Regulators examine the system, not the policy.

Technical documentation of ICT systems and security arrangements, and where available a third-party cybersecurity audit including penetration tests and a source code review of smart contracts.

Resilient ICT systems under DORA, a business continuity policy with recovery time and point objectives, plans for disruption of a permissionless ledger, and tests at least annually.

Systems that safeguard the availability, authenticity, integrity and confidentiality of data, evaluated regularly.

Clients' ownership rights protected, including on insolvency, and client funds placed with a credit institution or central bank by the end of the next business day.

A custody policy that minimises loss of crypto-assets or the means of access through fraud, cyber threats or negligence, and a described approval and safeguarding system for keys.

Client crypto-assets held separately on the ledger and operationally segregated, with the custodian liable for losses from an incident attributable to it.

Full responsibility retained for outsourced functions, with contingency plans, exit strategies and supervisory access in written agreements.

Trading systems that are resilient, sized for peak volumes, fully tested and covered by business continuity arrangements.

ICT continuity and risk controls under DORA for asset-referenced token issuers, and reserve assets held with a separate custodian within 5 working days.

Ultimate responsibility for ICT risk sits with the management body, which approves the resilience strategy and trains regularly.

A documented framework reviewed at least yearly, covering asset management, encryption, network security, logging, access control, patching and the full lifecycle of cryptographic keys.

Least-privilege access, strong authentication, protection of cryptographic keys, change management and patching.

Continuity and recovery plans tested at least yearly with cyber-attack and switchover scenarios, and backups restored periodically.

Initial notice within 4 hours of classification and 24 hours of awareness, an intermediate report within 72 hours, and a final report within one month.

Classification thresholds such as 10% of clients affected, over 2 hours of critical service downtime, or successful malicious access.

Every system supporting a critical or important function tested at least yearly by independent testers, through scans, source code reviews and penetration tests.

Firms identified by their authority run TLPT on live production systems at least every 3 years.

A register of every ICT contract reported yearly, exit strategies for critical services, and mandatory contract terms on security, testing, audit and access.

Management bodies approve and oversee cybersecurity measures, can be held liable, and must be trained.

Policies on risk analysis and information system security, and on assessing whether the controls work.

Incident handling, backup management, disaster recovery and crisis management.

Security of supplier relationships, weighing each supplier's vulnerabilities and development practices.

Security in acquisition, development and maintenance, including vulnerability handling and disclosure.

Cryptography and encryption, access control and asset management, and multi-factor authentication.

An early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.

Measures matched to the risk, including encryption and the ongoing confidentiality, integrity, availability and resilience of systems.

The ability to restore access to personal data in a timely manner after an incident.

A process for regularly testing, assessing and evaluating whether the security measures work.

Breaches notified to the supervisory authority within 72 hours where feasible, and every breach documented.

Data subjects told without undue delay when a breach is likely to create a high risk.

Only processors giving sufficient guarantees, with Art. 32 security measures required by contract.

The means of access protected through generation, storage, sharding and destruction against inoperability, loss, fraud and irrecoverability, with key incidents promptly resolved.

A record of where each key is, how it is secured and who can use it, kept for 5 years.

Client cryptoassets held on trust, and internal records reconciled with on-chain holdings at least once each business day.

Any shortfall made good no later than 24 hours after it is identified.

Sub-custodians appointed only after due diligence, under a written agreement, in jurisdictions that regulate resilience and key security.

The full UK resilience regime applied to cryptoasset firms, with scenarios such as hot wallet compromise and oracle manipulation.

The FCA told before a firm relies on critical providers such as MPC or HSM custody and transaction signing infrastructure.

Backing assets reconciled daily, held on statutory trust, with no more than 20% at intragroup custodians.

Platform systems that are resilient, sized for peak volumes, fully tested and covered by continuity arrangements.

Important business services identified and reviewed at least once a year.

An impact tolerance set for each important business service.

The ability to stay within each tolerance through a severe but plausible disruption.

The people, processes, technology, facilities and information behind each service documented and reviewed yearly.

A testing plan against scenarios of varying severity, with lessons from tests and real disruptions acted on.

