Insurance Provider Licensing Frameworks

1. Licensing Model Taxonomy

Six distinct models exist for establishing a digital asset insurance operation. No jurisdiction has created a dedicated "digital asset insurer" licence category; instead, existing frameworks are adapted or purpose-built innovation classes are layered onto traditional insurance regulation.

Model A: Dedicated Innovation Insurer Class

Bermuda is the only jurisdiction that has created bespoke insurer licence classes for digital asset businesses:

• Class IIGB (Innovative Insurer General Business) -- for general insurance conducted in an innovative manner, particularly using digital assets. Relm Insurance (the first and only Class IIGB holder) is the sole holder.
• Class IILT (Innovative Insurer Long-Term) -- for innovative life insurance. Meanwhile Insurance Bitcoin (Class IILT) is the sole holder, operating entirely in BTC; it released the first-ever audited BTC-denominated financial statements in June 2025.

These classes have minimum capital determined case-by-case by the BMA, a 75% minimum liquidity ratio (IIGB), and audited financial statement requirements. Bermuda is also consulting on a Parametric Special Purpose Insurer (PSPI) class (consultation opened 22 January 2026, deadline 27 February 2026; proposed fees USD 10K restricted / 15K unrestricted), but the PSPI class remains proposed -- not enacted as of 4 June 2026, targeted for end-Q2 2026.

Model B: General Insurer / Reinsurer with Digital Asset Endorsement

The dominant global model. Insurers authorised under existing frameworks (Solvency II, Solvency UK, state-based US licensing, MAS Insurance Act, Swiss Solvency Test) add digital asset coverage to existing underwriting books without requiring separate authorisation.

• UK: Lloyd's syndicates (Atrium/609, TMK, Markel, Canopius, Mosaic/1609, Chaucer, Arch) write digital asset risks under existing specie, crime, cyber, and financial institutions classes. No separate PRA authorisation is needed for the risk class.
• EU: Solvency II-authorised insurers write coverage under miscellaneous financial loss or general liability classes. EIOPA's 100% capital stress for insurer crypto holdings (final technical advice March 2025) is still pending -- it awaits a subsequent delegated act and was NOT included in Delegated Regulation (EU) 2026/269 (OJ 18 February 2026), which contains no crypto-specific charge.
• Singapore: MAS-licensed direct general insurers write under miscellaneous insurance. No specific insurance class or capital surcharge for digital asset risks.

Model C: Lloyd's Coverholder / Managing General Agent (MGA)

The fastest route to underwriting capacity for specialist digital asset firms. A coverholder receives delegated binding authority from one or more Lloyd's syndicates and writes policies on Lloyd's-rated paper (A+ AM Best / AA- S&P).

Coverholder status requires Lloyd's Corporation approval, FCA authorisation (or equivalent home-state registration), and demonstration of underwriting expertise. Lower capital requirements than establishing a syndicate, but the coverholder depends on syndicate capacity. (The widely-cited Evertas/Arch "USD 500M/2025" per-policy figure is unconfirmed; the verified self-reported limit remains USD 420M.)

Model D: Captive Insurer

Purpose-built for large digital asset companies self-insuring risks the commercial market will not cover. The landmark example is Nakamoto, Ltd. (Gemini's Class 1 captive in Bermuda, January 2020), providing USD 200 million custody coverage (self-reported; largest crypto-custodian limit at launch).

Key captive domiciles:

Bermuda's other commercial/captive classes for reference: Class 2 USD 250,000; Class 3 USD 1,000,000; Class 4 USD 100,000,000. Cayman ended 2025 with 720 active Class B/C/D insurers (USD 51B gross written premiums, 42 new licences -- self-reported/CIMA).

Model E: Mutual / Discretionary Cover

Nexus Mutual (UK-registered company limited by guarantee, No. 10917763, incorporated 16 August 2017, London) operates as a discretionary mutual on Ethereum. Members have no contractual obligation to pay claims, which is why it is not "insurance business" under FSMA and operates without FCA authorisation (the FCA did approve its use of "mutual" in the name). Self-reported figures: capital pool ~USD 190 million; ~USD 18 million in claims paid since 2019; ~USD 194 million active cover.

