Digital Asset Business (Custody of Client Assets) Rules 2024

Summary

These Rules, made by the Bermuda Monetary Authority under the Digital Asset Business Act 2018, set out how digital asset businesses must handle client fiat and digital assets they hold in custody. They establish segregation, fiduciary, accounting, reconciliation and default (pooling) requirements designed to protect client assets from a firm's own creditors and from mismanagement.

• Segregation: Client assets must be kept separate from the digital asset business's own assets and paid into a designated client bank account or client wallet account, with the approved bank or intermediary acknowledging in writing that it cannot exercise set-off against those assets.
• Timely handling of receipts: Client assets received must be paid into a client account no later than the next day, and mixed remittances of client and other funds must be sorted out within one day of expected clearance.
• Fiduciary duty and pooling: Client assets are held on a fiduciary basis for clients according to their beneficial ownership; on a pooling event (default of the firm, an intermediary, an approved bank, or a regulatory direction) assets are pooled and distributed to clients pari passu.
• Client asset controls review: A digital asset business must implement client asset controls proportionate to its business, and have these reviewed annually by a qualified person (internal auditor, approved auditor, or Authority-approved person) who produces a report with specified content.
• Record retention: Copies of the annual qualified person's report must be kept for at least five years at the firm's head office (Class F or M licensees) or principal place of business (Class T licensees) and produced to the Authority on request.
• Interest disclosure: Firms must clarify in writing with each client whether interest is payable on client assets and on what terms.
• Accounting and daily calculation: Firms must account properly for client assets, calculate each client's credit balance daily, and if a shortfall or misuse of one client's assets for another is found, must promptly pay in an equivalent sum, which itself becomes a client asset.
• Reconciliation: Client account balances must be reconciled against bank or intermediary statements, and totals across clients reconciled, at least monthly, with the reconciliation completed within 10 days of the relevant date and discrepancies corrected forthwith.
• Pooling event notification: A digital asset business must inform the Authority and all affected clients of any pooling event as soon as practicable after it occurs.

The Rules also set out detailed mechanics for how pooling operates when an approved bank or intermediary defaults, and confirm that a digital asset business remains bound by these Rules even where it delegates custody functions or passes client assets to an intermediary.

Key obligations

• Keep client assets segregated from the digital asset business's own assets and pay them into a designated client bank account or client wallet account
• Obtain written acknowledgment from any approved bank or intermediary holding a client account that it will not exercise set-off against client assets
• Pay client assets received into a client account no later than the next day after receipt (or otherwise discharge them under rule 9)
• Sort out mixed remittances so that non-client portions are paid out within one day of expected clearance, except for fees/commissions properly due
• Implement client asset controls proportionate to the nature, scale and complexity of the business
• Have client asset controls reviewed annually by a qualified person who prepares a report covering specified matters
• Retain the qualified person's annual report for at least five years and produce it to the Authority upon request
• Clarify in writing with each client whether interest is payable on client assets and on what terms
• Perform a daily calculation of each client's credit balance and promptly make up any shortfall identified
• Reconcile client account balances against approved bank or intermediary statements, and reconcile totals across clients, at least monthly, completing the reconciliation within 10 days and correcting discrepancies forthwith
• Notify the Authority and all affected clients of any pooling event as soon as practicable after it occurs
• Remain responsible for compliance with these Rules even where client assets or functions are delegated to an intermediary

Applies to

digital asset businesses, Class F licensees, Class M licensees, Class T licensees, approved banks, intermediaries, qualified custodians

Deadlines

• not later than the next day: Client assets received must be paid into a client account by the next day after receipt
• within one day: Non-client portion of a mixed remittance must be paid out within one day of expected clearance of the remittance
• annually: Review of client asset controls by a qualified person, with a report prepared on findings
• not less than five years: Retention period for the qualified person's annual report
• not less frequently than once a month: Reconciliation of client account balances and totals
• within 10 days: Reconciliation must be performed within 10 days of the date to which it relates
• within one month after the pooling event: Period for return of client assets held by an intermediary at the time of a pooling event before distributions can be made in advance
• as soon as practicable: Notification to the Authority and affected clients of the occurrence of a pooling event

Related documents

• This document is made under Digital Asset Business Act 2018