Digital Asset Compliance Glossary

202 regulation, custody, tokenization and stablecoin terms for banks, custodians, asset managers and issuers. Each one links to the full article.

By the Guardian team · Updated November 2026

52 terms

Regulations and regulators

The rules that reach digital asset firms, grouped by region, and what each asks of technology.

Global standard setters

Basel cryptoasset prudential standard (SCO60)

Also called Basel crypto standard, SCO60, BCBS cryptoasset exposures, prudential treatment of cryptoasset exposures

The Basel cryptoasset standard (SCO60) is the Basel Committee's prudential treatment of bank cryptoasset exposures, with a 1 January 2026 implementation date that national regulators adopt on their own timetable. Assets failing its classification conditions fall into Group 2, capped at 2% of Tier 1 capital.

Learn more Institutional Digital Asset Cybersecurity

FATF DeFi control indicators

Also called FATF 12 indicators, FATF DeFi report 2026, indicators of control

The FATF DeFi control indicators are 12 non-binding signs of who controls a DeFi arrangement, from the FATF's July 2026 DeFi report. Seven are onchain, such as upgradeability and oracle control; five are offchain, such as multisig signatories and front ends.

Full article FATF DeFi Report 2026: 12 Control Indicators Mapped to Code

Financial Action Task Force (FATF)

Also called FATF, FATF recommendations, GAFI

The Financial Action Task Force (FATF) is the intergovernmental body that sets the global anti-money laundering and counter-terrorist financing standard, the FATF Recommendations. In its 2026 DeFi survey, only 26 of 142 responding jurisdictions had assessed DeFi risks.

International Organization of Securities Commissions (IOSCO)

Also called IOSCO, IOSCO DeFi Recommendations, FR/14/2023

The International Organization of Securities Commissions (IOSCO) is the global standard setter for securities regulators; its December 2023 DeFi Policy Recommendations (FR/14/2023) make nine recommendations. Recommendation 2 asks regulators to identify a DeFi arrangement's Responsible Persons, including holders of administrative rights to its smart contracts.

Full article Decentralization Tests Compared: SEC, FCA, MiCA, FATF, IOSCO

European Union

Digital Operational Resilience Act (DORA)

Also called DORA, regulation (EU) 2022/2554, Digital Operational Resilience Act

The Digital Operational Resilience Act (DORA) is the EU regulation on ICT risk for financial entities, including MiCA-authorized CASPs, applying since 17 January 2025. It requires protected cryptographic keys, yearly independent testing of critical systems and notice within 4 hours of classifying a major incident.

Full article Crypto Regulatory Compliance: The Security Requirements

DLT Pilot Regime

Also called DLT Pilot, Regulation (EU) 2022/858, Pilot Regime for market infrastructures based on distributed ledger technology, DLT MTF, DLT TSS

The DLT Pilot Regime (Regulation (EU) 2022/858) is the EU framework, applying from 23 March 2023, for trading and settlement infrastructure for tokenized financial instruments on distributed ledgers. Its IT arrangements must ensure smart contract reliability, and authorities may order an independent audit.

Learn more Regulatory & Compliance Assessment

European Banking Authority (EBA)

Also called EBA

The European Banking Authority (EBA) is the EU banking authority that classifies asset-referenced and e-money tokens as significant under MiCA and then supervises their issuers. With ESMA and EIOPA it designates DORA's critical ICT third-party providers, and it issues guidelines on transfers to self-hosted addresses.

Learn more Regulatory & Compliance Assessment

European Securities and Markets Authority (ESMA)

Also called ESMA

The European Securities and Markets Authority (ESMA) is the EU securities markets authority that keeps the MiCA register and drafts technical standards for crypto-asset service providers. Its 8 October 2026 opinion says CASPs should provide no service, custody included, for non-MiCA-compliant stablecoins.

Markets in Crypto-Assets Regulation (MiCA)

Also called MiCA, Regulation (EU) 2023/1114, Markets in Crypto-Assets

The Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) is the EU's rulebook for crypto-asset service providers and issuers of asset-referenced and e-money tokens, fully applicable since 30 December 2024. Authorization files must include technical documentation of ICT systems and security arrangements (Article 62(2)(j)).

Full article Crypto Regulatory Compliance: The Security Requirements

NIS2 Directive

Also called NIS2, Directive (EU) 2022/2555, NIS 2

NIS2 (Directive (EU) 2022/2555) is the EU cybersecurity directive for essential and important entities, such as cloud and managed security providers; financial entities under DORA follow DORA instead. It requires measures including MFA and supply chain security, and an early incident warning within 24 hours.

Learn more Regulatory & Compliance Assessment

Transfer of Funds Regulation (TFR)

Also called TFR, Regulation (EU) 2023/1113, EU Travel Rule, Transfer of Funds Regulation recast

The Transfer of Funds Regulation (TFR, Regulation (EU) 2023/1113) is the EU law that applies the Travel Rule to crypto. Since 30 December 2024, CASPs must send originator and beneficiary information with every crypto-asset transfer, whatever the amount.

Learn more Regulatory & Compliance Assessment

United Kingdom

CASS 17 (FCA cryptoasset custody rules)

Also called CASS 17, FCA crypto custody rules, PS26/11

CASS 17 is the FCA's custody chapter for client cryptoassets from October 25, 2027: assets held on trust and reconciled with onchain holdings each business day. Its key rules are technology-agnostic but require a record of where each key is and who can use it.

Full article UK Crypto Regulation October 2027: What Must Be Ready

Cryptoasset admission due diligence (FCA)

Also called CRYPTO 3.2.5r, FCA listing due diligence, FCA token admission rules, PS26/9, QCDD

Cryptoasset admission due diligence is the FCA rule (CRYPTO 3.2) that a retail UK trading platform admits a token only if reasonably satisfied it is unlikely to harm retail investors. From October 25, 2027, criteria must cover known risks in the token's smart contracts.

Full article UK Crypto Listing Due Diligence: Smart Contract Checks

FCA DeFi guidance (GC26/7)

Also called GC26/7, FCA DeFi guidance, FCA decentralised finance guidance

GC26/7 is the FCA's draft guidance (October 21, 2026) on how existing resilience and financial crime rules apply to firms using DeFi. Paragraph 3.28 asks firms to identify the upgrade mechanisms, emergency controls and admin keys that could affect their services.

Full article FCA DeFi Guidance GC26/7: A Mapping Checklist

Financial Conduct Authority (FCA)

Also called FCA, UK FCA

The Financial Conduct Authority (FCA) is the UK conduct regulator responsible for authorizing cryptoasset firms under SI 2026/102, which comes fully into force on October 25, 2027. Existing firms that apply between September 30, 2026 and February 28, 2027 can keep operating while it decides.

Money Laundering Regulations 2017 (UK MLRs)

Also called MLRs, UK MLRs, Money Laundering Regulations, SI 2017/692, FCA crypto registration

The Money Laundering Regulations 2017 (MLRs) are the UK's AML rules, under which cryptoasset exchanges and custodian wallet providers register with the FCA and send originator and beneficiary data with transfers. These registrations do not convert into authorization under the 2027 cryptoasset regulation.

Full article UK Crypto Regulation October 2027: What Must Be Ready

PERG 18 (FCA decentralisation guidance)

Also called draft PERG 18, CP26/36, FCA cryptoasset perimeter guidance, FCA decentralisation test

Draft PERG 18 is the FCA's proposed guidance (CP26/36, October 21, 2026) on how decentralization, automation and smart contracts affect whether a person needs authorization. It weighs governance, operational and economic facts, and says lacking a single controller does not necessarily settle the question.

Full article FCA Crypto Perimeter Guidance: Draft PERG 18 Control Facts

SYSC 15A operational resilience

Also called SYSC 15A, FCA operational resilience rules, PS21/3

SYSC 15A is the FCA's operational resilience chapter, requiring firms to set an impact tolerance for each important business service, map what supports it and test against severe but plausible disruption. It reaches cryptoasset firms from October 25, 2027.

Full article FCA DeFi Guidance GC26/7: A Mapping Checklist

UK cryptoasset regulation (SI 2026/102)

Also called FSMA Cryptoassets Regulations 2026, SI 2026/102, UK crypto regulation, UK crypto regime 2027

The UK cryptoasset regulation is SI 2026/102, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, bringing cryptoasset activities into the FCA's perimeter on October 25, 2027. From day one, firms need SYSC 15A resilience, CASS 17 key management and token admission due diligence.

Full article UK Crypto Regulation October 2027: What Must Be Ready

United States

BitLicense

Also called 23 NYCRR 200, New York virtual currency license

The BitLicense is New York's license for virtual currency business involving New York or its residents, such as transmission, custody and exchange, under 23 NYCRR Part 200, in force since 2015. It requires a CISO, annual pentests and vulnerability assessments at least quarterly.

Learn more Regulatory & Compliance Assessment

California Digital Financial Assets Law (DFAL)

Also called DFAL, California DFAL, Digital Financial Assets Law, DFPI crypto license

The Digital Financial Assets Law (DFAL) is California's licensing law for exchanging, transferring or storing digital financial assets for California residents. A license has been required since 1 July 2026 unless a completed application was filed by then, and section 3701 requires written security programs.