A written self-assessment, approved by the governing body and kept for at least 6 years.

An operational and security risk framework with an annual assessment to the FCA, and major incidents reported without undue delay.

Important business services identified, with tolerances set where disruption would threaten safety, soundness or stability.

Remain within tolerance in a severe but plausible disruption, including risks from the wider group.

The resources each important business service depends on mapped.

Tests against a range of adverse scenarios.

A self-assessment approved by the management body.

Infrastructure stays within tolerance in an extreme but plausible disruption.

Materiality assessed for every outsourcing, and the PRA notified before a material one is entered or changed.

Controls for data in transit, in memory and at rest, including encryption, key management and access management.

Full access and audit rights for the firm, its auditors and the regulators in outsourcing contracts.

Continuity plans and documented, tested exit plans, including stressed exits.

Incidents that cross a harm threshold reported within 24 hours of the threshold being met.

A final report within 30 working days of resolution.

Major operational or security incidents reported within 4 hours of first detection.

A register of material third-party arrangements submitted every year.

In steady state, 70% short-term UK government debt and 30% unremunerated Bank of England deposits.

Backing assets held on statutory trust for holders.

Redemption within 24 hours of a full request.

Operational resilience and outsourcing supervised jointly by the Bank and the FCA.

Encryption, resilience, timely restoration and regular testing of controls.

Breaches notified within 72 hours where feasible, and every breach documented.

Data subjects told of high-risk breaches without undue delay.

Processors give sufficient guarantees, with security and audit terms in the contract.

Identifiable reserves of at least 1:1 in listed assets, with no pledging or rehypothecation outside narrow exceptions.

Monthly published reserve composition, examined by a registered public accounting firm and certified by the CEO and CFO.

Principles-based operational, compliance and information technology risk management standards, tailored to each issuer.

The technological capability to seize, freeze, burn or prevent the transfer of payment stablecoins when lawfully ordered.

Technical capabilities, policies and procedures to block, freeze and reject impermissible transactions.

Reserves, collateral and issuing private keys held only by regulated custodians, segregated as customer property.

A board-approved program covering asset inventory, validation that smart contracts and key systems operate as intended, independent testing, incident response, and private key management, backup and recovery.

Redemption within two business days, 24-hour notice when redemptions exceed 10% of supply in a day, and a full-scope OCC exam every 12 months.

A risk-based cybersecurity program and written policies approved annually, with independent audits for Class A companies.

A CISO who reports in writing to the senior governing body at least annually.

Penetration testing from inside and outside by a qualified party at least annually, automated scans, and risk-prioritised remediation.

Least privilege, annual access reviews and prompt deprovisioning; privileged access management and blocked common passwords for Class A.

A written risk assessment updated at least annually and on material change.

Written policies for assessing providers, minimum security practices and contract terms covering MFA, encryption and incident notice.

MFA for any individual accessing any information system, and an asset inventory with owner, classification and recovery time objective.

Training and monitoring, encryption at rest and in transit, and incident response and BCDR plans tested annually, including restores from protected backups.

Cybersecurity incidents reported within 72 hours, extortion payments within 24 hours, and an annual compliance certification by 15 April.

Virtual currency of the same type and amount owed to customers, never sold, lent or encumbered except at their direction.

A program across identify, protect, detect, respond and recover, with a board-approved policy that covers changes to core protocols the licensee does not control.

A qualified CISO and an annual CISO report to NYDFS.

Penetration testing at least annually, vulnerability assessment at least quarterly, and tamper-protected audit trails that reconstruct every transaction.

A BCDR plan with off-site backups, tested at least annually by independent staff or a qualified third party.

Assets segregated on-chain and in ledgers, prior approval for any new sub-custodian, and reconciliation of books to chain demonstrable at any time.

Full reserves measured daily, redemption within T+2, monthly CPA examination and an annual controls attestation.

A cybersecurity risk assessment of each coin and its underlying blockchain before listing.

One qualified individual responsible for the information security program.

Written criteria for assessing risks to confidentiality, integrity and availability, repeated periodically.

Least-privilege access, and MFA for any individual accessing any information system.

