Custodian Insurance Requirements by Jurisdiction

1. The Mandatory-versus-Voluntary Spectrum

Across the 18 jurisdictions studied, no jurisdiction has created a dedicated "digital asset insurer" licence category, and only a minority impose insurance on custodians as a hard requirement. The distinction that matters most for custodians is whether insurance is a mandate (a precondition for operating) or a voluntary market practice driven by client demand. The matrix below classifies each jurisdiction precisely; the sections that follow detail the mandate, scope, regulator, and the availability of Lloyd's specie/crime cover for each.

A precise count for N = 18:

• Insurance mandated or mandated-in-substance for custodians: 7 jurisdictions — Hong Kong, South Korea, the UAE, Bahrain, Canada, the Cayman Islands, and (partially) Nigeria within the Emerging-Markets group.
• Insurance permitted as an explicit alternative to own funds, but not mandatory: 4 jurisdictions — the European Union, France, Germany, and Liechtenstein (all under MiCA/MiCAR Article 67).
• Flexible "surety-bond-or-trust-or-insurance" client-asset protection (insurance one of several options): 1 jurisdiction — Bermuda.
• Voluntary / no insurance mandate: the remainder — the United States, Singapore, Switzerland, the United Kingdom, Australia (enacted but not in force; PI-only via AFSL), Japan (no standalone mandate today; pre-funded liability reserves proposed under FIEA migration), and Brazil / India / South Africa within the Emerging-Markets group.

In every one of the 18 jurisdictions, deposit-guarantee and investor-compensation schemes exclude crypto-assets (where such a scheme exists at all). Insurance, capital, and asset segregation — not the public safety net — are the only protections available to custodial clients.

2. Mandatory and Mandated-in-Substance Jurisdictions

Seven jurisdictions make insurance (or an equivalent compensation arrangement) a precondition for providing digital asset custody. They differ sharply in specificity — from Hong Kong's prescriptive 50%/100% coverage ratios to the UAE's principles-based "adequacy" standard.

2.1 Hong Kong -- SFC VATP Regime

The

Hong Kong Securities and Futures Commission (SFC) imposes the most prescriptive coverage thresholds globally. Every licensed Virtual Asset Trading Platform (VATP) must maintain a compensation arrangement covering client virtual assets as an explicit licensing condition. The Hong Kong Monetary Authority (HKMA) mirrors the requirement for banks, and the Insurance Authority (IA) supervises insurers.

Lloyd's specie/crime cover: Foundational and dominant. Canopius (Lloyd's) led OSL's USD 1B custody programme (covering hot and cold wallets); Arch, Atrium, and Beazley syndicates underwrite Hong Kong crypto risk, and the Marsh Blue Vault consortium (with Arch) is active. Domestic insurer capacity is limited.

2026 development: The Insurance Authority published RBC-framework consultation conclusions on 8 May 2026, applying a 100% downward stress factor to insurers' direct crypto holdings (no diversification benefit), with a look-through plus counterparty-default overlay for stablecoins and an exclusion for tokenised conventional instruments; implementation is targeted for 31 December 2026, pending LegCo negative vetting. As of 18 May 2026, 13 VATPs are licensed (NewBX Limited / Bixin.com being the latest).

2.2 South Korea -- Virtual Asset User Protection Act (VAUPA)

South Korea's VAUPA, effective 19 July 2024, is one of the most prescriptive mandatory frameworks globally and the only one validated in practice by an actual hack restoration.

• VASPs must maintain liability insurance, equivalent reserves, or a combination covering at least 5% of the value of customer virtual assets held in hot wallets.
• Minimum amounts are set by VASP category: KRW 3 billion (~USD 2.2M) for KRW-market exchanges; KRW 500 million (~USD 370,000) for coin-only exchanges and wallet/custodians.
• Cold storage minimum: 80% of user deposits offline.
• Insurance must come from FSC-notified providers; domestic insurers (Samsung Fire & Marine, DB Insurance, Hyundai Marine & Fire, KB Insurance) launched VAUPA-compliant products in 2024.