Learn more Regulatory & Compliance Assessment

CFTC crypto ANPRM

Also called Regulation CTX, Regulation CAM, CFTC request for comment on crypto, 91 FR 64811

The CFTC crypto ANPRM is the Commission's October 2026 advance notice on Regulation CTX and Regulation CAM for crypto transactions and markets; comments are due December 14, 2026. Question V.B.5.vii asks whether to require testing, formal verification, audit or fail-safes for smart contracts.

Full article CFTC Request for Comment on Crypto: The Technical Questions

CLARITY Act

Also called Digital Asset Market CLARITY Act, H.R. 3633

The Digital Asset Market Clarity Act (CLARITY Act, H.R. 3633) is a US crypto market structure bill the House passed in July 2025; as of September 2026 it had not become law. The House text treats a blockchain as mature if no person or commonly controlled group controls it.

Full article The SEC Crypto Safe Harbor Proposal: Rule 400 and Form TR

Commodity Futures Trading Commission (CFTC)

Also called CFTC

The Commodity Futures Trading Commission (CFTC) is the US regulator of commodity derivatives markets under the Commodity Exchange Act. Its October 2026 advance notice takes the preliminary view that actual delivery of a retail crypto purchase may require the buyer to hold the private keys.

Federal Reserve GENIUS Act proposal (12 CFR 247)

Also called 12 CFR 247, docket r-1899, fed GENIUS Act rule, 247.13

The Federal Reserve GENIUS Act proposal is the Board's September 29, 2026 proposed rule (12 CFR part 247) for the stablecoin issuers it supervises. Proposed section 247.13 requires validating that smart contracts operate as intended, periodic independent testing, and private key management, backup and recovery.

Full article Federal Reserve GENIUS Act Proposal: IT Security Standards

Financial Crimes Enforcement Network (FinCEN)

Also called FinCEN

The Financial Crimes Enforcement Network (FinCEN) is the US Treasury bureau that administers the Bank Secrecy Act, under which crypto exchangers generally qualify as money transmitters. With OFAC, it proposed AML and sanctions program rules for permitted payment stablecoin issuers on April 10, 2026.

GENIUS Act

Also called guiding and establishing national innovation for U.S. stablecoins Act, Public Law 119-27, US stablecoin Law

The GENIUS Act (Public Law 119-27, signed July 18, 2025) is the US stablecoin law under which only permitted payment stablecoin issuers may issue payment stablecoins, effective January 18, 2027. Issuers must be able to seize, freeze or burn coins under lawful orders.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

New York State Department of Financial Services (NYDFS)

Also called NYDFS, DFS, New York DFS

The New York State Department of Financial Services (NYDFS) is New York's financial regulator, which licenses virtual currency businesses under the BitLicense. Every entity it licenses or charters, including limited purpose trust companies, falls under its cybersecurity regulation, Part 500.

Learn more Regulatory & Compliance Assessment

NYDFS Part 500 (23 NYCRR 500)

Also called 23 NYCRR 500, Part 500, NYDFS cybersecurity regulation

NYDFS Part 500 (23 NYCRR 500) is New York's cybersecurity regulation for every entity NYDFS licenses or charters, including BitLicensees. As amended in November 2023, it requires annual pentests by a qualified party, MFA for all users and 72-hour incident notice.

Full article Crypto Regulatory Compliance: The Security Requirements

Office of the Comptroller of the Currency (OCC)

Also called OCC, Comptroller of the Currency

The Office of the Comptroller of the Currency (OCC) is the US regulator of national banks and, under the GENIUS Act, some stablecoin issuers. Its final rule, effective January 18, 2027, requires validating that smart contracts operate as intended and managing private keys.

Full article Crypto Regulatory Compliance: The Security Requirements

Proposed Rule 400 and Form TR

Also called SEC crypto safe harbor, Rule 400, Form TR, regulation crypto assets

Proposed Rule 400 is the SEC's August 2026 crypto safe harbor: an investment contract would be deemed ended once the issuer completes or permanently ceases its promised efforts and files Form TR. The evidence is largely technical, from deployed bytecode to upgrade authority.

Full article The SEC Crypto Safe Harbor Proposal: Rule 400 and Form TR

SEC crypto FAQ

Also called SEC staff FAQs on crypto assets, Corporation Finance crypto FAQ, FAQ 1.5, FAQ 2.3

The SEC crypto FAQ is the Division of Corporation Finance's staff guidance on crypto assets, issued September 25, 2026 and updated November 2, 2026, without legal force. FAQ 1.5 lists four unilateral powers, such as modifying code or limiting access, that mark a central party.

Full article The SEC Central Party Test: Which Admin Powers Count

Securities and Exchange Commission (SEC)

Also called SEC, US SEC

The Securities and Exchange Commission (SEC) is the US federal securities regulator. Its March 17, 2026 interpretive release sets out when a crypto asset is subject to an investment contract, using a central party concept that turns on who controls the protocol.

Treasury foreign payment stablecoin proposal

Also called 12 CFR 1523, treasury GENIUS act issuance rule, 1523.3, foreign stablecoin due diligence rule

Treasury's foreign payment stablecoin proposal (12 CFR 1523.3) is a draft rule on how US exchanges may offer foreign issuers' coins. They could rely on the issuer's representation of lawful-order compliance after reasonable due diligence; Question 52 asks whether that includes checking freeze functions.

Full article GENIUS Act Foreign Issuers: A Due Diligence Checklist

Canada and Latin America

Banco Central do Brasil (BCB)

Also called BCB, Central bank of Brazil, resolução BCB 520, Resolution BCB 520

The Banco Central do Brasil (BCB) is Brazil's central bank, which regulates virtual asset services under Resolution BCB 520. Banks and brokers may offer those services after a filing backed by an independent technical certification under IN BCB 701.

Canada Stablecoin Act

Also called Stablecoin Act Canada, canadian Stablecoin regulations, Bank of Canada Stablecoin

Canada's Stablecoin Act is the federal law, administered by the Bank of Canada, for fiat-backed stablecoins from non-financial issuers; it received royal assent in March 2026 but is not in force. Draft regulations require independent reviews of risk and data security policies every three years.

Full article Canada Stablecoin Act: Risk, Data Security and Incidents

IN BCB 701 (Banco Central do Brasil)

Also called instrução Normativa BCB 701, IN 701, BCB 701 technical certification

Instrução Normativa BCB 701 (January 2026) is the BCB rule on the independent technical certification that Brazilian banks and brokers need to offer virtual asset services without a separate VASP. The certifier must opine on each of at least 17 items, including smart contract testing.

Full article Instrução Normativa BCB 701: What the Certification Covers

Asia-Pacific

Australian Securities and Investments Commission (ASIC)

Also called ASIC, ASIC CP 392, CP 392

The Australian Securities and Investments Commission (ASIC) is Australia's corporate and financial services regulator, which will license digital asset platforms from April 8, 2027. Its draft standards (CP 392) require reconciling each token class every business day, but set no hot and cold wallet ratio.

Digital Assets Framework Act (Australia)

Also called Corporations Amendment (Digital Assets Framework) Act 2026, daf Act, Digital asset platform licence Australia

The Corporations Amendment (Digital Assets Framework) Act 2026 is Australia's law requiring operators of digital asset platforms and tokenised custody platforms to hold an Australian financial services licence; it commences April 8, 2027. Operators must meet ASIC's asset-holding standards, a civil penalty provision (section 912BB).

Full article ASIC CP 392: Asset-Holding Standards for Crypto Platforms

Hong Kong Monetary Authority (HKMA)

Also called HKMA, Stablecoins Ordinance, cap. 656, Hong Kong stablecoin licence

The Hong Kong Monetary Authority (HKMA) is Hong Kong's banking regulator, which licenses fiat-referenced stablecoin issuers under the Stablecoins Ordinance, in force since August 1, 2025. Its guideline bars any single party from performing high-risk token operations and requires yearly and per-upgrade contract audits.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

MAS Technology Risk Management Guidelines

Also called MAS TRM Guidelines, TRM Guidelines, Technology Risk Management Guidelines

The MAS Technology Risk Management Guidelines (January 2021) are Singapore's technology risk expectations for financial institutions, including digital token service providers, and MAS weighs observance in supervision. They call for yearly pentests of internet-facing systems and sensitive keys in an HSM.

Learn more Regulatory & Compliance Assessment

Monetary Authority of Singapore (MAS)

Also called MAS, Monetary Authority of Singapore

The Monetary Authority of Singapore (MAS) is Singapore's central bank and financial regulator, which licenses digital payment token service providers. Its Notice FSM-N13 requires notice within 1 hour of discovering a relevant incident, one of the fastest reporting clocks in crypto regulation.

Full article Crypto Regulatory Compliance: The Security Requirements

Payment Services Act (Singapore)

Also called Payment Services Act 2019, PSA, Singapore PSA

The Payment Services Act 2019 is Singapore's licensing law for payment services, including digital payment token services, under which firms hold a money-changing, standard payment institution or major payment institution licence. MAS consultation P015-2026 proposes amending it for stablecoins, including trace, freeze and/or burn capability.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

Securities and Futures Commission (SFC)

Also called SFC, Hong Kong SFC

The Securities and Futures Commission (SFC) is Hong Kong's securities regulator, which licenses virtual asset trading platforms and authorizes tokenized investment products for the public. Its circular 26EC35 requires licensed platforms to adopt phishing-resistant login by 8 July 2027.

