Go back to menu

Crypto custody regulation – what rules apply globally?

Use our new tracker

19 October 2020

Policy makers around the world have started to introduce specific regulatory regimes for cryptoasset custody businesses in response to growing market activity. In order to help firms navigate this fast-evolving area, we have prepared an international Cryptoasset Custody Rules Tracker.

Our Cryptoasset Custody Rules Tracker provides a high level summary of certain global regimes that have been introduced as at October 2020, including which activities fall within scope of the regime and the identity of the relevant regulator(s). In some cases, these regimes may apply alongside existing financial services and other regulation.

A key question for firms investing or trading in cryptoassets to consider is how they will hold those cryptoassets. In particular, they will need to consider whether to hold those cryptoassets directly as a participant in the relevant distributed ledger system, or whether to engage the services of a custodian to safekeep cryptoassets and/or private cryptographic keys on their behalf.

Whilst disintermediation is often cited as a key benefit of distributed ledger technology (DLT), there are also downsides to holding cryptoassets directly, not least the risk of losing a private cryptographic key (and thereby losing access to the cryptoassets) as well as the associated administrative burden. Investors in many traditional financial instruments are also used to holding them through a custodian. As a result, there has been significant development of, and interest in, cryptoasset custody services over the past few years.  

In response, policy makers in various jurisdictions have moved to introduce new laws and regulations that apply specifically to providers of cryptoasset custody services. Our Cryptoasset Custody Rules Tracker provides a high level summary of the specific cryptoassets regimes that apply in relation to the custody of cryptoassets across a number of global jurisdictions. For each jurisdiction, it identifies the activities that are subject to the regulatory regime, the relevant regulator(s) and relevant sources of legislation or regulation.

Providers of cryptoasset custody services will also need to consider the extent to which their business is regulated under other existing regimes, such as financial services legislation (including regulation applicable to investment services, banking, payment services, e-money and crowdfunding activities) and data protection regulation.  The extent to which these pre-existing regulatory regimes may apply to cryptoassets will vary from jurisdiction to jurisdiction and the analysis can be very fact specific. Consideration of the extent to which these pre-existing regulatory regimes may also apply to cryptoasset custody service providers therefore goes beyond the scope of this tracker.

The tracker provides a snapshot of the position as at 5 October 2020. However, we expect to see further developments in this area in the coming months.