Belize -- Custody Regulations Regulatory Overview

Belize has recently introduced comprehensive legislation for virtual asset services, including custody. The primary regulatory body overseeing these activities is the International Financial Services Commission (IFSC).

The key pieces of legislation are:

1. Virtual Assets Services Act, 2024 (VASA 2024)
2. International Financial Services Commission (Virtual Assets) Regulations, 2024

These laws establish a framework for the licensing and supervision of Virtual Asset Service Providers (VASPs), which explicitly include providers of virtual asset custody services.

Here’s a breakdown of the specific aspects:

Cryptocurrency/Digital Asset Custody Regulations in Belize

1. Custodial License Requirements

Under the Virtual Assets Services Act, 2024, any person wishing to provide virtual asset services, which explicitly include "custody or administration of virtual assets or instruments enabling control over virtual assets," must obtain a license from the IFSC.

Key Requirements for a VASP License (including custody services):

• Application Process: Submission of a detailed application to the IFSC.
• Fit and Proper Test: Directors, senior management, and significant shareholders must undergo a "fit and proper" assessment, considering their competence, integrity, and financial soundness.
• Minimum Capital Requirements: VASPs must meet prescribed minimum paid-up capital requirements, which are stipulated in the Regulations and vary depending on the services offered.
• Business Plan: Submission of a comprehensive business plan detailing operations, organizational structure, internal controls, risk management framework, technology infrastructure, and security measures.
• AML/CFT Compliance: Robust Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) policies and procedures must be in place, compliant with Belizean laws (e.g., Money Laundering and Terrorism (Prevention) Act) and international FATF standards. This includes customer due diligence (CDD), record-keeping, suspicious transaction reporting, and internal controls.
• Risk Management Framework: Detailed policies for identifying, assessing, monitoring, and mitigating risks associated with virtual asset services, including technological, operational, cybersecurity, and market risks.
• Corporate Governance: Establishment of sound corporate governance arrangements, including clear lines of responsibility, oversight by the board, and internal audit functions.
• Information Technology (IT) & Cybersecurity: Implementation of robust IT systems and cybersecurity measures to protect virtual assets, client data, and operational integrity.

Regulatory Reference:

• Virtual Assets Services Act, 2024:
  • Part II: Licensing of Virtual Asset Service Providers (e.g., Section 7: Requirement for licence; Section 8: Application for licence).
• International Financial Services Commission (Virtual Assets) Regulations, 2024:
  • Part II: Licensing Requirements and Procedures.
• IFSC Website: The IFSC website will typically host the latest versions of these acts and regulations, along with application forms and guidance notes.
  • Current Public Information Page (check for updated links to the specific acts): IFSC Belize – Virtual Asset Services

2. Segregation of Client Assets Rules

The Virtual Assets Services Act, 2024 and its accompanying Regulations explicitly mandate the segregation of client assets.

Key Provisions:

• Separate Accounts: A licensed VASP providing custody services must hold client virtual assets in accounts separate from its own assets.
• No Commingling: Client assets must not be commingled with the VASP's proprietary assets.
• Trustee Capacity: The VASP must hold client virtual assets in trust or a similar fiduciary capacity, ensuring they are protected in the event of the VASP's insolvency or bankruptcy.
• Record-Keeping: Detailed and accurate records of all client virtual assets must be maintained, clearly identifying ownership.

Regulatory Reference:

• Virtual Assets Services Act, 2024: Look for sections related to client asset protection or client funds (e.g., Part V: Conduct of Business and Client Protection, or specific sections within it addressing segregation).
• International Financial Services Commission (Virtual Assets) Regulations, 2024: Will elaborate on the specifics of asset segregation, accounting, and reporting requirements.

3. Insurance/Bonding Requirements

While the initial public summaries of the VASA 2024 and its Regulations do not always highlight explicit, universally mandated insurance or bonding requirements as a standalone section for all VASPs, they typically fall under broader risk management and financial soundness provisions.