Full article Crypto Regulatory Compliance: The Security Requirements

SFC tokenisation circular

Also called 26EC22, SFC circular on tokenisation of SFC-authorised investment products, 23ec53

The SFC tokenisation circular (26EC22, revised April 2026) is the SFC's rulebook for putting an SFC-authorised investment product on a blockchain for Hong Kong's public. Providers must show their smart contracts are free of flaws with high confidence, and get a third-party audit on request.

Full article SFC Circular on Tokenisation: Smart Contract Integrity

SFC virtual asset custody circular (25EC44)

Also called 25EC44, SFC custody circular, SFC cold wallet standards

The SFC virtual asset custody circular (25EC44) is the August 15, 2025 circular setting minimum custody standards for Hong Kong's licensed trading platforms. Cold wallets should not include public-chain smart contracts, signers must see transactions in human-readable form, and third-party wallet code needs independent review.

Full article SFC VA Custody Circular: Cold Wallet Standards

Middle East

ADGM draft DeFi guidance

Also called ADGM DeFi Risk Management Guidance, FSRA consultation paper no. 5 of 2026, ADGM DeFi Guidance

ADGM's draft DeFi Risk Management Guidance is the FSRA's October 6, 2026 consultation on how regulated firms should diligence and monitor DeFi protocols they use. It asks firms to map admin, upgrade and pause authority before onboarding, and to use threshold alerts beyond periodic review.

Full article DeFi Protocol Due Diligence Checklist for Regulated Firms

ADGM Financial Services Regulatory Authority (FSRA)

Also called FSRA, ADGM FSRA, Abu Dhabi Global Market regulator

The Financial Services Regulatory Authority (FSRA) is the regulator of the UAE's Abu Dhabi Global Market (ADGM) free zone, including its virtual asset firms. Its GEN 3.5 cyber rules, in force since 31 January 2026, require MFA for privileged access and 24-hour incident notice.

Learn more Regulatory & Compliance Assessment

Central Bank of the UAE (CBUAE)

Also called CBUAE, UAE Central Bank, Payment Token Services Regulation

The Central Bank of the UAE (CBUAE) is the UAE's central bank and onshore financial regulator, licensing payment token issuers and providers outside the free zones. Its Payment Token Services Regulation (2024) requires MFA, an independent technology audit function and immediate reporting of major incidents.

Federal Decree-Law No. 6 of 2025 (Article 62)

Also called new CBUAE law, UAE Central Bank law 2025, Article 62 CBUAE

Federal Decree-Law No. 6 of 2025 is the UAE's consolidated Central Bank law, in force from September 16, 2025. Article 62 extends licensing to anyone facilitating a licensed financial activity by any technology, including DeFi protocols, so who holds admin keys becomes a licensing question.

Full article Federal Decree-Law No. 6 of 2025: What It Means for DeFi

VARA Technology and Information Rulebook

Also called VARA Technology Rulebook, VARA cybersecurity rules, Technology and Information Rulebook

VARA's Technology and Information Rulebook is the binding cybersecurity rulebook for every VASP licensed in Dubai, applying in its current version since 19 June 2025. It covers smart contract audit, no single point of failure in key access, annual independent pentests and 72-hour incident reports.

Full article Crypto Regulatory Compliance: The Security Requirements

Virtual Assets Regulatory Authority (VARA)

Also called VARA, Dubai VARA

The Virtual Assets Regulatory Authority (VARA) is Dubai's virtual asset regulator, licensing VASPs across Dubai except the DIFC. Its Custody Services Rulebook bars rehypothecation and requires wallets holding only one client's assets, with seed phrases split into at least two parts.

Learn more Regulatory & Compliance Assessment

14 terms

Licences and regulated entities

Who needs authorization, and the token types the rules sort them into.

Asset-referenced token (ART)

Also called ART, asset-referenced token, asset referenced token

An asset-referenced token (ART) is a MiCA crypto-asset, other than an e-money token, that purports to keep a stable value by referencing another value or right, including one or more official currencies. Reserves must be segregated, held by a separate custodian and audited six-monthly.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

CASP authorization (MiCA)

Also called CASP authorisation, MiCA authorisation, MiCA license, MiCA licence

CASP authorization is the MiCA license a firm needs to provide crypto-asset services in the EU; banks and some other financial entities may notify instead. Applications must include ICT and security documentation and any third-party cybersecurity audit, ideally with smart contract source code review.

Full article DORA Source Code Review: Do Smart Contract Audits Count?

Crypto-asset service provider (CASP)

Also called CASP, crypto-asset service provider, crypto asset service provider

A crypto-asset service provider (CASP) is a firm whose business is providing crypto-asset services, such as custody, exchange, transfer or running a trading platform, to clients under MiCA authorization. CASPs also fall under DORA, so they must protect cryptographic keys and test critical systems yearly.

Crypto-asset white paper

Also called MiCA white paper, crypto asset white paper

A crypto-asset white paper is MiCA's mandatory disclosure document for a public offer or admission to trading, covering the issuer, the token's rights, the underlying technology and risks. For most crypto-assets and e-money tokens it is notified to the authority, not approved.

Digital payment token service provider (Singapore)

Also called DPT service provider, DPT, digital Payment token service provider, DPTSP

A digital payment token (DPT) service provider is a firm licensed under Singapore's Payment Services Act 2019 to provide DPT services such as crypto dealing or custody. MAS guidelines require keys for at least 90% of customer assets in cold wallets.

E-money token (EMT)

Also called EMT, electronic money token, e-money token

An e-money token (EMT) is a MiCA crypto-asset that purports to keep a stable value by referencing one official currency, such as a dollar or euro stablecoin. Issuers must be credit or e-money institutions, and must redeem at par at any time without a fee.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

Foreign payment stablecoin issuer

Also called foreign issuer GENIUS Act, section 2(12) GENIUS

A foreign payment stablecoin issuer is, under GENIUS Act section 2(12), an issuer organized or domiciled outside the US that is not a permitted issuer. From January 18, 2027, US exchanges may offer its coin only if it can and will comply with lawful orders.

Full article Is USDT GENIUS Act Compliant? What Treasury Asks Exchanges

Money services business (MSB)

Also called MSB, money transmitter, FinCEN MSB registration

A money services business (MSB) is a US Bank Secrecy Act category, including money transmitters, that must register with FinCEN within 180 days and keep an AML program. FinCEN's 2019 guidance says crypto exchangers and administrators generally qualify as money transmitters.

Learn more Regulatory & Compliance Assessment

No-action letter

Also called SEC no-action letter, no action letter, Canton Coin no-action letter

A no-action letter is an SEC staff statement that it would not recommend enforcement if a requester acts as described; it rests on the requester's facts and is not a Commission ruling. Staff's November 3, 2026 Canton Coin letter relied on Digital Asset's governance representations.

Full article Is Canton Coin a Security? The SEC No-Action Letter

Passporting under MiCA

Also called MiCA passport, cross-border provision of crypto-asset services, Article 65 MiCA

Passporting under MiCA is a CASP's right to serve other EU member states on its home authorization, after notifying its home authority (Article 65). Services may start once host states are informed, within 10 working days, or at the latest 15 calendar days after notice.

Learn more Regulatory & Compliance Assessment

Permitted payment stablecoin issuer (PPSI)

Also called PPSI, permitted issuer, federal qualified issuer, state qualified issuer

A permitted payment stablecoin issuer (PPSI) is an entity allowed to issue payment stablecoins under the US GENIUS Act: a bank subsidiary or a federal or state qualified issuer. It needs one-to-one reserves and the capability to seize, freeze or burn coins under lawful orders.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

Significant EMT or ART

Also called significant e-money token, significant asset-referenced token, significant stablecoin MiCA

A significant EMT or ART is an e-money or asset-referenced token the EBA classifies as significant for meeting at least three MiCA criteria, such as over 10 million holders or EUR 5 billion issued. The EBA then takes over much of the issuer's supervision.

Virtual asset service provider (VASP)

Also called VASP, virtual asset service provider

A virtual asset service provider (VASP) is the FATF's term for a business that, for others, exchanges, transfers or safeguards virtual assets, or provides financial services for a token offer. FATF says controllers of a DeFi protocol can be VASPs, though the software is not.

Virtual asset trading platform (VATP)

Also called VATP, virtual asset trading platform, SFC licensed exchange

A virtual asset trading platform (VATP) is a crypto exchange licensed by Hong Kong's SFC, holding client assets on trust through a wholly owned local custody subsidiary. The SFC requires 98% of client assets in cold storage and audits of smart contract tokens before admission.

Full article Crypto Regulatory Compliance: The Security Requirements

25 terms

ICT risk and operational resilience

DORA and its counterparts: ICT risk, third parties, incidents and testing.

Asset inventory

Also called IT asset inventory, ICT asset register, NYDFS 500.13

An asset inventory is a maintained list of a firm's information systems and assets, each with an owner and classification. NYDFS 500.13 also requires location, support expiry and recovery time objective; for an onchain business it should include every deployed contract on every chain.

Learn more Risk Monitoring & Rating

Business continuity plan (BCP)

Also called BCP, ICT business continuity plan, BCDR plan, business continuity and disaster recovery

A business continuity plan is a documented plan for keeping critical functions running through a disruption and restoring them afterward. DORA requires ICT continuity plans tested at least yearly, including cyber-attack scenarios; for digital asset firms, key recovery and lost signer quorums belong in them.

