What Works & What Doesn't

This analysis synthesises findings from 18 jurisdiction profiles and the guidance layer to identify which regulatory approaches to digital asset insurance produce measurable results -- positive or negative -- and which remain contested. The 18 jurisdictions are the United States, Bermuda, Canada, the Cayman Islands, Australia, Hong Kong, Japan, Singapore, South Korea, the European Union, France, Germany, Liechtenstein, Switzerland, the United Kingdom, Bahrain, the UAE, and an emerging-markets cluster (Brazil, Nigeria, South Africa, India). Every item below is grounded in at least one verified country outcome. Market-capacity, premium, and per-policy figures are self-reported by the named provider or broker and flagged as such.

1. What Clearly Doesn't Work

1.1 No Insurance Mandate Combined with No Deposit Guarantee

• The approach -- Relying on operator goodwill and self-funded compensation without requiring exchanges to hold insurance or participate in a deposit guarantee scheme
• Country --
  Japan
• Verified outcome -- Coincheck lost ~$530 million (500 million NEM) in January 2018 with zero insurance; the exchange paid ~$420 million from its own capital to roughly 260,000 affected users. DMM Bitcoin lost ~$305-308 million in May 2024 (4,502.9 BTC, Lazarus Group suspected) with no theft insurance; the parent group injected ~$365 million via DMM.com, but the strain proved unsustainable -- DMM Bitcoin shut down in December 2024 and transferred accounts to SBI VC Trade. The Deposit Insurance Corporation of Japan (DICJ) deposit scheme explicitly excludes crypto, which is classified as "property value" under the Payment Services Act rather than a deposit.
• Why it fails -- Without a mandate, exchanges rationally avoid the cost of insurance. When hacks occur, the only recovery mechanism is the operator's balance sheet, which is itself vulnerable. Japan's FSA is now migrating crypto regulation from the PSA to the FIEA -- the Cabinet approved the FIEA amendment bill on 10 April 2026 (effective as early as fiscal 2027 if passed), introducing mandatory liability reserves with an optional approved-insurance count, insider-trading bans, and an unregistered-operator penalty raised to ten years' imprisonment / JPY 10 million -- precisely because the voluntary approach failed repeatedly at scale.

1.2 Self-Insurance Without External Oversight

• The approach -- Allowing exchanges to display "insurance fund" balances generated internally, with no independent verification, no licensed insurer, and no regulatory capital standards
• Country -- Global (FTX)
• Verified outcome -- FTX displayed a publicly visible "Insurance Fund" whose balance was fabricated -- co-founder Gary Wang testified that he wrote code generating a random number to display as the fund balance. When FTX collapsed in November 2022, no meaningful insurance recovery was available because fraud is excluded from commercial cover. The Chapter 11 estate ultimately identified roughly $7 billion in recoverable assets, and the confirmed plan pays about 98% of creditors approximately 118% of their petition-date claim value -- recovery driven by asset clawback and rising token prices, not insurance.
• Why it fails -- Self-insurance funds with no external audit, no licensed underwriter, and no regulatory oversight provide the appearance of protection without the substance. Users reasonably but incorrectly believed their assets were protected. The FTX failure prompted regulators worldwide to distinguish sharply between genuine insurance and operator reserve claims.

1.3 False Deposit-Insurance Claims by Crypto Firms

• The approach -- Crypto platforms implying or stating that customer deposits are covered by government deposit-insurance schemes
• Country --
  United States
• Verified outcome -- The FDIC issued cease-and-desist letters to nine entities in 2022-2023 for falsely implying FDIC coverage of crypto. Voyager Digital claimed it was FDIC-insured (July 2022); an FTX US officer stated that direct deposits sat in "individually FDIC-insured bank accounts" (August 2022). Consumers who relied on these representations lost access to funds when the platforms failed. The exclusion has since been reinforced rather than relaxed: the FDIC's GENIUS Act stablecoin NPR (FIL-11-2026, published 7 April 2026, comments due 9 June 2026) confirms that stablecoin reserves are not pass-through insured, and the SEC/CFTC joint interpretation (Release 33-11412 / CFTC PR 9198-26, 17 March 2026) sets a five-part token taxonomy without extending any deposit or investor guarantee to crypto.
• Why it fails -- No major jurisdiction extends deposit insurance to crypto held on exchanges, and the two newest US measures (the GENIUS Act NPR and the joint SEC/CFTC interpretation) explicitly decline to do so even for stablecoin reserves. When firms falsely imply coverage, consumers make decisions based on a non-existent safety net, and FDIC enforcement arrives only after the damage is done.

