SEC 암호자산 보관 규칙 제안 핵심 정리

“the Commission is proposing new custody rules under the Investment Company Act and amendments to the Advisers Act custody rule to provide a tailored framework for crypto asset custody.”

“The Investment Company Act custody rules require that a regulated fund maintains fund securities and similar investments with certain specified custodians (``Investment Company Act custodians'') and subject to conditions designed to assure the safety of the regulated fund's assets.”

“Among other things, the Advisers Act custody rule requires that an adviser that has custody of client funds or securities maintain such funds or securities with a qualified custodian (collectively with Investment Company Act custodians, ``permitted custodians''), subject to specified exceptions.”

“Under this proposal, an adviser that has self-custody of client crypto assets would be required to comply with the proposed adviser self-custody rule with respect to those crypto assets.”

“The proposed adviser self-custody rule would require an adviser that has self-custody of client crypto assets to adopt, implement, and maintain safeguarding systems that maintain each client's crypto assets in one or more crypto asset addresses on the crypto network storing only such client's crypto assets.”

“Additionally, advisers would be required to mitigate cybersecurity risks, including by implementing (1) periodic but no less than annual written assessments of cybersecurity risks to crypto assets in the adviser's self-custody and cybersecurity risks associated with the adviser's safeguarding systems; (2) measures reasonably designed to detect, mitigate, and remediate any cybersecurity threats and vulnerabilities with respect to the adviser's safeguarding systems; and (3) measures reasonably designed to detect, respond to, and recover from a cybersecurity incident relating to the adviser's safeguarding systems.”

“advisers would consequently need to conduct the first risk assessment before the adviser takes self-custody of a crypto asset, which would help ensure that those risks are mitigated before a cybersecurity incident happens”

“The proposed rule would require advisers with self-custody of clients' crypto assets to obtain a written internal control report prepared by an independent public accountant within six months of having self-custody and no less than once each calendar year thereafter.”

“The report must include an opinion of the independent public accountant as to whether controls were suitably designed and implemented and operating effectively throughout the period to achieve control objectives relating to custodial services, including the safeguarding of crypto assets held by the adviser on behalf of its clients.”

“In addition, the proposed rule would also require that the independent public accountant verify that the crypto assets are reconciled to the crypto network.”

“prior to engaging a State trust company as a custodian for crypto assets, and on an annual basis thereafter, the adviser or regulated fund must determine in writing that it has a reasonable basis, after due inquiry, for believing that the State trust company: (1) is authorized by the relevant State banking authority to provide custody services for crypto assets and related cash and/or cash equivalents and (2) maintains and implements written policies and procedures reasonably designed to safeguard crypto assets and related cash and/or cash equivalents from the risk of theft, loss, misuse, and misappropriation”

“These policies and procedures would be required, at a minimum, to address private key management and cybersecurity”

“Receive and review the state trust company's most recent annual financial statements and confirm that such financial statements are prepared in accordance with U.S. GAAP and are subject to an audit (as defined in rule 1-02(d) of Regulation S-X (17 CFR 210.1-02(d))) that is performed by an independent public accountant”

“Receive and review the state trust company's most recent written internal control report prepared by an independent public accountant during the current or prior calendar year and confirm that such internal control report contains an opinion of such independent public accountant as to whether controls were suitably designed and implemented and operating effectively throughout the period to achieve control objectives relating to custodial services, including the safeguarding of client crypto assets and related cash and/or cash equivalents.”

“These account statements (or transmissions) would be required to identify the crypto address that stores the client's crypto assets and the crypto network on which such crypto address operates, to identify the amount of crypto assets in the account at the end of the period and set forth all transactions in crypto assets in the account during the period, and to include a statement urging the client to compare the account statements from the adviser with the crypto asset balances and transaction information indicated under the client's crypto asset address.”

“We also propose to add new questions requiring advisers to report whether an independent public accountant prepares an internal control report with respect to custodial services in connection with the adviser having self-custody of client crypto assets and to report identifying information about any accountant(s) engaged to perform an internal control report.”

“We propose to add a new Item 5.K.(5)(a), which would require the adviser to indicate whether it has self-custody of crypto assets on behalf of SMA clients, and a new Item 5.K.(5)(b) that would require the adviser to provide the approximate amount of such self-custodied crypto assets in U.S. dollars, the number of SMA clients for which the adviser self-custodies crypto assets, and the number of crypto asset addresses that store client crypto assets in the adviser's self-custody.”

“Similarly, we propose to add a new question 25(h)(1) in Section 7.B. of Schedule D that would require the adviser to indicate whether it self-custodies crypto assets for a private fund, and a new question 25(h)(2) that would require the adviser to provide the approximate amount of such self-custodied crypto assets in U.S. dollars for the private fund and the total number of crypto asset addresses that store the crypto assets of which the adviser has self-custody for the private fund.”

“If the proposed self-custody rules are adopted, the adviser or regulated fund would need to disclose whether it holds crypto assets in self-custody as well as the associated material risks and conflicts of interest, including disclosure of what measures are in place if the assets are lost, stolen, or misappropriated or in the event of bankruptcy.”

“When a regulated fund or an adviser invests (on behalf of a client) in crypto assets, these disclosures would be required to appropriately address the associated material risks. This generally would include a description of their crypto asset investment strategies and the risks associated with investing in crypto assets as well as custodial risks related to crypto asset investments.”

“Finally, if the proposed State trust company rules are adopted, the adviser or regulated fund would need to disclose whether it uses a State trust company as custodian for crypto assets and the associated risks that may arise from this arrangement.”

“In addition, the proposed rule would also require that the independent public accountant verify that the crypto assets are reconciled to the crypto network.”

“Similarly, we propose to add a new question 25(h)(1) in Section 7.B. of Schedule D that would require the adviser to indicate whether it self-custodies crypto assets for a private fund, and a new question 25(h)(2) that would require the adviser to provide the approximate amount of such self-custodied crypto assets in U.S. dollars for the private fund and the total number of crypto asset addresses that store the crypto assets of which the adviser has self-custody for the private fund.”

“We propose to add a new Item 5.K.(5)(a), which would require the adviser to indicate whether it has self-custody of crypto assets on behalf of SMA clients, and a new Item 5.K.(5)(b) that would require the adviser to provide the approximate amount of such self-custodied crypto assets in U.S. dollars, the number of SMA clients for which the adviser self-custodies crypto assets, and the number of crypto asset addresses that store client crypto assets in the adviser's self-custody.”