Custody Licensing Frameworks

This section provides a comparative analysis of how jurisdictions license institutional crypto custodians, evaluates the effectiveness of each model, and recommends a tiered licensing framework grounded in real-world precedent. It is intended for policymakers and regulators designing or enhancing custody regulation for digital assets.

1. Global Landscape: Licensing Model Taxonomy

Jurisdictions have adopted six distinct licensing models for institutional crypto custody. Each model reflects different regulatory philosophies, institutional capacities, and market development stages. This taxonomy classifies all 20 surveyed jurisdictions by their primary licensing approach.

Model A: Bank-Only Custody (Traditional Banking License Required)

Concept: Only entities holding a full banking license may provide crypto custody services. No standalone crypto custody license exists. This model leverages existing prudential infrastructure but restricts market entry to incumbent financial institutions.

Jurisdictions:

• South Korea: Under the Virtual Asset User Protection Act (VAUPA, effective 19 July 2024) and the Special Financial Information Act (SFIA), crypto custody is functionally restricted to registered VASPs that maintain real-name bank accounts with partner banks (banks are the sole eligible custodians of customer KRW deposits). The bank partnership requirement operates as a de facto bank-gating mechanism, limiting KRW-linked exchange and custody operations to a small group of exchanges (Upbit, Bithumb, Coinone, Korbit, GOPAX). VAUPA/SFIA prescribe no specific minimum capital amount; barriers are enforced through the mandatory insurance or compensation-reserve requirement (covering losses from hacking, operational failure, or theft) and the 80% cold storage mandate. The FSC reported to the National Assembly on 17 March 2026 that it is reviewing separation of brokerage and custody, with custody to become a standalone licensable business line under second-phase Digital Asset Basic Act legislation (proposal, not enacted). (Source: Library of Congress, VAUPA; Tokenization Compliance, South Korea)

Assessment: The bank-only model provides strong prudential safeguards but significantly constrains market entry and innovation. In South Korea, the real-name bank account bottleneck has effectively created an oligopolistic custody market dominated by a handful of exchanges.

Model B: Dedicated Crypto Custody License

Concept: A purpose-built license category specifically for crypto custody, distinct from general banking or financial services licenses. This model allows crypto-native firms to enter the market without obtaining a full banking license while subjecting them to tailored prudential requirements.

Jurisdictions:

• Germany: The Kryptoverwahrgeschaft license under Section 1(1a) sentence 2 no. 6 of the German Banking Act (KWG), effective 1 January 2020, was among the first dedicated crypto custody licenses globally. Pre-MiCA, it required BaFin authorization and EUR 150,000 minimum capital for pure crypto custody (up to EUR 730,000 with added services). Under MiCA, custody (Class 2) requires EUR 125,000 permanent minimum own funds per Annex IV. Germany chose a shortened 12-month grandfathering period ending 31 December 2025. As of 12 April 2026, Germany led the EU with 53 authorised CASPs (~26% of the EU total of 199), the highest count among EU member states. (Source: BaFin Crypto Custody Business; Compliance Corylated, MiCA Turns One)

• Liechtenstein: A dual regime combining the TVTG (Token and TT Service Provider Act / "Blockchain Act," in force 1 January 2020) with MiCAR (taken into the EEA Agreement 24 June 2025). The TVTG offers dedicated registration as a TT/VT service provider — custody is a single unified category, VT-Verwahrer (Art. 2(1)(n)), covering safeguarding of both tokens and VT keys (the former separate TT Token Depositary and TT Key Depositary roles were merged); TT Protector remains distinct. The custodian holds a flat CHF 100,000 minimum capital (Art. 16(1)(b)); the issuance-value tiers — CHF 50,000 (≤CHF 5m), CHF 100,000 (CHF 5–25m), CHF 250,000 (≥CHF 25m) — apply to token issuers (Art. 16(1)(a)), not custodians. For MiCAR-in-scope custody, the CASP route applies (EUR 125,000, Class 2). The FMA is the integrated sole regulator. Bank Frick received MiCAR authorisation (custody, order execution, transfer services) on 20 January 2026 with passporting across 30 EEA states. As of 4 November 2025, 29 TVTG registrations existed (including 5 banks offering token custody). Transition to MiCAR by 1 July 2026. (Source: [TVTG / EWR-MiCA-DG]; matrix fact file)

• UAE (VARA): Dubai's Virtual Assets Regulatory Authority issued the Custody Services Rulebook (Version 2.0, effective 19 June 2025), requiring a dedicated separately licensed entity for custody (custody cannot be combined with other VA activities). Minimum paid-up capital: AED 4,000,000 (~USD 1,089,000). VARA requires client-level wallet segregation, proof-of-reserves, qualified-custodian (insured vault) arrangements, and risk-based cold/hot wallet allocation (VARA does not mandate a fixed cold-storage percentage). (Source: VARA Custody Services Rulebook; Neo Legal, VARA License)

• UAE (ADGM FSRA): Custody of virtual assets as a regulated financial service. Capital requirement: USD 4,000,000 Tier-1 capital for public fund custody; reduced to USD 250,000 BCR for non-public fund custody (effective August 2025). Notification-based process for accepted virtual assets as of June 2025. (Source: ACA Group, ADGM Prudential Changes; King & Spalding, ADGM FSRA Amendments)