Lloyd's specie/crime cover: Available via Lloyd's Asia-Pacific coverholders distributing through licensed Korean brokers; Evertas (a Lloyd's coverholder) is the named specialty crypto provider. The matrix records no specific domestic market-capacity figure, and depth for large-scale losses remains untested at scale.

Proof of concept: In November 2025, Upbit's ~USD 28M Solana-token hack was the first publicly reported use of VAUPA-mandated insurance and reserves to fully restore a hacked exchange's funds (Upbit subsequently raised cold storage to 95%).

Pending — not enacted: A no-fault liability regime remains PROPOSED, not enacted, as of 4 June 2026. It is the central feature of the Democratic Party's second-phase Digital Asset Basic Act (DABA) bill (introduced 8 April 2026, fines up to 3% of annual revenue), which was dropped from the National Policy Committee subcommittee agenda on 12 May 2026, with review pushed to H2 2026. The April 2026 operational-resilience package (5-minute reconciliation, kill switch, monthly audits, CRO/Risk Committee) does not change the Section 2 insurance/reserve thresholds.

2.3 United Arab Emirates -- VARA, ADGM FSRA & DFSA

The

UAE operates a multi-regulator mandatory regime — among the most comprehensive globally — across four perimeters: VARA (Dubai mainland), ADGM FSRA (Abu Dhabi), DFSA (DIFC), and CBUAE (federal/onshore).

VARA's four mandatory insurance categories (Company Rulebook v2.0, effective 19 June 2025):

ADGM FSRA mandates PII (minimum standards effective 1 January 2026, annual board-approved attestation); DFSA mandates PII + cyber insurance (effective 12 January 2026). All require a regulated insurer and use adequacy-based standards — no fixed minimum coverage amounts are prescribed; VARA assesses adequacy case-by-case with annual review, and may waive coverage where a VASP demonstrates inability to obtain it, subject to alternative risk-mitigation licence conditions.

Lloyd's specie/crime cover: Available — hot-wallet theft via commercial crime policies, cold storage (specie) via London/Bermuda specialty markets and Lloyd's syndicates (Arch, Atrium, Beazley, Canopius). Brokers Marsh (DART; Blue Vault with Arch/Canopius) and Aon run dedicated digital-asset practices in the region.

2026 developments: VARA's Exchange Services Rulebook v2.1 (Part V, 31 March 2026) introduced a dedicated ETD Insurance Fund (a default-protection/clearing-style buffer distinct from the Section D commercial policies) for VASPs offering exchange-traded derivatives. Existing operators must comply with Federal Decree-Law No. 6 of 2025 (which brings DeFi/blockchain within scope via Article 62) by September 2026.

2.4 Bahrain -- Central Bank of Bahrain (CBB)

Bahrain's CBB Rulebook Volume 6 imposes quantified mandatory insurance on all Crypto-Asset (CRA) Module licensees — more prescriptive on the minimum than the UAE's principles-based regime — under a single regulator for both crypto-assets and insurance.

Bahrain maintains two separate frameworks: the Digital Tokens framework (issued 30 March 2023 via CRA amendments, addressing security-type tokens) and the Stablecoin Issuance and Offering (SIO) Module (4 July 2025 — fully fiat-backed single-currency stablecoins, 1:1 reserves with independent custodians, daily reconciliation, annual external audit, minimum paid-up capital BHD 250,000). The SIO Module specifies no distinct issuer insurance mandate (NOT VERIFIED in the published SIO text).

Lloyd's specie/crime cover: No local specie product is identified (NOT VERIFIED); specialty risks are placed internationally through licensed intermediaries (Lloyd's syndicates, Bermuda carriers, Marsh/Aon Gulf operations). Local specialty capacity is very limited, and no Bahraini insurer offers a dedicated digital-asset product as of June 2026.

2.5 Canada -- CIRO Digital Asset Custody Framework

Canada makes fidelity and specie insurance mandatory in substance — a "gating factor" for custodian-tier approval — under CIRO's interim Digital Asset Custody Framework, published 3 February 2026. CSA platform recognition undertakings (PRUs) create implicit insurance needs, OSFI sets insurer capital treatment, and CDIC/CIPF exclude crypto. No prescribed minimum coverage amounts.

