Digital Asset Business - Code of Practice (February 2024)

Summary

This is the Bermuda Monetary Authority's Code of Practice issued under Section 6 of the Digital Asset Business Act 2018. It sets out the standards, procedures and sound principles that BMA expects licensed digital asset businesses (DABs) to follow in areas such as governance, risk management, client dealings and cooperation with regulators. Failure to adhere to the Code is a factor BMA will weigh when assessing whether a DAB is conducting business in a sound and prudent manner, and the Authority applies the Code proportionately based on each DAB's nature, scale, complexity and risk profile.

• Corporate governance: DABs must maintain a sound governance framework with a board that oversees strategy, risk, fitness and propriety of directors/officers, conflicts of interest, and delegation to chief and senior executives.
• Senior representative: Every DAB must appoint an approved senior representative who maintains an office in Bermuda, is knowledgeable in digital asset business and Bermuda law, and has an early warning reporting role under Section 20 of the Act.
• Risk management: DABs must establish a risk management function with documented roles, a risk management framework, and key policies including a risk policy, cybersecurity policy, client private key storage policy, and policies required under the POCR AML/ATF regulations.
• Client due diligence and internal controls: Requirements cover client due diligence and monitoring, segregation and protection of client assets, competent management, delegation controls, recordkeeping, adequate personnel, cyber risk controls, internal audit, compliance function, self-assessment and operational risk incident reporting.
• Outsourcing: DABs must maintain oversight and controls over outsourced functions and third-party service providers.
• Conduct of business: Requirements address integrity and ethics, market integrity, conflicts of interest, fair treatment of clients (including vulnerable clients), product due diligence, advertising, sales practices, client communications, disclosure, suitability, client agreements, online business conduct, confidentiality, complaint handling, and closed or inactive accounts.
• Cooperation with regulators: DABs must deal openly and cooperatively with BMA and other relevant regulators, and ensure contracts with vendors or agents do not frustrate BMA's supervisory or regulatory functions.

The Code should be read alongside the DAB Statement of Principles issued under Section 5 of the Act, and its provisions apply across all licensed digital asset business activity in Bermuda.

Key obligations

• DABs must establish and maintain a sound corporate governance framework with an effective board that oversees strategy, risk and management performance
• DABs must appoint an approved senior representative who maintains an office in Bermuda and is knowledgeable in digital asset business and related Bermuda law
• DABs must establish a risk management function and adopt key policies including a risk policy, cybersecurity policy, client private key storage policy, and AML/ATF policies required under the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008
• DABs must segregate and protect client assets and maintain adequate accounting and recordkeeping systems
• DABs must maintain internal audit and compliance functions with independence and direct reporting lines to the board
• DABs must implement a documented complaints management framework, maintain a complaint register, and make complaint handling information publicly accessible
• DABs must maintain publicly available criteria and procedures for closed and inactive accounts and promptly return client funds where accounts are closed or deactivated
• DABs must preserve the confidentiality of client information and advise persons with access to confidential information of their obligations in writing
• DABs must ensure contracts with outsourced vendors and agents do not frustrate the Authority's supervisory or regulatory functions and must deal openly and cooperatively with BMA

Applies to

Digital Asset Business (DAB) licensees

Related documents

• This document is made under Digital Asset Business Act 2018