto-specific controls (key management, wallet security, air-gapped operations) are implemented
• The UK FCA explicitly references ISO/IEC 27001 as the applicable standard for cold storage and multi-signature protocols (CP25/14)
• South Korea's KISA ISMS certification is modeled on ISO/IEC 27001 principles
• Germany expects ISO 27001 (or SOC 2 Type II) as a market norm for licensed custodians
• ISO 27001 certification is a common prerequisite for institutional custody relationships

Limitations for crypto: ISO 27001 is a general information security standard and does not address crypto-specific concerns such as private key lifecycle management, wallet architecture, on-chain transaction verification, or blockchain-specific incident response. It is therefore typically deployed alongside CCSS or proprietary crypto-security frameworks.

Source:

• ISO, "ISO/IEC 27001 Information security management systems": https://www.iso.org/standard/27001

3.3 NIST Cybersecurity Framework

Developer: U.S. National Institute of Standards and Technology (NIST)

The NIST Cybersecurity Framework (CSF), updated to Version 2.0 in February 2024, organizes cybersecurity risk management into six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Application to crypto custody:

• The framework is directly applicable to crypto custody operations and is referenced by U.S. federal banking regulators (OCC, FDIC) as an expected baseline
• The
  European Union's DORA regulation aligns its ICT risk management framework with NIST CSF core functions -- relevant across the EU and the MiCA jurisdictions (
  France,
  Germany,
  Liechtenstein,
  Luxembourg)
• Crypto custodians map their key management controls to NIST CSF categories (e.g., PR.DS -- Data Security for key storage; PR.AC -- Access Control for key access; DE.CM -- Continuous Monitoring)

Source:

• NIST, "Cybersecurity Framework 2.0": https://www.nist.gov/cyberframework

3.4 Cloud Security Alliance (CSA) Guidance

Developer: Cloud Security Alliance

The CSA has published guidance on blockchain and distributed ledger technology security, addressing:

• Security considerations for cloud-hosted custody infrastructure
• Shared responsibility models between cloud providers and custody operators
• Key management in cloud and hybrid environments
• Compliance mapping between CSA controls and financial regulatory requirements

Application to crypto custody: As custody infrastructure increasingly leverages cloud-hosted HSMs and key management services (e.g., AWS CloudHSM, Azure Dedicated HSM, GCP Cloud HSM), CSA guidance provides a framework for evaluating the security of these implementations. This is particularly relevant in the

European Union and the other MiCA jurisdictions, where DORA imposes ICT third-party risk management requirements on CASPs.

4. What Works / What Does Not Work

4.1 What Works: Prescriptive Cold Storage Ratios

Case study:

Japan post-Coincheck

The Coincheck hack of January 2018 resulted in the theft of approximately USD 530 million worth of NEM tokens -- at the time, the largest cryptocurrency theft in history. The attack exploited the fact that Coincheck held NEM tokens in a hot wallet rather than cold storage. The exchange was not yet fully registered with the FSA at the time.

Following the hack, the FSA:

• Issued a business improvement order to Coincheck
• Conducted on-site inspections of all registered exchanges
• Issued administrative actions against multiple exchanges
• Strengthened the 95% cold storage mandate with enhanced enforcement

The result: Japan has experienced no major exchange hack involving a fully registered exchange since the implementation of the strengthened cold storage requirements. The Zaif hack (September 2018, approximately USD 60 million) occurred during the transition period and itself accelerated enforcement. Coincheck compensated all affected users from its own funds (approximately JPY 46.3 billion), setting a market precedent.

Assessment: Prescriptive cold storage mandates are effective at preventing the specific category of attack that exploits internet-connected wallet infrastructure. Japan's experience demonstrates that a 95% cold storage requirement, combined with 100% own-asset backing for hot wallet exposure, can materially reduce institutional loss events. The same prescriptive logic now appears in Bahrain's per-asset 95% rule and Canada's 80% Acceptable-Third-party-Custodian threshold, both adopted in jurisdictions seeking a clear security floor.

Sources:

• Dzilla (27 November 2025), cited above
• Japan jurisdiction profile sources (FSA / JVCEA)

4.2 What Works: Outcome-Based Standards with Audit

Case study:

United Kingdom FCA approach

The UK's outcome-based approach provides flexibility for custodians to adopt the technology best suited to their operational model while requiring:

• Detailed key-mapping records
• ISO/IEC 27001 compliance for key management
• Sub-custodian due diligence and ongoing oversight

This approach avoids the rigidity of prescriptive ratios while maintaining accountability through audit and oversight mechanisms. It allows custodians to adopt emerging technologies (e.g., MPC threshold signatures, TEE-based custody) without requiring regulatory amendments each time a new technology matures. Switzerland's FINMA principles, Gibraltar's ten-principle DLT regime, and Cayman's robust-key-management expectation share the same outcome-based philosophy, as does the directly-applicable MiCA regime governing the EU, France, Germany, Liechtenstein, and Luxembourg.