Learn more Regulatory & Compliance Assessment

Business impact analysis (BIA)

Also called BIA

A business impact analysis is an assessment of how severe disruptions would affect a firm's functions, weighing their criticality, dependencies and the time after which disruption becomes unacceptable. DORA Article 11(5) requires one, and ICT systems must be designed in line with it, including redundancy.

Learn more Regulatory & Compliance Assessment

Chief information security officer (CISO) requirement

Also called CISO, NYDFS 500.4, information security officer

A CISO requirement is a rule that a regulated firm name a qualified person to run its cybersecurity program. NYDFS 500.4 requires a CISO who reports in writing to the senior governing body at least annually; VARA requires one separate from the Compliance Officer.

Learn more Regulatory & Compliance Assessment

Critical ICT third-party service provider (CTPP)

Also called CTPP, critical ICT third-party provider, DORA oversight framework

A critical ICT third-party service provider is an ICT provider that the European Supervisory Authorities designate as critical for financial entities under DORA Article 31, placing it under direct oversight by a Lead Overseer. The first designations were published on 18 November 2025.

Learn more Regulatory & Compliance Assessment

Critical or important function

Also called CIF, critical or important functions, DORA Article 3(22)

A critical or important function, under DORA Article 3(22), is a function whose disruption would materially impair a firm's financial performance, the soundness or continuity of its services, or its regulatory compliance. Systems supporting one need appropriate tests at least yearly (Article 24(6)).

Full article DORA Penetration Testing Requirements: Articles 24 to 27

Dependency mapping

Also called resilience mapping, SYSC 15A mapping, end-to-end dependency mapping

Dependency mapping is the documented record of the people, processes, technology, facilities, information and third parties behind each important service. Under the FCA's draft GC26/7, a firm using DeFi should also map the contracts, oracles and bridges it relies on, and who can upgrade them.

Full article FCA DeFi Guidance GC26/7: A Mapping Checklist

Digital operational resilience testing

Also called DORA testing programme, DORA Article 24, resilience testing program

Digital operational resilience testing is the risk-based testing program DORA requires of every financial entity other than a microenterprise, run by independent testers. Systems supporting critical or important functions need appropriate tests at least yearly, such as scans, source code reviews or pentests.

Full article DORA Penetration Testing Requirements: Articles 24 to 27

Exit strategy (ICT third parties)

Also called exit plan, DORA exit strategy, stressed exit

An exit strategy is a documented, tested plan for leaving an ICT provider that supports a critical or important function without disrupting the business, compliance or client services. DORA Article 28(8) requires one, naming alternatives and a plan to move services and data.

Learn more Regulatory & Compliance Assessment

ICT concentration risk

Also called concentration risk, third-party concentration risk, single point of failure

ICT concentration risk, under DORA, is a firm's dependence on one critical ICT provider, or a few related ones, such that their failure could endanger its critical or important functions. Onchain, it arises when one RPC provider, oracle or bridge sits under several positions.

ICT risk

Also called information and communication technology risk, technology risk

ICT risk, under DORA, is any reasonably identifiable circumstance in the use of network and information systems that, if it materializes, could compromise their security or the services a firm provides. DORA makes the management body ultimately responsible for it (Article 5(2)).

ICT risk management framework (DORA)

Also called DORA Article 6, ICT RMF

The ICT risk management framework is the documented set of strategies, policies, procedures and tools a DORA financial entity uses to protect its information and ICT assets. It must be reviewed at least yearly (periodically for microenterprises) and after major ICT-related incidents (Article 6(5)).

Learn more Regulatory & Compliance Assessment

ICT third-party risk

Also called third-party ICT risk, DORA third-party risk management, ICT vendor risk

ICT third-party risk is the ICT risk a financial entity takes on through ICT services provided by outside providers or their subcontractors, including outsourcing. Under DORA Article 28, the entity remains fully responsible for its obligations, whatever it outsources.

Learn more Regulatory & Compliance Assessment

Impact tolerance

Also called impact tolerances, maximum tolerable disruption

An impact tolerance is the maximum tolerable disruption to an important business service, measured at least by time, beyond which further disruption could cause clients intolerable harm. Firms must stay within it through severe but plausible disruption, such as a chain halt (SYSC 15A.2.9R).

Important business service (UK)

Also called IBS, important business services, SYSC 15A important business service

An important business service is a service a UK firm provides to clients that, if disrupted, could cause them intolerable harm or put the UK financial system or markets at risk. Cryptoasset firms must identify theirs under SYSC 15A from October 25, 2027.

Full article UK Crypto Regulation October 2027: What Must Be Ready

Incident classification and reporting

Also called incident classification, incident reporting, reportable incident, materiality thresholds

Incident classification is rating an incident against a regulation's criteria to decide whether it must be reported. Under DORA, an incident affecting critical services is major if it involves malicious unauthorized access to systems or meets two other thresholds, such as over 10% of a service's clients.

Learn more Regulatory & Compliance Assessment

Major ICT-related incident

Also called major incident (DORA), DORA incident reporting, major ICT incident

A major ICT-related incident is an ICT incident with a high adverse impact on systems supporting a financial entity's critical or important functions (DORA Article 3(10)). Initial notice is due within 4 hours of classifying it as major, and no later than 24 hours after becoming aware.

Full article Crypto Regulatory Compliance: The Security Requirements

Multi-factor authentication (MFA) requirement

Also called MFA, 2FA, two-factor authentication, NYDFS 500.12

A multi-factor authentication requirement is a rule that users prove their identity with at least two different types of factor before reaching a system. NYDFS 500.12 has required it for every individual accessing any information system since November 1, 2025.

Operational resilience

Also called digital operational resilience, op res, operational resilience framework

Operational resilience is a firm's ability to keep its most important services running through severe but plausible disruption, and to recover within set limits. For digital asset firms, the dependencies to test include RPC providers, oracles, bridges, custodians and signers.

Learn more Regulatory & Compliance Assessment

Recovery time objective (RTO)

Also called RTO, recovery objective, service recovery time objective

A recovery time objective is the maximum time a system or service may stay down before it must be restored. MAS caps it at 4 hours for critical systems, and a timed restore or key recovery is the evidence it can be met.

Learn more Regulatory & Compliance Assessment

Register of information (DORA)

Also called DORA register of information, RoI, ICT third-party register

The register of information is the record a DORA financial entity keeps of every contractual arrangement for ICT services from third-party providers, flagging those supporting critical or important functions (Article 28(3)). Registers are filed yearly, and the ESAs used them to designate critical ICT providers.

Full article Crypto Regulatory Compliance: The Security Requirements

Scenario testing (severe but plausible)

Also called severe but plausible scenario, scenario-based test, resilience scenario test

Scenario testing is a test of whether a firm can stay within its impact tolerances or recovery objectives through a severe but plausible disruption. For digital asset firms, typical scenarios are key compromise, an unreachable signer quorum, oracle failure and a chain halt.

Full article FCA DeFi Guidance GC26/7: A Mapping Checklist

Source code review (DORA)

Also called DORA Article 25 source code review, code review, smart contract source code review

A source code review is a test that examines an application's code for weaknesses, listed in DORA Article 25 among the resilience tests a program can include. A smart contract audit can count if it is risk-based and independent, and every fix is validated.

Full article DORA Source Code Review: Do Smart Contract Audits Count?

Threat-led penetration testing (TLPT)

Also called TLPT, DORA TLPT, intelligence-led red teaming

Threat-led penetration testing (TLPT) is a controlled, intelligence-led red team test of a financial entity's critical live production systems (DORA Article 3(17)). Only entities their authority identifies must run it, at least every 3 years, and CASPs are not among the types authorities must select.

Full article DORA Penetration Testing Requirements: Articles 24 to 27

TIBER-EU

Also called Threat Intelligence-Based Ethical Red Teaming, TIBER, TIBER-EU framework

TIBER-EU is the European framework for threat intelligence-based ethical red teaming, developed by the ECB with the EU's national central banks and first published in May 2018. Its updated version is aligned with DORA's technical standards for threat-led penetration testing (Delegated Regulation 2025/1190).

Full article DORA Penetration Testing Requirements: Articles 24 to 27

19 terms

Custody and key management

How client assets and keys are held, approved and reconciled.

Address allowlist (whitelisting)

Also called address whitelist, whitelisting, whitelisted addresses, withdrawal allowlist

An address allowlist is a list of pre-approved destination addresses a wallet may send to, with transfers anywhere else blocked. Hong Kong's SFC requires whitelisted transfer addresses for client cold wallets and stringent controls on changing the list.

Full article SFC VA Custody Circular: Cold Wallet Standards

Cold wallet (cold storage)

Also called cold storage, offline wallet, air-gapped wallet

A cold wallet is a wallet whose private keys are generated and kept offline, on air-gapped devices or certified HSMs. Hong Kong's SFC custody circular (25EC44) says client cold wallets should not include public-chain smart contracts, which rules out contract-based multisigs.

Full article SFC VA Custody Circular: Cold Wallet Standards

Digital asset custodian

Also called crypto custodian, virtual asset custodian, custodian

A digital asset custodian is a firm that holds client assets by controlling their private keys, usually under a license or charter. Firms that appoint one stay responsible: ASIC's draft standards require prior due diligence, written monitoring and a review at least every 13 months.

Full article ASIC CP 392: Asset-Holding Standards for Crypto Platforms

Digital asset custody

Also called crypto custody, virtual asset custody, crypto-asset custody

Digital asset custody is holding digital assets on behalf of clients, which in practice means controlling the private keys that can move them. Supervisors test it through key generation, signing controls, segregation, reconciliation and recovery, not physical safekeeping.