• Bahrain: The Central Bank of Bahrain (CBB) Crypto-Asset Module (CRA Module, Volume 6 of CBB Rulebook) establishes four licensing categories. Custody is permitted under Categories 2, 3, and 4, with minimum paid-up capital of BHD 100,000 (Category 2), BHD 200,000 (Category 3), and BHD 300,000 (Category 4); Category 1 (no custody) is BHD 25,000. Bahrain prescribes 95% cold storage (per asset, CRA-8.1.9), mandatory multi-signature, no rehypothecation, and 1:1 holding. Annual licensing fee: 0.25% of relevant operating expenses (tiered maxima BHD 6,000–12,000 by category). Rain Management W.L.L. became the first licensed crypto-asset service provider in the Middle East in 2019. (Source: CBB CRA Module; Al Tamimi, CBB Crypto-Asset Regulations)

Assessment: The dedicated license model has proven the most effective at attracting institutional crypto custody entrants while maintaining regulatory standards. Germany's early adoption (2020) yielded a deep market within five years, demonstrating that purpose-built licensing frameworks generate market depth. Liechtenstein's TVTG (2020) likewise paired an early dedicated regime with statutory bankruptcy-remoteness, and the move to MiCAR now layers EEA passporting on top. VARA's higher capital threshold (AED 4M) and Bahrain's prescriptive custody conduct rules show the model can be calibrated for both institutional-grade and emerging-market contexts.

Model C: Trust Company Model

Concept: Crypto custody is authorized under existing trust company or trust corporation legislation, leveraging fiduciary law concepts for asset safekeeping. This model relies on trust law to provide asset segregation and client protection.

Jurisdictions:

• United States (state trust charters): Multiple US states authorize crypto custody under trust company charters. The New York Department of Financial Services (NYDFS) has licensed entities including Paxos Trust Company, Gemini Trust Company, and BitGo Trust Company under the New York Banking Law. South Dakota has issued trust charters (e.g., to Anchorage Digital, prior to its OCC national trust bank conversion). On 30 September 2025, the SEC issued a no-action letter permitting state trust companies to act as qualified custodians, and NYDFS updated its custodial-structures guidance. By early 2026 the OCC had conditionally approved a series of crypto firms for national trust bank charters, including (December 2025) Ripple, BitGo, Fidelity Digital Assets, Paxos, and First National Digital Currency Bank, followed by Stripe/Bridge, Crypto.com, Protego, and Coinbase (April 2026). (Source: OCC, National Trust Bank Charter Approvals, December 2025; Cadwalader, OCC Conditional Approvals)

• Canada: Provincial trust company legislation provides the primary pathway. Tetra Trust Company (Calgary, Alberta) is Canada's first trust company specifically licensed to custody digital assets, authorized by the Alberta Superintendent of Financial Institutions in July 2021. CIRO's Digital Asset Custody Framework (effective 3 February 2026) introduced a four-tier custodian structure. Trust company custodians require minimum equity of C$10 million (Canadian) or C$100 million (foreign). CTPs must keep at least 80% of client crypto with Acceptable Third-party Custodians (typically cold storage), with dealer self-custody capped at 20%. (Source: CoinDesk, CIRO Crypto Custody Rules; CIRO Digital Asset Custody Framework)

Assessment: The trust company model provides strong legal protections through established fiduciary law, particularly for asset segregation and insolvency treatment. The US state trust model has proven flexible, enabling both crypto-native firms and traditional institutions to offer custody, and the SEC's September 2025 no-action letter expressly endorsed state trust companies as qualified custodians. Canada's QuadrigaCX failure (2019) was a direct catalyst for the trust company and CIRO custodian framework developments, demonstrating how market failures drive regulatory evolution.

Model D: Comprehensive CASP/VASP Framework

Concept: A comprehensive, multi-service licensing regime that covers crypto custody as one of several regulated crypto-asset services within a single statutory framework. These regimes typically include passporting or cross-border recognition mechanisms.

Jurisdictions:

• European Union (MiCA): The Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), with Title V (CASP authorization, including custody) applicable from 30 December 2024, establishes harmonized rules across all 27 EU member states plus EEA countries. Custody and administration of crypto-assets on behalf of third parties is a regulated service under MiCA Title V. Capital requirement for custody is the Class 2 floor of EUR 125,000 (Annex IV), or one quarter of the preceding year's fixed overheads, whichever is higher (Article 67); Class 1 is EUR 50,000 and Class 3 is EUR 150,000. CASPs authorized in one member state can passport services across the EU single market. All transitional/grandfathering periods end uniformly on 1 July 2026 (no extensions, per ESMA's 17 April 2026 statement). As of 12 April 2026, third-party trackers reported 199 authorized CASPs (171 with passporting), with custody the most common service (117 of 199, ~59%). (Source: Dechert, MiCA CASP Regulation; BaFin, MiCAR Services)

• France: Under the PACTE Law (2019), France established the DASP (PSAN) regime with mandatory registration for custody services, plus enhanced registration (January 2024) and an optional full license. Over 100 DASPs registered under the national regime. France adopted the full 18-month MiCA transition, ending 1 July 2026. Societe Generale-FORGE obtained the first full DASP license in July 2023 and was authorized as a MiCA CASP for custody and administration (via Article 60 notification) on 23 October 2025; Coinhouse received full MiCA CASP authorization including custody on 7 May 2026. (Source: AMF, DASP Registration; SG Forge, First DASP License)