General Expectations:

• Financial Resources: VASPs are expected to maintain adequate financial resources, including sufficient capital, to cover operational risks and potential liabilities.
• Risk Management: The comprehensive risk management framework required will likely necessitate considerations for covering potential losses due to cyber-attacks, operational failures, or misconduct. This often implies the need for appropriate insurance coverage (e.g., cybersecurity insurance, professional indemnity insurance), even if not explicitly mandated for a specific amount in the law.
• IFSC Discretion: The IFSC may, at its discretion, impose specific insurance or bonding requirements on individual licensees based on their business model, scale of operations, and risk profile.

Regulatory Reference:

• Virtual Assets Services Act, 2024: Sections pertaining to capital requirements, financial soundness, and risk management framework.
• International Financial Services Commission (Virtual Assets) Regulations, 2024: May detail specific capital adequacy ratios or financial safeguards that implicitly require or are supplemented by insurance.

4. Cold Storage Mandates

The Belizean legislation, like many emerging frameworks, focuses on establishing principles of robust security and risk management rather than mandating specific technological solutions like cold storage.

Key Provisions:

• Robust Security Measures: Licensed VASPs must implement stringent security measures to protect virtual assets from theft, loss, or unauthorized access. This includes cybersecurity protocols, cryptographic security, access controls, and data integrity.
• Risk Assessment: Custodians are required to conduct thorough risk assessments of their storage solutions (both hot and cold) and implement controls commensurate with the identified risks.
• Operational Resilience: Requirements for business continuity plans and disaster recovery protocols to ensure the continuous availability of services and protection of assets.
• Technology Framework: The VASP's technology infrastructure, including its storage solutions, must be audited, robust, and resilient.

While "cold storage" isn't explicitly mandated for a certain percentage of assets, the requirement for robust security and risk management effectively pushes custodians towards utilizing best practices, which inherently includes significant reliance on cold or multi-signature storage for the majority of client assets. The choice between hot, warm, and cold storage will be part of the VASP's risk management strategy reviewed by the IFSC.

Regulatory Reference:

• Virtual Assets Services Act, 2024: Sections related to security, operational resilience, and risk management.
• International Financial Services Commission (Virtual Assets) Regulations, 2024: Will likely elaborate on the expected standards for IT governance, cybersecurity, and operational controls relevant to virtual asset storage.

5. Qualified Custodian Definitions

The Belizean framework defines "custody" as a specific virtual asset service that requires a license. Therefore, a "qualified custodian" in Belize is essentially a Virtual Asset Service Provider (VASP) that has been duly licensed by the IFSC to provide custody or administration services for virtual assets, and which complies with all ongoing regulatory obligations.

The Virtual Assets Services Act, 2024 defines "virtual asset services" to include:

• "(c) custody or administration of virtual assets or instruments enabling control over virtual assets."

Thus, any entity licensed by the IFSC to perform this specific service, and adhering to the stipulated requirements for capital, governance, security, and client asset segregation, would be considered a "qualified custodian" within the Belizean regulatory context.

Regulatory Reference:

• Virtual Assets Services Act, 2024:
  • Section 2: Interpretation (defining "virtual asset service" and "custody").
  • Part II: Licensing of Virtual Asset Service Providers.

6. Pending Custody Legislation

As of early 2024, the Virtual Assets Services Act, 2024 and the International Financial Services Commission (Virtual Assets) Regulations, 2024 are the current and most recent comprehensive legislation governing virtual asset services, including custody, in Belize.

These acts represent a significant step in formalizing the regulatory landscape for virtual assets in Belize, moving from a previous position where specific regulations were less explicit. Therefore, there isn't significant pending custody-specific legislation in the immediate pipeline, as the new framework has just been established.

However, financial regulations are dynamic. The IFSC, like other regulators, will likely monitor the evolving virtual asset landscape and industry practices, and may introduce amendments, further guidance, or new regulations in the future as needed to adapt to technological advancements, market developments, and international standards (e.g., updates from FATF). Any future consultations or proposed amendments would typically be announced on the IFSC's official website.

Disclaimer: This information is for general informational purposes only and does not constitute legal, financial, or regulatory advice. Specific regulatory interpretations and requirements can be complex and may change. Always consult with legal and regulatory professionals qualified in Belize for advice tailored to your specific situation.