Tier capital figures are self-reported, drawn from law-firm and trade-press readings of the CIRO notice rather than a published CIRO schedule. "Fidelity" means a Crime/Financial Institution Bond across all storage; "specie" applies to cold storage. OSFI separately raised the Group 2 crypto-exposure cap from 1% to 5% of Net Tier 1 capital (effective January 2026).

Lloyd's specie/crime cover: Accessible through licensed Canadian brokers; fidelity/crime bonds and specie (cold-storage) cover are available through Lloyd's syndicates and Bermuda/Cayman specialty carriers (with Marsh and Aon Canadian offices). No major Canadian insurer has launched a dedicated digital-asset line (NOT VERIFIED — absence of evidence), leaving a domestic capacity gap and reliance on global specialty markets.

Pending: The federal Stablecoin Act received Royal Assent on 26 March 2026 (via Bill C-15; Bank of Canada as supervisor) but is not yet in force (implementation expected 2027). The CIRO framework is "interim"; minimum coverage amounts may follow.

2.6 Cayman Islands -- CIMA Market Conduct RSOG

The

Cayman Islands moved from disclosure-based requirements to prescribed insurance categories on an "insure-or-mitigate" basis via the Market Conduct RSOG (MC-RSOG, effective February 2026), making insurance mandatory in substance but flexible for all VASPs authorised under the VASP Act. CIMA is the dual regulator for both insurance and VASPs.

The MC-RSOG prescribes the insurance categories VASPs must hold — professional liability, theft/loss of client assets, business interruption, and cybersecurity — but permits equivalent risk-mitigation in lieu, and sets no numeric coverage minimums. The shift responded directly to CIMA's November 2025 thematic review finding that 82% of reviewed VASPs lacked any cybersecurity insurance. Supervision and enforcement of the "insure-or-mitigate" assessment are not yet established through published guidance (NOT VERIFIED).

Lloyd's specie/crime cover: No specific Lloyd's specie/crime product is detailed in the matrix; Cayman reinsurers and Segregated Portfolio Companies access global reinsurance capacity through retrocession with Bermuda and London-market participants. No crypto-specific captive has been formed (NO DATA as of June 2026), though a deep captive ecosystem (720 active Class B/C/D insurers) exists.

2026 milestone: The first full Cayman VASP licence was issued to BCXPro (JMSC Trading Limited) on 5 February 2026, covering virtual-asset custody (the VASP Act's Phase Two licensing regime took effect 1 April 2025).

2.7 Nigeria (Emerging Markets) -- Partial Mandate

Within the Emerging-Markets group, Nigeria is the only partial mandate. The SEC requires a fidelity bond of at least 25% of minimum paid-up capital, plus user-asset insurance (no minimum specified) and cold-wallet audit/insurance, for DAX/DAOP/DAI/custodian licensees under ISA 2025. A 16 January 2026 SEC circular raised minimum paid-up capital (DAX/Custodians ₦2bn, DAOP ₦1bn, DAI ₦500m), mechanically raising the fidelity-bond floor (deadline 30 June 2027). It is the most prescriptive of the four emerging markets, but no local capacity exists to satisfy it — international specialty capacity (Bermuda/London) is theoretically accessible but priced for institutional clients. By contrast, South Africa maintains an explicit Section 13 insurance exemption, and Brazil and India impose no digital-asset insurance mandate.

3. Insurance-as-Capital-Alternative Jurisdictions (MiCA / MiCAR)

Four jurisdictions permit insurance to substitute for own funds under MiCA/MiCAR Article 67 — a regulatory pull toward insurance without a hard mandate.

3.1 European Union -- MiCA (Regulation 2023/1114)

The

Markets in Crypto-Assets Regulation makes insurance an elective prudential safeguard, not a mandate, for crypto-asset service providers (CASPs), supervised by ESMA/EBA (with EIOPA and national NCAs for insurers under Solvency II).

