Analysis of the requirements and compliance of crypto asset custody of the United States, Hong Kong, and Singapore

Source: Aiying Compliance

Yesterday, the US Securities and Exchange Commission (SEC) punished the Galois Capital Management LLC. This company is a former registered investment consultant in Florida and is mainly invested in encrypted assets.SEC found that Galois Capital was managing customer assets, andFailure to comply with the custody rules in the “Investment Advisory Law 1940”, especially in the management of encrypted assets, there are serious omissions.Specifically, Galois Capital failed to ensure that the crypto assets they managed were stored in a qualified custodian institution. Instead, these assets were placed on the cryptocurrency trading platform that did not meet the requirements, resulting in most of the asset losses during the FTX exchange collapse.EssenceIn addition, Galois also misleads investors and provides inconsistent redemption clauses.

Aiying Aiying believes that such incidents will appear frequently in the field of crypto asset management in the future.With the increasing popularity of encrypted assets, investment consulting companies are still in a state of self -supervision due to the lack of position and the increase in the cost of later compliance in the early stages of supervision.The probability of punishment is only higher and higher.

1. Applicability and expansion of American hosting rules

Origin and original intention of custody rules

The US custody rules, in simple terms, is a set of legal provisions for protecting investor assets.These rules are derived from“1940 Investment Consultant Law”The goal at that time was to prevent investment consultants from having “cat greasy” when managing customer assets.According to this regulation, if the investment consulting company has the right to control or manage the assets of customers, these assets must be kept by a qualified custodian, such as supervised banks or financial institutions.

The core idea of the custody rules is simple:Investing consultants cannot mix customer assets with their own money, and they must be managed separately.If the customer’s assets have changed, the custodian also needs to notify the customer in time and regularly provide the asset status report.These measures are to ensure the security of investors’ funds, and they will not suffer losses due to the mistakes of investment consultants or improper behaviors.

Expand to virtual assets

With the popularity of virtual assets such as Bitcoin and Ethereum, the financial market has changed a lot.Virtual assets have brought new challenges to traditional asset management due to their decentralization, anonymity and price fluctuations.Seeing this change, SEC realized that it is necessary to expand the protection of the custody rules to these emerging virtual assets.

In recent years,The SEC has clearly stated that the custody rules are not only applicable to traditional financial assets such as stocks, bonds, but also virtual assets must also abide byEssenceIn other words, if an investment consulting company manages the cryptocurrency of customers, these assets also need to be placed in a qualified custodian.Qualified custodians must not only meet the traditional regulatory requirements, but also have the ability to respond to the unique risks of virtual assets, such as preventing hackers from losing the loss of cryptocurrencies.

Second, the requirements of the US qualified custodian license requirements

For the qualified custodian of virtual currency assets, the SEC and other related regulatory agencies have begun to pay attention to and regulate this emerging field.Qualified custodians of digital assets need to meet the requirements of traditional custodians, and at the same time, they must also have special abilities to manage and protect these digital assets.The following are some key standards and requirements for digital asset -related custodians:

Type of digital asset qualified custodian

Bank and trust companyThe

Banks and trust companies supervised by the federal or state government may provide digital asset custody services.In order to meet the requirements of qualified custodians, these institutions must have technology and infrastructure that protect and manage digital assets.
Specialized digital asset custody companyThe

Some companies provide custody services for cryptocurrencies and other digital assets.These companies may have registered at the state or federal level and have been strictly supervised.For example, companies such as Coinbase Custody and Bitgo Trust have provided custody services for digital assets and obtained the qualifications of specific states or federal custodians.

Registered brokerage businessThe

The brokerage regulated by FINRA may provide digital asset custody services, but they must ensure that they have special technical capabilities required to manage digital assets.

Other regulatory financial institutionsThe

Some regulatory financial institutions, as scheduled, or foreign financial institutions, can also be regarded as qualified custodians if they meet the requirements of digital asset custody.

Key requirements of digital asset custodians

Safety technical infrastructureThe

Digital asset custodors must have advanced network security technologies to prevent hackers from losing assets.This usually includes the use of Office Storage, Multi-Signature technology, hardware security module (HSM), etc.

Asset separation and independent accountThe

Digital assets must be stored separately from other assets of the custodian. Customers’ assets must be placed in independent accounts and clearly identified as customer assets.

Regular audit and reportThe

Digital asset custodors should regularly accept third -party audits to ensure the security of assets and the compliance of hosting services.In addition, they need to provide customers with regular asset status reports.

