International Standards & Frameworks

1. Overview

No international standard-setting body has issued standalone guidance on digital asset insurance products. The global regulatory architecture for digital asset insurance is therefore assembled from intersecting workstreams across multiple bodies -- each addressing a facet of the problem but none providing a comprehensive framework.

This section synthesises the positions of six international bodies and one industry think tank, drawing on the jurisdiction and international-framework research files. The purpose is to enable regulators to understand what standards exist, where the gaps are, and what guidance they can expect in the near term.

Across the 18 jurisdictions studied in this domain, the standard-setter posture is consistent: insurance is addressed only indirectly -- through safeguarding, capital, conduct, and AML/CFT requirements. No international body mandates custodian or VASP insurance, and none provides a deposit-guarantee equivalent for crypto holders. Where insurance is mandatory it is so by national choice (Hong Kong, South Korea, the UAE, Bahrain, and -- in substance for custodians -- Canada and the Cayman Islands), not because any global standard requires it.

2. IAIS -- Insurance Core Principles and Digital Assets

2.1 Institutional Role

The International Association of Insurance Supervisors is the global standard-setting body for insurance supervision, comprising over 200 member jurisdictions. The IAIS develops the Insurance Core Principles (ICPs), which form the globally accepted framework for insurance regulation. ICPs are soft law -- not legally binding but used as benchmarks by the IMF and World Bank in Financial Sector Assessment Programs (FSAPs).

As of June 2026, the IAIS has not issued dedicated guidance on digital asset insurance products. Its approach is to apply existing ICPs -- designed to be technology-neutral -- to emerging risks, including those posed by digital assets.

Source: IAIS, Digital Innovation Activities; IAIS, Strategic Plan 2025-2029

2.2 Insurance Core Principles Applicability

The ICPs were adopted on 1 October 2011 and most recently revised on 5 December 2024. Six ICPs have direct relevance to digital asset insurance:

ICP 8 -- Risk Management and Internal Controls. Requires insurers to have effective enterprise risk management (ERM) frameworks. Insurers underwriting digital asset risks must integrate crypto-specific risk factors (volatility, smart contract failure, custody loss, regulatory change) into ERM. No IAIS-specific guidance exists on how ICP 8 should treat digital asset risk categories.

ICP 14 -- Valuation. Establishes requirements for valuing assets and liabilities for solvency purposes. Valuation of digital asset insurance liabilities faces challenges from limited claims history, extreme price volatility, and the absence of standardised loss distributions. The IAIS has not issued specific guidance on valuing digital asset insurance liabilities.

ICP 15 -- Investment. Governs insurer investment activities under prudent-person principles. Insurers investing in crypto-assets must demonstrate suitability for backing insurance liabilities. The December 2024 ICP revisions focused on climate risk in investments but did not introduce crypto-specific investment restrictions. EIOPA has noted that insurer crypto-asset investments remain "relatively limited to date and commonly take place via unit-linked life insurance products."

ICP 17 -- Capital Adequacy. The Insurance Capital Standard (ICS) was adopted in December 2024, effective 1 January 2025, as the prescribed capital requirement for Internationally Active Insurance Groups (IAIGs), using a 99.5% VaR measure over a one-year horizon. The ICS does not include a specific crypto-asset risk sub-module. Digital asset insurance lines would attract capital charges under the insurance risk module; insurer crypto-asset investments would face market risk charges. As of early 2026, 59 IAIGs from 18 jurisdictions have been identified under the ICS framework.

ICP 19 -- Conduct of Business. Requires fair treatment, transparent disclosure, and appropriate claims handling. No specific ICP 19 guidance addresses consumer protection for purchasers of crypto-specific insurance policies.

ICP 22 -- AML/CFT. The IAIS Application Paper on Combating ML/TF (November 2021) aligns with FATF standards. It focuses on the life insurance sector and does not specifically address AML/CFT risks arising from insuring digital asset businesses.

Sources:

• IAIS, ICPs and ComFrame (December 2024)
• IAIS, ICS Level 1 and Level 2 Texts (December 2024)
• IAIS, Application Paper on AML/CFT (November 2021)

2.3 FinTech Forum and DeFi Insurance Assessment

The IAIS FinTech Forum operates three workstreams: AI, SupTech, and Monitoring Emerging Digital Trends. Its digital asset insurance work includes:

• Crypto-Assets Member Survey: Mapped insurer underwriting and investment activities related to crypto assets. Results shared internally but not published as a standalone report.
• DeFi Insurance Use Case Assessment: Assessed B3i (blockchain reinsurance, insolvent July 2022), Etherisc (decentralised parametric insurance), and Nexus Mutual (DeFi cover protocol). The Forum noted it is "not yet clear if certain DeFi-related products are defined as 'insurance' products or what the best or appropriate regulatory approach is for these applications."