1.4 Voluntary Insurance Alone Without Structural Mandates

• The approach -- Encouraging but not requiring digital asset service providers to obtain insurance, relying on market forces to drive adoption
• Countries --
  Singapore,
  UK
• Verified outcome -- Only approximately 11% of global cryptocurrency holders carry any form of insurance coverage (AM Best, self-reported). Singapore's MAS does not require its 37 licensed major payment institutions with DPT-service activity to hold insurance as a licensing condition; PS-G03 mandates only that at least 90% of customer assets sit in cold storage, leaving the ~10% hot-wallet gap to voluntary cover. The BingX hack in Singapore (20 September 2024, ~US$52 million hot-wallet, North Korea-linked) produced no insurance recovery -- BingX compensated users from its own reserves. The UK imposes no bespoke crypto-insurance mandate, and custodian insurance remains voluntary even under the forthcoming regime (SI 2026/102, in force 25 October 2027), despite hosting the world's largest specialty market at Lloyd's.
• Why it fails -- Information asymmetry and adverse selection create classic market failure. Exchanges with strong security treat insurance as an unnecessary cost; exchanges with weak security cannot obtain coverage at affordable rates. The result is systematic underinsurance across the industry.

1.5 Disclosure-Only Frameworks Without Prescribed Categories or Verification

• The approach -- Establishing regulatory frameworks that expect or disclose insurance without prescribing which categories must be held or verifying that regulated entities actually obtain coverage
• Country --
  Cayman Islands (pre-2026 posture)
• Verified outcome -- CIMA's thematic desk-based review (review period September 2024-February 2025, published November 2025, 11 VASPs) found that 82% of the reviewed VASPs lacked any cybersecurity insurance under the then-prevailing disclosure-based VASP Act regime, which set insurance/indemnity expectations but prescribed no categories, no approved-insurer list, and no numeric minimums. In direct response, Cayman moved to a prescriptive posture: the Market Conduct RSOG (MC-RSOG, effective February 2026) now lists the insurance categories VASPs must hold -- professional liability, theft/loss of client assets, business interruption, and cybersecurity -- on an "insure-or-mitigate" basis. The first full Cayman VASP licence issued to BCXPro (JMSC Trading Limited, virtual asset custody) on 5 February 2026.
• Why it fails -- A framework that creates expectations without specifying categories or verifying compliance produces compliance theatre: 82% non-coverage despite an in-force regime. Cayman's correction illustrates the fix -- naming categories on an insure-or-mitigate basis -- but the supervision and enforcement of that standard is not yet established through published guidance (NOT VERIFIED), so the gap between paper and practice is narrowing rather than closed.

1.6 Treating Digital Asset Insurance Identically to Traditional Lines

• The approach -- Applying or proposing punitive traditional capital and stress frameworks to insurer crypto exposures without a calibrated path to enactment
• Country --
  EU (EIOPA proposal)
• Verified outcome -- EIOPA's final technical advice (27 March 2025) proposed a 100% capital stress for insurer crypto holdings under Solvency II -- requiring insurers to hold capital equal to the full value of any crypto exposure. Critically, this charge is not yet enacted: the Solvency II Delegated Regulation that did get adopted, Regulation (EU) 2026/269 (published in the OJ on 18 February 2026, in force 10 March 2026), contains no crypto-specific charge, and the 100% stress remains a pending subsequent delegated act. The result is a structural mismatch in waiting: MiCA Article 67 creates regulatory demand for insurance (the insurance-or-own-funds option for CASPs, with ~199 licensed CASPs across 23 member states ahead of the 1 July 2026 transition deadline), while the prospective Solvency II treatment threatens to constrain the supply side once enacted.
• Why it fails -- Creating demand for insurance through CASP regulation while preparing a 100% capital charge on the supply side produces a coordination risk. If enacted as advised, European insurers would face a charge that makes digital asset underwriting uneconomic relative to other risk classes, pushing capacity to Lloyd's and offshore markets. The lesson is forward-looking: the charge is pending, and its calibration at enactment will determine whether the mismatch materialises.