Hot wallet

Also called online wallet, hot storage, withdrawal wallet

A hot wallet is a wallet whose private keys sit on internet-connected systems so it can sign quickly, usually for client withdrawals. ASIC's RG 133 treats keeping key material on internet-connected systems no more than strictly necessary as good practice.

Key backup and recovery

Also called key recovery, key backup, seed backup, key disaster recovery

Key backup and recovery is keeping protected copies of private keys or key shares and restoring signing ability when a key, device or signer is lost. The OCC's GENIUS rule requires private key management, backup and recovery, and a dated, performed recovery test proves it.

Full article Federal Reserve GENIUS Act Proposal: IT Security Standards

Key ceremony

Also called key generation ceremony, key signing ceremony, custody key ceremony

A key ceremony is a scripted, witnessed procedure for generating, splitting and storing the keys or key shares that control assets, with every step recorded. Under Hong Kong's custody circular, ceremony records are the evidence that keys were generated on air-gapped devices.

Key generation

Also called private key generation, seed generation, key creation

Key generation is the creation of a private key or seed from a cryptographically secure random source. A predictable generator makes every key it produced brute-forceable, and Hong Kong's SFC expects client cold wallet keys generated on air-gapped devices.

Full article Crypto Wallet Penetration Testing: What to Test

Key rotation

Also called signer rotation, key replacement, signer change

Key rotation is replacing a key or signer with a new one, on a schedule or after a compromise or a signer's departure, and revoking the old one. For a multisig, it is complete only when chain state shows the old key has no role.

Omnibus wallet

Also called pooled wallet, omnibus account, commingled wallet

An omnibus wallet is a single wallet holding many clients' digital assets, with the firm's internal ledger recording each client's share. ASIC's draft standards allow pooling with a written policy, reconciliation each business day per token class and shortfalls corrected within two business days.

Full article ASIC CP 392: Asset-Holding Standards for Crypto Platforms

Proof of reserves

Also called PoR, proof-of-reserves attestation, proof of reserves audit

Proof of reserves is an attestation that an exchange or custodian holds assets covering its customer balances, usually by showing control of onchain addresses. An asset-side check can be accurate and still miss a shortfall, so strong methods also state liabilities, encumbrance, timing and scope.

Full article CFTC Request for Comment on Crypto: The Technical Questions

Qualified custodian

Also called qualified custodian Rule, SEC custody Rule, Rule 206(4)-2

A qualified custodian is a firm eligible to hold advisory client assets under the SEC's custody rule (Rule 206(4)-2): a bank or savings association, registered broker-dealer, futures commission merchant or eligible foreign institution. Canada's draft Stablecoin Regulations require reserves at a Canadian qualified custodian.

Reconciliation

Also called asset reconciliation, onchain reconciliation, wallet reconciliation

Reconciliation is the regular comparison of a firm's records of client holdings with the assets actually held onchain or at custodians, so any shortfall is found and corrected. Hong Kong's SFC expects real-time reconciliation; ASIC's draft standards require it each business day, per token class.

Full article SFC VA Custody Circular: Cold Wallet Standards

Safeguarding of client assets

Also called safeguarding, client asset safeguarding, client asset protection, CASS 17

Safeguarding is the set of legal and operational arrangements that keep client assets protected and recoverable if the firm holding them fails. For digital assets, rules such as the UK's CASS 17 cover ownership rights, record-keeping, reconciliation and private key management.

Segregated wallet

Also called segregated account, per-client wallet, dedicated client wallet

A segregated wallet is a wallet that holds only client assets, often for a single client, kept apart from the firm's own wallets. Brazil's Resolution BCB 520 requires client wallets separate from the custodian's, with house keys unable to affect them.

Segregation of client assets

Also called asset segregation, client asset segregation, segregation of client funds

Segregation of client assets is keeping client assets legally and operationally separate from a firm's own, so they can be identified and returned if the firm fails. Onchain it means separate client wallets or ledger records, and house keys that cannot move client funds.

Full article Instrução Normativa BCB 701: What the Certification Covers

Signing quorum (threshold)

Also called signing threshold, m-of-n threshold, approval quorum, quorum signing

A signing quorum is the minimum number of independent approvers or key shares, such as 3 of 5, needed to authorize a transaction. It is the usual control against a single point of failure, but supervisors also ask how independent the signers are.

Sub-custodian

Also called subcustodian, sub-custody, delegated custodian

A sub-custodian is a custodian appointed by another custodian or platform to hold client assets on its behalf. Responsibility does not pass down the chain: under ASIC's draft CP 392 standards, the operator stays responsible for compliance through every custodian and sub-custodian.

Transaction policy engine

Also called policy engine, transaction authorization policy, signing policy

A transaction policy engine is the rules layer in a custody or signing system that checks each transaction against preset limits, such as allowed destinations, amounts and approvers, before signing. ASIC's draft standards expect controls to prevent and detect unauthorized or erroneous transfers.

21 terms

Tokenization and settlement

Tokenized funds, deposits and securities, and how they settle.

Atomic settlement

Also called atomic swap settlement, atomic DvP, instant atomic settlement

Atomic settlement is settlement in which all legs of a transaction, such as asset and cash, complete together or not at all. Token platforms can settle atomically at trade time, but the ledger update and legal finality may not coincide.

Burn and re-issuance

Also called burn and reissue, burn and re-issue, token reissuance

Burn and re-issuance is a mechanism in which an issuer destroys tokens at a compromised address and issues replacements to a new one. An attacker who reaches the burner and minter roles can do the same, so those roles need multiple approvals.

Full article SFC Circular on Tokenisation: Smart Contract Integrity

Canton Network

Also called Canton, Canton blockchain, Canton protocol

Canton Network is a public layer 1 blockchain built for privacy-preserving transactions, in which validators store only the contracts their parties may see and synchronizers order encrypted messages between them. Most remaining risk sits with each institution's validator, Daml applications and node keys.

Full article Canton Network Security for Banks and Asset Managers

Central bank digital currency (CBDC)

Also called CBDC, retail CBDC, rCBDC, digital central bank money

A central bank digital currency (CBDC) is central bank money in digital form, denominated in the national unit of account and a direct liability of the central bank. A retail CBDC is for the public; a wholesale CBDC is for settlement between financial institutions.

Learn more Institutional Digital Asset Cybersecurity

Cross-chain bridge

Also called blockchain bridge, token bridge, bridged token, crypto bridge

A cross-chain bridge is a system that moves tokens or messages between blockchains, locking or burning on one chain and minting or releasing on another once verifiers attest. If one verifier suffices, its operator can forge messages that mint unbacked tokens or release collateral.

Daml

Also called Daml smart contracts, Daml templates

Daml is Canton's smart contract language, in which each contract template declares its signatories and observers and each choice its controller, and the protocol enforces those authorizations. It does not make business logic correct, so caller-supplied parties and contract IDs still need checks.

Full article Canton Network Security for Banks and Asset Managers

Delivery versus payment (DvP)

Also called DvP, DVP settlement, delivery-versus-payment

Delivery versus payment (DvP) is a settlement mechanism that ties delivery of a security to payment, so the security moves if and only if the payment does. It removes principal risk, but onchain only if the escrow locking one leg has no other release path.

Forced transfer (clawback)

Also called clawback, force transfer, forcedTransfer, admin transfer

A forced transfer is a privileged token function, such as ERC-3643's forcedTransfer, that moves tokens out of an address without its owner's signature. Listing reviews treat it as a limit on ownership rights, and SEC staff FAQ 1.5 counts reversing transactions as central party authority.

Permissioned blockchain

Also called private blockchain, permissioned ledger, restricted DLT, permissioned DLT

A permissioned blockchain is a ledger on which only approved participants may join, run nodes or validate transactions, unlike a public permissionless chain anyone can use. Trust shifts to the operators: if one entity runs all validation, it can delay or block any transaction.

Permissioned token (transfer restrictions)

Also called permissioned token, transfer-restricted token, allowlisted token, whitelisted token

A permissioned token is a token whose contract only lets approved addresses, usually KYC-verified, hold or receive it. It is only as strong as its code: every transfer path, including transferFrom, batch transfers, permits and bridged copies, must enforce the allowlist.

Full article SFC Circular on Tokenisation: Smart Contract Integrity

Real-world assets (RWA)

Also called RWA, RWAs, tokenized real-world assets, RWA tokenization

Real-world assets (RWA) is the industry term for traditional financial or physical assets, such as government bonds, fund units or gold, represented by tokens on a blockchain. Each token depends on offchain custody of the asset and on who controls minting and burning.

Security token (tokenized security)

Also called tokenized security, tokenised securities, digital security, ERC-3643

A security token is a token that represents a security, such as a share, bond or fund unit, so securities law governs its issuance and transfer. Hong Kong's SFC names transfer restrictions, mint-and-burn, transaction reversals and redemption procedures as key controls on public chains.

Settlement finality

Also called final settlement, finality, legal finality

Settlement finality is the legally defined moment when a transfer becomes irrevocable and unconditional, and cannot be unwound if a participant becomes insolvent. On a blockchain, consensus finality is technical, so the arrangement should state whether settlement is final onchain or offchain.