ComplianceThe

Digital asset custodors must comply with the same compliance requirements as traditional asset custodians, including anti -money laundering (AML), understanding of customers (KYC), and other applicable financial regulations.In addition, it is necessary to follow a specific digital asset compliance framework, such as the transparency and traceability of blockchain transactions.

Insurance and security measuresThe

In order to further protect customer assets, digital asset custodors usually buy insurance to prevent asset losses caused by hacking or operating errors.

Supervision and certification

Specific State Certification: In the United States, some states, such as New York, have passed the New York State Financial Services Law (NYDFS), which allows qualified companies to provide custody services for encrypted assets.
Federal level supervision: Although the federal level supervision has not completely covered all types of digital asset custody services, regulators such as SEC and CFTC are gradually formulating relevant rules and supervising the market.

There are a total of 12 institutions that have obtained a custody license: a total of 12:

(Source: New York State Financial Services Department NYDFS)

>Third, policies in other regions

Hongkong

1. Background introduction

As an international financial center, the supervision of the digital assets is gradually strengthening.With the popularization of cryptocurrency and blockchain technology, Hong Kong’s regulatory agencies have begun to formulate corresponding regulations to regulate the custody and trading services of cryptococcering assets.Hong Kong’s trust or company service provider (TCSP) license is one of the permits that digital asset custody service providers must get.

2.Specific requirements

TCSP license: In Hong Kong, companies that provide encrypted asset custody services need to apply and hold TCSP licenses.This license is regulated by the Hong Kong Corporation Registration Office (CR), which aims to ensure that the organization that provides trust or company services meet the requirements of anti -money laundering (AML) and cracking down on terrorism (CFT).
Asset separation and independent account: The custodian who obtains the TCSP license must ensure that the customer’s crypto assets are strictly separated from their own assets, which usually needs to deposit customer assets in an independent account.This approach can prevent the custodian from affecting the customer’s asset security when financial problems.
Safety technology and compliance requirements: Companies holding TCSP licenses must also have strong network security measures to protect customers’ digital assets.This includes using cold storage, multiple signature technology, and establishing strict compliance procedures to ensure the safety of assets.
Regular audit and report: The hosting service provider needs to conduct regular audits and provide customers with detailed asset status reports to ensure transparency and the right to customer knowledge.

3..Regulatory agency

Hong Kong Corporation Registration Office (CR): The company’s registration office is responsible for the distribution and supervision of the TCSP license to ensure that companies providing hosting services comply with relevant laws and regulations.CR’s main responsibilities include the legal requirements of reviewing applications, on -site inspections, and supervision companies to comply with anti -money laundering and counter -terrorism financing.

4. 4..Industry practice

In Hong Kong, many fintech companies and traditional financial institutions have obtained TCSP licenses to legally provide encrypted asset custody services.For example, companies such as OSL and BC Group, Hashkey have launched a compliant custody business in Hong Kong to provide safe digital asset management services for institutional investors at home and abroad.

Singapore

1. 1.Background introduction

Singapore has attracted many digital asset companies with its open financial policy and innovation environment.The Singapore Financial Authority (MAS) is an important institution for regulating digital asset custody. It has formulated a series of regulations to ensure that the custody of encrypted assets meet international standards.

2.Specific requirements

Payment Service Act (PSA): Singapore implemented the “Payment Service Act” (PSA) in 2020, which incorporates encrypted asset services (including custody services) into the scope of supervision.According to PSA, companies that provide encrypted asset custody services must obtain a “digital payment token service” license issued by MAS.
Qualifications of custodians: In Singapore, custodians need to ensure that their technology and operation frameworks meet strict security standards.MAS requires the custodian to have sufficient funds, a complete risk management system, and strong network security measures.
Compliance and audit: The custodian must meet the requirements of anti -money laundering (AML) and cracking down on funding (CFT) regulations, and establish a strong customer due diligence (KYC) procedure.The custodian also needs to conduct internal and external audits on a regular basis to ensure the transparency and compliance of its operation.
Customer asset protection: The custodian must store the customer’s encrypted assets separately from their assets and provide independent account management services.This requirement is designed to ensure the safety of customer assets and not be affected by the financial status of the custodian.

3..Regulatory agency

Singapore Financial Authority (MAS): MAS is the central bank and major financial regulatory agencies in Singapore, which is responsible for supervising the compliance of encrypted asset custody services.By the implementation of the “Payment Service Act”, MAS has established a clear regulatory framework for encrypted asset custody.

4. 4..Industry practice

Singapore’s digital asset custody market is rapidly developing, and many internationally renowned digital asset companies have established custody business in Singapore.For example, PROPINE has become the first digital asset custody company to get a “comprehensive custody” license issued by MAS, marking Singapore’s leading position in this field.