ASIC Tightens Grip on Crypto Custody in Major Rule Overhaul

The Australian Securities and Investments Commission (ASIC) has released updated guidelines for financial services firms that hold client assets. The guidelines introduce new requirements for cryptocurrency custody and strengthen oversight of asset holders.

ASIC Updates Asset Holding Guidelines

The revamped Regulatory Guide 133 (RG 133), published today (Tuesday), marks the first major update since June 2022 and expands the scope of asset-holding requirements to address emerging risks in digital assets while reinforcing traditional custody standards.

“Asset holders must establish and maintain business continuity arrangements appropriate to their operations' nature, scale and complexity,” states the new guidance, which takes effect immediately.

Key Changes:

• Enhanced information security controls for crypto-asset custodians
• Stricter risk management processes for digital asset custody
• Updated financial requirements for asset holders
• Expanded oversight of sub-custodial arrangements

The guidelines apply to a broad spectrum of financial services providers, including registered scheme operators, licensed custodians, managed discretionary account providers, and operators of investor-directed portfolio services.

At the end of September, Australia's regulator gained new powers to oversee financial market infrastructure. These reforms aim to enhance the stability and efficiency of the country's financial system. The Treasury Laws Amendment (Financial Market Infrastructure and Other Measures) Bill 2024, which received Royal Assent on September 17, introduces a series of measures designed to strengthen oversight of key entities that facilitate trading in Australia's capital markets.

Regulator Adds Crypto Custody Standards

For cryptocurrency custody, ASIC now requires providers to implement robust security protocols and maintain comprehensive risk management frameworks when dealing with crypto exchanges.

This includes maintaining cold storage systems with limited connectivity to computing networks, implementing strong physical security for hardware devices storing private keys, and establishing geographically distributed backup locations for key recovery systems.

Transaction security requirements mandate multi-signature or sharding-based signing approaches over single private key systems. Asset holders must implement permissioning processes that prevent single-party control over transactions. For products with limited interaction needs, the guidance recommends whitelisting predefined addresses to enhance security.

For exchange due diligence, asset holders must conduct thorough evaluations of any crypto exchanges used. These exchanges must be registered with AUSTRAC or equivalent foreign authorities and implement risk-based systems under AML/CTF Act requirements.

This is another crypto regulatory update from ASIC after the market watchdog released a consultation paper earlier this month. The paper highlighted 13 practical examples for determining cryptocurrency services and ASIC is seeking public feedback on its proposals.