Smart contract integrity (SFC)

Also called smart contract integrity, high level of confidence (SFC), SFC tokenisation audit requirement

Smart contract integrity is the SFC tokenisation circular's requirement that a provider confirm, and show on request, that its smart contracts are free of vulnerabilities and security flaws with a high level of confidence. The SFC sets no method but can request a third-party audit.

Full article SFC Circular on Tokenisation: Smart Contract Integrity

Super Validator (Canton)

Also called Canton Super Validator, SV Node, Super Validator Node Operator

A Super Validator is a participant that helps run Canton Network's Global Synchronizer. Digital Asset told the SEC that, at September 30, 2026, about 60 acted through 13 node operators, each with one vote, and protocol changes needed at least two-thirds of them.

Full article Is Canton Coin a Security? The SEC No-Action Letter

Synchronizer (Canton)

Also called Global Synchronizer, Canton Synchronizer, Canton sequencer, Canton mediator

A synchronizer is the Canton component that routes encrypted messages between validators: its sequencer orders them and its mediator declares transactions committed or rejected. Operators cannot read or forge content but could delay it, and a single-operator synchronizer puts all ordering trust in one entity.

Full article Canton Network Security for Banks and Asset Managers

Tokenization

Also called tokenisation, asset tokenization, tokenized assets

Tokenization is recording a traditional asset, such as a fund unit, bond or bank deposit, as a digital token on a programmable ledger. The token contract decides who can hold, transfer, mint and burn it, so its admin keys are part of the asset's risk.

Tokenized deposit

Also called tokenised deposit, deposit token, tokenized bank deposit

A tokenized deposit is a commercial bank deposit recorded as a token on a programmable ledger, so it stays a claim on the issuing bank, not a bearer token. Under the GENIUS Act, a deposit recorded using distributed ledger technology is not a payment stablecoin.

Learn more Institutional Digital Asset Cybersecurity

Tokenized fund (tokenized money market fund)

Also called tokenised fund, tokenized money market fund, tokenized MMF, tokenised investment product

A tokenized fund is an investment fund whose units are issued as tokens on a blockchain, with its ownership register kept in step with onchain balances. Under the SFC's circular, the provider stays responsible for the arrangement and its ownership records despite outsourcing.

Transfer agent

Also called registrar and transfer agent, share registrar, digital transfer agent

A transfer agent is a firm that keeps an issuer's record of security holders and records each change of ownership. When a security or fund is tokenized, onchain balances need to reconcile to that record, including burns and reissues.

Wholesale CBDC

Also called wCBDC, wholesale central bank digital currency, tokenized central bank money, tokenised central bank money

A wholesale CBDC is a central bank digital currency for use only by financial institutions, distinct from reserve and settlement account balances. BIS Innovation Hub projects such as Helvetia and Jura used it to settle tokenized assets in central bank money, domestically and across borders.

Learn more Institutional Digital Asset Cybersecurity

15 terms

Stablecoins

Reserves, redemption and the freeze, seize and burn controls regulators require.

Decentralized verifier network (DVN)

Also called DVN, LayerZero DVN, verifier network

A decentralized verifier network (DVN) is a LayerZero verifier that checks a cross-chain message before the destination chain acts on it, such as minting tokens. A pathway relying on one DVN lets a single operator forge messages, so LayerZero recommends at least two independent DVNs.

Full article Multichain Stablecoin Deployment Verification Checklist

Depeg

Also called de-peg, stablecoin depeg, loss of peg, peg loss

A depeg is a material move in a stablecoin's market price away from the value it references, such as a dollar coin trading well below $1. Stablecoins trade on secondary markets, so the price can deviate from par even when redemption at par is promised.

Fiat-backed stablecoin

Also called fiat-collateralized stablecoin, fiat-referenced token, reserve-backed stablecoin

A fiat-backed stablecoin is a stablecoin backed by cash and near-cash reserves, such as bank deposits and short-dated government bills, in the currency it tracks. Its integrity depends on minting only against confirmed reserve inflows and reconciling supply on every chain to reserves daily.

Freeze function

Also called token freeze, freeze role, freezer role, stablecoin freeze

A freeze function is a privileged token function that stops a specific address from sending, and often receiving, a token. GENIUS Act issuers need capabilities to block, freeze and reject impermissible transactions, and a freeze works only if it covers every transfer path.

Full article Stablecoin Freeze Requirements: MAS, HKMA and the GENIUS Act

Minter role (mint authority)

Also called mint authority, minter, master minter, MINTER_ROLE, supply controller

A minter role is the privileged permission in a token contract to create new tokens, often within an allowance set by a master minter role. Unauthorized minting creates unbacked coins, so the role needs quorum control, allowance and velocity limits, and monitoring of every mint.

Full article Federal Reserve GENIUS Act Proposal: IT Security Standards

Monthly reserve report (attestation)

Also called reserve attestation, reserve report, monthly reserve attestation, reserve examination

A reserve report is a stablecoin issuer's periodic disclosure of its outstanding tokens and the reserves backing them. The GENIUS Act requires a monthly report published online, examined each month by a registered public accounting firm and certified by the CEO and CFO.

Multichain stablecoin deployment

Also called multichain stablecoin, omnichain stablecoin, cross-chain stablecoin, multi-chain deployment

A multichain stablecoin deployment is a stablecoin issued on several blockchains, natively or through an omnichain standard that burns or locks on one chain and mints on another. Each has its own addresses, roles and wiring, so each must be verified as a separate release.

Full article Multichain Stablecoin Deployment Verification Checklist

Non-MiCA-compliant stablecoin

Also called non-MiCA compliant stablecoin, unauthorised stablecoin, non-compliant EMT, non-compliant ART

A non-MiCA-compliant stablecoin is an e-money or asset-referenced token whose MiCA conditions for a lawful EU offer or admission to trading are not met. ESMA's October 8, 2026 opinion says CASPs should provide no services for such tokens, custody included, by January 8, 2027.

Full article ESMA's Opinion on Non-MiCA Compliant Stablecoins

Omnichain fungible token (OFT)

Also called OFT, LayerZero OFT, OFT adapter, omnichain token

An omnichain fungible token (OFT) is LayerZero's standard for one token across many chains: the source burns or locks tokens and the destination mints or unlocks them once the message is verified. Peers must be reciprocal, shared decimals identical and only one lockbox adapter used.

Full article Multichain Stablecoin Deployment Verification Checklist

Payment stablecoin (GENIUS Act)

Also called payment stablecoin, GENIUS Act stablecoin, permitted payment stablecoin

A payment stablecoin is the GENIUS Act's term for a digital asset used for payment or settlement that its issuer must redeem at a fixed value. From January 18, 2027, only permitted issuers may issue one, and its contract needs freeze, seize and burn capability.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

Redemption at par

Also called par redemption, redeem at par, stablecoin redemption

Redemption at par is a stablecoin holder's right to redeem tokens with the issuer at face value. Timing differs: at any time for MiCA e-money tokens, one business day in Hong Kong, next business day in the UK, three business days in Canada's draft.

Reserve assets

Also called stablecoin reserves, backing assets, reserve backing

Reserve assets are the cash and high-quality liquid assets a stablecoin issuer holds to back every token in circulation at least one to one. The GENIUS Act limits them to cash, deposits, Treasuries of 93 days or less and similar assets, held by supervised custodians.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

Seize and burn

Also called seize, freeze and burn, burn frozen funds, destroyBlackFunds, wipeFrozenAddress

Seize and burn is a stablecoin issuer's ability to destroy tokens at a frozen address and, if an order requires, reissue them to a new one, such as a government-controlled wallet. The GENIUS Act requires the capability to comply with such lawful orders.

Full article GENIUS Act Foreign Issuers: A Due Diligence Checklist

Stablecoin

Also called stable coin, stablecoins, fiat stablecoin

A stablecoin is a crypto-asset designed to keep a stable value against a reference asset, usually one fiat currency, most often by holding reserves. Regulations broadly agree on reserves and redemption, and differ on mint and upgrade keys, freeze powers and contract audits.

Full article Stablecoin Regulation in 2026: Six Regulations Compared

Stablecoin blacklist

Also called stablecoin blocklist, USDC blacklist, USDT blacklist, blacklister role

A stablecoin blacklist is the onchain list of addresses an issuer has blocked from transacting in its token, maintained by a blacklister or asset protection role. What it blocks varies: a blacklisted USDC address cannot send or receive, while Ethereum USDT checks only the sender.

Full article GENIUS Act Foreign Issuers: A Due Diligence Checklist

13 terms

Admin keys and decentralization

Who can upgrade, pause or move funds, and how regulators read those powers.

Admin key

Also called admin keys, administrative key, privileged key, owner key

An admin key is a private key, or the multisig or contract behind it, that controls privileged smart contract functions such as upgrading code, pausing, freezing or minting. Regulators ask who holds each, behind what threshold and timelock, read from chain state, not documentation.

Full article Who Controls DeFi? Admin Keys Behind 25 Top Protocols

Broad-based governance

Also called broad based governance, broad-based governance system, FAQ 1.4 footnote 2

Broad-based governance, in SEC staff FAQ 1.4, is a governance system that is transparent, rules-based and wide and diverse, with no concentration of control, including through delegation. Discretion exercised solely through it is one of FAQ 1.5's two exits from central party status.

Full article The SEC Central Party Test: Which Admin Powers Count

Central party (SEC FAQ 1.5)

Also called central party test, SEC central party, no central party

A central party, in the SEC's crypto guidance, is a person, entity or group with operational, economic or voting control of a crypto system. Staff FAQ 1.5 gives four examples of unilateral authority: over access, voting processes, who validates, and modifying code or reversing transactions.