This model falls outside traditional insurance regulation in every jurisdiction studied. In the EU, a discretionary mutual such as Nexus Mutual likely falls outside Solvency II, MiFID II and gambling rules, but there is no definitive EU ruling as of March 2026; the EU's planned DeFi-specific framework (expected mid-2026) may change this classification.

Model F: DeFi Protocol / Parametric Smart Contract

Protocols such as InsurAce and Unslashed Finance (both NOT VERIFIED in several jurisdiction files) operate peer-to-peer risk pools on-chain. No jurisdiction has licensed a DeFi insurance protocol as an insurance undertaking. These protocols face a three-way classification challenge under EU law (insurance / derivative / gambling) and potential CFTC jurisdiction in the US as event contracts. In the US, NXM tokens may be securities under Howey, but the SEC and state regulators have taken no enforcement action against DeFi insurance protocols as of March 2026.

2. Insurance Provider Licensing Requirements by Jurisdiction

The following table covers the supply side: what is required to establish an entity that underwrites digital asset insurance risks. This section mirrors the t4 data (licence type, capital requirement, key insurance rules) for all 18 jurisdictions and feeds the License Map.

2.1 Primary Markets

2.2 Emerging and Specialist Markets

3. Insurance Requirements for Crypto Businesses by Jurisdiction

The demand side: which jurisdictions mandate that CASPs/VASPs carry insurance, and what are the specifications. Across the N=18 jurisdictions, the precise legal character ranges from hard mandatory limits to discretionary, insure-or-mitigate, and pure-voluntary regimes -- these must not be conflated.

3.1 Mandatory Insurance Regimes

EU MiCA, France, Germany and Liechtenstein are deliberately listed in §3.2: under MiCA Art. 67 insurance is an alternative to own funds, not a mandate. Australia mandates only "adequate" professional indemnity via the existing AFSL regime (no bespoke crypto coverage ratio), and the regime does not commence until 9 April 2027 -- so it too is treated as voluntary/PI-only rather than a bespoke mandatory crypto-insurance regime.

3.2 Voluntary, Insurance-or-Own-Funds, or No-Mandate Jurisdictions

3.3 MiCA Insurance Policy Specifications (Art. 67(4))

For all EU/EEA jurisdictions, a MiCA-compliant insurance policy (where insurance is elected as the prudential safeguard) must meet these structural requirements:

• Initial term of at least 1 year
• Cancellation notice period of at least 90 days
• Provided by a third-party authorised insurer (located in the EU/EEA)
• Publicly disclosed on the CASP's website
• Covers the mandatory risk categories: loss of documents, misrepresentation, acts/errors/omissions, business interruption/system failures, gross negligence in safeguarding, loss of crypto-assets or access means, and custodian liability under Art. 75(8)

MiCA does not specify minimum monetary coverage amounts -- only that coverage must be at least equal to the permanent minimum capital thresholds (EUR 50K-150K). This is a known gap: a technically compliant policy could offer minimal protection for a custodian holding billions.

4. Arbitrage Analysis

4.1 Cheapest Path to Establishing a Digital Asset Insurance Operation

Winner: Bermuda Class 1 Captive

• Minimum capital: USD 120,000
• Annual management costs: USD 45,000-65,000
• Formation timeline: 3-4 weeks
• Total first-year cost: approximately USD 200,000-250,000 (including legal, capital, management)
• Limitation: Only insures own risks and affiliates

Runner-up: Hawaii Captive

• Minimum capital: USD 100,000
• Estimated formation costs: USD 35,000-75,000
• Onshore US domicile

For commercial insurance (third-party risks):

• Lloyd's coverholder via an established syndicate is the most capital-efficient route to writing third-party digital asset insurance. The coverholder does not need to post its own capital for insurance liabilities; the syndicate provides capacity. Costs are primarily operational (FCA authorisation fees GBP 280-222,940; Lloyd's coverholder approval process).

