finma

Eidgenössische Finanzmarktaufsicht FINMA Autorité fédérale de surveillance des marchés financiers FINMA Autorità federale di vigilanza sui mercati finanziari FINMA Swiss Financial Market Supervisory Authority FINMA

FINMA Guidance 01/2026 Custody of cryptobased assets

12 January 2026

+

finma

Contents

1 Introduction 3

2 Risks associated with the custody of cryptobased assets 3

3 Treatment under supervisory law 4

3.1 Custody of cryptobased assets as custody assets by a Swiss bank4

3.2 Requirements in connection with individual portfolio management 5

3.3 Management of collective assets under the CISA 7

3.4 Offering structured products or crypto ETPs under the FinSA 7

4 Risk notice for investors 8

+

finma

1 Introduction

In this guidance, FINMA provides information on the risks associated with the custody of cryptobased assets. In addition, the guidance specifies the requirements for the custody of cryptobased assets in order to limit custody risks in the interests of client and investor protection.

FINMA is seeing growing interest in cryptobased assets and associated services in the Swiss financial market. The increased market demand for trading, investment and custody services relating to cryptobased assets has demonstrably led to an expansion of services at institutions subject to FINMA's supervision, in particular banks, securities firms, managers of collective assets and portfolio managers (hereinafter "institutions").

With the entry into force of the DLT blanket act, comprehensive bankruptcy protection was introduced in Switzerland for cryptobased assets held in custody by third parties (Art. 37d in conjunction with Art. 16 para. 1bis of the Banking Act of 8 November 1934 [BA; SR 952.0], Art. 242a of the Federal Act of 11 April 1889 on Debt Enforcement and Bankruptcy [SchKG; SR 281.1]). At the same time, the regulatory environment is also evolving in other jurisdictions. As a result, FINMA was increasingly confronted by questions, such as which regulatory requirements foreign custodians must fulfil.

2 Risks associated with the custody of cryptobased assets

Distributed ledger technology (DLT) offers innovative and technology- specific features. Assets are stored "on the blockchain" and are therefore exposed to operational risks such as cyber attacks and the risk of inadequate protection of the private keys. These risks must be adequately addressed when offering financial services in connection with cryptobased assets.

From an operational perspective, it is necessary to establish and maintain a technical infrastructure and the associated expertise. If the custodian is a third party, there are counterparty risks insofar as the segregability of the cryptobased assets is not guaranteed in the event of the third party's insolvency. If the custodian is also located abroad, complex legal issues may arise. In addition, there is a dependency on the respective third party, in particular on its technical infrastructure, necessitating careful selection of the third party. The risk increases significantly if the third-party custodian is not subject to prudential supervision and does not have to comply with any supervisory standards for custody. Findings from FINMA's supervision show

+

finma

that these risks were not always adequately taken into account by the supervised institutions in the past.

3 Treatment under supervisory law

3.1 Custody of cryptobased assets as custody assets by a Swiss bank

Swiss financial institutions may offer their clients custody of and trading in cryptobased assets within a bankruptcy-proof framework (Art. 37d in conjunction with Art. 16 no. 1bis BA, Art. 242a SchKG). FINMA explained the supervisory treatment of crypto custody services as follows in its Guidance 08/2023 "Staking"1 (section 3.1):

Treatment under bankruptcy law (Art. 242a para. 2 SchKG):

Individual custody

Yes

Obligation for crypto assets to be held in readiness for customers at all times

Segregation in event of custodian's bankruptcy

Collective custody with clear customer shares

Yes

No

Collective custody without clear customer shares

No segregation

1 FINMA Guidance 08/2023 "Staking" of 20 December 2023, available at www.finma.ch > Documentation > FINMA Guidance.

+

finma

Treatment under banking law (Art. 1a and 1b BA in conjunction with Art. 5 and 5a BO):

Individual custody

Obligation for crypto assets to be held in readiness for customers at all times

Yes

Banking licence not required (but subject to AMLA supervision)

Collective custody with clear customer shares

Yes

Fin Tech licence

No

Collective custody without clear customer shares

Banking licence

Accounting treatment and prudential requirements:

Yes

Individual custody

Obligation for crypto assets to be held in readiness for customers at all times

Not held on balance sheet and no capital requirements (except Art. 4sexies BA)

Collective custody with clear customer shares

Yes

No

Collective custody without clear customer shares

On-balance-sheet and capital requirements

If a Swiss bank holds the cryptobased assets of its clients as segregable custody assets in accordance with Article 37d in conjunction with Article 16 no. 1bis BA, it does not generally have to meet capital requirements for these assets (subject to Art. 4sexies BA). If custody is delegated to third parties abroad, this exemption applies by way of analogy, provided that equivalent conditions are met, i.e. if the foreign third-party custodian is also subject to prudential supervision and the foreign law guarantees bankruptcy protection for the cryptobased assets held in custody.

3.2 Requirements in connection with individual portfolio management

In accordance with Article 24 para. 1 of the Financial Institutions Ordinance of 6 November 2019 (FinIO; SR 954.11), institutions active in individual portfolio management shall ensure that the assets entrusted to them for management are held in safekeeping, segregated per client, with a bank pursuant to the BA, a securities firm pursuant to the Financial Institutions Act of 15 June 2018 (FinIA; SR 954.1), a trading facility for distributed ledger technology securities (DLT trading facility) in accordance with the FinMIA or

+

finma

other institution that is subject to supervision equivalent to that in Switzerland.