Key finding: The IAIS FinTech Forum has identified the DeFi insurance classification problem but has not issued a formal position or proposed a resolution framework.

Source: IAIS, Report on FinTech Developments (December 2022)

2.4 Operational Resilience and Strategic Direction 2025-2029

The IAIS Strategic Plan 2025-2029 identifies digital innovation as a cross-cutting theme, but priorities focus on AI governance, SupTech adoption, and operational resilience. The Strategic Plan does not include crypto-specific or digital asset insurance workstreams as standalone priorities.

The most concrete recent deliverable in this workstream is the final Application Paper on Operational Resilience Objectives and Toolkit, published 12 February 2026 (following draft consultations in 2024 and a July 2025 consultation draft). The paper establishes operational resilience objectives and a supporting toolkit to help supervisors meet the ICPs. It is directly relevant to insurers using DLT/blockchain for underwriting or claims processing and to third-party technology governance, but it contains no crypto-specific provisions and does not constitute digital asset insurance guidance.

The Roadmap 2026-2027 similarly contains no specific deliverables on digital asset insurance, crypto-asset guidance, or blockchain insurance regulation. The digital innovation workstream remains focused on AI and operational resilience.

Sources:

• IAIS, Strategic Plan 2025-2029
• IAIS, Final Application Paper on Operational Resilience Objectives and Toolkit (12 February 2026)

3. IOSCO -- DeFi Insurance Protocol Classification

3.1 Institutional Role

The International Organization of Securities Commissions does not regulate insurance directly -- that is the IAIS domain. However, IOSCO's work on digital asset investor protection, custody standards, and DeFi protocol classification has direct implications for how insurance-like products in the digital asset ecosystem are regulated.

3.2 Custody and Investor Protection (IOSCOPD747)

IOSCO's 18 Policy Recommendations for Crypto and Digital Asset Markets (IOSCOPD747, November 2023) include custody provisions (Recommendations 12-16) that are the most insurance-relevant international standards:

• CASPs must segregate client assets from proprietary assets
• Accurate records establishing "the precise nature, amount, location and ownership status of Client Assets" must be maintained
• CASPs must disclose custody practices, including what protections (insurance or otherwise) apply

IOSCO does not mandate insurance as a specific custodial safeguard, but its custody recommendations create a regulatory environment where insurance serves as a complementary protection mechanism.

Source: IOSCO, IOSCOPD747

3.3 DeFi Insurance Protocol Classification (IOSCOPD699, IOSCOPD754)

IOSCO's DeFi reports raise the critical regulatory question: are DeFi insurance protocols regulated as insurance, securities, or derivatives?

The IOSCO Decentralized Finance Report (IOSCOPD699, March 2022) and the Policy Recommendations for Decentralized Finance (IOSCOPD754, December 2023) suggest that many DeFi "insurance" protocols may function as derivatives under securities law:

• "A large portion of derivative DeFi protocols allow participants to create synthetic crypto-assets whose value derives from an underlying reference asset or event, and the reference asset or event could include the failure or hack of another DeFi protocol (insurance)"
• This classification implies that protocols like Nexus Mutual, InsurAce, and Unslashed Finance may be offering products that constitute securities or derivatives rather than insurance

Key finding: DeFi cover protocols potentially fall under securities regulation (registration, prospectus requirements, broker-dealer licensing) rather than -- or in addition to -- insurance regulation (licensing, reserve requirements, actuarial standards). This is the single most consequential unresolved international classification question for digital asset insurance.

Sources:

• IOSCO, IOSCOPD699
• IOSCO, IOSCOPD754

3.4 Thematic Review (IOSCOPD801) and 2026 Work Program

IOSCO's thematic review of implementation across 20 jurisdictions (IOSCOPD801, October 2025) found:

• "Significant progress is being made" but "there is still much more to be done"
• Custody recommendations showed strongest implementation; insurance mandates vary significantly
• Cross-border cooperation remains challenged by "legal barriers such as secrecy laws, data privacy restrictions and confidentiality requirements"
• No global consensus has emerged on whether insurance should be mandatory for CASP custody

IOSCO's 2026 Work Program (IOSCOPD813 / OR/01/2026, February 2026) supersedes the prior programme and commits IOSCO to finalising a formal assessment methodology for the Crypto and Digital Asset (CDA) Recommendations during 2026, after which the Assessment Committee will conduct regular consistency assessments and initiate recurring thematic reviews. The programme is informational rather than rule-making -- it introduces no new insurance or DeFi requirements -- but it signals that custody, investor-protection, and DeFi implementation (the areas most relevant to digital asset insurance) will be subject to recurring assessment.

