JCBA proposes 347 practices to strengthen cryptocurrency custody

The Japan Crypto Asset Business Association (JCBA) presented a draft on October 20 containing 347 security practices for crypto asset custodians, a step that seeks to standardize controls in a sector with specific risks not covered by traditional audits. The initiative, although non-binding, reflects the growing global regulatory pressure on the custody of digital assets, a key service for institutional and retail investors. Context Japan, one of the first countries to regulate crypto assets —with the approval of the Payment Services Act in 2017—, has maintained a proactive approach to supervising the sector. The JCBA, an entity that brings together more than 100 companies from the local ecosystem, including exchanges and custody providers, has been a key player in developing voluntary standards before they are adopted by regulators such as the Financial Services Agency (FSA). The announcement comes in a context of greater scrutiny over the security of custodians following incidents such as the collapse of FTX in 2022 or the Poly Network hack in 2021, which exposed vulnerabilities in private key management. Globally, jurisdictions such as the EU —with the MiCA regulation— and the USA —with SEC proposals— have advanced frameworks that demand greater controls from custody providers. In Japan, however, current regulation does not detail specific technical requirements for these services, which has led the JCBA to propose a reference framework. The crypto asset market, according to CryptoScore Pro data as of October 21, showed a slight recovery, with Bitcoin (BTC) trading at $83,498 (+2.48% in 24 hours) and Ethereum (ETH) at $2,468 (+3.54%). The Crypto Fear & Greed index, which measures market sentiment, stood at 63/100 ("greed"), reflecting moderate optimism but without euphoria. The facts The draft published by the JCBA on October 20 includes 347 security practices distributed across ten areas, as reported by CoinPost and confirmed by DiarioBitcoin . These areas cover: Corporate governance. Personnel management. Physical security of the facilities. Business Continuity Planning (BCP). Sub-custody management. Private key management (separate from signing operations). Signing operations (distinct from key management). Five additional areas not detailed in the available information. The proposal classifies custody services into five models: holding , intermediary , supply , reference , and others . However, the document does not specify which obligations correspond to each category nor how a provider's classification would be determined, according to the published information. Along with the draft, the JCBA included two practical tools: a self-assessment form in Excel format and a log to document verifications. These tools aim for custodians to review their internal controls, although the association clarified that the material is a draft and not a mandatory standard or a certification mechanism. No timeline has been established for its implementation, nor has it been indicated whether the 347 points will be enforceable in the future. One of the most prominent aspects of the document is its critique of third-party assurance reports, such as SOC2 . The JCBA argues that these reports, while useful for evaluating general corporate security controls, do not address specific risks of crypto-assets, such as the lifecycle management of private keys. The association does not completely rule out the utility of SOC2, but insists that they are not sufficient on their own to guarantee security in the custody of digital assets. The available information does not clarify if the JCBA plans to conduct external evaluations of custodians nor how compliance with the proposed practices would be verified. It has also not been detailed whether the self-assessment form will serve as a basis for future audits or if the association will publish updated versions of the draft. Understanding the key notions Crypto-asset custodian A custodian is an entity that stores and protects digital assets on behalf of third parties, such as investors or companies. Unlike an exchange, which facilitates buying and selling, the custodian focuses on the security of the funds, preventing their loss or theft. For example, an investment fund that buys Bitcoin may hire a custodian to manage the private keys of its assets, reducing the risk of hacks or human errors. Private keys and signing operations Private keys are cryptographic codes that allow transactions to be authorized on a blockchain. Whoever controls them, controls the assets. Signing operations, on the other hand, are the technical process by which a transaction is validated using those keys. Separating both functions—as proposed by the JCBA—seeks to prevent a single person or system from having total access to the funds, reducing risks of fraud or errors. SOC2 The SOC2 (Service Organization Control 2) report is an auditing standard that evaluates a company's security, availability, integrity, and confidentiality controls. It is issued by external firms and is common in sectors such as banking or technology. However, the JCBA points out that SOC2 does not cover specific risks of crypto-assets, such as the management of private keys, which require more specialized protocols. Custody models The five models proposed by the JCBA (holding, intermediary, supply, reference, and others) reflect the diversity of services in the sector. For example, a holding custodian could store assets without interacting with them, while an intermediary could facilitate transactions. The lack of a clear definition in the draft leaves doubts about the responsibilities of each model, an aspect that could be clarified in future versions. Analysis: what is at stake The JCBA proposal introduces an unprecedented security framework for the custody of crypto-assets, with direct implications for the supply and demand of specialized services. By separating key management from signing operations, the draft seeks…