• Luxembourg: Custody is regulated principally under directly-applicable MiCAR (applicable to CASPs from 30 December 2024), with the national Law of 6 February 2025 designating the CSSF as the single competent authority. The custody capital floor is the MiCAR Class 2 minimum of EUR 125,000 (Annex IV). Luxembourg's distinctive national lead derives from its Blockchain Laws I–IV (the control-agent model, with Blockchain Law IV of 19 December 2024 decoupling issuance-account management from custody) and its unrivalled fund-custody/depositary ecosystem. The legacy VASP registration regime is in run-off to 1 July 2026. Coinbase Luxembourg S.A. was authorised as a CASP under MiCAR on 30 June 2025 (Coinbase's EU/MiCA hub, passporting across 27 EU states). (Source: [Law of 6 February 2025]; matrix fact file)

• Cayman Islands: Virtual assets are regulated under the Virtual Asset (Service Providers) Act (first enacted 2020, consolidated as the 2024 Revision), supervised solely by the Cayman Islands Monetary Authority (CIMA). Phase Two (in force since 1 April 2025) moved custody services and trading platforms from registration to full licensing. Custodians must segregate client virtual assets in identifiable wallets and hold client fiat at a CIMA-regulated bank (or a bank in a non-high-risk jurisdiction). There is no published fixed minimum capital figure — capital adequacy is assessed case-by-case against nature/scale/complexity, alongside regulatory-capital, recovery-plan, and stress-testing rules (confirmed unchanged February 2026). The February 2026 Market Conduct framework (MC-RSOG) added mandatory insurance (professional liability, theft/loss of client assets, business interruption, cybersecurity), with alternative risk-mitigation permitted where insurance is unavailable. (Source: [VASP Act 2024 Revision; CIMA Custody/VATP Rule]; matrix fact file)

• Singapore: The Payment Services Act 2019 (PSA), as amended (in effect April 2024), regulates DPT custody as a payment service. Major Payment Institution (MPI) license required for larger operators; Standard Payment Institution (SPI) for smaller-scale (base capital SGD 100,000). Capital requirement: SGD 250,000 base capital for MPI and for the DTSP regime. The Financial Services and Markets Act 2022 introduced a parallel DTSP licensing regime, effective with no transitional period from 30 June 2025. As of March 2026, MAS had 37 active MPI licenses for DPT services. Mandatory 90% cold storage under PS-G03. (Source: FintechNews Singapore, Licensed Providers; Allen & Gledhill, MAS DPT Regulations)

• Japan: The Payment Services Act (PSA) requires registration of all Crypto Asset Exchange Service Providers (CAESPs) with the FSA (covering custody-only activity since the May 2019 amendment, in force May 2020). Minimum stated capital: JPY 10 million plus positive net assets (the often-cited "JPY 50 million practical minimum" is secondary commentary, NOT VERIFIED). Japan mandates ≥95% cold storage and requires hot-wallet exposure (≤5%) to be backed 100% by the operator's own crypto ("Redemption Guarantee Crypto Assets"). The Cabinet approved a bill on 10 April 2026 migrating crypto regulation from the PSA to the Financial Instruments and Exchange Act (FIEA), effective ~fiscal 2027 if enacted. JVCEA serves as a recognized self-regulatory organization. (Source: Disruption Banking, Crypto Regulation Japan 2025; Dzilla, Japan Crypto Framework)

• Hong Kong: The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), amended effective 1 June 2023, requires licensing of Virtual Asset Trading Platforms (VATPs), with custody embedded. The proposed standalone VA Custodian license requires HK$10 million paid-up share capital (~US$1.28M), with minimum liquid capital up to HK$3 million and excess liquid capital ≥12 months of operating expenses. FSTB/SFC consultation conclusions (24 December 2025) narrowed the custody scope to private-key safekeeping and added an expedited pathway; a bill for all four regimes is targeted for 2026. (Source: Davis Polk, Hong Kong VATP Regime; Gibson Dunn, Hong Kong Custody Consultation)

• Brazil: Law No. 14,478/2022 (BVAL, effective 20 June 2023) established the regulatory foundation. BCB Resolutions 519/520/521/2025 (in force 2 February 2026) operationalized the framework. SPSAVs (Sociedades Prestadoras de Servicos de Ativos Virtuais) must be authorized by the BCB in three categories (Intermediary, Custodian, Broker), with an independent technical certification (Instruction 701/2026) gating custody/intermediation. Capital requirements moved to an activity-based formula set by Resolution BCB 517 and Joint Resolution 14 (both 3 November 2025), producing an R$10.8 million–R$37.2 million span (cost component + activities component x captation factor 1.0-1.5), with no simple category-to-figure mapping. A 270-day adaptation period runs to 30 October 2026. (Source: Chainalysis, Brazil Crypto Framework; Notabene, BCB VASP Resolutions)

Assessment: Comprehensive CASP/VASP frameworks provide the most complete regulatory coverage and, where passporting exists (EU MiCA, with Liechtenstein and Luxembourg as EEA/EU custody venues), the strongest cross-border interoperability. The EU's MiCA passporting mechanism is the single most significant structural advantage of this model, eliminating the need for separate licensing in each member state — Luxembourg leverages it as Coinbase's EU hub. Singapore's deliberate selectivity (37 MPI licenses) and the Cayman Islands' phased registration-to-licensing tightening show that comprehensive frameworks can also function as quality filters.

Model E: Bespoke/Special Purpose License

Concept: Purpose-built legal structures that create new categories of regulated entities specifically designed for digital asset activities, distinct from both traditional banking and generic financial services licenses.