Sources:

• IOSCO, IOSCOPD801
• IOSCO, 2026 Work Program (IOSCOPD813 / OR/01/2026)

4. FSB -- Financial Stability and Client Asset Safeguarding

4.1 CA and GSC Recommendations (July 2023)

The FSB's global regulatory framework for crypto-asset activities consists of:

• 9 CA Recommendations for crypto-asset activities and markets
• 10 GSC Recommendations for global stablecoin arrangements

Both frameworks apply "same activity, same risk, same regulation" and were endorsed by G20 leaders.

Insurance-relevant provisions:

• CA Recommendation 5 (Risk Management): Requires effective risk management frameworks addressing operational, cyber, and custody risks -- the risks insurance products typically cover
• CA Recommendation 7 (Disclosures): Requires transparent disclosure of governance, operations, and risk profiles, including insurance arrangements and coverage limitations
• GSC reserve requirements: Reserve assets must be "unencumbered and easily and immediately convertible into fiat currency at little or no loss"; capital buffers must be "consistent with the size of the GSC in circulation"; single-fiat-referenced GSCs must redeem at par into fiat -- creating insurance-like guarantee structures

The FSB does not mandate insurance for CASPs or stablecoin issuers, and the GSC recommendations explicitly stop short of requiring deposit insurance or equivalent protection for stablecoin holders. Its safeguarding provisions create the regulatory context in which insurance functions as a critical risk transfer mechanism, but the par-redemption requirement is an economic guarantee, not an insurance mandate.

Sources:

• FSB, CA Final Report (July 2023)
• FSB, GSC Final Report (July 2023)

4.2 Thematic Peer Review (October 2025)

The FSB's October 2025 thematic review found:

• 11 jurisdictions (39%) have finalized a regulatory framework for crypto-assets
• "Significant gaps and inconsistencies remain that could pose risks to financial stability"
• Only 11 jurisdictions have implemented comprehensive reporting requirements -- effective monitoring exists in just over half of jurisdictions with frameworks
• Recovery and resolution planning remains a "critical gap" -- directly relevant to insurance payouts in custodial failure scenarios
• No assessment of insurance coverage mandates across jurisdictions was conducted

Key finding: A majority of jurisdictions have not finalized crypto-asset regulatory frameworks, meaning insurance mandates (which depend on underlying CASP licensing regimes) cannot be implemented in most markets.

Source: FSB, Thematic Review (October 2025)

4.3 Insurance Sector Systemic Risk

The FSB monitors insurance sector exposure to digital assets as part of its financial stability mandate:

• Direct insurance sector exposure to crypto-assets remains minimal at the aggregate level
• Primary connections are through cyber insurance and D&O insurance for crypto firms
• The FSB has not identified systemic risk to the insurance sector from digital asset exposures

The FSB's 2026 Work Programme (February 2026) and the FATF's Targeted Report on Stablecoins and Unhosted Wallets (3 March 2026) keep stablecoins a priority but neither addresses insurance, leaving the standard-setter posture unchanged.

5. BIS/Basel -- Prudential Treatment Reference

5.1 Basel Committee Crypto-Asset Capital Standard

The Basel Committee on Banking Supervision finalized its standard on prudential treatment of banks' crypto-asset exposures in December 2022, with amendments in July 2024 and implementation date of 1 January 2026.

The classification framework creates a reference point for insurance capital treatment:

Insurance relevance: The 1,250% risk weight for Group 2b crypto-assets signals the extreme capital cost regulators associate with unbacked crypto exposure. While the Basel standard applies to banks, it establishes the prudential reference that influences how insurance supervisors think about crypto-asset capital treatment. The IAIS ICS does not include a specific crypto-asset sub-module, but the Basel framework provides the closest available benchmark. The Basel Committee announced on 20 May 2026 that it has expedited a targeted review of the cryptoasset standard (SCO60), signalling possible recalibration of the Group 1b/Group 2 classification and the 1,250% risk weight; no insurer-specific crypto capital standard has resulted.