Full article The SEC Central Party Test: Which Admin Powers Count

Control facts (FCA PERG 18)

Also called PERG 18 control facts, FCA decentralisation test, control features

Control facts are the evidence the FCA's draft PERG 18 guidance weighs to judge whether any person determines, influences, operates, maintains, updates or controls a crypto arrangement. They fall into three groups (governance, operational and technical, and economic), and no single fact decides the outcome.

Full article FCA Crypto Perimeter Guidance: Draft PERG 18 Control Facts

Control inventory

Also called privileged role map, role map, admin powers inventory, control map

A control inventory is a dated record of every privileged role, read from chain state and corporate records: each holder, threshold, timelock and bypass, and the people and entities behind each key. The same inventory serves the SEC, FCA and FATF tests.

Full article FATF DeFi Report 2026: 12 Control Indicators Mapped to Code

Decentralization test

Also called decentralisation test, DeFi decentralization test, sufficient decentralization

A decentralization test is a regulator's analysis of whether a person or group still controls a crypto protocol, and so whether rules apply to them. The SEC, FCA, EU, FATF and IOSCO tests differ in wording but turn on the same contract facts.

Full article Decentralization Tests Compared: SEC, FCA, MiCA, FATF, IOSCO

Essential managerial efforts

Also called efforts of others, managerial efforts, Howey efforts of others

Essential managerial efforts are, under the Howey test, the efforts of others from which buyers of an investment contract expect profit. SEC staff FAQ 2.3 says that once a crypto system is functional, services to secure, maintain, improve or enhance it would not count.

Full article Essential Managerial Efforts: Security Work After Launch

Foundation keys

Also called foundation admin keys, foundation multisig, foundation roles

Foundation keys are the admin roles a crypto foundation can use without a governance vote, such as parameter setters, oracle admins, fee switches and proxy admins. Under SEC staff FAQ 1.4's footnote 4, such control over another system could make the foundation a central party.

Full article When a Crypto Foundation Is a Central Party

Functional crypto system

Also called functional network, functionality (SEC), functional system

A functional crypto system, in the SEC's March 17, 2026 interpretive release, is one whose native asset can be used in accordance with the system's programmatic utility. After functionality, SEC staff FAQ 2.3 says security and maintenance work would not be essential managerial efforts.

Full article Essential Managerial Efforts: Security Work After Launch

Onchain governance

Also called on-chain governance, token governance, DAO governance, governor and timelock

Onchain governance is a process in which token holders vote on protocol changes through smart contracts, usually a governor and a timelock that executes passed proposals. A team key that can upgrade the governor, cancel proposals or skip the timelock can route around the vote.

Privileged role

Also called privileged function, admin role, role admin, privileged access

A privileged role is a smart contract permission that lets its holder call functions ordinary users cannot, such as minter, pauser, blacklister, upgrader or role admin. Role admins are meta-powers: they can grant any other role, including to themselves, so they need the strongest controls.

Full article The SEC Central Party Test: Which Admin Powers Count

Role-based access control (RBAC)

Also called RBAC, AccessControl, OpenZeppelin AccessControl, role-based permissions

Role-based access control (RBAC) is a contract design in which each privileged function is gated by a named role, such as MINTER_ROLE or PAUSER_ROLE, granted to addresses by a role admin. Holders must be rebuilt from RoleGranted and RoleRevoked events and confirmed with hasRole.

Upgrade authority

Also called upgrade key, upgradeability control, proxy admin authority

Upgrade authority is the power to replace a deployed smart contract's code, usually held through a proxy admin, owner or governance timelock. Whoever holds it can in principle change what the contract does with deposits, so reviews record its holder, threshold, delay and any bypass.

Full article Who Controls DeFi? Admin Keys Behind 25 Top Protocols

20 terms

Standards, controls and evidence

The frameworks, reports and evidence that prove a control works.

Attestation

Also called attestation report, assurance report, reserve attestation

An attestation is a statement, by an independent practitioner or an accountable officer, that a fact or control holds, such as a CPA firm's report on stablecoin reserves. A reserve attestation that checks assets but not liabilities can be accurate and still miss a shortfall.

Compensating control

Also called compensating controls, alternative control

A compensating control is an alternative safeguard that meets the intent of a required control the firm cannot implement as written. NYDFS 500.12 lets a CISO approve them in writing in place of MFA, if reasonably equivalent or more secure and reviewed at least annually.

Control framework

Also called security control framework, controls framework, control set

A control framework is a structured set of control objectives used to design, test and report on a security program, such as NIST CSF 2.0, ISO/IEC 27001 Annex A or CCSS. Mapping each control to several frameworks lets one test answer several rulebooks.

Learn more Regulatory & Compliance Assessment

CryptoCurrency Security Standard (CCSS)

Also called CCSS, C4 CCSS, CCSS Certification

The CryptoCurrency Security Standard (CCSS) is the CryptoCurrency Certification Consortium's set of security requirements for information systems that store, manage or interact with cryptocurrencies, from key generation to compromise response. Systems, not whole companies, are certified, at Level I, II or III.

Learn more Regulatory & Compliance Assessment

Cybersecurity maturity assessment

Also called maturity assessment, security maturity score, CSF profile

A cybersecurity maturity assessment is a score of how developed a security program is against a framework such as NIST CSF 2.0, expressed as a current and a target profile. The score should rest on evidence, such as identity provider exports and test results.

Learn more Regulatory & Compliance Assessment

Evidence pack

Also called compliance evidence pack, regulatory evidence pack, audit evidence

An evidence pack is a set of dated, versioned artifacts proving that controls work, each mapped to the provisions it answers. Typical items are pentest reports with retests, audits tied to a commit, onchain role maps, key recovery records and incident timelines.

Learn more Regulatory & Compliance Assessment

Gap assessment

Also called gap analysis, compliance gap analysis, gap register

A gap assessment is a provision-by-provision comparison of what a regulation or standard requires with what a firm has: the control, the evidence that proves it, and the gap where neither exists. DORA Article 25 lists gap analyses among its resilience tests.

Learn more Regulatory & Compliance Assessment

Independent security audit

Also called independent audit, third-party security audit, independent cybersecurity assessment

An independent security audit is a review of a firm's systems, controls or smart contracts by a qualified party with no role in building or running them, kept as regulatory evidence. Hong Kong's SFC requires one before a licensed platform admits a smart contract token.

Independent technical certification (IN BCB 701)

Also called technical certification, certificação técnica, BCB technical certification

A technical certification, under Brazil's IN BCB 701, is an independent qualified firm's conclusive opinion on an institution's adequacy to offer virtual asset services. It must address at least 17 items separately, and a filing without it has no effect.

Full article Instrução Normativa BCB 701: What the Certification Covers

ISO/IEC 27001

Also called ISO 27001, ISO/IEC 27001:2022, ISMS certification

ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which accredited bodies certify organizations. Its 2022 edition has 93 Annex A controls in four themes, and the transition from the 2013 edition closed on 31 October 2025.

Learn more Regulatory & Compliance Assessment

NIST Cybersecurity Framework (CSF) 2.0

Also called NIST CSF, CSF 2.0, NIST Cybersecurity Framework

The NIST Cybersecurity Framework 2.0 is a framework for managing cybersecurity risk, released on February 26, 2024, with six functions: Govern, Identify, Protect, Detect, Respond and Recover. When the FFIEC retired its Cybersecurity Assessment Tool in 2025, it named CSF 2.0 among the alternatives.

Learn more Regulatory & Compliance Assessment

Regulatory readiness assessment

Also called readiness assessment, authorization readiness, licensing readiness assessment

A regulatory readiness assessment is a review of which regulations and licenses reach a firm's activities, and how its technology, security, custody and resilience controls measure up to them. Gaps are ordered by what would block authorization and what an examiner will test first.

Learn more Regulatory & Compliance Assessment

Residual risk

Also called accepted risk, risk acceptance

Residual risk is the risk that remains after controls are applied. ADGM's draft DeFi guidance expects it documented and accepted by someone with authority to accept it, and a credible evidence pack states it openly with an owner.

Risk register

Also called risk log, enterprise risk register, cyber risk register

A risk register is the record of a firm's identified risks, each with an owner, a rating, the controls that address it and the residual risk accepted. Onchain exposures, such as an admin key with no timelock, belong in it beside IT risks.

Learn more Regulatory & Compliance Assessment

SOC 2

Also called SOC 2 report, System and Organization Controls 2, Trust Services Criteria

SOC 2 is a report from a licensed CPA firm on a service organization's controls for security, availability, processing integrity, confidentiality or privacy, assessed against the AICPA's Trust Services Criteria. A Type II report also tests whether the controls operated effectively.

Learn more Regulatory & Compliance Assessment

SOC 2 Type II

Also called SOC 2 Type 2, Type II report, SOC 2 Type 2 report

A SOC 2 Type II report covers both the design of a service organization's controls and whether they operated effectively over a review period, listing each test and its result. A Type I report covers design only, at a single date, and neither is a code review.

Learn more Regulatory & Compliance Assessment

Third-party due diligence

Also called vendor due diligence, vendor risk assessment, supplier due diligence

Third-party due diligence is the assessment of a vendor or service provider's capability, security and risk before contracting and at intervals afterward. For third-party wallet software, Hong Kong's SFC requires independent review of the vendor's code before onboarding and before material changes.