1.7 Nation-State Attack Exclusions in a Market Dominated by State Actors

• The approach -- Requiring cyber-insurance exclusions for state-backed cyber operations (Lloyd's Bulletin Y5381, effective March 2023) in a market where the single largest source of theft is state-affiliated
• Country -- Global (Lloyd's market)
• Verified outcome -- North Korea's Lazarus Group stole roughly $2.02 billion in cryptocurrency in 2025 alone. The Bybit hack (~$1.5 billion, 21 February 2025 -- the largest single theft on record) was attributed to Lazarus Group and was recovered not by insurance but by Bybit replenishing reserves within roughly 72 hours via bridge loans. Under current Lloyd's policy wordings, such losses would fall within the nation-state exclusion if attribution is established, meaning the single largest category of crypto theft losses is potentially excluded from coverage entirely.
• Why it fails -- When the dominant risk (state-sponsored theft) is excluded from the dominant market (Lloyd's), the insurance product addresses a subset of the risk that does not include the most probable and severe loss scenario. Policyholders pay premiums for coverage that may not respond to the most likely claim.

2. What Clearly Works

2.1 Mandatory Insurance with Quantified Minimums

• The approach -- Requiring all VASPs to maintain liability insurance or equivalent reserves covering at least 5% of customer hot-wallet assets, with category-specific minimum floors
• Country --
  South Korea (VAUPA)
• Verified outcome -- The Virtual Asset User Protection Act (effective 19 July 2024) mandates insurance-or-reserve cover of at least 5% of customer hot-wallet value, with minimum floors of KRW 3 billion ($2.2 million) for KRW-market exchanges and KRW 500 million ($370,000) for coin-only exchanges and custodians, on top of an 80% cold-storage minimum. Domestic insurers (Samsung Fire & Marine, DB Insurance, Hyundai Marine & Fire, KB Insurance) launched compliant products on schedule. When Upbit was hacked in November 2025 (~KRW 44.5 billion / ~$28 million in Solana-based tokens), it restored all affected funds through insurance and reserves under the VAUPA framework and raised its cold storage to 95% -- the first publicly reported use of mandated crypto-exchange insurance to cover a hack.
• Why it works -- Quantified minimums create a clear compliance target; the 5% hot-wallet threshold is calibrated to be economically feasible; domestic insurer participation ensures local capacity. The Upbit incident validated the framework under real conditions. (Note: South Korea's proposed no-fault liability rules remain PROPOSED, not enacted -- see Section 3.)

2.2 Coverage-Ratio Mandates (Hot/Cold Wallet Split)

• The approach -- Requiring licensed VATPs to maintain compensation arrangements covering 100% of client assets in hot/online storage and 50% of client assets in cold storage
• Country --
  Hong Kong (SFC)
• Verified outcome -- The SFC's VATP regime (operative since June 2023) makes a 100%-hot / 50%-cold compensation arrangement a licensing condition, with at least 98% of client assets held in cold storage and the hot-wallet share expected to stay under 2%. OSL secured a record US$1 billion Lloyd's custody programme led by Canopius (October 2024) to meet the requirement. The SFC accepts four compensation forms -- third-party insurance, dedicated funds, reserved virtual assets, and bank guarantees -- with daily monitoring and immediate shortfall notification. As of 18 May 2026 the SFC had licensed 13 VATPs. On the supply side, the Insurance Authority's RBC consultation conclusions (8 May 2026) set a 100% downward stress factor on insurers' direct crypto holdings (implementation targeted 31 December 2026, pending LegCo negative vetting), opening a path for domestic insurer crypto capacity.
• Why it works -- Prescriptive ratios are clear, verifiable, and leave no room for interpretation; the 100% hot-wallet requirement eliminates the most acute vulnerability; allowing multiple compensation mechanisms accommodates capacity constraints. The OSL placement demonstrates the market can respond to clear mandates.