Sources:

• BCBS, Prudential Treatment of Crypto-asset Exposures (December 2022)
• BIS, Press Release on Amendments (July 2024)
• BIS, Basel Committee press release (20 May 2026)

5.2 BIS Innovation Hub

The BIS Innovation Hub has not launched dedicated insurance innovation projects. However, CBDC projects (Helvetia, Aurum, Rosalind), cyber security experiments, and tokenisation work (Project Agora) have indirect relevance to future insurance settlement infrastructure.

5.3 CPMI-IOSCO -- Financial Market Infrastructure

The CPMI and IOSCO issued guidance on applying the Principles for Financial Market Infrastructures (PFMI) to stablecoin arrangements that may constitute systemically important FMIs. The guidance notes that stablecoin settlement assets "carry additional financial risk" that may require insurance or risk-transfer mechanisms, but does not mandate insurance specifically.

Source: IOSCO, IOSCOPD707

6. FATF -- AML/CFT for Insurance and Digital Assets

6.1 VA/VASP Guidance and Recommendation 15 Compliance

FATF's updated guidance (October 2021) establishes that VASPs are subject to the same AML/CFT obligations as financial institutions, including customer due diligence, record keeping, and suspicious transaction reporting. The travel rule (Recommendation 16) requires originator and beneficiary information to accompany VA transfers.

In its sixth Targeted Update on the Implementation of the FATF Standards on VAs/VASPs (26 June 2025), the FATF reported that, of 138 jurisdictions assessed for Recommendation 15 (new technologies and VASPs), only ~1% were fully compliant and 29% (40 of 138) largely compliant, while 49% were partially compliant and 21% non-compliant -- i.e. roughly 70% of jurisdictions are not yet largely or fully compliant with AML/CFT standards for virtual assets. This persistent under-compliance creates compliance uncertainty for insurers covering cross-border digital asset activities.

Source: FATF, Targeted Update on VAs and VASPs (June 2025)

6.2 Insurance Sector Guidance Gap

The FATF's Guidance for a Risk-Based Approach: Life Insurance Sector (October 2018) is the primary FATF document addressing AML/CFT in insurance. It was written before digital asset insurance products existed as a meaningful market and does not address:

• AML/CFT risks specific to digital asset insurance products
• CDD requirements for insuring crypto businesses
• ML/TF risks from DeFi insurance protocols operating without KYC/AML controls
• Whether non-life insurance covering digital assets requires AML/CFT treatment

Source: FATF, Life Insurance Sector RBA Guidance (October 2018)

6.3 Layered Compliance Framework

The IAIS-FATF interaction creates a four-layer compliance framework for insurers covering digital asset businesses:

1. FATF Recommendations -- Global AML/CFT standards for all financial institutions
2. FATF Insurance Sector Guidance (2018) -- Sector-specific RBA guidance (life insurance only)
3. IAIS ICP 22 and Application Paper -- Insurance supervisory standards for AML/CFT
4. National implementation -- Jurisdiction-specific AML/CFT laws

None of these layers currently provides specific guidance on the AML/CFT risks of insuring crypto-native clients.

7. Geneva Association -- Insurance Industry Research

7.1 DeFi and Blockchain in Insurance (August 2023)

The Geneva Association's report "Assessing the Potential of DeFi and Blockchain Technology in Insurance" is the most comprehensive publication on DeFi and blockchain in insurance from any international body.

Key findings:

• Blockchain-based insurance solutions are "primarily found in large, competitive markets and are confined to specific nonlife sectors like crypto-related risks"
• "The expected efficiency gains and new business opportunities have not yet materialised"
• Smart contracts can "mitigate moral hazard (e.g. parametric insurance) and help with fraud detection, process automation and operational efficiency"
• Smart contracts allow "instantaneous and automatic execution of claims payments"

Source: Geneva Association, DeFi & Blockchain in Insurance (August 2023)

7.2 Cyber Insurance Protection Gap

The Geneva Association's cyber research programme documents the broader protection gap context:

• Global cyber premiums grew from less than USD 1.5 billion (2013) to approximately USD 15 billion (2023)
• Coverage addresses less than 1% of total P&C insurance needs
• The estimated cyber protection gap exceeds USD 0.9 trillion -- more than 99% of total economic losses uninsured
• Since early 2023, at least five re/insurers have issued cyber insurance-linked securities (ILS)
• Approximately USD 800 million in cyber catastrophe bonds issued -- a small fraction of capacity needs

The cyber protection gap is directly relevant to digital asset insurance because crypto exchange hacks, smart contract exploits, and bridge attacks are cyber events that fall within -- or adjacent to -- the cyber insurance landscape. Many cyber policies contain digital asset exclusions or sub-limits, compounding the coverage gap.