• Article 75(8): CASPs providing custody are liable for loss of clients' crypto-assets due to malfunction or hacking, except where the loss arose from an event beyond their reasonable control — the most significant custodian-liability provision in any jurisdiction.
• Article 67 prudential requirement: CASPs must hold at all times the higher of minimum permanent own funds (EUR 50,000–150,000 by class; EUR 150,000 CET1 for Class 3 custody) or one quarter of the preceding year's fixed overheads — met via own funds, an equivalent insurance policy, or a combination.
• The Article 67(4) policy must run ≥1 year, give ≥90 days' cancellation notice, come from a third-party authorised insurer, be publicly disclosed, and cover six risk categories (including the Article 75(8) custodian liability). No minimum coverage amount is specified.

Lloyd's specie/crime cover: Yes — Lloyd's is the primary market. Evertas (custodial crime), Coincover (hot-wallet), and specie/custodial-crime cover are written via syndicates (Arch, Atrium, Beazley, Canopius, TMK, Markel). Marsh's MiCAssure was designed specifically to meet Article 67.

2026 status — important correction: The Solvency II Delegated Regulation (EU) 2026/269 was published in the OJ on 18 February 2026 and entered into force 10 March 2026; it contains NO crypto-specific capital charge. EIOPA's 100% crypto capital stress (final technical advice, 27 March 2025) is still a pending subsequent delegated act — not yet enacted. The MiCA transitional period ends 1 July 2026 (~199 licensed CASPs across 23 countries as of April 2026).

3.2 France -- PACTE Law / MiCAR

France pioneered the insurance-or-own-funds model in 2019 (PACTE Law's optional DASP licence required professional-indemnity insurance or minimum own funds), four years before MiCAR — but insurance remains elective, not mandatory. The AMF authorises and the ACPR clears prudentially; MiCAR Article 67 has applied to CASPs since 30 December 2024.

Lloyd's specie/crime cover: Yes, via London — Evertas crime/theft/fidelity up to USD 420M (self-reported) and Lloyd's syndicates (Arch, Beazley, Canopius) are accessible to French entities. No French-domiciled insurer underwrites a dedicated digital-asset product; French majors (AXA IM, SG-Forge, Generali, CACEIS) engage only as investors/issuers. The DASP/MiCAR transition ends 1 July 2026 (~90 PSANs were unlicensed in January 2026, ~30% had applied).

3.3 Germany -- BaFin / MiCAR

Germany applies MiCAR Article 67's insurance-as-capital option (not mandatory) under BaFin, the integrated supervisor. It is the largest visible EU/EEA MiCA CASP market — ~53 authorised CASPs (vs ~25 in the Netherlands) of ~199 EU/EEA-wide (self-reported, MiCA SCAN, confirmed 4 May 2026).

Lloyd's specie/crime cover: Yes — Marsh MiCAssure was developed with Lloyd's syndicates, and Evertas (Lloyd's-backed) writes crime/theft/fidelity up to USD 420M (self-reported). Germany is distinguished by Munich Re as a domestic underwriting champion (Digital Asset Comprehensive Crime Plus, Staking Risk, and Smart Contract Risk products; fully-insured custody/staking with Boerse Stuttgart Digital). National KMAG grandfathering closed 31 December 2025; the EU-wide transition ends 1 July 2026.

3.4 Liechtenstein -- FMA / TVTG + MiCAR

Liechtenstein's TVTG (Blockchain Act) imposes no insurance mandate on TT service providers (event-driven supervision); MiCAR Article 67's voluntary insurance-or-own-funds applies only to in-scope CASPs (since the EEA MiCAR Implementation Act, 1 February 2025). The FMA is the integrated supervisor.

Lloyd's specie/crime cover: Yes, via London — Lloyd's syndicates (Arch, Beazley, Canopius) and Evertas provide crime/theft/fidelity, with custody/specie cold/warm/hot wallet coverage accessible. No Liechtenstein-domiciled insurer underwrites a dedicated digital-asset product. The jurisdiction is distinctive for dual EEA + Swiss passporting; its deposit-guarantee foundation (EAS) is a Protected Cell Company (PCC) under which security tokens are eligible for investor compensation up to CHF 30,000 while unbacked crypto (BTC, ETH) is not. TT providers must obtain MiCAR authorisation by the 1 July 2026 grandfathering deadline (Art. 63/143(3)).