Jurisdictions:

• United States (Wyoming SPDI): The Special Purpose Depository Institution charter (HB 74, 2019) is a bespoke bank charter for digital asset custody. SPDIs are fully reserved (100% of client fiat deposits), uninsured, and cannot lend. Statutory minimum capital is USD 5 million, with a practical floor of 1.25–1.75% of assets under custody or USD 10 million, whichever is greater. Custodia Bank and Kraken Financial are notable SPDI holders; Kraken Financial became the first crypto bank to receive a Fed master account on 4 March 2026. (Source: Wyoming Division of Banking, SPDI; Kraken, SPDI Explained)

• Switzerland: Switzerland offers a tiered bespoke framework: (1) FinTech license under Article 1b Banking Act — CHF 300,000 minimum capital, deposits capped at CHF 100 million, no lending; (2) DLT Trading Facility license under FMIA — CHF 1 million for trading-only, CHF 5 million for custody/settlement/clearing; (3) Proposed Crypto Institution license under FinIA reform (consultation closed 6 February 2026, capital thresholds not yet published, expected late 2026 or early 2027). The DLT Act (2021) provides statutory bankruptcy protection for custodied crypto assets under DEBA Articles 242a–242b. BX Digital AG became the first DLT trading facility licensed in March 2025; FINMA Guidance 01/2026 addresses foreign sub-custodian delegation and equivalence. (Source: FINMA, FinTech Licence; FINMA, DLT Trading Facility License; Loyens & Loeff, FinIA Reform)

• Bermuda: The Digital Asset Business Act 2018 (DABA) is a bespoke regime supervised solely by the Bermuda Monetary Authority (BMA), with custody captured as "providing custodial wallet services." It issues a three-class licence (Class T Test / Class M Modified / Class F Full). Minimum net assets are US$100,000 for Class M and Class F (or higher as the BMA directs), with a custody annual-fee floor of US$150,000 (the highest activity-specific minimum). DABA provides statutory creditor-exclusion: s.18(4) makes custodied client digital assets not property of the licensee and "not subject to the claims of creditors," and the Custody of Client Assets Rules 2025 add a pari-passu insolvency waterfall. s.18(1) mandates a surety bond, trust account, or indemnity insurance for clients, and the Custody Code (February 2024) sets prescriptive key-management standards (≥256-bit entropy seeds, ≥3-person seed ceremony, M-of-N multi-sig). (Source: [Digital Asset Business Act 2018; DAB (Custody of Client Assets) Rules 2025]; matrix fact file)

• Gibraltar: The Financial Services (DLT Providers) Regulations 2017 (in force 1 January 2018, consolidated under the Financial Services Act 2019) created the world's first bespoke DLT-specific regime, supervised by a single integrated regulator (GFSC) on a principles-based, outcome-focused basis (ten regulatory principles). Custodial wallet/key-storage is captured directly as a licensable DLT Provider activity; a separate non-custodial Virtual Asset Arrangement Provider (VAAP) category was added 27 October 2025 (Principle 5 does not apply to VAAPs). There is no single fixed statutory minimum capital figure — an individualised, risk-based "adequate financial and non-financial resources" test applies under Principle 3 (set case-by-case). Client assets must be segregated (Principle 5 / Guidance Note 5), but there is no crypto-specific statutory bankruptcy-remoteness provision (NO DATA FOUND); protection rests on operational segregation plus general trust/insolvency law. (Source: [Financial Services (DLT Providers) Regulations 2017/2020; GFSC Guidance Note 5]; matrix fact file)

Assessment: Bespoke/special purpose licenses allow regulators to craft requirements precisely calibrated to the risk profile of crypto custody without the overhead of full banking regulation. Wyoming's SPDI model (full-reserve, no lending) eliminates the fractional-reserve risk that underlies traditional bank failures. Switzerland's tiered approach and Bermuda's DABA both pair bespoke licensing with statutory bankruptcy protection — Bermuda's s.18(4) creditor-exclusion and pari-passu waterfall make it a small-jurisdiction analogue to Switzerland's DEBA. Gibraltar's principles-based regime (the first DLT-specific statute globally, January 2018) is the most flexible, though its main relative weakness is the absence of a codified crypto-specific bankruptcy-remoteness statute.

Model F: No Specific Regime / General Financial License / Enacted-Not-Yet-Commenced

Concept: No dedicated crypto custody license is yet operative. Custody may fall within the perimeter of general financial services regulation, or sit under an enacted-but-not-yet-commenced framework. Firms typically operate under AML registration in the interim.

Jurisdictions:

• Australia (enacted, not yet commenced): The Corporations Amendment (Digital Assets Framework) Act 2026 received Royal Assent on 8 April 2026 and commences 9 April 2027 (with a six-month transition). Until commencement, digital currency exchange providers register with AUSTRAC for AML/KYC only. The Act introduces two new financial products — Digital Asset Platforms (DAPs) and Tokenised Custody Platforms (TCPs) — requiring an Australian Financial Services Licence (AFSL); DAP/TCP-specific capital figures are not yet published (instruments due months 6–12 of the roadmap, NOT VERIFIED). ASIC's INFO 225 (October 2025) currently permits omnibus holding. No fixed cold-storage percentage is mandated. (Source: Piper Alderman, Digital Asset Legislation; Treasury Ministers, Digital Asset Laws)

• United Kingdom (transitional state): The UK currently operates under an MLR registration (AML-only) model administered by the FCA. The full FSMA-based cryptoasset regime, including custody ("safeguarding"), goes live on 25 October 2027; the application gateway opens 30 September 2026 (closing 28 February 2027). The proposed CRYPTOPRU prudential sourcebook sets a Permanent Minimum Requirement (PMR) of GBP 150,000 for safeguarding, plus an activity-based K-factor (K-CSG) of 0.04% of average client cryptoassets safeguarded. The Property (Digital Assets etc) Act 2025 (Royal Assent 2 December 2025) confirms digital assets as a third category of personal property (England & Wales). (Source: FCA, New Regime for Cryptoasset Regulation; Linklaters, FCA MiFID-Style Capital; Ashurst, FCA Stablecoins and Custody)