Assessment: The outcome-based model is well-suited for jurisdictions with strong regulatory capacity and a mature audit ecosystem. Its effectiveness depends on the quality and frequency of regulatory examination -- without robust oversight, outcome-based standards risk becoming aspirational rather than enforceable. Bermuda demonstrates a hybrid: an outcome-based hot/cold ratio combined with a highly prescriptive key-ceremony Code.

4.3 What Does Not Work: Absence of Standards

Case studies from the pre-regulation era:

Each of these incidents occurred in the absence of -- or prior to the effective enforcement of -- specific key management regulations. Mt. Gox operated in a period of essentially zero regulatory oversight. Coincheck's hack directly triggered Japan's strengthened cold storage mandate. The Bitfinex hack exposed weaknesses in multi-sig implementations when not combined with adequate operational security. The QuadrigaCX collapse in Canada -- where the sole director's death left client assets inaccessible -- similarly drove Canada's CIRO four-tier custody framework.

Assessment: The historical record demonstrates that exchange-level custody without mandatory security standards produces a predictable pattern of catastrophic loss events. The aggregate losses from the four incidents above exceed USD 1.3 billion, with broader systemic effects on market confidence and retail investor protection.

Sources:

• Multiple widely reported incidents; amounts from contemporaneous reporting
• Chainalysis, "2024 Crypto Crime Report": https://www.chainalysis.com/blog/2024-crypto-crime-report-introduction/

4.4 Mixed: MPC Adoption

Status: MPC has gained significant institutional adoption (Fireblocks, Coinbase, and others) as a flexible alternative to multi-signature architectures. However, regulatory treatment remains inconsistent:

Challenges:

• Lack of standardized MPC protocols (multiple competing implementations)
• Regulatory uncertainty in jurisdictions that specify "multi-signature" requirements (notably Bahrain and Bermuda)
• Limited formal audit frameworks specifically for MPC implementations
• Key share management introduces operational complexity distinct from multi-sig

Assessment: MPC represents a technically superior approach for many use cases (blockchain-agnostic, no on-chain footprint, flexible key rotation), but regulatory frameworks have not consistently kept pace. Policymakers should consider technology-neutral language that encompasses both multi-sig and MPC under a broader "distributed key control" requirement.

5. Recommended Framework: Tiered Key Management Requirements

Based on the analysis of global regulatory approaches across all 20 jurisdictions, the following tiered framework is recommended for jurisdictions developing or refining key management standards for institutional crypto custody.

Tier 1: Baseline Requirements (All Licensed Custodians)

These requirements should apply to every entity licensed to custody crypto assets on behalf of clients:

1. Cold storage majority mandate: At least 80% of customer assets must be maintained in cold storage (systems not connected to the internet). This threshold balances security with operational viability, as demonstrated by

   South Korea's VAUPA framework and
   Canada's 80% Acceptable-Third-party-Custodian threshold.

2. Hot wallet capital backing: For assets held in hot wallets, the custodian must maintain own-capital reserves equal to at least 100% of the hot wallet exposure, following

   Japan's Redemption Guarantee Crypto Assets model.

3. Distributed key control: All custodial wallets must employ either multi-signature or MPC protocols (or an equivalent distributed key control mechanism) such that no single individual or single device can unilaterally authorize a transaction. This follows

   Singapore's dual authorization requirement and
   Bahrain's mandatory multi-signature rule.

4. Key lifecycle management policy: Custodians must maintain and disclose a documented policy covering key generation, storage, usage, backup, rotation, and decommissioning.

5. Incident response and disaster recovery: Documented plans for key compromise, system failure, and asset recovery, tested at least annually -- following

   Cayman Islands's annual key-compromise protocol testing.

6. Security audit: Annual independent security assessment by a qualified third party, covering key management controls, wallet architecture, and operational procedures.

Tier 2: Enhanced Requirements (Custodians Above a Materiality Threshold)

For custodians holding assets above a jurisdiction-defined materiality threshold (e.g., USD 100 million or equivalent), additional requirements should apply:

1. Cold storage ratio increase: Minimum 90% cold storage, following

   Singapore's PS-G03 standard.

2. HSM certification: Cryptographic keys must be generated and stored in hardware security modules certified to at least FIPS 140-2 Level 3 or equivalent, following

   Bermuda's FIPS 140-2 Custody Code recommendation.

