New FINMA guidance on crypto custody requirements

The market risk tied to the high volatility of many cryptobased assets is well known, while the risks associated with the custody of these assets less so. FINMA addresses this topic in its new guidance by specifying requirements for custodians and other service providers for cryptobased assets. In general, supervised Swiss service providers must ensure that cryptobased assets are kept in custody at prudentially supervised institutions in Switzerland or in a jurisdiction with equivalent supervision and with a legal framework that allows bankruptcy-proof custody solutions.

Background

Cryptobased assets are increasingly popular in the Swiss financial market. Swiss institutions meet the market’s demand with additional trading, investment, and custody services. FINMA notes in particular an expansion of the cryptobased asset offerings at banks, securities firms, fund managers, and portfolio managers. This caused FINMA to specify requirements for custodians of cryptobased assets and for supervised institutions relying on such custodians. The circular highlights that cryptobased assets are prone to cyber-attacks in general and to private keys of wallets being compromised. Therefore, the operational aspects of custody, like implementation and maintenance of appropriate custody infrastructure and related knowledge of blockchain technology are of the essence. If custody is delegated to a third party, the delegating institution must mitigate resulting counterparty risks and risks related to the dependency on the third party’s infrastructure by appointing the (sub-)custodian only after performing due diligence checks.

Custody requirements for Swiss service providers

Find below an overview of institutions and products affected by changes introduced by the new FINMA Guidance on Crypto Custody Requirements compared with the current framework:

Banks: Swiss banks can offer custody of and trading in cryptobased assets in a bankruptcy-proof way when keeping the assets either in individual custody or in collective custody with clear customer shares and always keeping the assets in readiness for customers. If these requirements are not met, the cryptobased assets are not held in a bankruptcy-proof way and thus have to be backed with capital. In case the Swiss bank delegates custody to a third party abroad, the third party custodian must be subject to equivalent supervision abroad and foreign law has to guarantee bankruptcy protection.

At a glance:

Individual portfolio managers: Individual portfolio managers must keep assets of their clients segregated per client. The client’s assets must be kept in custody at a Swiss bank, securities firm, trading facility for distributed ledger technology (DLT trading facility). Foreign institutions subject to equivalent supervision may also be appointed as custodians. The respective provision is in force for a few years, but due to a lack of eligible crypto custodians, individual portfolio managers often struggled to meet this requirement.

In Switzerland, the DLT blanket act introduced a legal framework which allows for keeping cryptobased assets in a bankruptcy-proof way. Also, foreign regulation, namely the EU Market in Crypto-Assets Regulation (MiCA), provides for appropriate governance of EU-based custodians. Therefore, FINMA now stresses the responsibility of individual portfolio managers to ensure appropriate custody of client assets. Appropriateness of custody solutions requires that the custodian is prudentially supervised, either in Switzerland or equivalently abroad, and that foreign law allows for bankruptcy-proof custody.

Individual portfolio managers must amend existing custody arrangements that do not meet these requirements.

An exemption to this rule applies under very limited circumstances. Existing custody arrangements may benefit from a grandfathering only if requirements regarding the custodian are met and a client outreach has been performed. Only arrangements with the following custodians are eligible for grandfathering:

Non-Swiss custodians subject to equivalent prudential supervision (such custodians may be eligible despite a lack of equivalent bankruptcy protection in the custodian’s home jurisdiction); or
Swiss custodians that are members of an AML self-regulatory organization and offer bankruptcy-proof custody solutions (such custodians may be eligible despite a lack of prudential supervision).

If the custodian meets either of the two criteria above, the individual portfolio manager intending to rely on the grandfathering exemption must perform a client outreach to provide information about the custody arrangements and request written consent. The wealth manager must be able to prove

to have provided comprehensive information to clients about increased custody risks associated with the existing custody service provider, especially in case of bankruptcy;
to have provided information to clients about suitable custodians in Switzerland and abroad; and
to have received client’s written consent to retain the existing custody arrangement, despite not being suitable according to FINMA’s interpretation.

FINMA pre-empts attempts to circumvent the custody requirements with respective foreign products being placed in clients’ portfolios. If a Swiss institution sponsors or manages such foreign products investing in cryptobased assets the Swiss custody requirements have to be met.

At a glance:

Managers of collective investment schemes: The new FINMA guidance does not change the requirements imposed on fund assets of Swiss collective investment schemes. These assets have to be kept in custody with a Swiss bank. If the Swiss bank delegates custody it must adhere to the requirements set out above and in addition the risks associated with the delegated custody must be disclosed in the prospectus and the basic information sheet.

At a glance:

Offering of structured products and ETPs: The new FINMA guidance does not change the existing requirements tied to offering structured products to retail investors. As for the custody requirements, special purpose vehicles (SPVs) issuing structured products collateralised with cryptobased assets must ensure that the security interest (e.g., pledge) in favour of the investors is legally enforceable. FINMA stressed that this does not only encompass enforceability in case of an SPV default but also requires legal protection in the event of insolvency of the custodian of the collateral.

As for ETPs, the requirements for collateralisation and custody of collateral are set out in the listing rules of both Swiss exchanges.

Our services

We support service providers and their investors in assessing existing custody solutions for cryptobased assets. We also support the implementation of new custody solutions at service providers, including (sub-) delegation to third parties in Switzerland or abroad. Our capabilities range from legal and regulatory to operational aspects.