Assessment: The absence of an operative custody regime creates significant risks during the interim. Australia's pre-reform lack of crypto-specific licensing contributed to multiple retail custody failures (e.g., FTX Australia), though its enacted DAF Act 2026 now closes the gap once it commences in April 2027. The UK's deliberate phased approach — AML registration now, full FSMA authorization by October 2027 — represents a considered transition reinforced by the Property (Digital Assets etc) Act 2025, but the extended timeline means the UK is operating with a regulatory gap relative to the EU (MiCA live since December 2024) and Singapore (PSA amendments live since April 2024).

2. Comparative Analysis

The following table provides a side-by-side comparison of custody licensing requirements across all 20 surveyed jurisdictions. Capital requirements, processing times, and costs are drawn from the verified per-jurisdiction fact matrix.

Note: Links are omitted from table cells per formatting rules. See jurisdiction-specific sections and the Verification Notes appendix for full source citations.

3. What Works and What Doesn't

This section evaluates licensing models based on observable outcomes: market development, investor protection, enforcement effectiveness, and international competitiveness.

3.1 What Works

Dedicated crypto custody license category (Model B)

The evidence strongly supports creating a purpose-built custody license. Germany's Kryptoverwahrgeschaft license, introduced in January 2020, channeled EUR 48.7 billion in custodied assets by June 2025 (28% YoY growth) and led the EU with 53 authorised CASPs by April 2026. The dedicated license provided regulatory certainty for crypto-native firms that could not or did not wish to obtain full banking licenses, while imposing tailored requirements (cold storage, key management, asset segregation) that generic financial services licenses do not address. Liechtenstein's TVTG (2020) demonstrates the same pattern in a smaller jurisdiction, pairing dedicated registration with statutory creditor-exclusion and now EEA passporting.

VARA's dedicated custody services license in Dubai — requiring a separately licensed entity, AED 4M capital, qualified-custodian (insured vault) arrangements, and client-level wallet segregation — has attracted institutional-grade operators. The higher capital threshold filters for institutional readiness.

Tiered licensing with proportionate requirements (Models C, D, E)

Multiple jurisdictions have adopted tiered licensing with successful outcomes:

• Canada (CIRO, February 2026): Four-tier custodian framework calibrated by capital, governance, cybersecurity, and insurance. This framework directly addressed the QuadrigaCX failure (2019), where a single custodian's key management failure resulted in approximately CAD 250 million in client losses.

• Switzerland (FINMA): Multiple existing tiers (SRO membership, FinTech license, DLT trading facility, banking license) with a fifth (crypto institution) under consultation. Each tier has calibrated capital, supervisory, and reporting requirements. Switzerland's tiered approach has attracted both crypto-native firms and traditional institutions (SIX Digital Exchange, Sygnum Bank, AMINA).

• Bermuda (BMA): Three-class DABA licence (Class T Test / Class M Modified / Class F Full) with a sandbox-style Test class for new entrants, paired with statutory creditor-exclusion (s.18(4)) and a pari-passu insolvency waterfall (Custody Rules 2025).

• Bahrain (CBB): Four licensing categories, with custody progressively available from Category 2 upward. Capital scales from BHD 25,000 (Category 1, no custody) to BHD 300,000 (Category 4, exchanges + custody). The sandbox-to-license pathway has proven effective for new market entrants.

• Singapore (MAS): Dual-track PSA (SPI/MPI) and FSMA (DTSP) licensing, with 37 MPI licenses granted as of March 2026. MAS's deliberate selectivity — rejecting many applicants — has maintained high standards while building a critical mass of licensed operators.

Passporting and cross-border recognition (Model D)

MiCA's EU passporting mechanism is the strongest evidence of what works in cross-border custody licensing. A CASP authorized in any EU member state can provide services across all 27 member states plus EEA countries without separate licensing — Luxembourg (Coinbase's EU hub) and Liechtenstein (Bank Frick, passporting across 30 EEA states) both compete on this single-market reach. As of April 2026, 199 CASPs were authorized EU-wide, of which 171 held passporting and ~117 offered custody. Germany's early MiCA adoption (53 CASPs by April 2026, the most among EU member states) demonstrates the first-mover advantage of early passporting participation.

Statutory bankruptcy protection

Switzerland's DEBA Articles 242a–242b provide statutory segregation of custodied crypto assets from the custodian's bankruptcy estate — a level of legal certainty unmatched in most jurisdictions. Liechtenstein (Art. 25 TVTG + Insolvenzordnung (IO) Art. 41) and Bermuda (DABA s.18(4) creditor-exclusion + pari-passu waterfall) provide comparable codified protection, placing all three at the top tier for legal certainty. Japan's statutory preferential repayment rights for customers of registered exchanges similarly provide strong insolvency protection. These statutory protections are significantly more effective than contractual arrangements alone, as demonstrated by the FTX bankruptcy where commingled customer assets were exposed to general creditor claims.

3.2 What Doesn't Work

No operative custody requirement (Model F interim states)

Australia's pre-reform lack of crypto custody licensing contributed to significant consumer losses. The absence of custody-specific obligations meant intermediaries could commingle client and proprietary assets, fail to implement adequate key management, and operate without insurance or capital buffers. The FTX Australia collapse crystallized this failure: customers had no regulatory recourse specific to crypto custody. The enacted DAF Act 2026 addresses this, but only once it commences in April 2027.

