top of page

Safekeeping of virtual assets 

Fourth service in the list of VASP services (“Limb (iv)”). Generally, this service covers any activity (holding, trading, transferring, spending, etc.), performed as a business, by a person who has the ability to exercise the control over Virtual assets belonging to another natural or legal person (customer), on behalf of that person. This Limb (iv) is to be read expansively (FATF Virtual asset Guidance, §72).

​

The term “safekeeping” consists in the service of holding a Virtual asset, or the private keys to the Virtual asset, for or on behalf of another person (FATF Virtual asset Guidance, §72).

​

The term “administration” includes the service of managing Virtual assets, for or on behalf of another person (FATF Virtual asset Guidance, §72).

​

The term “control” is to be understood as the ability to hold, trade, transfer or spend a Virtual asset belonging to another person (and, therefore, the private keys associated with that Virtual asset) – i.e. having the power to use a Virtual asset or to change its disposition. “Control” does not need to be unilateral and can include circumstances where keys or credentials held by others are (also) required in order to change the assets disposition, such as in the case of multi-signature processes. Therefore, the existence of a multi-signature model does not mean a particular entity does not have control. This definition of “control” also holds for interpreting the terms ‘enabling control’ used in the definition of Limb (iv) (FATF Virtual asset Guidance, §73).

​

The qualification of a person as a Limb (iv) VASP mostly depends on the extent of influence that that person may have over the Virtual assets belonging to another person, for or on behalf of that other person (FATF Virtual asset Guidance, §73).

​

The Limb (iv) definition includes most “custodial wallet service” providers given that they hold and/or keep Virtual assets (including Virtual currencies), for or on behalf of another person (FATF Virtual asset Guidance, §74). It may namely include the “custodial wallet service” as defined by Directive (EU) 2018/843 (AMLD5) as a service to safeguard private cryptographic keys on behalf of customers, to hold, store and transfer virtual currencies (Article 1(1)(d) of Directive (EU) 2018/843).

​

Therefore, the Limb (iv) definition includes those persons (a) that have control of the private keys associated with Virtual assets belonging to another person (which may be understood as “safekeeping” services), or (b) that have control of the smart contracts to which they are not a party and that involve Virtual assets belonging to another person (FATF Virtual asset Guidance, §75).

 

The Commission de Surveillance du Secteur Financier (the “CSSF”) has provided some recommendations regarding key management, including for a service provider that stores its customers private keys (CSSF, Distributed Ledger Technologies & Blockchain, p. 33 and 34). The following recommendations have inter alia been provided (not the full list):

  • define mechanisms/processes to generate and safely deliver encryption key pairs to customers (Q15);

  • ensure a strong relationship between a customer's keys and his identity (Q15);

  • define a process to protect the information/data linking the customer real identity, its public key and the ownership of the assets (Q15);

  • describe the private keys storage mechanisms and tools used (smart contracts, multisig wallets, cold wallets, etc...) (Q16);

  • describe the type of wallet solution used (software/hardware), its mode of operation and the security mechanisms/measures to prevent theft/corruption/loss of the private keys stored in the wallet (Q16);

  • implement a strong customer authentication mechanism to verify the customer identity linked to the private keys (Q16);

  • assess the appropriate use of backup wallets, multi-signatures or other private key security practices (Q16);

  • describe the authentication mechanisms (multi-signatures, 2FA, certificates, behaviour analysis, geofencing, etc...) and processes (recovery of password, accounts, backup wallets) in place to prevent unauthorized access to the solution (Q16);

  • describe the procedures and tools in place in case of lost keys and whether there is a possibility to recover the lost keys, which may include multiple hardware wallets that will act as duplicates of each other in order to have a backup of the hardware wallet, assets not directly owned by the customer’s address and/or usage of a multi-signature wallet (Q17).

 

Those who offer escrow services, such as lawyers, must consider (a) whether they provide this service frequently as a business; and (b) whether the elements of control are actually offered by themselves or by a party to whom they outsource the control - such as a custodial wallet service provider to which the Virtual assets have been consigned (FATF Virtual asset Guidance, §74).

​

However, firms which merely provide ancillary infrastructure to allow another entity to offer Limb (iv) VASP services will not normally satisfy the VASP definition, to the extent that they do not also engage in or actively facilitate as a business any of the aforementioned covered Virtual Assets activities or operations for or on behalf of another person:

  • Internet provider (ISPs), or providers of internet network services and infrastructure;

  • Providers of computing resources, including cloud data storage providers;

  • integrity service providers responsible for verifying the accuracy of digital signatures;

  • software developers;

  • hardware wallet manufacturers;

  • providers of unhosted wallets (whose functions are only developing and/or selling software/hardware), etc. (FATF Virtual asset Guidance, §76 and 83).

 

Examples of Limb (iv) VASPs:

bottom of page