Log in Create an account
regulationsresearchdigital asset insuranceguidance documentCompliance & Enforcement

Compliance & Enforcement

June 4, 2026

37 min read

1. AML/KYC for Insurance Providers Serving Crypto

Insurance providers writing digital asset risks sit at the intersection of two regulatory regimes: traditional insurance AML/KYC obligations and the newer virtual asset AML/CFT framework. This section maps the requirements across the major jurisdictions in this domain and the international standard-setting bodies that anchor them.

1.1 International Standards: FATF and IAIS

The FATF Recommendations form the global baseline. Recommendation 10 (Customer Due Diligence) and Recommendation 15 (New Technologies) apply to all financial institutions, including insurers. The FATF's October 2018 "Guidance for a Risk-Based Approach: Life Insurance Sector" explicitly requires life insurers and intermediaries to identify, assess, and mitigate money-laundering and terrorist-financing risks through risk-based CDD. Recommendation 22 extends CDD obligations to designated non-financial businesses and professions, and the Interpretive Note to Recommendation 15 (amended June 2019) broadened the scope to cover virtual assets and virtual asset service providers (VASPs).

Implementation of the virtual-asset standard remains uneven. The FATF's June 2023 Targeted Update found that 75% of jurisdictions surveyed were only partially or non-compliant with FATF virtual asset requirements, and more than half of the 151 responding jurisdictions had not taken any steps toward implementing the Travel Rule. The June 2024 and February 2025 Targeted Updates continued to urge stronger global action. By the FATF's 2025 assessment cycle, of the 138 jurisdictions assessed against Recommendation 15, only roughly 1% were rated fully compliant and approximately 29% largely compliant — a benchmark that bears directly on the underwriting risk insurers face when an inadequately supervised VASP is the policyholder.

The IAIS complements FATF through Insurance Core Principle 22 (ICP 22) on AML/CFT. The November 2021 revised Application Paper on Combating Money Laundering and Terrorist Financing provides detailed guidance for life insurers and intermediaries on risk assessment, CDD, beneficial ownership identification, suspicious transaction reporting, and record-keeping. The paper specifies that the identity and status of parties to life insurance contracts -- including beneficiaries and beneficial owners -- determine the extent of AML controls. It permits flexible timing for beneficiary verification (identification may occur at or before payout rather than at policy inception), provided risk-based safeguards are in place.

For insurers writing digital asset risks, the intersection is critical: an insurer providing crime or custody coverage to a crypto exchange must apply both its traditional insurance AML obligations and assess whether the policyholder itself is subject to VASP AML requirements and is compliant.

Sources:

1.2 EU Anti-Money Laundering Regulation (AMLR)

The

EU adopted its AML Package in 2024, centred on Regulation (EU) 2024/1624 (the AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6). The AMLR will apply directly across member states from 10 July 2027. The Anti-Money Laundering Authority (AMLA), based in Frankfurt, commenced operations on 1 July 2025.

For insurers and intermediaries, the AMLR scope covers:

  • Life insurers and investment-related insurance undertakings -- full CDD, enhanced due diligence (EDD), and suspicious activity reporting obligations apply.
  • Insurance intermediaries -- in scope where they act with respect to life insurance and investment-related insurance services. Intermediaries that do not collect premiums or amounts intended for customers and act under the responsibility of an insurance undertaking are excluded. Non-life insurance intermediaries fall outside scope.
  • Crypto-asset service providers (CASPs) -- brought explicitly within the obliged entity framework under MiCA and the AMLR, meaning insurers that also hold CASP authorisations face dual obligations.

Key changes relevant to digital asset insurance include: a five-working-day deadline for responding to Financial Intelligence Unit (FIU) requests, tightened beneficial-ownership transparency requirements, mandatory proliferation-financing risk assessments, and expanded supervisory and enforcement powers for national competent authorities.

Insurers writing digital asset risks in the EU should note that their crypto-client policyholders are themselves obliged entities under the AMLR. The insurer's own CDD process must verify that the policyholder's AML programme is adequate -- creating a layered compliance obligation. This obligation tightens as the MiCA transitional period ends on 1 July 2026, after which only authorised CASPs may operate;

France (DASP transition likewise ending 30 June / 1 July 2026),
Germany (national KMAG grandfathering already closed 31 December 2025), and
Liechtenstein (TT service providers must hold MiCAR authorisation by 1 July 2026) all converge on the same deadline.

Sources:

1.3 UK Money Laundering Regulations (MLRs)

The

UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended) apply to "relevant persons," which include insurance undertakings and intermediaries conducting life insurance or investment-related business.

For digital asset-specific obligations:

  • Cryptoasset exchange providers and custodian wallet providers carrying on business in or from the UK are "relevant persons" under the MLRs and must register with the FCA before commencing in-scope activities.
  • Registered firms must conduct CDD (Regulation 27), ongoing monitoring (Regulation 28), EDD for high-risk situations including politically exposed persons (Regulation 33), and maintain records for at least five years (Regulation 40).
  • The Travel Rule took effect on 1 September 2023 following amendment of the MLRs, requiring cryptoasset businesses to collect, verify, and share originator and beneficiary information for transfers.
  • Since 2022, UK sanctions regulations (e.g., the Russia (Sanctions) (EU Exit) Regulations 2019, as amended) treat cryptoasset exchange providers and custodian wallet providers as "relevant firms" with mandatory reporting duties regarding knowledge or reasonable cause to suspect breaches, designated persons, or frozen assets.