4.2 Fastest Path to Authorisation

4.3 Best Passporting Scope

Tier 1: EU Solvency II Authorisation

• Single passport across 27 EU states + 3 EEA states (Iceland, Norway, Liechtenstein)
• Total addressable market: ~450 million people
• Combined with MiCA, creates an integrated CASP + insurer passport framework
• Liechtenstein adds Swiss market access via bilateral agreement -- the only jurisdiction offering EEA + Switzerland from one licence

Tier 2: Lloyd's Global Reach

• Lloyd's licences in 200+ territories worldwide
• Policies written on A+ rated paper
• Coverholders (Evertas, AnchorWatch, Qubit) access global markets through Lloyd's
• UK-based but global distribution; Lloyd's Europe (Brussels) provides EU access

Tier 3: Bermuda Equivalence

• EU Solvency II full equivalence -- commercial insurers and reinsurers
• US NAIC Reciprocal Jurisdiction -- reduced collateral for reinsurers
• UK recognition post-Brexit
• Limitation: Equivalence applies to commercial classes, not captives

4.4 Most Prestigious for Institutional Credibility

1. Lloyd's of London -- A+ AM Best, AA- S&P. The Marsh DART facility (up to USD 825M capacity, self-reported), Aon's USD 1.2B+ capacity (self-reported), and the Coincover/Atrium product set the institutional standard. OSL's USD 1 billion Canopius placement (Hong Kong, October 2024) is the largest single-custodian digital asset insurance programme reported globally (self-reported).

2. Munich Re -- World's largest reinsurer backing digital asset products directly (Digital Asset Comprehensive Crime Plus, Staking Risk, Smart Contract Risk). Institutional-grade credibility for regulated custodians; the domestic underwriting champion in Germany.

3. Bermuda BMA Class IIGB/IILT -- Purpose-built regulatory credibility. Relm Insurance and Meanwhile Insurance Bitcoin are the proof cases.

4. EU Solvency II insurer -- Signals institutional permanence and prudential rigour. Marsh's MiCAssure product is positioned for this audience.

5. Banking Access for Insurance Entities

Banking access remains a critical practical constraint for digital asset insurance operations. The following assessment is based on jurisdiction-level research.

6. Approval and Rejection Data

Published approval/rejection data for digital asset insurance licensing is scarce across all jurisdictions.

Known Approvals

Rejection Data

NO DATA FOUND -- no jurisdiction publishes digital asset insurance licence rejection statistics. The BMA, PRA, FCA, CIMA and Lloyd's Corporation do not disclose rejected applications. EIOPA does not aggregate NCA rejection data for Solvency II applications. (One partial proxy: South Africa's FSCA reported 512 CASP applications received, 300 approved, 14 declined, 121 withdrawn as of 12 December 2025 -- but this is licensing-side, not insurance-specific.)

EU CASP Authorisations (Insurance-Relevant)

As of mid-April 2026, ESMA reports ~199 licensed CASPs across 23 EU/EEA countries; Germany is the largest single market at ~53 authorised CASPs (self-reported, MiCA SCAN). The proportion electing the insurance option vs. own funds under MiCA Art. 67 is not publicly reported by ESMA or NCAs. This is a significant data gap for understanding market demand for MiCA-compliant insurance.

7. Hidden Costs and Practical Intelligence

7.1 What the Law Does Not Say

Bermuda:

• Class IIGB/IILT capital is "BMA-determined" -- in practice this means pre-application engagement and negotiation with the BMA is essential
• Dual licensing (DABA + Insurance Act 1978) for entities spanning both regimes has limited published consolidation guidance
• The proposed PSPI class (consultation Jan-Feb 2026) covers traditional parametric only and excludes hybrid indemnity; it remains proposed, not enacted, targeted end-Q2 2026
• Operational Resilience Code compliance required by 31 March 2028

UK / Lloyd's:

• Lloyd's Performance Oversight reviews syndicate business plans annually; digital asset underwriting must be justified within the plan
• Coverholder approval requires a managing agent relationship -- finding a willing managing agent is the critical gatekeeping step
• FCA authorisation fees range from GBP 280 (Cat 1) to GBP 222,940 (Cat 10) depending on complexity; most insurance intermediaries fall into Category 4
• Lloyd's Product Innovation Facility (PIF) capacity is approximately GBP 150 million -- a finite pool