Encryption in transit and at rest, secure development practices, and logging of authorised users' activity.

Without continuous monitoring, annual penetration tests and vulnerability assessments every six months.

Capable providers, safeguards required by contract, and periodic reassessment.

A written incident response plan, and an annual written report to the board.

The FTC notified within 30 days of discovering an event affecting 500 or more consumers.

Procedures to detect, respond to and recover from unauthorised access to customer information.

Affected individuals notified as soon as practicable and within 30 days of becoming aware.

Oversight of providers, who must report a breach to the firm within 72 hours.

A material cybersecurity incident disclosed within 4 business days of determining it is material.

Processes for assessing and managing material cyber risk, including outside assessors and third-party oversight, described annually.

Board oversight and management's role and expertise described annually.

A comprehensive written program approved and overseen by the board.

Key controls tested regularly by independent third parties or independent staff.

Due diligence, contract terms and monitoring, including review of providers' audits and test results.

The primary regulator notified no later than 36 hours after determining a notification incident occurred.

Bank service providers notify the bank when an incident disrupts covered services for four hours or more.

A full lifecycle from due diligence to termination, with audit rights, business continuity and subcontractor terms.

Control such that no one else can move the asset alone, secure key generation, plans for lost or compromised keys, and smart contracts governed through their lifecycle.

Custody and sub-custody permitted with sound risk management and third-party oversight of sub-custodians' controls.

Written information security and operational security, business continuity and disaster recovery programs, created before applying.

Administrative, physical and technical safeguards for customer information and every digital financial asset.

A responsible individual with the authority to enforce each program; DFPI evaluates programs against NIST CSF 2.0.

Enough of each asset under control to cover every customer entitlement, held in statutory trust and outside the licensee's estate.

A certified risk assessment of each asset before listing, covering cybersecurity, theft and code or protocol defects.

Material data security breaches and cybersecurity events described in the annual report.

A framework and process to identify critical systems.

Unscheduled downtime of each critical system no more than 4 hours in any 12 months.

An RTO of no more than 4 hours for each critical system, with recovery tested and documented at least every 12 months.

MAS notified as soon as possible, and no later than 1 hour after discovering a relevant incident.

A root cause and impact analysis report within 14 days of discovery.

IT controls that protect customer information from unauthorised access or disclosure.

Every administrative account on operating systems, databases, applications, security appliances and network devices secured against unauthorised access.

Patches applied within a timeframe matched to the risk, with compensating controls where no patch exists.

Written security standards for every system, and systems that conform to them.

Perimeter controls that restrict all unauthorised network traffic.

Malware protection on every system where it can be implemented.

MFA for all administrative accounts on critical systems and for every account that reaches customer information over the internet.

The board ensures a technology risk framework and function, approves technology risk appetite, and ensures independent audit.

Technology risk at a third party assessed before contracting and monitored for confidentiality, integrity and resilience.

Static, dynamic and interactive testing, with major defects fixed before production.

An RTO and RPO for each system, and disaster recovery tested against them regularly.

Never alone, segregation of duties and least privilege, with privileged accounts granted on need and their activity logged and reviewed.

A key management policy from generation to expiry, with sensitive keys held in hardened, tamper-resistant systems such as an HSM.

Blackbox and greybox testing of online services, and internet-facing systems tested at least yearly or after major change.

Red team exercises that validate cyber defence and response.

Critical business services and functions identified by impact on safety and soundness, customers and other institutions.

An SRTO for each critical business service, with dependency RTOs that can meet it.

People, processes, technology and third parties mapped for each critical service, and third parties shown to meet the SRTO.

Concentration of people, technology or providers in one site or one provider addressed.

Regular testing against severe but plausible scenarios, with results documented and gaps reported to senior management.

An independent audit of the BCM framework and each critical service at least once every three years.

MAS notified within 1 hour of a severe disruption, and an annual attestation on BCM preparedness to the board.

Customer assets placed in a designated trust account, separate from the licensee's own, no later than the next business day.

A separate book entry for each customer's assets.

Adequate systems and controls, and all reasonable measures to keep keys secure and intact.

Segregation of duties, so safeguarding is never directed by people who trade or make investment decisions.