An insurer providing coverage to UK-registered crypto firms must verify the policyholder's FCA registration status and assess the adequacy of the policyholder's own AML programme as part of underwriting due diligence. The UK's forthcoming cryptoasset regime (SI 2026/102, in force 25 October 2027) does not introduce a bespoke insurance mandate, so AML registration and conduct verification remain the principal compliance checkpoints.

Sources:

1.4 US Bank Secrecy Act / AML for Insurance Companies

Under

US federal law, insurance companies are subject to the Bank Secrecy Act (BSA) through 31 CFR Part 1025, administered by the Financial Crimes Enforcement Network (FinCEN). Since May 2006, every insurance company issuing or underwriting a "covered product" must maintain a risk-based AML programme.

Covered products include: permanent life insurance policies (excluding group life), annuity contracts (excluding group annuities), and any other insurance product with features of cash value or investment. Property and casualty insurance is generally excluded from BSA/AML requirements.

Programme requirements (31 CFR 1025.210) mandate:

  • Designation of a compliance officer responsible for implementing the AML programme
  • Written policies, procedures, and internal controls reasonably designed to control money-laundering risks
  • Ongoing training of appropriate personnel
  • Independent testing to monitor and maintain programme adequacy

Suspicious Activity Reporting (31 CFR 1025.320) requires insurance companies to file SARs with FinCEN when they detect suspicious transactions. SARs and supporting documentation must be maintained for five years from the date of filing. SAR confidentiality provisions prohibit disclosure of the SAR or its existence, except to FinCEN, federal/state/local law enforcement, or federal regulatory authorities examining BSA compliance.

For digital asset insurance specifically: while property and casualty products (crime, specie, cyber) that cover crypto custodians are not "covered products" under 31 CFR 1025, insurers writing such coverage are still subject to general federal anti-fraud and sanctions compliance obligations. Insurers should also note the evolving federal stance on the deposit-insurance perimeter: the FDIC's GENIUS Act stablecoin NPR (FIL-11-2026, issued 7 April 2026, comments due 9 June 2026) confirms that stablecoin reserves are not pass-through insured, and the joint SEC/CFTC interpretation of 17 March 2026 (SEC Release 33-11412 / CFTC PR 9198-26) establishes a binding five-part token taxonomy that shapes which products fall within the securities and commodities perimeters.

Sources:

1.5 Singapore MAS AML Requirements for Insurers

Singapore's Monetary Authority of Singapore (MAS) imposes AML/CFT requirements on life insurers through MAS Notice 314 ("Prevention of Money Laundering and Countering the Financing of Terrorism -- Life Insurers"), with supporting guidelines. The notice applies to all direct life insurers in relation to their life policies.

Key obligations include: ML/TF risk assessment and mitigation, CDD before and after establishing business relationships, requirements for reliance on third parties, record-keeping, suspicious transaction reporting (STRs), and internal policies covering compliance, audit, and training.

July 2025 amendments to Notice 314 strengthened requirements by: mandating proliferation-financing (PF) risk assessments, clarifying STR filing obligations (five-business-day deadline after suspicion is established), and updating guidelines on beneficial-ownership identification.

For digital asset service providers, the Payment Services Act (PSA) -- amended April 2024 -- expanded MAS regulatory scope to digital payment token (DPT) service providers, including custodial services and DPT exchange facilitation. The DTSP licensing framework under the FSMA 2022 took effect on 30 June 2025. As of 4 June 2026, the MAS Financial Institutions Directory lists 37 Major Payment Institutions with DPT-service activity. These requirements align with FATF standards on VASPs.

Insurers serving Singapore-based crypto firms should verify that DPT service provider policyholders hold valid MAS licences and have complied with the applicable AML/CFT requirements. Notably, MAS does not mandate insurance as a DPT licensing condition (consumer protection rests on trust-account segregation and the PS-G03 90% cold-storage requirement), so the insurer's verification focus is licensing and AML adequacy rather than confirming a statutory coverage floor.

Sources:

This section catalogues enforcement actions where regulators acted against false or misleading insurance-related representations by digital asset firms, supervisory penalties bearing on insurance and custody obligations, and insurance fraud cases in the digital asset space, across all 18 jurisdictions in this domain. These actions collectively define the boundaries of permissible conduct and serve as precedent for future enforcement.

2.1 FDIC Cease-and-Desist Actions: False FDIC Insurance Claims

The Federal Deposit Insurance Corporation has pursued a sustained campaign against crypto firms that falsely represented FDIC insurance coverage to consumers. The Federal Deposit Insurance Act prohibits any person from making false representations about deposit insurance status or extent of coverage. Between July 2022 and January 2024, the FDIC issued cease-and-desist demands to at least 16 entities across four rounds. This enforcement posture is reinforced by the policy direction of the GENIUS Act NPR (FIL-11-2026, April 2026), which makes explicit that stablecoin reserves are not pass-through FDIC-insured -- closing the door on a representation some issuers might otherwise have implied.

Round 1 -- Voyager Digital (28 July 2022): The FDIC and Federal Reserve Board jointly issued a cease-and-desist letter to Voyager Digital, a crypto brokerage firm. Voyager represented on its website, mobile app, and social media that customers who invested through the Voyager cryptocurrency platform would receive FDIC insurance coverage for all funds held by Voyager, and that the FDIC would insure customers against Voyager's own failure. In reality, while Voyager maintained a deposit account at Metropolitan Commercial Bank, the FDIC insurance applied only to the underlying bank deposits -- not to Voyager's crypto products or Voyager's own solvency. Voyager's partner bank had raised concerns about the "potentially misleading" claims as early as 2021, but Voyager removed the claims only after receiving the cease-and-desist.

