Turks and Caicos -- Custody Regulations Regulatory Overview

Turks and Caicos Islands (TCI) has established a robust regulatory framework for Virtual Asset Service Providers (VASPs), including those offering digital asset custody services. The primary legislation governing this sector is the Virtual Asset Service Providers Act 2022 (VASP Act 2022) and the accompanying Virtual Asset Service Providers Regulations 2023 (VASP Regulations 2023). These frameworks came into effect in 2023.

The Turks and Caicos Islands Financial Services Commission (FSC) is the regulatory body responsible for licensing, supervision, and enforcement under these laws.

Here's a breakdown of the key custody-related regulations:

1. Custodial License Requirements

• Requirement for Licensing: Any entity providing "custody or administration of virtual assets or instruments enabling control over virtual assets on behalf of another natural or legal person" (as per the definition of a VASP in Section 3 of the VASP Act 2022) is required to be licensed by the TCI FSC.
• Application Process: Applicants must submit a comprehensive application to the FSC, which includes:
  • Detailed business plan.
  • Information on the applicant's corporate structure, ownership, and management.
  • Proof of financial soundness and capital adequacy.
  • Robust anti-money laundering (AML) and combating the financing of terrorism (CFT) policies and procedures.
  • Risk management framework.
  • IT and cybersecurity policies.
  • Segregation of client assets policies.
  • Disaster recovery plan.
• Fit and Proper Test: All directors, senior officers, and significant shareholders are subject to "fit and proper" assessment by the FSC.
• Local Presence: A licensed VASP must have a physical presence or designated contact in TCI.

Regulatory Reference:

• Virtual Asset Service Providers Act 2022, Section 6 (Requirement to be Licensed).
  • TCI FSC Legislation Page (You may need to search for the specific Act once on the page, or navigate through the "Virtual Asset Services" section).
• Virtual Asset Service Providers Regulations 2023, Regulation 3 (Application for License).
  • TCI FSC Legislation Page

2. Segregation of Client Assets Rules

TCI law explicitly mandates strong measures for client asset segregation:

• Holding in Trust & Separate Accounts: A licensed VASP must:
  • Hold client virtual assets in trust for the benefit of the client.
  • Maintain separate client accounts for each client.
• Protection from Insolvency: Client virtual assets held by a VASP cannot be considered assets of the VASP in the event of its insolvency or winding-up, protecting clients from creditors.

Regulatory Reference:

• Virtual Asset Service Providers Act 2022, Section 14(1)(a) and 14(1)(b) (Safeguarding client assets).
  • Specifically: "A licensed VASP shall — (a) hold virtual assets or instruments enabling control over virtual assets in trust for and on behalf of its client; (b) maintain separate client accounts for its clients."

3. Insurance/Bonding Requirements

• Professional Indemnity Insurance: Licensed VASPs are required to maintain adequate professional indemnity insurance or other comparable guarantee. The specific amount or nature of this "comparable guarantee" would be subject to FSC approval based on the VASP's business model and risk profile.

Regulatory Reference:

• Virtual Asset Service Providers Act 2022, Section 14(1)(c) (Safeguarding client assets).
  • Specifically: "A licensed VASP shall — (c) maintain adequate professional indemnity insurance or other comparable guarantee to cover the risks associated with the safekeeping and management of virtual assets for clients."

4. Cold Storage Mandates

TCI regulations specifically address the secure storage of virtual assets, including cold storage:

• Policies and Procedures: Licensed VASPs must establish and maintain sound policies and procedures for the secure storage and control of virtual assets.
• Cold Storage for Significant Proportion: The regulations explicitly require the use of cold storage for a "significant proportion" of client virtual assets. This indicates a clear preference for offline storage for enhanced security against cyber threats.
• Secure Access Controls: Procedures for secure access to virtual assets, including multi-factor authentication, robust private key management, and cryptographic security measures, are expected.
• Business Continuity and Disaster Recovery: VASPs must have robust plans to ensure the continuity of services and the recovery of client assets in case of unforeseen events.

Regulatory Reference:

• Virtual Asset Service Providers Act 2022, Section 14(1)(e) (Safeguarding client assets).
  • Specifically: "A licensed VASP shall — (e) establish and maintain sound policies and procedures for the secure storage and control of virtual assets or instruments enabling control over virtual assets."
• Virtual Asset Service Providers Regulations 2023, Regulation 11(2)(d) (Operational and Technical Requirements).
  • Specifically: "A licensed VASP shall have appropriate — (d) policies and procedures for the secure storage of virtual assets, including the use of cold storage for a significant proportion of client virtual assets and the implementation of robust cryptographic security measures."

5. Qualified Custodian Definitions

The TCI VASP Act and Regulations do not use the term "qualified custodian" in the same way, for example, the US SEC does (referring to banks, broker-dealers, etc.).

Instead, in the TCI context, an entity acting as a "custodian" for virtual assets must be a VASP licensed under the TCI Virtual Asset Service Providers Act 2022. The Act's requirements, including capital adequacy, robust governance, technical safeguards, and compliance with AML/CFT standards, effectively define what constitutes a legitimate and regulated virtual asset custodian in TCI. Therefore, a "qualified custodian" for digital assets in Turks and Caicos is a duly licensed and compliant VASP.

6. Pending Custody Legislation

As of late 2023/early 2024, the VASP Act 2022 and VASP Regulations 2023 represent the most recent and comprehensive legislative framework for digital asset custody in Turks and Caicos. These laws were enacted recently, establishing a robust and detailed regime.

While there is no major new pending legislation anticipated to drastically alter the custody rules in the immediate future, regulatory environments are always subject to evolution. The TCI FSC, like other financial regulators, may issue guidance notes, circulars, or minor amendments to clarify existing provisions or adapt to emerging market practices and risks. It is always advisable to monitor the TCI FSC's official website (www.tcifsc.tc) for any announcements, consultations, or updated publications.

Disclaimer: This information is for general informational purposes only and does not constitute legal advice. For specific legal advice regarding digital asset custody regulations in Turks and Caicos, it is essential to consult with a qualified legal professional specializing in TCI financial services law.