2.3 Insurance-or-Capital Option

• The approach -- Allowing CASPs to satisfy prudential safeguards through either own funds (equity) or a qualifying insurance policy, at the operator's election
• Countries --
  EU (MiCA Art. 67);
  France (PACTE Law, 2019 -- pioneer)
• Verified outcome -- MiCA's prudential safeguard (the higher of the Annex IV minimum capital -- EUR 50,000 / 125,000 / 150,000 by class -- or one-quarter of fixed overheads) can be met through own funds, an insurance policy, or a combination. France pioneered the professional-indemnity-insurance-OR-own-funds model under the 2019 PACTE Law, four years before MiCA adopted it EU-wide; it transitioned smoothly via Ordinance 2024-936 and Decree 2025-169, with the DASP/MiCAR transitional period ending 1 July 2026. As of mid-2026, around 199 CASPs are licensed across 23 member states, with Germany the largest visible market (~53 authorised CASPs, self-reported). The Art. 67(4) policy must run at least one year, give at least 90 days' cancellation notice, come from a third-party authorised insurer, be publicly disclosed, and cover the prescribed risk categories including Art. 75(8) custodian liability.
• Why it works -- Flexibility accommodates different business models and sizes; small entrants can use insurance rather than tying up capital; the prescribed policy specifications ensure coverage quality. France's head start demonstrated the model's viability before EU-wide adoption.

2.4 Lloyd's Specialty Market Model

• The approach -- Enabling a market-led approach where specialist syndicates, coverholders, and MGAs develop digital asset insurance products within an existing regulatory and rating infrastructure
• Country --
  UK (Lloyd's of London)
• Verified outcome -- Lloyd's hosts multiple syndicates writing digital asset risks (Atrium 609, Canopius, Mosaic 1609, Chaucer, Arch, TMK, Markel, Beazley). Evertas holds coverholder status with up to US$420 million per-policy capacity (self-reported, June 2023). AnchorWatch became a Lloyd's coverholder in November 2024 -- the first direct-to-retail bitcoin insurance via Lloyd's -- scaling to up to US$500 million per customer (self-reported). Marsh's DART custody facility offers up to US$825 million (self-reported, 2024), and Aon reports over US$1.2 billion individual client capacity globally (self-reported). Evertas/Nayms have enabled on-chain Lloyd's policy payments via Ethereum/USDC. Howden estimated global crypto GWP at roughly US$150-300 million in 2024 (self-reported).
• Why it works -- Lloyd's provides a globally recognised rating, established PRA/FCA-overseen infrastructure, and a syndicate model that distributes risk across multiple capital providers. The delegated-authority model lets specialist firms (Evertas, AnchorWatch) build focused expertise without their own insurer licence. Capacity has grown organically in response to institutional demand, particularly from the EU MiCA and Hong Kong mandates -- though it remains capacity-constrained against a multi-trillion-dollar crypto market.

2.5 Captive and Innovation-Class Structures for Digital Asset Firms

• The approach -- Enabling digital asset companies to form captives and dedicated innovative-class insurers under purpose-built regulatory categories
• Country --
  Bermuda (Relm / captive market)
• Verified outcome -- Bermuda's BMA created the Class IIGB (Innovative Insurer General Business) and Class IILT (Innovative Insurer Long-Term) licences for digital asset insurance. Relm Insurance is the first and only commercial Class IIGB holder, writing D&O, professional indemnity, crime, cyber, smart-contract-failure, and staking/slashing cover; Relm also held FTX-related policies exceeding US$15 million and allocated reserves for those claims after the December 2022 collapse (self-reported). Gemini formed Nakamoto, Ltd. as a Class 1 captive with US$200 million in custody coverage capacity (the largest crypto-custodian limit at launch, self-reported). Meanwhile Insurance holds the first IILT licence for BTC-denominated life insurance and released the first audited BTC-denominated financial statements (June 2025). Class 1 captive minimum capital starts at US$120,000. The BMA is consolidating this further via a proposed Parametric Special Purpose Insurer (PSPI) class (consultation January 2026, targeted enactment end Q2 2026) and completed an Embedded Supervision DeFi pilot (Chainlink/Apex/Bluprynt/Hacken) on 6 May 2026.
• Why it works -- Captives let digital asset firms retain risk that commercial markets price uneconomically, build loss history that supports future commercial placement, and tailor coverage to specific operational risks. Bermuda's innovation classes confer regulatory legitimacy without forcing digital asset insurers into traditional categories, while low minimum capital and a single integrated regulator (the BMA oversees both insurance and DABA digital asset businesses) reduce barriers to entry.