Round 2 -- FTX US and Four Others (19 August 2022): The FDIC issued cease-and-desist letters to five entities: FTX US, Cryptonews.com, Cryptosec.info, SmartAsset.com, and FDICCrypto.com. FTX US President Brett Harrison had tweeted that "direct deposits from employers to FTX US are stored in individually FDIC-insured bank accounts in the users' names" and that "stocks are held in FDIC-insured and SIPC-insured brokerage accounts." Harrison deleted the tweet after receiving the letter and clarified he did not mean crypto assets were insured. FDICCrypto.com registered a domain name suggesting affiliation with or endorsement by the FDIC.

Round 3 -- CEX.IO, Zera Financial, and Two Websites (15 February 2023): The FDIC demanded that CEX.IO Corp., Zera Financial, Captainaltcoin.com, and Banklesstimes.com cease making false claims that CEX.IO and Zera Financial were FDIC-insured or that FDIC insurance would protect customers' cryptocurrency holdings.

Round 4 -- Five Additional Entities (19 January 2024): The FDIC issued letters to Atmos Financial PBC, BybitcoinEx Inc., ORGANO Payments Inc. (and its subsidiary OGPay), Horizon Globex GmbH (operating Upstream Exchange), and Zil Money Corporation. This round followed the FDIC's adoption of a revised final rule on 20 December 2023 that substantially updated its regulations on misrepresentation of deposit insurance, specifically addressing scenarios where non-bank entities provide misleading information about FDIC coverage.

FTC Enforcement -- Voyager / Stephen Ehrlich (October 2023 -- June 2025): The Federal Trade Commission reached a settlement with bankrupt Voyager Digital that permanently banned the company from handling consumer assets and imposed a suspended judgment of $1.65 billion (suspended to permit return of remaining assets to consumers through bankruptcy). The FTC simultaneously filed suit against former CEO Stephen Ehrlich for falsely claiming that consumers' deposits were FDIC-insured and "safe." In June 2025, Ehrlich agreed to pay $2.8 million and accepted a ban on marketing or selling retail crypto products.

Sources:

2.2 SEC Enforcement Regarding Insurance Representations

The SEC has not brought a standalone enforcement action specifically targeting false insurance representations by crypto firms. However, its broader enforcement programme has addressed misleading marketing and safety representations by digital asset companies that implicitly or explicitly suggested investor protections equivalent to insurance.

Between April 2021 and December 2024, the SEC initiated approximately 125 cryptocurrency-related enforcement actions, resolving 98 and imposing approximately $6.05 billion in penalties. While these predominantly targeted unregistered securities offerings, exchange operations, and custody rule violations, several cases involved representations about the "safety" of consumer funds that parallel the false insurance claims pursued by the FDIC.

The SEC's Crypto Assets and Cyber Unit (formerly the Crypto Assets and Emerging Technology Unit) continues to monitor representations by crypto firms about asset protection. The joint SEC/CFTC crypto-asset interpretation of 17 March 2026 (SEC Release 33-11412 / CFTC PR 9198-26), which establishes a binding five-part token taxonomy, sharpens which crypto products sit inside the securities or commodities perimeters and therefore which safety/protection representations are actionable under federal securities and commodities law.

Sources:

2.3 FCA Enforcement: Crypto Financial Promotions Under PS23/6

The FCA's Policy Statement PS23/6 (June 2023) classified cryptoassets as "Restricted Mass Market Investments" and established financial promotion rules effective 8 October 2023. The regime requires that all cryptoasset promotions be fair, clear, and not misleading; include prominent risk warnings; ban inducements to invest; and impose appropriateness assessments and a 24-hour cooling-off period on consumers.

While PS23/6 is not insurance-specific, it directly affects how insurance-like protections and guarantees may be marketed in relation to crypto products. Any promotion suggesting that a crypto product carries insurance protection, deposit guarantees, or equivalent safety features falls squarely within the FCA's remit. Making a financial promotion without using one of the four legal routes (FCA authorisation, approval by an authorised person, exemption, or MLR registration) constitutes a criminal offence punishable by up to two years' imprisonment, an unlimited fine, or both.

The FCA has stated it will take "robust action" against non-compliant firms, including requesting website takedowns, imposing restrictions to prevent harmful promotions, and bringing enforcement proceedings. As of early 2026, the FCA has not published a specific enforcement action targeting false insurance representations in crypto promotions, but the legal framework to pursue such action is in place. The FSCS does not cover cryptoasset losses, even under the new 2027 regime (SI 2026/102), so any promotion implying compensation-scheme protection for crypto holdings is squarely within the FCA's enforcement perimeter.

Sources:

2.4 Asia-Pacific Supervisory Enforcement

Several Asia-Pacific regulators have moved from guidance to penalties, and their enforcement bears directly on insurance, custody, and client-asset obligations.

Australia -- Bit Trade (Kraken), AUD 8 million (12 December 2024): The Federal Court ordered Bit Trade Pty Ltd (operator of the Kraken exchange in Australia) to pay an AUD 8 million penalty (ASIC media release 24-274MR) for issuing a credit facility (a margin-extension product) to more than 1,100 customers without a target market determination, in breach of design-and-distribution obligations. The action sits alongside the cancellation of FTX Australia's AFSL on 14 July 2023 (~30,000 customers; no dedicated crypto insurance covered the losses, with recovery flowing through the global FTX bankruptcy and further distribution from 31 March 2026) and ASIC's continuing actions against Binance bank-payment blocks and Block Earner. Australia's Digital Assets Framework regime (Royal Assent 8 April 2026; commences 9 April 2027) brings Digital Asset Platforms and Tokenised Custody Platforms under the AFSL regime, where adequate professional-indemnity insurance is an existing licence condition; AML/CTF obligations commenced for existing reporting entities (including existing DCE providers) on 31 March 2026, with tranche-2 new sectors commencing 1 July 2026.