4. Flexible Client-Asset-Protection Jurisdiction

4.1 Bermuda -- DABA (surety-bond-or-trust-or-insurance)

Bermuda's Digital Asset Business Act (DABA 2018) requires a licensed digital asset business holding client assets to maintain a surety bond, trust account, OR indemnity insurance — insurance is one of several permissible protections, not a strict mandate — at a level commensurate with risk (or other BMA-agreed mitigation), and the DAB must disclose whether it carries insurance against hacking/theft. The BMA is the integrated regulator for both insurance and digital asset businesses.

Lloyd's specie/crime cover: Bermuda hosts the largest reinsurance concentration outside Lloyd's. Relm Insurance (the first/only Class IIGB commercial insurer) writes D&O, professional indemnity, crime, cyber, smart-contract-failure, and staking/slashing cover; dedicated innovative classes (Class IIGB/IILT), the Nakamoto/Gemini Class 1 captive (USD 200M custody cover at launch), a sandbox/Innovation Hub, and ~50 years of captive expertise make Bermuda the world's most developed dedicated digital-asset insurance infrastructure. A proposed Parametric Special Purpose Insurer (PSPI) class remains in consultation (targeted end-Q2 2026).

5. Voluntary / No-Mandate Jurisdictions

The remaining jurisdictions impose no insurance mandate on custodians; protection rests on segregation, capital, cold-storage ratios, and market-driven (institutional-client-led) voluntary insurance.

5.1 United States

The

US has no federal mandate and no state mandate requiring digital asset firms to carry insurance, and no "digital asset insurance" licence category in any state. Insurance regulation is state-level (McCarran-Ferguson Act) and operates overwhelmingly through the surplus lines (non-admitted) market; federal agencies (FDIC, SEC, CFTC, OCC, FIO) intersect only indirectly, and the FIO has issued no digital-asset-insurance guidance.

Lloyd's specie/crime cover: Foundational. Lloyd's syndicates (Arch, Atrium, Beazley, Canopius) are the dominant surplus-lines providers; crime/specie policies are the core custodian coverage. Specialty insurers include Evertas (Lloyd's coverholder, Arch lead capacity), Relm, Munich Re, Coincover (Atrium), and Canopius. Exchange self-insurance funds (Binance SAFU ~USD 1B, Coinbase USD 320M, Bitstamp USD 300M) supplement commercial cover.

Deposit-scheme exclusion (refreshed): FDIC does not cover cryptocurrency, and the FDIC's GENIUS Act NPR (FIL-11-2026, issued 7 April 2026) bars pass-through insurance for stablecoin reserves — stablecoin reserves are NOT pass-through insured (comments due 9 June 2026; proposed, not final). SIPC does not protect unregistered crypto-asset securities or non-security crypto (BTC/ETH). The SEC/CFTC joint crypto-asset interpretation (SEC Release 33-11412 / CFTC PR 9198-26) was issued 17 March 2026, establishing a binding five-part token taxonomy.

5.2 Singapore

The

Monetary Authority of Singapore (MAS) — a single integrated regulator — does not require Digital Payment Token (DPT) service providers to hold insurance as a licensing condition. Protection is custody-first: trust-account segregation plus the PS-G03 cold-storage mandate (≥90% cold, ≤10% hot); insurance is not even listed as an alternative safeguarding method, and firms voluntarily insure only the ~10% hot-wallet exposure.

Lloyd's specie/crime cover: Strong and locally anchored. Canopius Syndicate 4444 was first on the Lloyd's Asia platform (May 2023), combining crime and specie into a single digital-asset custody policy (up to US$130M per line, covering crypto, stablecoins, and NFTs). Singapore hosts the second-highest number of crypto insurers globally (10, Tracxn Jan 2025), including Relm, OneDegree, and Lloyd's coverholders Evertas, Coincover, and AnchorWatch. Self-reported capacity: Evertas/Arch up to US$420M per policy (2023; the widely-cited US$500M/2025 figure is unconfirmed).