Sources:

• Geneva Association, Cyber Risk Accumulation (2024)
• Geneva Association, Cyber ILS Report (December 2024)

7.3 Government Backstop Concept

The Geneva Association has suggested that a government "backstop" for major cyber incidents might encourage re/insurers to extend coverage and increase risk-absorbing capacity. This model is potentially applicable to catastrophic digital asset loss events -- such as a systemic exchange failure or multi-protocol exploit -- where private insurance capacity alone is insufficient. The relevance is sharpened by the claims record: the Bybit hack (~USD 1.5 billion, February 2025) and 2025 industry theft of ~USD 3.4 billion produced no meaningful insurance recovery, with affected exchanges replenishing reserves from their own capital.

8. EIOPA -- Regional Implementation Example

The European Insurance and Occupational Pensions Authority provides the most developed example of an IAIS-aligned regional supervisor engaging with digital asset insurance:

• Discussion Paper on Blockchain and Smart Contracts in Insurance (2021): Consulted on blockchain applications; stakeholders agreed on opportunities (faster transactions, lower costs) and risks (cyber/operational risks, coding errors)
• Solvency II Monitoring: Tracks insurer crypto-asset investments, finding them "relatively limited to date and commonly take place via unit-linked life insurance products"
• 100% capital stress (March 2025 advice) -- NOT YET ENACTED: EIOPA's 27 March 2025 final technical advice recommended a 100% capital stress for insurer crypto holdings -- a conservative approach reflecting the absence of long-term actuarial data. The Solvency II Delegated Regulation (EU) 2026/269 (published in the OJ 18 February 2026, in force 10 March 2026, applicable from 30 January 2027) contains no crypto-specific capital charge; the 100% stress remains a pending subsequent delegated act, not enacted law.
• MiCA Coordination: As one of three European Supervisory Authorities (with EBA and ESMA), EIOPA participates in MiCA implementation. The MiCA transitional period ends 1 July 2026.
• Consumer Warning (October 2025): Three ESAs jointly warned consumers of "risks and limited protection for certain crypto-assets and providers"

Sources:

• EIOPA, Blockchain and Crypto Assets
• EIOPA, ESAs Consumer Warning (October 2025)

9. The Standard-Setter Gap Against National Practice

The international standard-setters' uniform silence on mandatory insurance contrasts sharply with the divergence visible across the 18 jurisdictions studied. National practice -- not global standards -- is where every insurance obligation originates.

9.1 Mandatory vs Voluntary Insurance

No international body mandates insurance. Where insurance is mandatory, it is a national choice:

• Mandatory (hard, quantified or category-prescribed):
  Hong Kong (SFC: 100% hot / 50% cold compensation as a VATP licensing condition),
  South Korea (VAUPA: liability insurance or equivalent reserves of ≥5% of hot-wallet assets, KRW 3 billion floor for KRW-market exchanges), the
  UAE (VARA four-category regime plus ADGM/DFSA PII/cyber mandates), and
  Bahrain (CBB PII ≥ BHD 100,000 + keyman + cybersecurity).
• Mandatory in substance, but flexible (insure-or-mitigate / gating factor):
  Canada (CIRO's February 2026 tiered custody framework makes fidelity/specie insurance a gating factor for higher custody tiers, with no prescribed minimums) and the
  Cayman Islands (the February 2026 MC-RSOG prescribes insurance categories on an "insure-or-mitigate" basis).
• Voluntary / elective: the
  United States,
  Bermuda (flexible surety-bond-or-trust-or-indemnity-insurance),
  Australia (PI-only via AFSL),
  Japan (no standalone mandate today; a pre-funded liability reserve with optional approved insurance is proposed under the FIEA migration),
  Singapore, the
  EU,
  France,
  Germany,
  Liechtenstein,
  Switzerland, and the
  UK (where insurance is the MiCA Art. 67 elective alternative to own funds in the EU/EEA, or simply unmandated).