Japan -- escalated penalties under the FIEA migration: Japan's enforcement architecture is shifting from the Payment Services Act toward the Financial Instruments and Exchange Act. The FIEA amendment bill was Cabinet-approved on 10 April 2026 and submitted to the Diet; it reclassifies crypto as financial instruments, introduces mandatory liability reserves (with approved insurance permitted to count toward part of the reserve), insider-trading bans, wallet-provider registration, and raises the penalty for unregistered operation to up to 10 years' imprisonment / JPY 10 million. Japan's loss history (Mt. Gox ~USD 450M in 2014; Coincheck ~USD 530M in 2018; DMM Bitcoin ~USD 305-308M in May 2024, Lazarus suspected) was met with no insurance recovery in any incident -- compensation came from corporate capital or parent-company support -- underscoring why the FIEA reserve-or-insurance regime is being introduced.

South Korea -- VAUPA mandatory-insurance enforcement and operational-resilience package: Under the Virtual Asset User Protection Act (effective 19 July 2024), all VASPs must maintain liability insurance or equivalent reserves of at least 5% of the value of customer virtual assets in hot wallets (minimum KRW 3 billion for KRW-market exchanges; KRW 500 million for coin-only exchanges and wallet/custodians). The November 2025 Upbit hack (~USD 28M in Solana tokens) was the first publicly reported instance of VAUPA-mandated insurance and reserves being used to fully restore customer funds; Upbit subsequently raised cold storage to 95%. After a February 2026 Bithumb keystroke error distributed ~620,000 BTC to 249 users (~99.7% recovered, industry-reported), the FSC's 6 April 2026 emergency package mandated five-minute ledger reconciliation, an automatic kill switch, monthly (rather than quarterly) audits, and a CRO/Risk Committee. A no-fault liability rule (fines up to 3% of annual revenue) remains proposed, not enacted -- a central feature of the second-phase Digital Asset Basic Act bill (8 April 2026), which was left off the National Policy Committee subcommittee agenda on 12 May 2026, pushing review into H2 2026.

Hong Kong -- compensation-arrangement enforcement at the licensing gate: The SFC enforces its 50%-cold / 100%-hot compensation-arrangement requirement as a VATP licensing condition rather than through post-hoc penalties. SFC pre-licensing inspections have identified insurance/compensation deficiencies (compliance findings, not loss events), and the January 2025 enhanced standards subject insurance exclusions and deductibles to closer scrutiny. As of 18 May 2026 the SFC has licensed 13 VATPs. No loss event has yet tested the compensation arrangements in practice.

Sources:

2.5 Other Jurisdictions: Enforcement and Mandate Posture

Across the remaining jurisdictions, the enforcement picture ranges from thematic supervisory findings to nascent or untested regimes:

  • Cayman Islands     -- CIMA's thematic desk-based review (period September 2024-February 2025, published November 2025) found that 82% of the 11 reviewed VASPs lacked any cybersecurity insurance. The regulator responded by moving from disclosure-based requirements to the Market Conduct RSOG (MC-RSOG, effective February 2026), which prescribes insurance categories (professional liability, theft/loss of client assets, business interruption, cybersecurity) on an "insure-or-mitigate" basis. CIMA issued the first full VASP licence (to BCXPro / JMSC Trading, custody) on 5 February 2026. Supervision and enforcement of the insure-or-mitigate standard is not yet established through published guidance (NOT VERIFIED).
  • Canada     -- CIRO's interim Digital Asset Custody Framework (3 February 2026) makes fidelity (crime/financial-institution bond) and specie insurance a gating factor for custodian-tier approval, with a self-custody allowance of up to 20% at Tier 4 standards; there are no prescribed minimum coverage amounts. The federal Stablecoin Act received Royal Assent on 26 March 2026 (Bill C-15) but is not yet in force (implementation expected 2027). No Canada-specific insurance claims or enforcement penalties are recorded.
  • Bermuda     -- DABA's flexible "surety-bond-or-trust-or-indemnity-insurance" client-asset protection is supervised by the BMA. The principal claims experience is Relm's FTX-related exposure (>USD 15M in policies to West Realm Shires / FTX.US and FTX Australia), for which Relm reserved and committed to pay legitimate covered claims; no aggregate Bermuda digital-asset claims data is published (LIMITED DATA).
  • Bahrain     -- The CBB mandates professional indemnity insurance (minimum BHD 100,000, ~USD 265,000), keyman risk insurance, and cybersecurity insurance (added March 2023) for all CRA Module licensees, and operates separate Digital Tokens (2023) and Stablecoin (SIO Module, July 2025) frameworks. No notable claims or enforcement penalties are recorded for Bahrain (NO DATA).
  • UAE     -- Mandatory insurance applies across multiple perimeters: VARA's four-category regime (PII, D&O, commercial crime for hot wallets, and other), ADGM FSRA PII (minimum standards effective 1 January 2026), and DFSA PII plus cyber insurance (effective 12 January 2026). The DFSA published a crypto-token firm-compliance thematic review in April 2026 identifying weaknesses in governance, oversight, and monitoring. VARA's ETD Insurance Fund (a default-protection buffer) was introduced 31 March 2026. Existing operators must comply with Federal Decree-Law No. 6 of 2025 by September 2026.
  • Emerging Markets (Brazil, Nigeria, South Africa, India) -- Enforcement is at the licensing-perimeter stage rather than insurance-specific penalties. Nigeria's SEC imposes a partial mandate (fidelity bond of at least 25% of minimum paid-up capital plus user-asset insurance); its 16 January 2026 circular raised minimum paid-up capital (DAX/Custodians ₦2bn, DAOP ₦1bn, DAI ₦500m, deadline 30 June 2027), mechanically raising the fidelity-bond floor. South Africa's FSCA grants a Section 13 insurance exemption (and reported 512 CASP applications, 300 approved, by December 2025). Brazil (BCB Resolutions 519/520/521; authorisation deadline 30 October 2026) and India (COINS Act/CARA discussion paper shelved again 1 April 2026) impose no insurance mandate.
  • Switzerland     and
    Liechtenstein     -- Neither imposes a statutory crypto-insurance mandate; FINMA Guidance 01/2026 requires bankruptcy-proof segregable custody plus operational/cyber controls with insurance optional, and Liechtenstein's TVTG imposes no insurance requirement (FMA fines up to CHF 100,000 for breaches). No jurisdiction-specific insurance-enforcement penalties are recorded.