3. Air-gapped key signing with multi-party ceremony: Cold wallet transaction signing must occur in air-gapped environments with multi-party participation, following

   Hong Kong's SFC Custody Standards Circular and
   Bermuda's ≥3-person seed ceremony.

4. SOC 2 Type II audit: Annual SOC 2 Type II audit covering key management operations, following

   Canada's NI 81-102 requirement for public crypto funds.

5. Geographic key distribution: Key shares or backup material must be stored across at least two geographically separate, physically secured locations, following

   UAE's VARA geographically-dispersed-backup requirement.

6. CCSS Level 2 certification (or equivalent).

Tier 3: Systemically Important Custodians

For custodians designated as systemically important (holding assets exceeding a higher threshold, e.g., USD 1 billion, or custodying assets for regulated financial institutions):

1. Cold storage ratio: Minimum 95%, following

   Japan's and
   Bahrain's standard.

2. 24/7 security operations center, following

   Hong Kong's SFC requirement.

3. Threat-led / semi-annual penetration testing, following

   European Union DORA requirements for significant firms and
   Bahrain's twice-yearly external penetration-test mandate.

4. CCSS Level 3 certification (or equivalent).

5. Real-time transaction monitoring and anomaly detection.

6. Board-level accountability: Designated senior officer with personal regulatory accountability for custody controls, following

   Hong Kong's model and
   Bermuda's board-approved IT audit plan.

7. Comprehensive insurance or compensation reserves covering both hot and cold wallet exposure, following

   Japan's proposed FIEA reform approach and
   Bermuda's statutory surety-bond/insurance requirement.

6. Decision Matrix

The following matrix maps regulatory design choices to policy objectives, enabling policymakers to select the approach most aligned with their jurisdiction's priorities.

Representative jurisdictions per model:

• Model A (Prescriptive Ratio): Japan, Hong Kong, Singapore, South Korea, Bahrain, Canada, Germany (market expectation)
• Model B (Outcome-Based): United Kingdom, Gibraltar, Cayman Islands, Bermuda (hybrid: prescriptive Code + risk-based ratio)
• Model C (Technology-Neutral): European Union, France, Switzerland, Liechtenstein, Luxembourg, UAE, Australia
• Model D (Self-Regulation): United States, Brazil

Recommended Combination

Based on empirical evidence from the jurisdictions surveyed, the optimal approach combines:

1. A prescriptive minimum cold storage ratio (80-95% depending on tier) to establish a clear security floor and prevent the catastrophic loss events that characterized the pre-regulation era

2. Technology-neutral language for key control mechanisms (accepting multi-sig, MPC, and future innovations under a "distributed key control" umbrella) to avoid locking the regulatory framework to current technology

3. Outcome-based audit and reporting requirements (SOC 2 Type II, independent security assessments, key-ceremony review on a fixed cadence) to ensure ongoing compliance without mandating specific operational procedures

4. Strict liability for custodial losses (following

   European Union MiCA Article 75(8)) to align custodian incentives with client protection

This hybrid approach draws on the strengths of the Japan/Singapore/Bahrain prescriptive model for its loss-prevention track record, the United Kingdom/European Union outcome-based model for its adaptability, the Switzerland/Liechtenstein/Luxembourg principles-based model for its technology neutrality, and Bermuda's prescriptive key-ceremony Code for its granular operational rigour.

Cross-References

• Licensing Frameworks -- for licensing requirements that complement key management standards
• Asset Segregation -- for requirements on how custodied assets are separated from operational holdings
• Insurance & Liability -- for insurance requirements covering key compromise and custodial loss events
• Audit & Reporting -- for audit standards applicable to key management operations

Verification Notes

All factual claims in this document are mirrored from the verified per-jurisdiction fact matrix maintained for this domain (covering all 20 jurisdictions) and cross-referenced against the sourced jurisdiction profiles in this repository. The "X of N" aggregates are derived from the matrix for N=20. Verification details:

Note on cold storage ratios: The numeric cold storage percentages (Japan 95%, Hong Kong 98%, Singapore 90%, South Korea 80%, Bahrain 95%, Canada 80%, Germany ~95% non-codified) are mirrored from the verified fact matrix and the individual jurisdiction profiles in this repository. The remaining 13 jurisdictions use risk-based, outcome-based, technology-neutral, or self-regulatory approaches with no fixed percentage; where a numeric ratio is absent or unconfirmed, the matrix records this as "NOT VERIFIED" or "NO DATA FOUND," and this document reflects that status honestly rather than inferring a percentage.