Three lines of defense

Also called three lines of defence, three lines model, 3LoD

The three lines of defense is a governance model separating risk ownership (the business), oversight (risk and compliance) and independent assurance (internal audit). DORA Article 6(4) requires ICT risk, control and internal audit functions to be kept separate under it or a comparable model.

Learn more Regulatory & Compliance Assessment

Trust center

Also called trust centre, security trust center, trust portal

A trust center is a page where a company shows partners, banks and auditors its security evidence: what was reviewed, which controls exist and who owns them, and what remains open. Kept current, it can answer much of a vendor security questionnaire with one link.

Learn more Fintechs

Vendor security questionnaire

Also called security questionnaire, due diligence questionnaire, DDQ

A vendor security questionnaire is a standard list of security questions a customer, bank or exchange sends a provider during due diligence, covering access, encryption, testing and incident response. DORA Article 25 also lists questionnaires among its basic resilience tests.

Learn more Regulatory & Compliance Assessment

15 terms

Digital asset risk management

How risk teams diligence, score and monitor onchain exposure.

Bridge risk

Also called cross-chain bridge risk, bridge exposure, wrapped asset risk

Bridge risk is the risk of loss when a cross-chain bridge fails or is compromised, for example through a single verifier, leaving wrapped assets unbacked or unredeemable. Mapping a bridge means recording its verification model and threshold, who can change them, and the redemption path.

Full article FCA DeFi Guidance GC26/7: A Mapping Checklist

Control change monitoring

Also called admin change monitoring, governance monitoring, signer change alerts

Control change monitoring is alerting on changes to who controls a contract, such as role grants, ownership transfers, multisig signer or threshold changes and shortened timelocks. An emergency role that skips the timelock gives no warning, so any use of one is a top-priority alert.

Full article DeFi Protocol Monitoring Under ADGM's Draft Guidance

Counterparty risk

Also called counterparty credit risk, onchain counterparty risk

Counterparty risk is the risk that the other party to a position or arrangement fails to perform, through default, insolvency or loss of the assets it holds. Onchain, the effective counterparty can be a custodian, bridge, stablecoin issuer or whoever holds a protocol's admin keys.

Learn more Institutional Digital Asset Cybersecurity

Depeg risk

Also called stablecoin depeg risk, peg risk

Depeg risk is the risk that a stablecoin, or a wrapped or bridged asset, trades or redeems away from the value it is meant to track. Signs to monitor include price deviation across venues, redemption failures, issuer freezes and large outflows.

Full article DeFi Protocol Monitoring Under ADGM's Draft Guidance

Dependency risk (oracles, bridges, keepers)

Also called inherited risk, third-party protocol risk, composability risk

Dependency risk is the exposure a position inherits from what a protocol relies on but does not control, such as oracles, bridges, keepers, sequencers and upstream protocols. ADGM's draft guidance asks for a current record of each one and whether it could be substituted.

Full article DeFi Protocol Due Diligence Checklist for Regulated Firms

Deployment verification

Also called stablecoin deployment verification, bytecode verification, post-deployment verification

Deployment verification is the check that the code, configuration, privileged addresses and transactions on each chain match what was audited and intended. It catches what a source audit cannot see, such as wrong constructor values, mismatched bridge peers or a deployer key left in control.

Full article Multichain Stablecoin Deployment Verification Checklist

Digital asset security

Also called crypto security, blockchain security, digital asset cybersecurity

Digital asset security is the protection of the keys, smart contracts, infrastructure and people that control digital assets. In an analysis of DefiLlama data, 72% to 74% of reported hack losses in 2024 and 2025 came from offchain compromises of keys, signers and systems.

Liquidity risk

Also called exit liquidity risk, market liquidity risk

Liquidity risk, for an onchain position, is the risk that a firm cannot exit at its size, or near the expected price, when it needs to. ADGM's draft guidance warns that exit routes may fail under stress, so position sizing and limits come first.

Onchain risk monitoring

Also called DeFi protocol monitoring, continuous protocol monitoring, position monitoring

Onchain risk monitoring is the continuous watch over protocols a firm relies on for events that change its exposure, such as upgrades, role grants, signer and timelock changes, oracle swaps and depegs. ADGM's draft DeFi guidance says it should not rely solely on periodic review.

Full article DeFi Protocol Monitoring Under ADGM's Draft Guidance

Onchain risk underwriting

Also called DeFi underwriting, onchain underwriting, position underwriting

Onchain risk underwriting is the assessment of a DeFi position before capital is committed: the deployed code, who controls it, its dependencies, its economic failure paths and the operator's record. It expires when the protocol upgrades or changes signers, so it is paired with monitoring.

Learn more Capital Allocators

Oracle risk

Also called price feed risk, oracle dependency risk

Oracle risk is the risk that a price or data feed a protocol relies on is inaccurate, delayed or manipulated, causing wrong liquidations, mispriced positions or exploits. Controls to check include staleness limits, deviation thresholds, fallback behavior and who can change the feed address.

Full article DeFi Protocol Monitoring Under ADGM's Draft Guidance

Protocol due diligence

Also called DeFi due diligence, DeFi protocol due diligence, protocol diligence

Protocol due diligence is a regulated firm's review of a DeFi protocol before using it: deployed code and audits, admin and upgrade authority, safety mechanisms, dependencies and liquidity. ADGM's draft guidance expects re-approval after material changes, such as a protocol upgrade or custody change.

Full article DeFi Protocol Due Diligence Checklist for Regulated Firms

Protocol risk rating

Also called DeFi risk rating, protocol risk score, risk score

A protocol risk rating is a score summarizing a protocol's security and economic risk, from inputs such as deployed code, admin control, dependencies and operator record, so positions can be ranked. A defensible rating opens into its inputs and moves when the protocol changes.

Learn more Capital Allocators

Security rating

Also called security score, cyber risk rating, security posture rating

A security rating is a score of an organization's security posture, derived from externally observable findings, that counterparties use in due diligence. For an onchain business it should cover both the external attack surface and deployed contract configuration, and open into the findings behind it.

Learn more Risk Monitoring & Rating

Smart contract risk

Also called contract risk, code risk, smart contract exposure

Smart contract risk is the risk of loss from a flaw in a contract's code or economic design, or in how it is deployed and controlled. An audit gives point-in-time assurance over one commit, so deployed bytecode, live roles and upgrades need their own checks.

8 terms

Financial crime and AML

The Travel Rule, sanctions screening and the analytics behind them.

Anti-money laundering (AML)

Also called AML, AML/CFT, anti-money laundering, countering the financing of terrorism

Anti-money laundering (AML) is the set of laws, programs and controls that stop criminal proceeds entering or moving through the financial system, usually paired with counter-terrorist financing (CFT). For stablecoins it reaches the contract: GENIUS Act issuers must be able to block and freeze transactions.

Blockchain analytics

Also called chain analysis, onchain analytics, crypto transaction monitoring, DLT analytic tools

Blockchain analytics is software and data that cluster addresses, attribute them to known entities and trace fund flows, for transaction monitoring, sanctions screening and investigations. Because AML controls depend on it, a gap in the vendor's coverage is a gap in the firm's own controls.

Know your customer (KYC)

Also called KYC, customer due diligence, CDD, identity verification

Know your customer (KYC) is the process of verifying who a customer is and assessing their risk, part of the customer due diligence AML rules require. The HKMA says each stablecoin holder's identity should be verified unless an issuer proves its other measures work.

Lawful order (freeze, seize or burn)

Also called lawful order GENIUS Act, seize freeze burn order, section 2(16) GENIUS

A lawful order, under GENIUS Act section 2(16), is a final and valid federal-law order from a court or authorized agency that can require a stablecoin issuer to seize, freeze, burn or prevent the transfer of coins. Seizures can require burning and reissuing coins.

Full article Stablecoin Freeze Requirements: MAS, HKMA and the GENIUS Act

OFAC and the SDN list

Also called OFAC, Office of Foreign Assets Control, SDN list, Specially Designated Nationals

The Office of Foreign Assets Control (OFAC) is the US Treasury office that administers sanctions and publishes the Specially Designated Nationals (SDN) list, which can include digital currency addresses. OFAC says these listings are not likely to be exhaustive, so matching addresses is not enough.

Sanctions screening

Also called wallet screening, address screening, sanctions compliance

Sanctions screening is checking customers, counterparties, transactions and wallet addresses against government sanctions lists, such as OFAC's SDN list, before funds move. ADGM's draft DeFi guidance lists counterparty and sanctions exposure among the areas firms should monitor in the protocols they use.

Self-hosted (unhosted) wallet

Also called unhosted wallet, self-custody wallet, non-custodial wallet, self-hosted address

A self-hosted (unhosted) wallet is one whose user holds the keys and transacts without a third party such as a CASP. For transfers over EUR 1,000 to or from one, EU CASPs must assess whether their client owns or controls it.

Learn more Regulatory & Compliance Assessment

Travel Rule

Also called crypto Travel Rule, FATF recommendation 16, FATF Travel Rule, wire transfer Rule

The Travel Rule is the FATF requirement, extended to virtual assets in 2019, that providers pass originator and beneficiary information to the receiving provider. FATF lets countries ask for less below USD/EUR 1,000; the EU applies the full rule to every crypto transfer.

Learn more Regulatory & Compliance Assessment