2.6 Insurance Fraud in the Digital Asset Space

Insurance fraud related to digital assets presents emerging risks for insurers. Documented patterns include:

  • Inflated loss claims: Policyholders overstating the quantum of cryptocurrency losses after a hack or operational failure, exploiting the difficulty of real-time on-chain valuation during volatile market conditions.
  • Staged theft events: Insiders colluding to fabricate evidence of a private-key compromise or hot-wallet breach to trigger crime or custody insurance claims.
  • Misrepresentation during underwriting: Crypto firms understating their risk exposure, failing to disclose material security vulnerabilities, or misrepresenting the percentage of assets held in cold storage to obtain lower premiums.
  • False FDIC / SIPC claims as marketing fraud: As documented in Section 2.1, representing uninsured crypto products as government-insured constitutes fraud under US federal law.

No comprehensive public database of digital asset insurance fraud cases exists, though the claims data section of this guidance document catalogues major loss events where insurance was or was not involved. Regulators should consider mandating insurer disclosure of digital asset claim denial rates and suspected fraud referrals to build the evidence base.

3. Regulatory Expectations for Insurers Writing Digital Asset Risks

3.1 Due Diligence on Crypto Clients (KYC for Policyholders)

Insurers underwriting digital asset risks are expected to conduct enhanced due diligence on policyholders that goes beyond standard commercial insurance KYC. Regulatory expectations, drawn from the FATF risk-based approach and national-level supervisory guidance, include:

  • Licensing verification: Confirm that the policyholder holds all required licences or registrations in its operating jurisdictions (e.g., FCA registration under UK MLRs, MAS Major Payment Institution / DTSP licence under the PSA and FSMA, state money-transmitter licences in the US, MiCA CASP authorisation in the EU, VASP licence under the Cayman VASP Act, VARA/ADGM/DFSA authorisation in the UAE).
  • AML programme assessment: Review the policyholder's own AML/CFT programme, including its compliance officer designation, CDD procedures, sanctions screening, and SAR/STR filing track record.
  • Beneficial ownership: Identify and verify the ultimate beneficial owners of the policyholder entity, particularly for firms operating through complex multi-jurisdictional structures.
  • Source of funds: For policies covering custody or crime risks, understand the composition of client assets held by the policyholder, including exposure to high-risk jurisdictions, privacy coins, or decentralised mixing services.
  • Regulatory compliance history: Check for prior enforcement actions, cease-and-desist orders, or regulatory warnings against the policyholder or its principals (e.g., the Bit Trade AUD 8 million penalty or FDIC false-insurance demands).

3.2 Sanctions Screening: OFAC, EU, and UN Lists

Insurers must screen policyholders, beneficiaries, and claims payees against applicable sanctions lists. The principal lists include: the US OFAC Specially Designated Nationals and Blocked Persons (SDN) List, the EU Consolidated Financial Sanctions List, the UN Security Council Consolidated List, and the UK Office of Financial Sanctions Implementation (OFSI) list.

The Tornado Cash precedent illustrates the complexity of sanctions compliance in the digital asset context. In August 2022, OFAC designated Tornado Cash -- a non-custodial Ethereum smart contract mixer -- on the SDN List, alleging it facilitated laundering of over $7 billion in cryptocurrency, including funds stolen by North Korea's Lazarus Group. This was the first time a decentralised, non-custodial smart contract had been sanctioned.

In November 2024, the Fifth Circuit Court of Appeals ruled that Tornado Cash's immutable smart contracts could not be sanctioned under existing law because they were not controlled by any specific party. On 21 March 2025, OFAC removed Tornado Cash from the SDN List.

For insurers, the Tornado Cash episode demonstrates that: (a) sanctions designations can reach into DeFi and smart-contract infrastructure, (b) insurers must screen not just entity names but also blockchain addresses against OFAC's SDN List (which includes cryptocurrency wallet addresses), and (c) the legal landscape is actively evolving. This is acutely relevant given that the Lazarus Group was responsible for roughly USD 2.02 billion in crypto theft in 2025 alone -- including the ~USD 1.5 billion Bybit hack (21 February 2025, the largest single theft on record) -- losses that fall within nation-state exclusions in standard Lloyd's wordings where attribution is established. OFAC guidance encourages crypto industry participants to develop, implement, and routinely update tailored, risk-based sanctions compliance programmes that include sanctions list and geographic screening.