As of 4 June 2026, the MAS Financial Institutions Directory lists 37 Major Payment Institutions with DPT-service activity (superseding the earlier "36" figure). The DTSP licensing framework (FSMA 2022) took effect 30 June 2025 with no insurance mandate, and MAS's April 2026 consultation on prudential treatment of cryptoassets was banking-focused with no insurance mandate.

5.3 Japan

Japan's Payment Services Act (PSA) imposes no standalone insurance mandate today; user protection rests on asset segregation, 95% cold storage, annual CPA audits, and JVCEA self-regulation, with the FSA/JFSA as regulator. Crypto is "property value," not a deposit, so the Deposit Insurance Corporation of Japan (JPY 10M limit) excludes it.

Proposed migration: The FIEA amendment bill was Cabinet-approved on 10 April 2026 and submitted to the Diet. It reclassifies crypto as a financial instrument and introduces mandatory pre-funded liability reserves (sized to trading volume/incident record, covering cold-wallet value; approved insurance may count toward part of the reserve), insider-trading bans, wallet-provider registration, and raises the unregistered-operator penalty to up to 10 years' imprisonment / JPY 10M fine. The new FIEA framework is expected to take effect as early as FY2027 if passed; the insurance-as-reserve details are not yet finalised.

Lloyd's specie/crime cover: Available via Lloyd's syndicates (Arch, Atrium, Beazley, Canopius) underwriting custody, crime, and professional liability, distributed into Japan through an HK-based Lloyd's coverholder MGA. Domestic non-life insurers (Sompo, MS&AD, Tokio Marine — ~90% of non-life premium) offer limited dedicated crypto products. Notably, none of Japan's major historical hacks (Mt. Gox, Coincheck, DMM Bitcoin) was covered by insurance — losses were absorbed via corporate capital, parent injections, or bankruptcy rehabilitation.

5.4 Switzerland

Switzerland applies a technology-neutral approach with no statutory insurance mandate — unlike France's DASP regime or EU MiCA, FINMA does not require crypto service providers to hold PI insurance or equivalent own funds. FINMA Guidance 01/2026 (12 January 2026) requires bankruptcy-proof segregable custody plus operational/cyber controls, with insurance optional; insurers are supervised under VAG and the Swiss Solvency Test (SST), not Solvency II, and there is no EU/EEA passporting (though Liechtenstein can passport in). Protection rests on insolvency segregation — segregable custody assets are returned to clients in bankruptcy — plus private-market insurance.

Lloyd's specie/crime cover: Yes, via London/international — Evertas (Lloyd's-backed) writes up to USD 420M per policy (self-reported), with specie/custody cover available and hot-wallet sub-limits typically capped around USD 10M. FINMA-licensed crypto banks (Sygnum, AMINA) carry institutional custody insurance; Swiss Re is cautious on direct underwriting. esisuisse deposit insurance (CHF 100,000) excludes all crypto.

5.5 United Kingdom

The

UK imposes no bespoke or mandatory digital asset insurance requirement, and custodian insurance remains voluntary even under the forthcoming 2027 regime. Digital-asset lines are written under existing general-insurance frameworks (FCA conduct/ICOBS; PRA prudential/Solvency UK; Lloyd's Corporation oversight). The new cryptoasset regime (SI 2026/102) comes into force 25 October 2027 but introduces no insurance mandate; CP26/4 proposes CASS-17-style non-statutory-trust safeguarding (structural, not an insurance mandate). FSCS explicitly excludes cryptoasset losses.

Lloyd's specie/crime cover: The UK is the global hub. Lloyd's syndicates (Atrium/609, TMK, Markel, Canopius, Mosaic/1609, Chaucer, Arch) and coverholders (Evertas, AnchorWatch) write specie/crime (custody) cover spanning hot and cold wallets, employee dishonesty, fraudulent transfer, and computer fraud — Canopius even covers "mysterious disappearance" of private keys. Self-reported capacity: Marsh DART up to USD 825M; Evertas up to USD 420M; AnchorWatch up to USD 500M/customer; Aon over USD 1.2B; Lloyd's PIF ~GBP 150M.