2.6 Custody-First Approach with Voluntary Insurance

• The approach -- Mandating strict cold-storage requirements (90% minimum) to structurally reduce insurable risk, then allowing the market to fill the residual hot-wallet gap voluntarily
• Country --
  Singapore (MAS PS-G03)
• Verified outcome -- PS-G03 requires DPT service providers to store at least 90% of customer assets in cold wallets, capping hot-wallet exposure at 10% and creating a well-defined, commercially insurable residual risk. Insurance is not itself a mandated safeguarding method -- consumer protection rests on trust-account segregation plus the cold-storage mandate -- but many firms voluntarily cover the ~10% hot-wallet exposure. Canopius Syndicate 4444 launched on the Lloyd's Asia platform (May 2023) combining crime and specie into a single digital asset custody policy with up to US$130 million per line (self-reported); Singapore has the second-highest number of crypto insurers globally (10, Tracxn January 2025). As of 4 June 2026, 37 major payment institutions are listed with DPT-service activity.
• Why it works -- Reducing the insurable exposure through custody mandates makes insurance commercially viable -- insuring 10% of assets is dramatically cheaper than insuring 100%. The 90/10 split gives underwriters a clear, quantifiable risk to price, and Singapore's depth as a Lloyd's Asia underwriting centre supplies local capacity, all without the compliance burden of a formal insurance mandate.

2.7 Mandatory Multi-Category Insurance for VASPs

• The approach -- Requiring all licensed VASPs to maintain prescribed categories of insurance (professional indemnity, D&O, commercial crime for hot-wallet assets, plus any additional cover the regulator deems appropriate)
• Country --
  UAE (VARA)
• Verified outcome -- VARA's Company Rulebook (v2.0, effective 19 June 2025) prescribes a four-category insurance regime (Section D) for all licensed VASPs: professional indemnity, D&O, commercial crime for hot-wallet assets, and additional cover as VARA deems appropriate. All cover must be placed with a regulated insurer, name the VASP as insured, and be reviewed annually, on an adequacy basis rather than fixed minimum amounts. VARA additionally introduced a dedicated ETD Insurance Fund (default-protection buffer) for VASPs offering exchange-traded derivatives (Exchange Services Rulebook v2.1, Part V, 31 March 2026). The ADGM FSRA separately requires PII for Category 3B/3C/4 firms (minimum standards effective 1 January 2026, annual board-approved attestation), and the DFSA requires PII plus cyber insurance for crypto-token firms (effective 12 January 2026).
• Why it works -- Specifying insurance categories (rather than "adequate insurance") eliminates ambiguity about what is required, and the multi-category approach ensures distinct risk vectors -- operational errors, management liability, theft, and emerging risks -- are each addressed. Annual review creates ongoing compliance monitoring across all three UAE perimeters.

3. Mixed Results

3.1 Prescriptive PII Minimums Without Broader Theft Coverage

• The approach -- Mandating professional indemnity insurance with a prescribed minimum (BHD 100,000 / ~$265,000) plus keyman and cybersecurity cover, but no prescribed crime/custody theft minimum
• Country --
  Bahrain (CBB CRA Module)
• Verified outcome -- The CBB requires all CRA Module crypto-asset licensees to hold PII of at least BHD 100,000 from a CBB-licensed insurer, plus keyman-risk insurance (no minimum specified) and cybersecurity insurance (added by the March 2023 CRA amendments, which also introduced the separate Digital Tokens framework for security-type tokens). This is more prescriptive on minimum amounts than many peers, but no Bahraini insurer offers a dedicated digital asset product as of June 2026, and specialty theft/custody risk is placed internationally with very limited local capacity.
• Why it's mixed -- A quantified PII floor plus mandated keyman and cyber cover is a stronger baseline than most jurisdictions, but crypto-specific losses (theft, hacking, key compromise) still depend on crime and custody policies that the local market cannot supply at scale. Bahrain's mandate is enforceable on paper but constrained by thin local specialty capacity.