Sources:

3.3 Suspicious Activity Reporting for Insurance Claims

Insurers writing digital asset risks should integrate suspicious activity indicators specific to the crypto sector into their claims-handling processes. Indicators warranting further investigation or SAR/STR filing include:

  • Claims following a reported hack where the policyholder's on-chain activity shows pre-hack fund movements to unrelated wallets
  • Multiple claims in rapid succession across related entities or common beneficial owners
  • Claims where the stated loss amount is inconsistent with independently verifiable on-chain records
  • Policyholders unwilling to cooperate with blockchain forensic analysis during claims investigation
  • Claims involving funds traced to sanctioned addresses, mixing services, or high-risk jurisdictions
  • Unusually prompt or detailed documentation of losses that suggests pre-fabrication

Under US law (31 CFR 1025.320), insurance companies must file SARs with FinCEN for suspicious transactions involving covered products. Under UK MLRs, suspicious activity reports go to the National Crime Agency. Under EU AMLR, STRs must be filed with the relevant national FIU. Under Singapore's Notice 314, STRs must be filed within five business days after suspicion is established.

3.4 Underwriting Standards for Digital Asset Risks

Insurers writing digital asset coverage are expected to apply underwriting discipline that reflects the unique risk characteristics of the asset class. Key underwriting standards include:

  • Security architecture review: Assessment of private key management (cold storage ratios, multi-signature requirements, hardware security module usage), penetration testing frequency, and incident response plans. Several jurisdictions now anchor this with prescribed cold-storage floors -- e.g., Hong Kong's 98% cold-storage requirement, Singapore's PS-G03 90% cold / 10% hot cap, Japan's 95% cold storage, and South Korea's 80% cold-storage minimum -- that insurers can use as underwriting benchmarks.
  • Governance and controls: Evaluation of board-level risk oversight, segregation of duties, proof-of-reserves attestations, and audit frequency (SOC 2 Type II certification is increasingly expected). South Korea's April 2026 package (five-minute reconciliation, kill switch, monthly audits, CRO/Risk Committee) illustrates the direction of supervisory expectation.
  • Regulatory status: Verification of current licences, registrations, and compliance history in all operating jurisdictions.
  • Financial health: Analysis of solvency, liquidity, and the policyholder's ability to sustain operations through market downturns -- particularly given the correlation between crypto market stress and claim frequency.
  • Coverage structuring: Clear definitions of covered events and triggers, appropriate sub-limits, waiting periods, and aggregation provisions that reflect the speed and scale of digital asset loss events.
  • Concentration limits: Portfolio-level controls to avoid excessive exposure to single policyholders, single blockchain protocols, or correlated risks (e.g., multiple clients using the same custodian).

3.5 PRA Dear CEO Letters: Innovation and Emerging Risk

The Bank of England's Prudential Regulation Authority (PRA) communicates supervisory expectations to insurers through annual "Dear CEO" letters. While no PRA letter has addressed digital asset insurance specifically, several priorities from the January 2025 letter are directly relevant:

  • Cyber underwriting risk: The PRA expects firms to "effectively identify, quantify, manage, and monitor cyber underwriting risk across their insurance portfolios," including scenario-testing that accounts for new risk drivers such as artificial intelligence. Digital asset custody is a cyber-adjacent risk that falls within this expectation.
  • Innovation and competition: The PRA aims to "spur a vibrant, innovative, and internationally competitive insurance sector" while protecting policyholders and ensuring firm safety and soundness. Insurers developing digital asset products should demonstrate that innovation is matched by proportionate risk management.
  • Orderly exit: The PRA emphasises that insurers must be able to exit the market in an orderly way if necessary -- a consideration for insurers whose digital asset books may exhibit correlated tail risk.
  • Climate and emerging risks: While not directly crypto-related, the PRA's emphasis on forward-looking risk assessment and scenario analysis establishes supervisory expectations for how insurers should approach any emerging risk class, including digital assets.

Comparable prudential signals appear elsewhere: Hong Kong's Insurance Authority published RBC consultation conclusions on 8 May 2026 applying a 100% downward stress factor to direct crypto holdings (no diversification benefit), and in the EU, EIOPA's March 2025 advice for a 100% capital stress on insurer crypto holdings remains a pending subsequent delegated act -- the adopted Solvency II Delegated Regulation (EU) 2026/269 (OJ 18 February 2026) contains no crypto-specific charge.

Sources:

4. De-Risking: Insurance Companies Refusing to Serve Crypto Businesses

4.1 The De-Risking Problem

De-risking -- the wholesale refusal by financial institutions to provide services to entire categories of clients deemed high-risk -- has significantly affected the digital asset industry's access to insurance. Many traditional insurers exclude crypto businesses entirely from their underwriting appetite, driven by: regulatory uncertainty, limited claims data and actuarial history, reputational risk concerns, and fear of inadvertent sanctions or AML violations.

This creates a protection gap that undermines market stability. Businesses that cannot obtain adequate insurance coverage operate with unhedged tail risk, increasing the probability of catastrophic consumer losses when adverse events occur -- precisely the outcome regulators seek to prevent. The gap is most visible in jurisdictions that mandate insurance but lack domestic underwriting supply: Bahrain (no Bahraini insurer offers a dedicated digital asset product), Canada (no major domestic insurer has launched dedicated digital asset lines), Australia (QBE/IAG/Suncorp offer no dedicated crypto products), and Nigeria (a fidelity-bond mandate with no local capacity to satisfy it) all rely on international specialty markets (Lloyd's, Bermuda, London) to meet local requirements.