5.6 Australia

Australia has no bespoke crypto insurance mandate; protection is voluntary / PI-only via the existing AFSL regime (AFSL holders must hold adequate professional-indemnity insurance). The Digital Assets Framework Act 2026 received Royal Assent on 8 April 2026 but commences 9 April 2027 (with a 6-month transition), bringing Digital Asset Platforms (DAPs) and Tokenised Custody Platforms (TCPs) under AFSL — but it prescribes no crypto coverage ratio. ASIC licenses, APRA handles prudential/insurers, and AUSTRAC handles AML/CTF.

Lloyd's specie/crime cover: Accessible via Australian brokers — Lloyd's syndicates (Arch, Atrium, Beazley, Canopius) underwrite crypto risk, with Marsh DART (up to USD 825M, self-reported) and Marsh Blue Vault (USD 150M cold storage). Domestic capacity is limited (QBE, IAG, Suncorp offer no dedicated crypto products).

AML/CTF reform (refreshed): New AML/CTF obligations commenced for existing reporting entities, including existing Digital Currency Exchange (DCE) providers, on 31 March 2026; the tranche-2 NEW sectors commence 1 July 2026. The Financial Claims Scheme (FCS, AUD 250,000) excludes crypto platforms (not ADIs).

6. Comparative Table: All 18 Jurisdictions x Requirements

Brazil, India, and South Africa (Emerging Markets) impose no DA insurance mandate — South Africa via an explicit Section 13 exemption — and are folded into the Emerging-Markets group above with Nigeria.

7. Cross-Reference with Crypto Custody Domain

7.1 Insurance and Custody Licensing Interaction

Insurance requirements interact with custody licensing regimes in three principal ways:

1. Insurance as licence condition / gating factor: In the UAE (VARA/ADGM/DFSA), Bahrain (CBB), Hong Kong (SFC), South Korea (VAUPA), Canada (CIRO), and the Cayman Islands (MC-RSOG), insurance or an equivalent compensation/mitigation arrangement is a precondition for obtaining or maintaining a licence. Failure to maintain coverage can result in suspension.

2. Insurance as capital substitute: Under MiCA/MiCAR (EU, France, Germany, Liechtenstein), insurance can replace own funds — an economic choice between holding EUR 150,000+ in CET1 or buying an equivalent policy.

3. Insurance as supervisory expectation: In the US (NY DFS) and UK (FCA), insurance is not formally required but is a practical necessity for regulatory approval and institutional onboarding.

7.2 Insurance vs. Capital vs. Segregation as Consumer Protection

No jurisdiction relies on a single mechanism alone; best practice combines segregation (insolvency), capital (smaller operational losses), and insurance (catastrophic risk transfer).

7.3 The "Unsaid Items" -- Institutional Client Demands

Regulatory minimums consistently fall below what institutional clients require (per market practice from Marsh, Aon, WTW, Lockton):

This gap means custodians targeting institutional clients must substantially exceed compliance minimums regardless of jurisdiction.

8. Gap Analysis

8.1 Coverage Gaps in Mandatory Jurisdictions

8.2 Structural Issues

1. Procyclicality: Capacity contracts during market stress precisely when claims increase; the 2022 crypto winter saw multiple underwriters exit.
2. Aggregation risk: A single systemic event (consensus failure, major protocol exploit) could trigger simultaneous claims, exhausting market capacity.
3. Valuation challenge: Digital-asset valuations fluctuate within policy periods; Hong Kong's dynamic compensation arrangement addresses this partially, but most jurisdictions use point-in-time valuations.
4. Cross-border enforcement: Insurance requirements follow the custodian's licence, not the client's domicile, creating protection gaps for cross-border users.

9. Recommended Framework for Regulators

Based on comparative analysis of all 18 jurisdictions, regulators designing custodian insurance requirements should consider the following.