Bank-only restriction without alternatives

The US experience with SAB 121 (SEC Staff Accounting Bulletin, effective April 2022 to January 2025) demonstrates the market-distorting effect of restricting crypto custody to banks without providing feasible alternatives. SAB 121 required reporting companies (including banks) to recognize crypto assets held in custody as on-balance-sheet liabilities with corresponding capital implications. This effectively made bank custody of crypto assets economically prohibitive. The rescission of SAB 121 via SAB 122 on 23 January 2025 (effective 30 January 2025) removed this barrier; within 11 months the OCC conditionally approved five national trust bank charters for crypto firms (Ripple, BitGo, Fidelity Digital Assets, Paxos, First National Digital Currency Bank), with further approvals (Stripe/Bridge, Crypto.com, Protego, Coinbase) following in early 2026. The lesson: regulatory frameworks that function as de facto prohibitions — even when not explicitly banning custody — stifle market development without improving safety. (Source: Deloitte, SAB 122; Jones Day, SAB 121 Rescission)

Overly complex multi-regulator frameworks

The United States and UAE illustrate the costs of regulatory fragmentation:

• In the US, crypto custody is potentially subject to SEC, OCC, CFTC, FDIC, Federal Reserve, FinCEN, and state-level regulation depending on the asset classification and entity type. This creates compliance uncertainty, arbitrage opportunities, and significant legal costs for custodians — though most 2025–2026 changes (SEC no-action letters, OCC interpretive letters, staff guidance) have moved in a coordinated permissive direction, with the GENIUS Act as the main statutory anchor.

• In the UAE, five regulators (VARA, ADGM FSRA, DFSA, CBUAE, and the federal CMA, which replaced the SCA on 1 January 2026) operate overlapping frameworks. While each framework is individually well-designed, the aggregate complexity creates jurisdictional confusion and elevated compliance costs.

3.3 Mixed Results

General financial license applied to crypto (Model D variants)

Comprehensive CASP/VASP frameworks produce mixed results depending on implementation:

• Positive: MiCA's harmonized approach reduces fragmentation within the EU. Singapore's PSA framework is clear and well-enforced. The Cayman Islands' phased move (registration to full Phase Two licensing in April 2025, plus the February 2026 Market Conduct framework) shows a maturing, tightening trajectory.
• Negative: Generic payment services licensing may not adequately address crypto-specific risks (key management, hot/cold wallet architecture, on-chain reconciliation). Japan's PSA framework, while mature, required multiple post-incident amendments (after Mt. Gox 2014, Coincheck 2018) to reach its current prescriptive level, and is now migrating to the FIEA. Several maturing centres (Cayman, Gibraltar, Liechtenstein, Luxembourg) leave key quantitative prudential parameters — cold-storage ratios, fixed capital minimums — case-by-case or unstated rather than codified.
• Key variable: The quality of crypto-specific secondary regulation (technical standards, guidance notes) matters more than the primary legislative vehicle.

4. Recommended Framework: Tiered Custody Licensing

This section proposes a tiered licensing framework for crypto custody, with each tier calibrated to the risk profile and systemic importance of the custodian. All thresholds cite real-world precedents.

Tier 1: Registration + Minimum Standards (Small Custodians)

Scope: Custodians holding less than USD 50 million in aggregate client assets under custody (AUC).

Rationale for threshold: Australia's DAF Act framework uses AUD 10 million in annual transactions (~USD 6.5 million) as its de minimis threshold, below which only notification is required. Singapore's SPI license covers smaller-scale DPT operations below prescribed volume thresholds. The USD 50 million threshold encompasses smaller custodians that are below systemic significance but above de minimis, aligning with the lower end of IOSCO's graduated regulatory approach.

Requirements:

Tier 2: Full License + Enhanced Prudential (Medium Custodians)

Scope: Custodians holding USD 50 million to USD 5 billion in aggregate AUC.

Rationale for threshold: Switzerland's FinTech license permits deposits up to CHF 100 million (~USD 112 million). The MiCA EUR 125,000 (Class 2, custody) capital floor is designed for firms at this scale. Canada's CIRO Tier 2-3 custodian requirements target firms with moderate capital and enhanced assurance. The USD 5 billion upper threshold marks the boundary where custodians begin to hold systemically significant asset volumes.

Requirements:

Tier 3: Enhanced Prudential + Systemic Safeguards (Large/Systemic Custodians)

Scope: Custodians holding more than USD 5 billion in aggregate AUC, or designated as systemically important by the competent authority.

Rationale for threshold: Germany's licensed custody sector held EUR 48.7 billion by June 2025. The OCC's conditional approval of national trust bank charters in December 2025 (Ripple, BitGo, Fidelity Digital Assets, Paxos, First National Digital Currency Bank) and early 2026 targets entities that will hold multi-billion-dollar AUC. ADGM's USD 4 million Tier-1 capital for public fund custody reflects the systemic risk profile of large custodians. The Basel Committee's crypto-asset exposure standards apply to banks with significant crypto holdings.

Requirements:

Transition and Grandfathering Provisions

All tiered frameworks should include transition provisions for existing operators. Real-world precedents:

5. Decision Matrix for Regulators

This matrix assists regulators in selecting the appropriate licensing model based on their jurisdiction's characteristics, institutional capacity, and policy objectives.