4.2 Directors & Officers (D&O) Market Challenges

The D&O insurance market for crypto companies illustrates the de-risking phenomenon most acutely:

  • Premium multiples: Crypto companies routinely face D&O premiums 2-3x higher than comparable technology firms, with some early-stage crypto companies reporting premiums 5x or more above market norms.
  • Limited carrier appetite: Fewer than five carriers have historically been willing to underwrite D&O for crypto firms, though this has expanded modestly since 2024 (Beazley launched a dedicated crypto D&O product; Evertas added D&O to its digital asset product suite).
  • High retentions: Retentions of $750,000 or more are common, raising questions about whether smaller crypto companies have sufficient assets to meet the retention before coverage attaches.
  • Aggressive exclusions: Many policies contain broad crypto-specific exclusions that can substantially diminish coverage value, excluding claims arising from regulatory enforcement, token issuance, DeFi protocol interaction, or smart-contract vulnerabilities.
  • FTX aftermath: The FTX bankruptcy created a landmark situation in which D&O insurers were found liable for covering legal defence costs of executives accused of fraud and criminal activity, increasing industry reluctance to underwrite crypto D&O risks.

Sources:

4.3 Banking Barriers for Insurance Entities Serving Crypto

Insurance companies and MGAs that choose to serve the digital asset sector face secondary de-risking from their own banking partners. Banks may: refuse to provide operating accounts to insurers with material crypto exposure, impose enhanced monitoring requirements that increase operational costs, or terminate banking relationships after crypto-market stress events.

This creates a cascading effect: even willing insurers may be unable to operationalise their coverage because they cannot maintain basic banking infrastructure. The problem is particularly acute for specialist digital asset insurers and MGAs that derive a majority of premium from crypto clients.

4.4 Impact on Market Development

De-risking undermines the regulatory objective of building a robust insurance ecosystem for digital assets. Key impacts include:

  • Concentration risk: The small number of willing insurers creates systemic concentration risk -- if a major underwriter exits the market, coverage gaps widen immediately. Bermuda's market is an extreme case (only two specialty insurers plus one captive).
  • Regulatory arbitrage: Firms may relocate to jurisdictions with less stringent insurance requirements, reducing supervisory oversight.
  • Self-insurance and captives: Major crypto firms establish captive insurers (e.g., Gemini's Nakamoto Ltd. in Bermuda), which provides entity-level protection but does not benefit the broader market or retail consumers.
  • Market size constraints: Industry market-research estimates put the global digital asset insurance market in the single-digit-billions range (self-reported / unaudited; one widely cited figure is ~USD 9.49 billion for 2025) -- still a fraction of the total assets under management in the digital asset industry.

Regulators should address de-risking by clarifying expectations (reducing regulatory uncertainty that drives blanket refusals), supporting data-sharing initiatives to build the actuarial base, and ensuring that AML/sanctions compliance frameworks are proportionate rather than prohibitive.

The following framework synthesises the obligations, enforcement precedents, and market dynamics documented in Sections 1-4 into actionable recommendations for regulators establishing or updating compliance regimes for digital asset insurance.

5.1 Tiered AML/KYC Requirements

Regulators should adopt a risk-based, tiered approach to AML/KYC for insurance products covering digital assets:

  • Tier 1 -- Standard CDD: For general liability, professional indemnity, and D&O policies issued to regulated crypto firms (i.e., firms holding VASP, CASP, or equivalent licences). Standard insurance KYC applies, supplemented by licence verification.
  • Tier 2 -- Enhanced CDD: For crime, custody, and specie policies where the insurer is directly exposed to digital asset loss events. Enhanced CDD should include on-chain risk-scoring of the policyholder's wallet infrastructure, sanctions screening of material wallet addresses, and review of the policyholder's own AML programme.
  • Tier 3 -- Heightened CDD: For policies involving DeFi protocols, non-custodial services, or operations in jurisdictions with weak FATF compliance (recalling that of the 138 jurisdictions assessed against FATF Recommendation 15 in 2025, only ~1% were fully compliant and ~29% largely compliant). Heightened CDD should include beneficial-ownership investigation through the full ownership chain, independent verification of smart-contract security audits, and ongoing monitoring of on-chain activity.

5.2 Clear Guidance on Insurance Representations

Building on the FDIC enforcement precedent, regulators should:

  • Prohibit digital asset firms from claiming or implying government-backed insurance coverage (FDIC, FSCS, SIPC, or equivalent) unless such coverage genuinely applies to the specific product. The FDIC's GENIUS Act NPR (April 2026) confirming that stablecoin reserves are not pass-through insured, and the deposit/investor-scheme exclusions documented in the deposit guarantee schemes section, provide the legal anchor.
  • Require clear disclosure of what insurance coverage (if any) a digital asset firm maintains, including the insurer's identity, policy limits, covered risks, and material exclusions.
  • Mandate that any reference to "insured" or "protected" in consumer-facing materials be accompanied by a standardised disclaimer identifying the insurer and the scope of coverage.