EU:

• 6-12 month practical authorisation timelines despite the statutory 40-working-day assessment period, due to NCA Q&A rounds
• Insurance policy premiums for MiCA compliance are not publicly standardised; market rates are opaque
• EIOPA's 100% capital stress for insurer crypto holdings (March 2025 advice) has not been incorporated into the Solvency II Delegated Regulation -- Delegated Regulation (EU) 2026/269 (OJ 18 Feb 2026, in force 10 Mar 2026) contains no crypto-specific charge; a subsequent delegated act is still pending
• No minimum monetary coverage amount in MiCA Art. 67(4)
• MiCA transitional period ends 1 July 2026; France (DASP) and Germany (KMAG already closed 31 Dec 2025) and Liechtenstein (TVTG MiCAR authorisation) align to this deadline

US:

• No admitted carrier has filed dedicated digital asset insurance rate/form filings in any significant number of states; there is no NAIC model law specific to digital asset insurance (no working group formed at NAIC Spring 2026)
• Surplus lines broker licence required in each state where risk is placed; NRRA assigns home-state jurisdiction; surplus lines tax 1.75%-6%
• FDIC's GENIUS-Act NPR (FIL-11-2026, 7 April 2026, comments due 9 June 2026) bars pass-through insurance for stablecoin reserves; the SEC/CFTC joint interpretation (Release 33-11412, 17 March 2026) sets a five-part token taxonomy
• Standard D&O and cyber policies increasingly contain cryptocurrency exclusions

Singapore:

• MAS Insurance Act minimum capital for direct general insurers is SGD 10 million -- a significant barrier
• No separate licensing pathway for digital asset-only insurers; insurance is not a listed PSA safeguarding method (trust segregation + PS-G03 90% cold storage instead)
• Lloyd's Asia Scheme (Canopius Syndicate 4444) provides the primary channel for specialist capacity

Hong Kong:

• The 100% hot / 50% cold wallet compensation requirement is among the most demanding globally
• Acceptable forms include insurance, dedicated funds, reserved VA, or bank guarantees -- but the SFC must approve; January 2025 enhanced standards scrutinise exclusions/deductibles
• The IA RBC amendments (conclusions 8 May 2026) apply a 100% downward stress factor to insurers' direct crypto holdings, a look-through plus counterparty-default overlay for stablecoins, and exclude tokenized conventional instruments; implementation 31 Dec 2026 pending LegCo negative vetting

South Korea:

• The ≥5% hot-wallet insurance/reserve mandate with KRW 3 billion floor (KRW-market exchanges) is prescriptive; the November 2025 Upbit restoration was the first publicly reported use of VAUPA-mandated insurance to cover a hack
• Proposed no-fault liability (DABA phase-2 bill, 8 April 2026) would shift the burden of proof to exchanges -- but remains PROPOSED, not enacted (dropped from the subcommittee agenda 12 May 2026, review pushed to H2 2026); fines up to 3% of annual revenue

UAE:

• VARA does not prescribe minimum coverage amounts despite mandating four insurance categories
• "Adequate to size and complexity" standard gives the regulators broad discretion
• VARA's ETD Insurance Fund (Part V, 31 March 2026) is a default-protection buffer distinct from the Section D commercial insurance categories
• Takaful/Sharia-compliant digital asset insurance is a gap (no products identified -- NOT VERIFIED)

Canada:

• CIRO custody tiers and capital figures are self-reported (law-firm/trade-press reading of the CIRO notice), not a published CIRO capital schedule
• CIRO's Feb 2026 framework is interim; minimum coverage amounts may follow
• The Stablecoin Act (Bill C-15, Royal Assent 26 March 2026) is not yet in force (implementation expected 2027)

Bahrain:

• Local specialty capacity is very limited; specialty risks placed internationally (Lloyd's, Bermuda, Marsh/Aon Gulf)
• The SIO (stablecoin) Module (July 2025) specifies no distinct issuer insurance mandate (NOT VERIFIED in published SIO text)

7.2 The Reinsurance Constraint

The single most important structural barrier to digital asset insurance market growth is the scarcity of reinsurance capacity. Traditional reinsurers have been slow to commit capital:

• Munich Re is the only Tier 1 global reinsurer with publicly confirmed dedicated digital asset products (crime, staking, smart contract)
• Swiss Re has NOT been independently verified as offering standalone digital asset reinsurance
• Major Bermuda reinsurers (Everest Re, RenaissanceRe, PartnerRe, Arch Capital) have NO publicly disclosed digital asset reinsurance exposure
• Relm II (Bermuda, authorised May 2022) is the only fully regulated collateralized reinsurance business accepting crypto collateral
• The FTX collapse (November 2022) created lasting headwinds for traditional reinsurer entry

Without deeper reinsurance participation, primary insurance capacity remains capped, premiums remain elevated, and per-policy limits are constrained.

8. Regulatory Direction

8.1 Tightening

8.2 Stable / Neutral

8.3 Loosening / Innovation-Friendly

8.4 Convergence Trend

A clear convergence pattern is emerging: jurisdictions that initially had no insurance requirements for crypto firms are progressively introducing them (Australia, Canada, Cayman), while jurisdictions with existing requirements are tightening standards (Hong Kong, South Korea). The IAIS has not issued dedicated digital asset insurance guidance, but its FinTech Forum monitors insurer crypto activities. Counting precisely across N=18: roughly half the jurisdiction set now imposes some mandatory or insure-or-mitigate insurance requirement on crypto custodians (Hong Kong, South Korea, UAE, Bahrain, Bermuda, Cayman, Canada, plus Nigeria within the Emerging Markets block), while the remainder rely on the MiCA insurance-or-own-funds election (EU, France, Germany, Liechtenstein), pure voluntary regimes (UK, US, Singapore, Switzerland, Australia, Brazil, India), or an explicit statutory exemption (South Africa).

9. Recommended Framework for Regulators

Based on evidence from all studied jurisdictions, the following recommendations address structural gaps in existing approaches.

9.1 For Jurisdictions Without Insurance Mandates (UK, US, Singapore, Switzerland, Australia)

Recommendation: Introduce tiered mandatory insurance requirements for licensed crypto custodians.

Evidence basis:

• Hong Kong's 100% hot / 50% cold wallet requirement and South Korea's ≥5% hot-wallet mandate demonstrate that prescriptive requirements are implementable -- and the Nov 2025 Upbit restoration shows they work in practice
• The Bybit hack (~USD 1.5 billion, February 2025) exceeded the largest verified per-policy limit (USD 420 million at Evertas, self-reported) by roughly 3.5x -- exchanges without insurance have no recourse (Bybit replenished via bridge loans, not insurance)
• Per AM Best, only ~11% of global crypto holders are insured (self-reported)

Proposed structure:

9.2 For Jurisdictions With Requirements But No Minimum Amounts (UAE VARA, EU MiCA, Cayman MC-RSOG)

Recommendation: Establish floor coverage amounts linked to assets under custody.

Evidence basis:

• MiCA Art. 67(4) specifies coverage scope but not a monetary floor -- a EUR 50,000 policy technically satisfies the regulation for a custodian holding billions
• VARA's "adequate to size and complexity" standard and Cayman's "insure-or-mitigate" basis provide useful flexibility but create compliance uncertainty
• EIOPA's pending 100% insurer capital stress will further constrain supply; minimum coverage floors would create demand certainty

9.3 For All Jurisdictions

Recommendation: Establish a confidential, aggregated digital asset insurance loss database.

Evidence basis:

• No jurisdiction publishes digital asset insurance claims statistics
• Loss ratios for digital asset insurance lines are universally NO DATA FOUND
• The IAIS or FSB could facilitate this, analogous to catastrophe modelling databases

Recommendation: Clarify the regulatory status of DeFi insurance protocols.