Assets held in trust computed against the amount required every business day, with results kept for 5 years.

No single person can authorise the movement of customer assets.

Keys for at least 90% of customer assets held in cold wallets at all times.

Where MPC is used, key shares held by different parties so no single party can move assets.

A licence is required to carry on the business, with criminal penalties for operating without one.

The same availability, 4 hour RTO, 1 hour notification and 14 day root cause rules as other licensees.

The six cyber hygiene measures, including MFA.

The TRM, Business Continuity, Outsourcing and Fit and Proper guidelines all apply to licensed DTSPs.

Client assets held on trust only through a wholly owned Hong Kong custody subsidiary that conducts no other business.

98% of client virtual assets held in cold storage unless the SFC permits otherwise.

Keys generated offline in a certified HSM where practicable, no single person with access to full seeds or keys, distributed backups, and keys stored in Hong Kong.

Whitelisted client addresses with proof of ownership, velocity limits, and destination addresses that cannot be modified before signing.

Cover for 50% of client assets in cold storage and 100% of those in hot and other storage, checked daily.

Two-factor client login, yearly access review, layered firewalls, patches within a month, EDR, real-time IDS and SIEM, and a SOC.

Before launch, on modification and periodically, including penetration testing and source code review of custody systems.

A written contingency plan with cyber scenarios and a backup facility, both tested at least yearly.

An independent smart contract audit before a token is admitted for trading.

A licensee meets the Schedule 2 minimum criteria at all times, not only at licensing.

The Monetary Authority told as soon as practicable of any material change affecting the criteria or the business.

A segregated reserve pool per stablecoin, at or above par, with independent attestation, audit and public disclosure.

Valid redemption requests honoured at par as soon as practicable, without unduly burdensome conditions.

Data security and integrity, fraud detection, robust and proven contingency arrangements, and operational and security safeguards.

Plans to restore critical functions after significant operational disruption, and for an orderly wind-down.

Mint, burn, upgrade, pause and freeze mapped to authorisation levels, multi-signature so no single party performs high-risk operations, and velocity limits, timelocks and simulation before broadcast.

Token contracts audited by a qualified third party at least annually and on every deployment or upgrade.

Certified HSMs, significant keys generated offline and air-gapped, multi-signature keys stored apart, and full lifecycle logs.

Penetration testing and source code review of major projects, plus vulnerability scanning and intelligence-led attack simulation.

Critical technology outsourced only after an independent assessment of the provider, shared with the HKMA.

Incident triggers including smart contract exploits and loss of key access, and a BCP with RTO and RPO tested at least annually.

Daily statements, weekly reporting, independent attestation, and immediate reporting of unresolved reconciliation gaps.

Incident response with timely reporting to the HKMA, baseline security, timely patching and tamper-protected logs.

An independent assessment of a critical provider's IT controls, annual review, and contingency and exit plans.

The board approves critical operations and a time-based tolerance for disruption to each, reviewed annually.

People, processes, technology, information, facilities and third parties mapped for each critical operation.

Regular tests against severe but plausible scenarios, with formal reports reviewed by senior management.

Inherent risk and maturity assessed under C-RAF, with intelligence-led testing (iCAST) for medium and high risk banks.

A technology governance and risk assessment framework with defence-in-depth controls, reviewed and tested periodically.

Submitted to VARA at licensing and reviewed by the CISO at least annually, covering smart contract validation and audit (I.B.3.f) and incident response.

A Chief Information Security Officer responsible for the rulebook, separate from the Compliance Officer.

No single point of failure, separately located backups, an audit log of every change of access to keys, and a quarterly internal audit of access removal.

Vulnerability assessments and penetration tests by a qualified independent party at least annually and before any new system, including smart contract audits where relevant.

Where VARA requires it, run by an accredited external tester carrying professional indemnity insurance.

A BCDR plan tested and updated annually, with an alternative site and DLT-specific risks such as key storage.

Material cybersecurity events reported to VARA within 72 hours of detection.

No rehypothecation even with consent, and each client's assets held in wallets that hold only that client's assets.

Custody run by a separate legal entity from other group virtual asset businesses, with a dedicated custody team.