If your jurisdiction has no existing crypto-specific regulation:

Consider: Model D (Comprehensive CASP/VASP framework) with tiered implementation

Because: The EU's MiCA framework demonstrates that a comprehensive, single-statute approach provides regulatory clarity and attracts market participants. Starting with a comprehensive framework avoids the need for incremental, reactive legislation. Singapore's PSA and the Cayman Islands' VASP Act provide non-EU examples of comprehensive frameworks built on payment-services or bespoke VASP legislation.

Implementation path: Enact primary legislation defining regulated crypto-asset services (including custody); designate a single competent authority; issue secondary regulations with tiered capital and operational requirements; provide 12-18 months transition for existing operators.

If your jurisdiction has AML-only registration (no prudential custody regulation):

Consider: Model B (Dedicated custody license) added to existing AML framework

Because: The UK's current gap between MLR registration and full FSMA authorization (October 2027) illustrates the risk of extended transition periods. Germany's experience shows that a dedicated custody license can be implemented rapidly (KWG amendment effective January 2020) and attracts significant market entry; Liechtenstein's TVTG (2020) and Bahrain's CRA Module show the same is achievable in smaller jurisdictions. Adding a dedicated custody license to existing AML registration provides incremental improvement without requiring a full legislative overhaul.

Implementation path: Amend existing financial services or banking legislation to define crypto custody as a regulated activity; establish capital, key management, and segregation requirements; permit existing AML-registered firms to apply within 6-12 months.

If your jurisdiction is a financial center seeking to attract institutional custody:

Consider: Model E (Bespoke/special purpose license) or Model B (High-standard dedicated license)

Because: Wyoming's SPDI charter, Switzerland's FinTech/DLT facility licenses, Bermuda's DABA, and Gibraltar's DLT Provider regime were all designed to attract crypto-native institutional firms. VARA's high-capital-threshold custody license (AED 4M) and ADGM's framework have attracted institutional operators. The key differentiator is the combination of: (1) regulatory certainty, (2) adequate capital thresholds to signal institutional credibility, and (3) statutory asset protection (bankruptcy segregation — as in Switzerland, Liechtenstein, and Bermuda).

Implementation path: Create a bespoke license category with: minimum capital of USD 1 million+; high cold-storage standards (90-95%); individual client wallet segregation; statutory bankruptcy protection for custodied assets; mutual recognition or passporting agreements with peer jurisdictions.

If your jurisdiction has a bank-dominated financial sector:

Consider: Model A (Bank custody) with Model B (Dedicated license) as a parallel pathway

Because: South Korea's bank-only model created an oligopolistic market dominated by a handful of exchanges. Adding a parallel dedicated custody license (as Germany did alongside its banking framework) allows non-bank institutions to participate while preserving prudential standards. The US experience with SAB 121 shows that restricting custody to banks without feasible compliance pathways leads to market suppression rather than risk reduction.

Implementation path: Authorize banks to provide crypto custody with appropriate capital treatment (per Basel Committee standards); simultaneously create a dedicated custody license for non-bank entities with calibrated requirements.

If your jurisdiction prioritizes cross-border interoperability:

Consider: Model D (Comprehensive framework with passporting)

Because: MiCA's EU passporting mechanism is the gold standard for cross-border custody licensing, leveraged by EU/EEA venues including Luxembourg and Liechtenstein. Hong Kong's ASPIRe roadmap and Singapore's DTSP regime also pursue mutual recognition. Without passporting or mutual recognition, custodians face duplicative licensing costs across each jurisdiction they operate in, which is particularly burdensome for institutional custodians with global client bases.

Implementation path: Align regulatory standards with IOSCO CDA Recommendations and FATF standards; negotiate mutual recognition agreements or passporting frameworks with target jurisdictions; adopt common supervisory reporting standards.

If your jurisdiction is resource-constrained:

Consider: Tiered registration (Tier 1 only) with progressive enhancement

Because: Bahrain's CBB implemented a four-category licensing framework with a regulatory sandbox pathway, and Bermuda's DABA Class T (Test) class similarly lets new entrants demonstrate compliance before graduating — both show that smaller jurisdictions with limited supervisory capacity can build effective crypto custody regulation. The sandbox/test-to-license model reduces the burden on the regulator by allowing market-based learning before full licensing.

Implementation path: Start with mandatory registration and basic standards (AML, segregation, disclosure); add capital and audit requirements for firms exceeding defined thresholds; use sandbox or test-class mechanisms for new entrants; leverage international standards (IOSCO, FATF) as ready-made compliance frameworks.

If your jurisdiction has recently experienced a major custody failure:

Consider: Model B (Dedicated custody license) with enhanced operational requirements and mandatory insurance

Because: Every major custody failure has catalyzed regulatory reform. Japan's Mt. Gox collapse (2014, ~USD 460 million lost) led to the PSA registration requirement (2017) and a 95% cold storage mandate. Japan's Coincheck hack (2018, ~USD 530 million) led to further strengthening of segregation and key management requirements. Canada's QuadrigaCX failure (2019, ~CAD 250 million) led directly to the CIRO tiered custodian framework (2026). South Korea's repeated exchange incidents led to VAUPA (2024) with 80% cold storage and mandatory insurance/reserves.

Implementation path: Mandate immediate registration of all operating custodians; impose cold storage requirements (minimum 80%, preferably 90-95%); require insurance or reserves; establish asset segregation with independent verification; create an incident reporting obligation with defined response timelines.