9.1 Minimum Viable Insurance Framework

9.2 Tiered Approach (Recommended)

Following the Canadian CIRO model, regulators should consider tiering insurance requirements to custodian size and risk profile:

9.3 Additional Recommendations

1. Prohibit self-insurance as sole protection: Reserve funds should supplement, not replace, third-party commercial insurance, and be subject to independent governance and audit.
2. Require insurance disclosure: Custodians should disclose insurer identity, policy limits, material exclusions, and claims history to clients.
3. Harmonise cross-border recognition: A policy meeting VARA or MiCA requirements should be recognised elsewhere without duplicative coverage.
4. Address the capacity constraint: Avoid mandating coverage levels that exceed available market capacity; engage Lloyd's, Munich Re, and Bermuda carriers during rulemaking — especially where a mandate (Nigeria, Bahrain, Canada) outruns local supply.
5. Establish loss-data sharing: Mandatory anonymised loss reporting would build the actuarial database underwriters need to expand capacity. See claims-history analysis for current data gaps.
6. Review requirements annually: The market evolves rapidly; staking insurance, smart-contract cover, and DeFi-custody products are still maturing.

Verification Notes

This document was refreshed on 4 June 2026 against the canonical per-jurisdiction fact matrix (.claude/digital-asset-insurance-fact-matrix.json), which is the verified source of truth for this run. No new web searches were conducted for this refresh; all facts mirror the matrix and existing verified content.

Aggregates are recomputed for N = 18 jurisdictions: United States, Bermuda, Canada, Cayman Islands, Australia, Hong Kong, Japan, Singapore, South Korea, European Union, France, Germany, Liechtenstein, Switzerland, United Kingdom, Bahrain, the United Arab Emirates, and the Emerging-Markets group (Brazil, Nigeria, South Africa, India).

Key refreshes reflected this cycle:

• United States: FDIC GENIUS-Act NPR (FIL-11-2026, 7 Apr 2026) — stablecoin reserves NOT pass-through insured; SEC/CFTC joint interpretation (Release 33-11412 / PR 9198-26) issued 17 Mar 2026.
• Canada: Stablecoin Act Royal Assent 26 Mar 2026 (Bill C-15), not yet in force; CIRO 20% self-custody allowance at Tier 4.
• Cayman Islands: First full VASP licence to BCXPro (JMSC Trading) 5 Feb 2026; MC-RSOG insure-or-mitigate effective Feb 2026.
• Australia: Digital Assets Framework Act Royal Assent 8 Apr 2026, commences 9 Apr 2027; AML/CTF — existing reporting entities (incl. existing DCEs) commenced 31 Mar 2026, tranche-2 new sectors commence 1 Jul 2026.
• Hong Kong: 13 SFC-licensed VATPs; IA 100% downward stress, consultation conclusions 8 May 2026.
• Japan: FIEA bill Cabinet-approved 10 Apr 2026, penalty up to 10 years / JPY 10M.
• Singapore: 37 MPI/DPT licences; Evertas/Arch up to US$420M per policy (self-reported).
• South Korea: No-fault liability PROPOSED, not enacted; DABA phase-2 bill 8 Apr 2026.
• EU: Solvency II Delegated Regulation (EU) 2026/269 (OJ 18 Feb 2026) contains NO crypto-specific charge; EIOPA's 100% crypto stress remains a pending subsequent delegated act; MiCA transition ends 1 Jul 2026.
• France: DASP transition ends 1 Jul 2026.
• Germany: ~53 CASPs, largest EU market (self-reported).
• Liechtenstein: TT providers must obtain MiCAR authorisation by 1 Jul 2026; EAS is a PCC.
• Bahrain: Separate Digital Tokens (2023) and Stablecoin (SIO, Jul 2025) frameworks.

Market-capacity, premium, and per-policy coverage figures (e.g., Marsh DART USD 825M, Evertas USD 420M per policy, OSL USD 1B, Aon USD 1.2B, Singapore SRA pool USD 1B) are self-reported by providers/brokers and flagged as such; they are not independently re-verified this cycle. Items marked NOT VERIFIED / NO DATA indicate facts the matrix could not confirm. Discretionary mutuals (e.g., Nexus Mutual) are distinguished from regulated insurance throughout — they are not licensed insurers and members lack regulatory protection.