The digital asset landscape is witnessing an increased adoption with the emergence of virtual digital assets. As digitization picks up pace and both governments and institutions embrace digital assets, the need for regulatory compliance to ensure investor protection, financial stability, and trust in the burgeoning digital economy is bound to increase.
This is why selecting an ideal digital asset custody solution partner is becoming an uphill task for institutions jumping on the bandwagon. However, reputed digital asset custody solution providers are aggressively pushing for top-notch certifications to keep up with the ever-evolving regulatory obligations. This blog explores the top licenses digital asset custody providers are pursuing to help institutions navigate the challenging regulatory frameworks and gain the trust of clients.
Top Licenses and Certifications Digital Custody Providers are Eyeing
ISO/IEC 27001:2022
ISO/IEC 27001 is the world’s most popular standard for information security management systems (ISMS). Concerned with any software system that deals in digital information or assets, the standard defines requirements an asset custodian must meet. Since the digital asset industry is fraught with sophisticated security risks, ISO/IEC 27001 is a key differentiator when it comes to obtaining operational approval in different parts of the world with stringent norms with respect to digital asset custody.
A custody solution provider has to undergo an audit by an external auditor from a certification body in order to obtain the certification. The ISO/IEC 27001:2022 offers a custody solution provider a competitive edge and minimizes the chances of clients encountering regulatory challenges. Liminal Custody, Fireblocks, and Atato Custody are some of the top digital asset custodians with an ISO certification.
CCSS
CCSS stands for CryptoCurrency Security Standard. It is a comprehensive security certificate awarded to the best of the best digital asset custody providers. Built by the CryptoCurrency Certification Consortium (C4), CCSS has three levels of certifications: Level 1, Level 2, and Level 3. It provides a comprehensive set of rules and metrics to evaluate platforms, wallet providers, and custody platforms. The framework primarily focuses on developing the best guidelines for implementing security controls that address:
- Private key generation and storage
- Wallet creation and storage
- On-chain transactions
CCSS enhances the security measures prescribed in the ISO/IEC 27001:2022 certification to tackle emerging security risks, making it easier for digital asset custodians to get a nod from the concerned regulatory bodies. While CCSS level 1 ensures that a digital asset custodian has implemented a comprehensive set of security controls to mitigate cyber threats and other security risks, level 2 indicates that the custodian has incorporated enhanced security measures specifically designed for decentralized systems.
However, Level 3 is the gold standard of CCSS as it indicates that a digital asset custodian has built on the requirements of Levels I and II while incorporating more stringent security controls, advanced risk management practices, regular security audits, and continuous monitoring. At present, Liminal Custody and Fireblocks are the only two custody solutions to possess the CCSS Level 3 certification. However, Liminal Custody is the only digital asset custodian in the world currently accredited with a CCSS Level 3 Full System certification. With regulatory bodies getting stricter than ever, more and more custody platforms will flock towards obtaining the Level 3 certification standards designed for this space.
SOC Type 2
When it comes to preventing unauthorized access to user data, private keys, or digital assets, SOC Type 2 is right up there. The full form of SOC Type 2 is Systems and Organization Controls 2. It is a security framework that provides guidelines on the protection of customer data from unauthorized access, security incidents, and other vulnerabilities. Developed by the American Institute of Certified Public Accountants, SOC Type 2 has 5 key pillars: security, availability, processing integrity, confidentiality, and privacy. Obtaining a SOC 2 certificate involves an evaluation by an independent auditor around the five aforementioned pillars.
A SOC 2-certified digital asset custodian helps institutions establish airtight internal security controls to enable seamless scaling. It also assists institutions in meeting regulatory requirements related to data security and privacy. Which can vary by industry and geography. A reputed digital asset custodian is bound to have a SOC Type 2 certification. As it enforces the need for detailed and comprehensive documentation.
BitLicense (New York State Department of Financial Services – NYDFS)
Silicon Valley is where most of the Web3-related innovations take place and that puts the US at the center of Web3-related activities. Thus, it is obvious for leading digital asset custodians to push for the necessary certifications for operating the world’s biggest economy. BitLicense is one of those certifications.
Introduced by the New York State Department of Financial Services (NYDFS) in 2015, it provides regulatory frameworks for digital asset businesses. BitLicense entails the transmission, custody, and exchange of digital assets. It also requires digital asset-native businesses to adhere to strict capital requirements, cybersecurity measures, and AML/KYC (Anti-Money Laundering/Know Your Customer) protocols. Thus, working with a BitLicense-certified digital asset custodian is highly likely to improve the credibility of digital asset businesses.
e-Money License (European Union)
The European Union is undoubtedly the second major hotbed for VDA-centric activities and innovations after the US. e-Money License is one of the most essential certifications for companies issuing electronic money and providing payment services, including digital asset custody. Granted by various national financial regulators within the EU. The e-Money License has been designed to ensure compliance with the EU’s electronic money and payment services directives. The certification makes it easier for VDA-native businesses to operate across member states under a single regulatory framework, simplifying expansion.
For EU-native digital asset businesses and institutions looking to outsource. Their asset custody, the e-Money License could be a deal breaker.
Securities Dealer License (Switzerland – FINMA)
Digital asset businesses and institutions love Switzerland because it is a tax haven. Almost every major DAO, protocol, or dApp has operations in VDA-friendly areas like Zug in Switzerland. Thus, obtaining a Swiss license is paramount for digital asset custodians to onboard more clients. This is where the aforementioned certification kicks in.
A digital asset custody solution provider must obtain a Securities Dealer License to comply with Swiss financial market regulations. It requires adherence to stringent standards, including capital adequacy, risk management, and transparency. As more and more digital asset businesses move to tax havens like Switzerland, digital asset custodians are likely to be flocking for their approvals for the aforementioned licenses.
Wrapping Up
As digital assets, primarily digital currencies come to the fore. The need for robust regulatory compliance is paramount for fostering investor protection, financial stability, and trust. With digital asset custodians facing significant challenges due to an increasing number of platforms entering. The custody market, obtaining the top certifications is the only way to gain a competitive edge. Pursuing top certifications such as ISO/IEC 27001:2022, CCSS, SOC Type 2, BitLicense, e-Money License, and the Securities Dealer License in Switzerland enables digital asset custodians to offer secure and reliable services.