3.2 Proposed Liability Reserve (Insurance Alternative) Awaiting Enactment

• The approach -- Migrating crypto regulation to a securities-style statute with mandatory liability reserves sized to trading volume and incident history, allowing approved insurance to count toward part of the reserve
• Country --
  Japan (FIEA bill, expected FY2027)
• Verified outcome -- Japan's FSA secured Cabinet approval of the FIEA amendment bill on 10 April 2026, reclassifying crypto as financial instruments and adding mandatory liability reserves (with an approved-insurance count), insider-trading bans, enhanced disclosure, and an unregistered-operator penalty of up to ten years / JPY 10 million. The bill has been submitted to the Diet and could take effect as early as fiscal 2027 if passed. The insurance-as-reserve mechanics are not yet finalised, and the bill is not yet law.
• Why it's mixed -- The proposal directly addresses Japan's documented failure mode (no insurance, no recovery), and the insurance-count alternative is sound in principle. But the FY2027 timeline means continued reliance on the status quo in the interim, and Japan's domestic insurers (Sompo, MS&AD, Tokio Marine dominate non-life but offer limited dedicated crypto products) may not develop sufficient capacity before the mandate bites.

3.3 CIRO Custody Framework with Insurance as Gating Factor

• The approach -- Establishing a tiered custody system where insurance (fidelity and specie) serves as a "gating factor" for custodian tier approval, effectively making insurance a precondition for higher-tier custody
• Country --
  Canada (CIRO, February 2026)
• Verified outcome -- CIRO's interim Digital Asset Custody Framework (published 3 February 2026) sets four tiers in which fidelity (crime/financial-institution bond) and specie (cold-storage) insurance gate the permitted custody arrangement: Tier 1 (100% holding, fidelity required), Tier 2 (100%, insurance plus resilience), Tier 3 (75%, specie for cold storage), Tier 4 (40%, internal controls), with self-custody allowed up to 20% at Tier 4 standards. No minimum coverage amounts are prescribed. CDIC and CIPF firmly exclude direct crypto holdings, so insurance is the only available protection mechanism. However, no major Canadian insurer has launched a dedicated digital asset product (NOT VERIFIED -- absence of evidence), and provincial licensing fragments capacity (an insurer must be licensed in each province where the risk is located). Separately, Canada's federal Stablecoin Act received Royal Assent on 26 March 2026 (via Bill C-15, Bank of Canada supervisor) but is not yet in force, with implementation expected in 2027.
• Why it's mixed -- Using insurance as a gating factor leverages underwriter due diligence as a proxy for regulatory assessment, but the mechanism depends on insurance being available and affordable, which is not guaranteed in Canada's fragmented provincial market with no domestic dedicated product. If capacity is insufficient, the gating factor becomes a barrier to entry rather than a quality signal. The framework is explicitly interim, and minimum coverage amounts may follow.

3.4 EEA Passporting for Digital Asset Insurance

• The approach -- Enabling insurers licensed in one EEA state to write digital asset insurance across the EEA (plus Switzerland via bilateral agreement) from a single licence, alongside statutory token protection
• Country --
  Liechtenstein / EEA
• Verified outcome -- Liechtenstein combines EEA passporting with a bilateral Swiss agreement, providing dual EEA + Swiss market access from a single licence, and its EAS investor-compensation scheme (a Protected Cell Company) covers security tokens -- DLT instruments matching traditional-security characteristics -- up to CHF 30,000, making Liechtenstein one of the few jurisdictions where tokenised securities benefit from explicit statutory protection (unbacked crypto such as BTC/ETH remains excluded). MiCAR has applied since the EEA MiCAR Implementation Act entered force on 1 February 2025, and the FMA granted its first MiCAR CASP authorisation in Q1 2026, with TT service providers required to obtain MiCAR authorisation by the 1 July 2026 grandfathering deadline. However, no Liechtenstein-domiciled insurer underwrites a dedicated digital asset product, and the TVTG imposes no insurance mandate on TT service providers.
• Why it's mixed -- The regulatory infrastructure is exceptional on paper -- dual EEA/Swiss passporting, MiCAR compliance, security-token EAS coverage -- but the underwriting market has not yet responded. The theory that a Liechtenstein-domiciled insurer (especially a captive reinsurer) could write digital asset policies across both blocs remains untested; until an insurer establishes there, the model is potential rather than proven.

4. Evidence-Based Playbook

The following principles are derived from the successes and failures documented above. Each is tied to at least one verified outcome.