Cryptobased assets, especially cryptocurrencies such as Bitcoin or Ether, are increasingly being used in individual portfolio management. They are therefore increasingly becoming part of client portfolios and must consequently be stored securely. As mentioned in the introduction, the legislator introduced comprehensive bankruptcy protection for cryptobased assets held in third-party custody through the DLT blanket act in 2021. Since then, certain regulatory (further) developments in other jurisdictions, such as the Markets in Crypto-Assets Regulation (MiCA)2 in the European Union, have created the basis for an appropriate custody environment for cryptobased assets. As a result, a growing number of suitable custodians of cryptobased assets with bankruptcy protection already exist abroad.

These developments must be taken into account when carefully selecting a custodian in accordance with Article 24 para. 1 FinIO. The appropriate safekeeping of managed cryptobased assets requires that they are held in custody by prudentially supervised institutions which, among other things, have an adequate technical infrastructure and the necessary expertise. Furthermore, it must be possible to segregate the cryptobased assets held in custody in the event of the custodian's bankruptcy. If the assets are held abroad, it must be ensured that the custodian institution is subject to supervision equivalent to that in Switzerland. This also requires that foreign law provides for bankruptcy protection for cryptobased assets that is equivalent to Swiss law.

It is the responsibility of the institutions to ensure appropriate custody of cryptobased client assets in accordance with the aforementioned requirements. Custody arrangements that do not meet the regulatory requirements must be adjusted in the interests of client protection.

Existing custody arrangements in which a) the foreign custodians of cryptobased assets are either subject to equivalent prudential supervision, but no equivalent bankruptcy protection exists, or b) arrangements with Swiss custodians under SRO supervision in which bankruptcy protection is ensured (Art. 242a SchKG), but prudential supervision is lacking, are permissible by way of exception, provided the portfolio manager (cumulatively):

· can be proven to have provided comprehensive information to the clients about increased custody risks associated with the existing custody service provider, particularly in the event of bankruptcy;

2 Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in cryptoassets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937.

finma +

· can be proven to have informed the clients about other suitable custodians for cryptobased assets in Switzerland and abroad;

· has documented the client's written consent to the use or retention of a custodian that is not suitable in the above sense.

The guarantee of appropriate safekeeping of entrusted assets in the interests of clients in accordance with Article 24 para. 1 FinIO may not be circumvented by structures with foreign products, as client protection must be comprehensively guaranteed. A Swiss institution that acts as a sponsor or manager of, for example, a foreign collective investment scheme that invests in cryptobased assets and places these in the portfolios of its clients is therefore responsible, for client protection reasons, for complying with the same principles in connection with the careful safekeeping of fund assets.

3.3 Management of collective assets under the CISA

The requirements for the safekeeping of fund assets of Swiss collective assets are governed by the Collective Investment Schemes Act of 23 June 2006 (CISA; SR 951.31). Accordingly, the fund assets must be held in safekeeping by a Swiss bank (custodian bank, Art. 72 para. 1 CISA). A custodian bank can delegate the safekeeping of fund assets to a third-party custodian or central securities depository in Switzerland or abroad where this is appropriate pursuant to Article 73 para. 2 CISA. Investors must be informed in the prospectus and in the basic information sheet in accordance with Title 3 of the Financial Services Act of 15 June 2018 (FinSA; SR 950.1) about the risks associated with such transfers.

Direct investments in cryptobased assets as part of Swiss collective assets must therefore generally be held in custody at a Swiss custodian bank. Delegation of custody to an equivalently supervised third-party custodian is possible, provided the custodian is subject to equivalent prudential supervision and equivalent bankruptcy protection rules for cryptobased assets exist in this regard.

3.4 Offering structured products or crypto ETPs under the FinSA

The offering of structured products to retail clients with whom there is no permanent portfolio management or investment advice relationship is governed by Article 70 FinSA. The issuing of structured products to retail clients by special purpose entities is permitted if these products are offered by prudentially supervised institutions in accordance with Article 70 para. 2 FinSA and a legally enforceable guarantee from a prudentially supervised financial intermediary in accordance with Article 70 para. 1 FinSA exists for the obligations of the issuer or legally enforceable real security is provided in

+

finma

favour of the investors (see Art. 70 para. 2 FinSA; Art. 96 paras. 2 and 3 of the Financial Services Ordinance of 6 November 2019 [FinSO; SR 950.11]).

Risks may also arise when offering structured products in the crypto sector with regard to the custody of the underlying cryptobased assets pledged as security. FINMA has already drawn attention to these risks in connection with crypto ETPs in its 2022 and 2023 annual reports.3 In the case of cryptobased assets, "real" security pursuant to Article 96 FinSO requires legal protection in the event of the insolvency of the custodian of the security.

Both Swiss stock exchanges have already issued specific rules in their regulations for the admission of crypto ETPs and their collateralisation.4

4 Risk notice for investors

Cryptobased assets, such as cryptocurrencies, are not per se safe investments for investors, even if they are held in custody in accordance with the above requirements. These are often risky and highly speculative investments that are characterised by high volatility. Investors should therefore be aware before entering into such investment transactions that high losses are also possible.

3 FINMA Annual Report 2023, p. 67; see also FINMA Annual Report 2022, p. 19 f.

4 See SIX Swiss Exchange AG, Additional Rules for the Listing of Exchange Traded Products, Arts. 12a-15; BX Swiss AG, Additional Rules for the Listing of Exchange Traded Products, Arts. 6-9.