Wallet types chosen by documented risk analysis, with transfer mechanisms between them under internal controls and independent audit.

Industry-best key generation, backups encrypted as strongly as the primary and stored apart, and seed phrases split into at least two parts.

Risk-tiered multi-signature with documented and audited procedures, and collusion risk mitigated.

Policies for key recovery, client communication, law enforcement cooperation and wind-down.

A register of each client's positions, monthly statements, and a full transaction audit trail kept for at least 8 years.

Dealing, settlement and safekeeping kept apart, and review functions separate from operations.

Each outsourcing assessed before it starts and at least annually, and each provider reviewed at least annually.

A register of every outsourcing arrangement, flagging material outsourcing and personal data.

Information security obligations, tested contingency plans, audit rights, insurance and data location written into outsourcing contracts.

VARA told in advance of any new or materially changed material outsourcing.

Commercial crime or similar insurance covering virtual assets held in hot wallets.

A wind-down plan covering system redundancy and record retention.

A written framework approved by the governing body, which sets cyber risk tolerance, reviewed at least annually.

An ICT asset inventory, with cyber risk assessed at least annually.

Least-privilege access, and multi-factor authentication for internet-accessible and privileged access.

A testing programme that tests internet-facing systems at least annually, such as penetration tests, red team exercises and bug bounties.

A cyber incident response plan tested regularly and reviewed at least annually.

Material cyber incidents reported to the FSRA immediately, and within 24 hours at the latest.

The firm stays responsible for outsourced functions and informs the FSRA of material outsourcing.

Continuity and disaster recovery arrangements kept current and tested regularly.

Documented wallet setup, backup and recovery, and key generation, storage, backup, destruction and access.

A security plan covering data, networks, cloud and facilities, and a risk plan that covers technology and hacking risk.

Client virtual assets reconciled at least weekly, with monthly statements to retail clients.

Any third-party custodian assessed against the custody and technology rules before it is used.

Core systems verified by a third party at least annually; trading facilities and custodians also commission an annual infrastructure review.

Layered security with no single point of failure, and key cryptographic functions performed only in modules meeting the highest recognised standards.

Smart contracts behind an accepted virtual asset should have had an independent, non-conflicted security review.

A framework that meets at least the UAE Information Assurance Standards.

Governance that includes an independent technology audit function.

A regular, risk-based assessment of the need for penetration and cyber-attack simulation testing.

Multi-factor authentication required.

Major security incidents reported to the CBUAE immediately.

Daily reconciliation of reserve assets and a monthly external audit.

The board is ultimately responsible for information security, with defined roles for management and individuals.

Capability matched to the threats, kept current, and assessed for any third party managing the entity's information assets.

All information assets, including those managed by third parties, classified by criticality and sensitivity.

Timely controls matched to the threat and the asset, and the design of third parties' controls evaluated.

Detection and response for plausible incidents, escalation to the board, and response plans reviewed and tested annually.

A systematic, risk-based testing program run by skilled and functionally independent testers, reviewed at least annually.

Internal audit reviews the design and operating effectiveness of controls, including third parties'.

Material information security incidents notified to APRA within 72 hours of becoming aware.

A material control weakness that cannot be fixed in time notified within 10 business days.

The board approves the business continuity plan, tolerance levels and service provider policy.

Sound IT capability, monitoring of the age and health of information assets, and compliance with CPS 234.

The people, technology, information, facilities and service providers behind each critical operation, and how they depend on each other.

Operational risk incidents with material impact notified to APRA within 72 hours.

For each critical operation, the maximum period of disruption, maximum data loss and minimum service levels.

A disruption to a critical operation outside tolerance notified within 24 hours.

An annual business continuity exercise under severe but plausible scenarios, including the failure of a material service provider.

A register of material service providers submitted annually, with due diligence and agreements that grant APRA access.

Platform operators must meet ASIC's asset-holding and transactional and settlement standards; a civil penalty provision.

Standards on safeguarding underlying assets, records, reconciliation and reporting; pooled wallets allowed if records identify each client's tokens.

Specialist custody infrastructure, on-chain segregation, keys in cold storage with hot storage minimised, and independently verified controls.