Principle 1: Mandate Insurance with Quantified Minimums

Voluntary approaches consistently fail to achieve adequate coverage. South Korea's 5% + KRW 3 billion formula, Hong Kong's 50%/100% ratios, and VARA's four-category requirement all show that quantified or prescribed-category mandates drive compliance. Disclosure-only requirements produce the pre-2026 Cayman result: 82% of reviewed VASPs uninsured for cyber risk despite an in-force framework.

Principle 2: Offer Insurance-or-Capital Flexibility

MiCA's insurance-or-own-funds model, pioneered by France under the 2019 PACTE Law, accommodates different business sizes without blocking small entrants. Requiring only insurance (without a capital alternative) risks barriers in markets with limited capacity; requiring only capital (without an insurance alternative) concentrates risk on operator balance sheets.

Principle 3: Separate Hot and Cold Wallet Requirements

Hong Kong's 100%-hot / 50%-cold framework (with ≥98% cold storage) and Singapore's 90% cold-storage mandate both show that differentiating requirements by storage type produces clearer compliance targets and more insurable risk profiles. Treating all digital assets as a single pool ignores the fundamentally different risk characteristics of hot versus cold storage.

Principle 4: Verify Compliance, Not Just Require It

The pre-2026 Cayman experience (82% cyber-uninsured despite a framework) proves that expectations without verification are ineffective. Hong Kong's daily monitoring, VARA's annual review, and South Korea's active FSS inspection regime show that ongoing verification is essential. Insurance attestation should be a licence-renewal condition, not a one-time filing.

Principle 5: Develop Domestic Insurance Capacity Before Mandating Coverage

South Korea ensured domestic insurers had VAUPA-compliant products available before the effective date, and the Upbit restoration validated that capacity. Japan's voluntary approach failed partly because domestic insurers had not developed crypto-specific products. Regulators should engage insurers well ahead of mandate effective dates so supply meets demand.

Principle 6: Distinguish Self-Insurance Funds from Licensed Insurance

FTX's fabricated insurance fund demonstrates the risk of conflating operator reserves with genuine insurance. Regulators should require clear labelling that self-insurance funds are not insurance and must not be described as such to consumers. Exchange "SAFU"-style funds and similar reserves are operator balance-sheet commitments, not third-party insurance, and should be disclosed as such.

Principle 7: Address Nation-State and Systemic Exclusions

With Lazarus Group responsible for roughly $2.02 billion in crypto theft in 2025 alone -- including the ~$1.5 billion Bybit hack -- nation-state exclusions in cyber policies create a structural coverage gap for the most probable and severe risk. Regulators designing mandatory insurance should either require nation-state risks to be covered or mandate separate mechanisms (reserves, captives, pooled funds) for excluded risks.

Principle 8: Enable Captive and Alternative Risk-Transfer Structures

Bermuda's Class IIGB/IILT innovation classes, captive infrastructure, and proposed PSPI class demonstrate that alternative risk-transfer mechanisms can fill gaps where commercial markets are insufficient. Regulators should recognise captives, parametric triggers, and dedicated reserve funds as qualifying mechanisms alongside traditional insurance.

Principle 9: Coordinate Insurer Capital Rules with CASP Insurance Mandates

The EU's prospective tension -- MiCA creating insurance demand while EIOPA's proposed (not yet enacted) 100% crypto stress threatens supply, even though the adopted Regulation (EU) 2026/269 carries no crypto charge -- shows the risk of uncoordinated regulation. Jurisdictions mandating insurance for digital asset firms should ensure that insurer capital rules, when finalised, do not make underwriting those risks prohibitively expensive. Hong Kong's parallel IA RBC work (100% downward stress, conclusions 8 May 2026) is the same lever applied with explicit attention to enabling domestic capacity.

Principle 10: Use Custody Mandates to Reduce Insurable Exposure

Singapore's 90/10 framework, South Korea's 80% cold-storage minimum, Hong Kong's ≥98% cold storage, and Japan's 95% cold-storage requirement all show that structural custody mandates reduce the volume of assets needing insurance. This makes insurance commercially viable by reducing the quantum of risk underwriters must price.

Principle 11: Prohibit False Deposit-Insurance Claims Proactively

The FDIC's nine cease-and-desist letters were reactive -- issued after consumers had already been misled -- and the 2026 GENIUS Act NPR reaffirms that even stablecoin reserves are not pass-through insured. Regulators should require explicit negative disclosure ("Your crypto assets are NOT covered by [deposit-insurance scheme name]") as a licence condition, rather than waiting for false claims to surface.