6. Key Principles for Licensing Framework Design

Drawing from the evidence across all 20 jurisdictions, the following principles should guide licensing framework design:

Principle 1: Proportionality. Requirements should scale with the size, complexity, and systemic importance of the custodian. Switzerland's tiered framework, Canada's CIRO four-tier custodian structure, Bermuda's three-class DABA licence, and the recommended Tier 1/2/3 framework above all embody this principle. Disproportionate requirements (e.g., bank-level capital for small custodians) suppress market entry without commensurate risk reduction.

Principle 2: Technology neutrality. Licensing requirements should be outcome-based (e.g., "protect client assets from unauthorized access") rather than technology-prescriptive (e.g., "use specific HSM model"). Switzerland's FINMA, Gibraltar's GFSC, and Liechtenstein's FMA take outcome-based approaches; Germany's BaFin and Bahrain's CBB are more prescriptive. Both work, but outcome-based requirements adapt better to technological evolution (e.g., MPC replacing multi-sig).

Principle 3: Regulatory clarity. A single competent authority or clearly delineated authority split reduces compliance costs and enforcement gaps. Germany (BaFin sole authority), Singapore (MAS), Bahrain (CBB), Luxembourg (CSSF), Liechtenstein (FMA), Bermuda (BMA), Cayman (CIMA), and Gibraltar (GFSC) all use single integrated regulators and outperform the US (6+ federal regulators plus states) and UAE (five regulators) on regulatory clarity metrics.

Principle 4: Statutory asset protection. Custody licensing should be accompanied by statutory provisions addressing the treatment of custodied crypto assets in insolvency. Switzerland (DEBA 242a-242b), Liechtenstein (TVTG Art. 25 + Insolvenzordnung (IO) Art. 41), Bermuda (DABA s.18(4) + pari-passu waterfall), Japan (statutory preference rights), and the UK (trust-based ring-fencing reinforced by the Property (Digital Assets etc) Act 2025) provide the strongest protections. Contractual protections alone are insufficient, as the FTX bankruptcy demonstrated.

Principle 5: International alignment. Frameworks should align with IOSCO CDA Recommendations, FATF standards, and Basel Committee prudential standards. As of October 2025, 12 jurisdictions had implemented final measures for IOSCO's custody recommendation, with 3 more in consultation.

Principle 6: Transition pathway. All new frameworks should include grandfathering provisions of 12-18 months (per MiCA precedent) with simplified application procedures for existing operators. Abrupt transitions risk market disruption and regulatory arbitrage; Singapore's no-transitional DTSP regime and Cayman's 90-day custody-application window are the more aggressive end of the spectrum.

Principle 7: Enforcement credibility. A licensing framework is only as effective as its enforcement. Germany's BaFin (Ethena GmbH wind-down, public name-and-warn strategy), VARA (KuCoin cease orders, marketing penalties up to AED 10M), Cayman's CIMA (Gate.io public notice), and MAS (selective licensing with revocation powers) demonstrate that visible enforcement is essential to regulatory credibility. Jurisdictions should budget for enforcement capacity from the outset.

Principle 8: Sandbox/test-class-to-license pathway. For emerging markets or jurisdictions building regulatory capacity, a sandbox mechanism (Bahrain's CBB FinHub 973) or a dedicated test-class licence (Bermuda's DABA Class T) provides a structured pathway for new entrants to demonstrate compliance before full licensing, building both regulatory expertise and market development simultaneously.

Cross-References

This document should be read in conjunction with:

• Asset Segregation -- for detailed analysis of segregation models and insolvency treatment across jurisdictions
• Key Management -- for technical standards on cold storage, HSM, MPC, and key ceremony requirements
• Capital Requirements -- for detailed analysis of prudential capital frameworks and Basel Committee standards
• IOSCO -- for the CDA Recommendations framework and implementation status
• Basel Committee -- for crypto-asset exposure prudential standards
• FATF -- for AML/KYC standards and Travel Rule requirements

Verification Notes

All factual claims in this document mirror the canonical per-jurisdiction fact matrix covering all 20 surveyed jurisdictions (verified as of 4 June 2026). Aggregate "X of N" figures are derived from the matrix for N=20. Key verification details:

Items requiring ongoing monitoring:

• UK FCA capital requirements (CRYPTOPRU): proposed in CP25/15 / CP25/42; final rules expected 2026. Figures cited are proposed, not final.
• Australia DAF Act instruments: DAP/TCP asset-holding (s 912BE), transactional/settlement (s 912BF), and financial-requirement (capital) standards await legislative instruments (roadmap months 6-12); thresholds NOT VERIFIED.
• Brazil SPSAV capital: the R$10.8M-R$37.2M span is set by the activity-based formula of Resolution BCB 517 + Joint Resolution 14 (3 Nov 2025); it is formula-driven (no fixed per-SPSAV-category figure). Public Consultation 126/2025 (Basel-aligned prudential capital) remains draft.
• Japan FIEA migration: Cabinet bill 10 April 2026; effective ~fiscal 2027 if enacted. Current requirements under PSA remain in force.
• Hong Kong dedicated custody license: bill targeted 2026 under ASPIRe; specific requirements (HK$10M paid-up) proposed, not yet enacted.
• South Korea standalone custody licence: under FSC review (17 March 2026 report); capital/segregation/bankruptcy-remoteness for a dedicated regime NOT VERIFIED.
• Liechtenstein / Luxembourg / Cayman / Gibraltar: several quantitative prudential parameters (fixed capital minimums, cold-storage ratios) are case-by-case or unstated rather than codified; treated as NOT VERIFIED where the matrix so indicates.
• Switzerland Crypto Institution License: FinIA reform capital thresholds not yet published (consultation closed 6 February 2026).