9.2 Deposit-Scheme Crypto Inclusion vs Exclusion

No standard-setter provides a deposit-guarantee equivalent for crypto, and national schemes overwhelmingly exclude it. Of the 13 jurisdictions in this domain with a deposit/investor-compensation scheme on point: 12 exclude crypto outright -- the US (FDIC/SIPC; the April 2026 FDIC GENIUS-Act NPR confirms stablecoin reserves are not pass-through insured), Canada (CDIC/CIPF), Australia (FCS/NGF), Hong Kong (ICF/HKDPB), Japan (DICJ), Singapore (SDIC), South Korea (KDIC), the EU (DGS/ICD), France (FGDR), Germany (EinSiG/EntSchG), Switzerland (esisuisse), and the UK (FSCS). Only Liechtenstein offers partial coverage: the EAS -- a protected cell company (PCC) -- extends investor compensation (up to CHF 30,000) to security tokens matching traditional-security characteristics, while unbacked crypto-assets (BTC, ETH) remain excluded. The remaining jurisdictions (Bermuda, Cayman Islands, Bahrain, the UAE, and the emerging markets) have no deposit-insurance-style scheme on point; the UAE instead mandates a VARA ETD Insurance Fund as a clearing-style default buffer.

9.3 Regulated Insurance vs Discretionary Mutual

The standard-setters' unresolved DeFi-classification question (§3.3) plays out concretely at national level. Nexus Mutual is a UK discretionary mutual -- members have no contractual obligation to pay claims, it is not "insurance business" under FSMA, and it operates without FCA authorisation as an insurer (the FCA approved only the use of "mutual" in its name). It is not MAS-licensed in Singapore and likely falls outside Solvency II in the EU. Genuinely decentralised cover protocols therefore sit outside the regulated-insurance perimeter in every jurisdiction studied, leaving policyholders without statutory protection -- exactly the regulatory-arbitrage gap IOSCO has flagged but not resolved. Where DeFi-adjacent risk is written as regulated insurance, it is via conventional carriers (e.g. Munich Re's Smart Contract Risk Insurance in Germany), not via on-chain mutuals.

10. Gap Analysis -- What International Standards Are Missing

As of June 2026, the following critical standards gaps exist across all international bodies:

10.1 Standards That Do Not Exist

10.2 Standards Under Development or Likely

10.3 Standards Unlikely in the Near Term

• IAIS standalone Application Paper on digital asset insurance: The IAIS Roadmap 2026-2027 contains no such deliverable. The earliest plausible timeline is 2028-2029.
• Global insurance mandate for CASPs: Neither the FSB nor IOSCO has signalled intention to recommend mandatory insurance. This will remain a national/regional decision -- as the §9.1 divergence demonstrates.
• Harmonised DeFi insurance classification: IOSCO and IAIS have not established a joint working mechanism for this issue. Classification will proceed jurisdiction-by-jurisdiction.

11. Recommended International Framework

11.1 For the IAIS

1. Issue an Application Paper on digital asset insurance by 2028, covering:

   • Classification of DeFi cover protocols (insurance vs. derivative vs. new category)
   • Actuarial standards for digital asset loss modelling
   • Capital adequacy guidance for digital asset insurance lines (ICS sub-module or guidance note)
   • Supervisory expectations for insuring crypto businesses (underwriting standards, concentration limits)

2. Amend ICP 15 (Investment) to include digital asset-specific guidance for insurer portfolios, addressing prudent-person principle application to crypto-asset investments.

3. Publish a survey of member practices -- building on the FinTech Forum's internal crypto-assets member survey -- to provide a public baseline of how national supervisors are currently treating digital asset insurance.

11.2 For IOSCO

1. Resolve the DeFi insurance classification question through a joint working group with the IAIS, producing a consultation paper by 2027 and folding the result into the CDA assessment methodology now scheduled for 2026.

2. Recommend insurance disclosure standards as part of CASP custody recommendations, specifying minimum disclosure of insurance coverage levels, carrier ratings, and exclusions.

11.3 For the FSB

1. Include insurance coverage mandates in the next thematic review cycle, assessing how jurisdictions are using insurance (or failing to) as a client asset protection mechanism.

2. Assess the need for a government backstop framework for catastrophic digital asset losses, building on the Geneva Association's cyber backstop concept.

11.4 For FATF

1. Update the Life Insurance Sector RBA Guidance (2018) to address AML/CFT risks of insuring digital asset businesses and DeFi insurance protocols.

2. Issue specific guidance on CDD requirements for insurers covering VASPs, including treatment of DeFi protocols with pseudonymous governance.

12. Verification Notes