Principle 12: Build Iteratively, Not Comprehensively

Singapore's path -- PSA 2019, PSA Amendment 2021, PS-G03 2024, DTSP 2025 -- and Cayman's move from disclosure-based expectations to the MC-RSOG prescribed categories (February 2026) both show that iterative development allows learning from market responses. Regulators should start with achievable requirements (PII, minimum crime coverage, custody mandates) and expand as capacity and evidence develop.

5. Verification Notes

• Scope and source of truth. This refresh covers the full set of 18 jurisdictions and mirrors the canonical per-jurisdiction fact matrix. No web search was conducted for this refresh; every fact reflects the matrix or facts already present in the prior version of this file.
• Self-reported figures. All market-capacity, premium, per-policy, and penetration figures (e.g. Evertas up to US$420M per policy; Marsh DART up to US$825M; AnchorWatch up to US$500M; Aon US$1.2B+; OSL US$1B programme; Nakamoto US$200M; ~11% holder penetration; Germany ~53 CASPs; ~199 EU CASPs) are self-reported by the named provider, broker, or aggregator and are flagged as such, not independently verified this cycle.
• Mandatory vs voluntary. South Korea (VAUPA), Hong Kong (SFC ratios), the UAE (VARA four-category + ADGM/DFSA PII), and Bahrain (PII/keyman/cyber) impose insurance obligations that are mandatory in law or in substance. Cayman's MC-RSOG (February 2026) is mandatory-in-substance on an "insure-or-mitigate" basis with no numeric minimums. The EU/France/Germany/Liechtenstein insurance-or-own-funds option is voluntary (elective). Singapore, Switzerland, the UK, Australia, and the United States impose no insurance mandate.
• Deposit-scheme treatment. Every deposit/investor-guarantee scheme examined excludes crypto: FDIC/SIPC (US), CDIC/CIPF (Canada), DICJ (Japan), KDIC (South Korea), SDIC (Singapore), HKDPB/ICF (Hong Kong), FCS/NGF (Australia), the EU DGS/ICS, FGDR (France), EinSiG/EntSchG (Germany), esisuisse (Switzerland), and FSCS (UK). The sole partial inclusion is Liechtenstein's EAS, which covers qualifying security tokens up to CHF 30,000 (not unbacked crypto).
• Regulated insurance vs discretionary mutual. DeFi insurance protocols (e.g. Nexus Mutual, a UK discretionary mutual, ~US$190M capital pool / ~US$194M active cover, self-reported via the protocol's own disclosures) are discretionary risk-sharing arrangements, not regulated insurance, and members lack regulatory protection. They are distinguished throughout from regulated commercial products such as Bermuda's Class IIGB cover and Munich Re's Smart Contract Risk Insurance.
• Pending vs enacted. Treated as pending/not-yet-in-force: the EIOPA 100% Solvency II crypto stress (advice March 2025, awaiting a subsequent delegated act); Japan's FIEA bill (Cabinet-approved 10 April 2026); South Korea's no-fault liability and second-phase DABA bill (proposed 8 April 2026); Canada's Stablecoin Act (Royal Assent 26 March 2026, not in force); Australia's Digital Assets Framework Act (Royal Assent 8 April 2026, commences 9 April 2027); the UK SI 2026/102 (in force 25 October 2027); Bermuda's PSPI class (targeted end Q2 2026); and Hong Kong's IA RBC amendments (conclusions 8 May 2026, implementation targeted 31 December 2026). Enacted/in force: Regulation (EU) 2026/269 (OJ 18 February 2026, no crypto charge); Cayman MC-RSOG (February 2026); UAE VARA v2.0 (June 2025) and ETD Insurance Fund (31 March 2026); Australia's AML/CTF obligations for existing reporting entities incl. existing DCEs (commenced 31 March 2026) with tranche-2 new sectors commencing 1 July 2026.
• International benchmark. Per the FATF's sixth targeted update (26 June 2025), of 138 jurisdictions assessed for Recommendation 15, only ~1% were fully compliant and 29% largely compliant -- so roughly 70% are not yet largely or fully compliant -- underscoring the global AML/CFT under-compliance backdrop against which insurers underwrite cross-border digital asset risk.