Keys protected online and offline, multi-signature or sharding over a single key, and no single party controlling the whole instruction process.

An independent controls audit of any custody provider obtained and considered.

Proposed: protection against loss or unauthorised transfer, and a quarterly wallet and address report to ASIC.

Four tiers, Partial, Risk Informed, Repeatable and Adaptive, describing how rigorous the risk management behind the program is.

Leadership accountable for cybersecurity risk, and the mission understood and used to drive it.

Risks from suppliers and other third parties understood, recorded, prioritised, assessed, responded to and monitored.

Inventories of hardware, software and services, and a process for receiving and responding to vulnerability disclosures.

Users, services and hardware authenticated, and access governed by least privilege.

Secure development practices across the lifecycle, and backups created, protected and tested.

Networks and services monitored for potentially adverse events.

Incident response executed with third parties, and recovery executed from the incident response process.

37 organisational, 8 people, 14 physical and 34 technological controls, each assessed for design and operation.

An inventory of information and associated assets, with owners.

Security across supplier relationships, agreements, the ICT supply chain, monitoring and cloud services.

Incident planning, response and learning, and ICT readiness for business continuity.

Restricted privileged access rights and secure authentication.

Information about vulnerabilities obtained, exposure evaluated, and measures taken.

Rules for cryptography, including key management.

A secure development lifecycle, security testing in development and acceptance, and change management.

Ongoing and separate evaluations that confirm controls are present and functioning.

Logical access security over protected assets, and credentials issued only to registered, authorised users.

Logical access measures against threats from outside the system boundary.

Detection of configuration changes and new vulnerabilities, and monitoring for anomalies that indicate malicious acts.

A defined program to understand, contain, remediate and communicate security incidents.

Changes authorised, designed, tested, approved and implemented.

Risks from vendors and business partners assessed and managed.

Backup and recovery infrastructure, and recovery plan procedures that are tested.

Key material generated confidentially from unpredictable randomness, by the actor who will use it.

Keys and backups stored to resist loss, theft and single points of compromise.

Who can reach key material, and the controls on every signing operation.

Keys and seed material destroyed from retired devices and media, including steel backups.

Independent security testing and audit of the system.

Logging and monitoring of key management activity.

Keyholder grant and revoke, policies, and risk management around the system.

A documented, rehearsed response to suspected key compromise.

Inventory and control of enterprise and software assets.

Account management and access control management, including MFA.

Vulnerabilities continuously assessed and remediated.

Audit log management and network monitoring and defence.

Recovery practices that restore assets to a trusted state.

Service provider management and application software security.

An incident response program and penetration testing.

Scripts on payment pages authorised and inventoried, and unauthorised changes to those pages detected.

Multi-factor authentication for all access into the cardholder data environment.

Internal and external vulnerability scans at least once every three months.

Internal and external penetration testing at least once every 12 months and after significant change.

Providers that could affect cardholder data managed, monitored and contracted for security.

An incident response plan ready to activate immediately, and tested.

Prioritised activities, their dependencies, and the time frames within which disruption becomes unacceptable.

Risks of disruption to prioritised activities identified and assessed.

Continuity strategies and documented plans and procedures for responding to disruption.

Plans exercised and tested against their objectives, with results reported.

The board approves the resilience approach and the tolerance for disruption to critical operations.

Continuity plans exercised under severe but plausible scenarios, and the dependencies behind each critical operation mapped.

Due diligence, equivalent resilience at the third party, and exit strategies.

Incident management across the full lifecycle, and regularly tested ICT and cyber protection, detection, response and recovery.

ICT and cyber risk identified and mitigated, monitored with regular tests, and privileged users managed.

Business impact analysis, recovery time and point objectives, and periodic testing with key providers.

A robust operational risk framework, reviewed, audited and tested periodically and after significant change.

Physical and information security policies covering all potential vulnerabilities and threats.

Critical IT systems able to resume within two hours, with settlement completed by end of day.

Risks from key participants, other infrastructures and service providers managed.

Governance, identification, protection, detection, and response and recovery, supported by testing, situational awareness and learning.