5.3 Insurer Reporting Obligations

Regulators should require insurers writing digital asset risks to report:

  • Aggregate gross written premium, claims incurred, and loss ratios for digital asset lines, reported separately from traditional business
  • Material claim events exceeding a threshold (e.g., $5 million) within a specified timeframe
  • Suspected insurance fraud referrals related to digital asset claims
  • Concentration data showing exposure to individual policyholders, protocols, or custodians

5.4 Sanctions Compliance Standards

Drawing on the Tornado Cash precedent and OFAC guidance, regulators should expect insurers to:

  • Screen policyholders and claims payees against all applicable sanctions lists, including wallet-address-level screening where the insurer has access to on-chain data
  • Maintain documented sanctions compliance programmes that are updated at least annually
  • Conduct enhanced screening when policies involve DeFi protocols, privacy-preserving technologies, or operations in high-risk jurisdictions
  • Report sanctions matches to the relevant authority (OFAC, OFSI, EU member-state competent authority) within mandated timeframes

5.5 Cross-Border Coordination

Digital asset insurance is inherently cross-border. Regulators should:

  • Participate in IAIS supervisory colleges and information-sharing arrangements for insurers writing material digital asset business across jurisdictions
  • Align licensing frameworks with international standards to reduce regulatory arbitrage
  • Engage with FATF mutual evaluation processes to ensure that insurance-sector AML/CFT assessments cover digital asset-related business

5.6 Addressing De-Risking

Regulators should take affirmative steps to ensure that legitimate digital asset businesses can access insurance:

  • Issue clear, public guidance on supervisory expectations for insurers writing digital asset risks, reducing the regulatory ambiguity that drives blanket refusals
  • Consider whether mandatory minimum insurance requirements for licensed VASPs/CASPs (as already implemented in South Korea, Hong Kong, Bahrain, and the UAE, and contemplated under MiCA and certain other frameworks) are appropriate for the jurisdiction, while ensuring domestic or accessible international underwriting supply exists to satisfy them
  • Support industry-led data-sharing initiatives (e.g., aggregated loss databases) to build the actuarial base necessary for accurate pricing
  • Monitor D&O and professional indemnity availability for digital asset firms as an indicator of market health

Verification Notes

This document mirrors the canonical per-jurisdiction facts in the digital-asset-insurance fact matrix (18 jurisdictions: United States, Bermuda, Canada, Cayman Islands, Australia, Hong Kong, Japan, Singapore, South Korea, European Union, France, Germany, Liechtenstein, Switzerland, United Kingdom, Bahrain, Emerging Markets [Brazil, Nigeria, South Africa, India], and the United Arab Emirates). No fact outside the matrix or the prior verified text has been introduced.

All enforcement actions cited were verified against primary regulatory sources (FDIC.gov press releases, FTC.gov press releases, FCA.org.uk policy statements, SEC.gov press releases, ASIC media release 24-274MR). Legislative references (31 CFR 1025, UK MLRs, EU Regulation 2024/1624, Singapore PSA / MAS Notice 314, Korea VAUPA, Japan FIEA amendment bill, Cayman MC-RSOG, Canada Bill C-15) were verified against official regulatory texts, the fact matrix, or official government portals. The Tornado Cash timeline was verified against OFAC records and the Fifth Circuit Court ruling. FATF and IAIS documents were verified against the organisations' official publication pages.

Key refreshes reflected this cycle (per the fact matrix): the US FDIC GENIUS Act NPR (FIL-11-2026, April 2026 — stablecoin reserves not pass-through insured) and the binding joint SEC/CFTC interpretation (17 March 2026); Australia's Bit Trade (Kraken) AUD 8 million penalty (12 December 2024) and the Digital Assets Framework Act (Royal Assent 8 April 2026, commences 9 April 2027) with AML/CTF reform (existing reporting entities incl. existing DCEs from 31 March 2026; tranche-2 new sectors from 1 July 2026); Japan's FIEA amendment bill (Cabinet-approved 10 April 2026, unregistered-operator penalty up to 10 years / JPY 10 million); South Korea's VAUPA mandatory-insurance enforcement (Upbit restoration, November 2025) with no-fault liability still proposed not enacted; Hong Kong's 13 licensed VATPs and the IA's 100% downward-stress RBC conclusions (8 May 2026); Cayman's first full VASP licence to BCXPro (5 February 2026) and the MC-RSOG insure-or-mitigate regime (February 2026); Canada's Stablecoin Act (Royal Assent 26 March 2026, not yet in force); the EU's Solvency II Delegated Regulation (EU) 2026/269 (OJ 18 February 2026, no crypto-specific charge), the pending EIOPA 100% crypto capital stress (Mar 2025 advice, not yet enacted), and the 1 July 2026 MiCA transition end (mirrored for France, Germany, and Liechtenstein); and the FATF Recommendation 15 2025 compliance benchmark (of 138 jurisdictions assessed, ~1% fully / ~29% largely compliant).

The following items could not be independently verified to a primary source and are flagged:

  • The exact number of SEC cryptocurrency enforcement actions (approximately 125 between April 2021 and December 2024) is drawn from secondary analysis (Gibson Dunn mid-year update) and may vary by counting methodology. PARTIALLY VERIFIED.
  • D&O premium multiples for crypto companies (2-3x, up to 5x) are drawn from broker reports and industry commentary rather than actuarial data filings. UNVERIFIED -- industry estimates only.
  • Global digital asset insurance market-size figures (single-digit-billions range; ~USD 9.49 billion for 2025) and per-policy / facility capacity figures (e.g., Marsh up to USD 825M, Evertas/Arch up to USD 420M per policy) are drawn from market-research reports and insurer/broker self-reporting and have not been independently audited. SELF-REPORTED / UNVERIFIED.
  • Supervision and enforcement of Cayman's MC-RSOG "insure-or-mitigate" standard is not yet established through published CIMA guidance. NOT VERIFIED.
  • South Korea's no-fault liability rule (fines up to 3% of annual revenue) remains PROPOSED, not enacted as of 4 June 2026.
Graph view