Evidence basis:

• Nexus Mutual (self-reported ~USD 190M capital pool, ~USD 18M claims paid) operates as a discretionary mutual outside insurance regulation in every jurisdiction
• The EU's Joint EBA-ESMA Article 142 Report on DeFi (January 2025) identified DeFi as growing; EU DeFi-specific regulation / a "decentralization" definition is expected mid-2026
• The three-way classification challenge (insurance / derivative / gambling) remains unresolved

9.4 Model Regulatory Architecture

Drawing on the strongest elements of each jurisdiction:

1. Innovation insurer class (Bermuda IIGB/IILT model) -- for native digital asset insurance businesses
2. Insurance-or-capital option (EU MiCA Art. 67 model) -- with a minimum monetary floor tied to AUC
3. Prescriptive compensation requirements (Hong Kong SFC model) -- 100% hot / 50% cold wallet
4. Sandbox pathway (Bermuda BMA model) -- with defined graduation criteria
5. Passporting (EU Solvency II model) -- enabling cross-border insurance operations from a single authorisation
6. Embedded supervision (Bermuda DeFi pilot, completed May 2026) -- real-time regulatory oversight integrated into blockchain infrastructure
7. Reinsurance incentives -- capital relief or reduced risk weights for reinsurers committing capacity to digital asset lines

10. Decision Matrix for Businesses

10.1 For Founders Establishing a Digital Asset Insurance Carrier

10.2 For GCs Structuring Multi-Jurisdiction Insurance Entities

Recommended architecture:

1. Bermuda holding company -- leverages EU Solvency II equivalence + NAIC Reciprocal Jurisdiction status + BMA innovation framework
2. Lloyd's coverholder -- for global distribution on A+ rated paper
3. EU subsidiary or branch -- for direct MiCA-compliant policy writing (Liechtenstein for dual EEA-Swiss access, or Germany/Netherlands for established NCA processes)
4. Bermuda captive -- for retained risk layer / self-insurance excess

Key structural considerations:

• Bermuda's Solvency II equivalence applies to commercial insurers/reinsurers, not captives
• Lloyd's Europe (Brussels) enables EU-passported business from UK-based syndicates
• MiCA's insurance option creates structural demand from EU-licensed CASPs
• Hong Kong's compensation requirements create demand from APAC VATPs
• South Korea's VAUPA creates demand from Korean exchanges (but a Korean-licensed insurer is likely required)

10.3 For Regulators Benchmarking Frameworks

Verification Notes

Research Methodology

All claims in this document are derived from the canonical per-jurisdiction fact matrix (digital-asset-insurance-fact-matrix.json) and the existing jurisdiction studies. This is a refresh synthesis: no new jurisdictions were added this run, and no fact appears here that is not in the matrix or the prior file. The analysis synthesises findings from 18 jurisdiction studies -- United States, Bermuda, Canada, Cayman Islands, Australia, Hong Kong, Japan, Singapore, South Korea, European Union, France, Germany, Liechtenstein, Switzerland, United Kingdom, Bahrain, United Arab Emirates, and an Emerging Markets block (Brazil, Nigeria, South Africa, India) -- with international framework context (IAIS, IOSCO, FSB/BIS/FATF). FATF's R.15 assessment context (of 138 jurisdictions assessed in 2025, ~1% fully and ~29% largely compliant) frames the global supervisory baseline.

Source Verification Status

Limitations

1. Insurance premium pricing data for digital asset coverage is not publicly standardised in any jurisdiction.
2. Loss-ratio data does not exist in published form for digital asset insurance lines globally.
3. The proportion of EU CASPs electing insurance vs. own funds under MiCA is not reported.
4. EIOPA's 100% crypto capital stress has been advised but not incorporated into the Solvency II Delegated Regulation; Delegated Regulation (EU) 2026/269 contains no crypto-specific charge, and a subsequent delegated act remains pending.
5. DeFi insurance protocol regulatory classification remains formally undetermined in all jurisdictions.
6. Several capital figures are self-reported readings of regulator notices (notably the Canadian CIRO custody-tier capital amounts) rather than published capital schedules.
7. BDIC Lloyd's coverholder status remains NOT VERIFIED.
8. Market-capacity, per-policy-limit and premium figures (Marsh USD 825M, Aon USD 1.2B, Evertas USD 420M, OSL USD 1B, Nexus Mutual pool) are self-reported by the providers and are flagged as such; the Evertas/Arch "USD 500M/2025" figure is unconfirmed.

---

Last verified: June 4, 2026