Summary
- "Providing Custody" under Schedule 1, para. 43(1)(a) of the Financial Services Act 2025 is "safeguarding of Financial Instruments, Virtual Assets or, Spot Commodities belonging to another", together with administering those assets (para. 43(1)(d)).
- Custody is regulated "irrespective of the kind of property to which it relates" (para. 2(2)); it is immaterial that title is uncertificated or that assets may be substituted with equivalent assets (para. 43(2)).
- "Arranging Custody" (para. 46) is arranging for another person to provide custody, with an exclusion for unconnected introducers to authorised custodians (para. 47).
- Para. 44 confirms that valuation information, currency conversion and onward transmission of documents are not "administration". Para. 45 applies the trustee, professional, group and incidental-information exclusions.
- Section 5A(4) bans custody of algorithmic stablecoins and privacy tokens; s. 5B allows GFSO to direct that a particular token not be held.
- Custodians must procure an annual Safe Custody Auditor's Report tied to COBS Chapter 15 (GEN 6.6.1(4), 6.6.7); GEN Principle 9 and Chapter 3 set the systems-and-controls baseline.
Why custody is the anchor licence
Custody is the activity most digital asset businesses in GMC end up needing. An exchange holds client wallets. A broker holds tokens pending settlement. A fund administrator holds fund property. A payments firm holds stablecoins in accounts. Each is, in the language of the Financial Services Act 2025, "Providing Custody", and each requires a Financial Services Licence from the Gelephu Financial Services Office (GFSO) covering that activity. The Financial Institutions Directory published by GFSO lists each licensed firm's activities; as at the date of this article, Providing Custody appears on more licences than any other activity.
Paragraph 43: Providing Custody
Paragraph 43(1) specifies four activities:
- "(a) safeguarding of Financial Instruments, Virtual Assets or, Spot Commodities belonging to another;
- (b) in the case of a Fund, safeguarding Fund Property;
- (c) Acting as a Central Securities Depository; or
- (d) administering the assets, Financial Instruments, Virtual Assets, Spot Commodities or Fund Property for the purpose of sub-paragraphs (a) and (b)".
A "Virtual Asset" is a digital representation of value that can be digitally traded and functions as a medium of exchange, unit of account or store of value, without legal tender status (s. 258). A "Financial Instrument" is defined by reference to paras 87–96, 99A and 99B of Schedule 1 and includes shares, debt instruments, fund units, derivatives, structured products and environmental instruments, so security tokens and tokenised carbon credits are also within para. 43.
Paragraph 43(2) removes two arguments a custodian might otherwise raise. It is "immaterial that title to the assets is held in uncertificated form" (para. 43(2)(a)). And it is "immaterial that the assets may be transferred to another person, subject to a commitment that they will be replaced by equivalent assets at some future date or when so requested by the person to whom they belong" (para. 43(2)(b)). A wallet model in which client tokens are pooled and the client is owed "equivalent" tokens rather than identical units is still custody.
Paragraph 2(2) of Schedule 1 adds that para. 43 is a regulated activity "irrespective of the kind of property to which it relates". Custody of a token that is neither a Financial Instrument nor a Virtual Asset in the technical sense should still be analysed under this provision.
The perimeter test: control
The Act leaves "safeguarding" to its ordinary meaning. In practice the question is whether the firm has control over client assets such that it could move them. For distributed ledger assets, that means control of private keys or of the signing arrangements that authorise transfers. A firm that holds keys, holds a threshold share of keys sufficient to sign, or operates a smart contract wallet it can unilaterally direct is safeguarding. A firm that supplies non-custodial wallet software and never has the ability to move client assets is not, on the face of para. 43, safeguarding anything. Where a multi-party computation or multi-signature design falls is fact-specific and should be put to GFSO with system diagrams; GFSO's application checklist calls for transaction flow diagrams for exactly this reason.
Paragraph 44: what is not "administration"
Paragraph 44 provides that three activities "do not constitute the administration of assets for the purposes of paragraph 43":
- "(a) providing information as to the number of Units or the value of any assets in respect of which custody is provided;
- (b) converting currency; or
- (c) receiving Documents relating to an investment solely for the purpose of onward transmission to, from or at the direction of the person to whom the investment belongs."
This is a narrow provision in its scope. It excludes portfolio reporting, foreign exchange and document-handling from the "administering" limb in para. 43(1)(d). It does not exclude safeguarding from the perimeter. A firm that holds keys cannot rely on para. 44 merely because it also provides valuations.
Paragraph 45: other exclusions
Paragraph 45 applies six general exclusions to Providing Custody:
| Exclusion | Provision | Effect for a virtual asset business |
|---|---|---|
| Trustees, nominees and personal representatives | para. 74(3) | No custody activity unless the trustee "holds himself out as providing a service" of that kind; lost if separately remunerated (para. 74(5)) |
| Profession or non-investment business | para. 75 | Custody that is a necessary part of a non-financial profession or business, not separately remunerated |
| Sale of goods or supply of services | para. 76 | Custody incidental to a non-financial supply |
| Groups and joint enterprises | para. 77 | Intra-group arrangements |
| Incidental information | para. 81 | Information services only |
| Insolvency practitioners | para. 82 | Acting as an insolvency practitioner |
Paragraph 79(6) further excludes an agreement by a Non-GMC Person to provide custody where the agreement "is the result of a legitimate approach", one not solicited by the foreign custodian, unless the solicitation came from a Licensed Firm or Exempt Firm (para. 79(7)). Section 259 separately treats an activity as carried on "in GMC" where the firm's registered or head office and day-to-day management are in GMC, or where it is carried on from an establishment maintained in GMC.
Paragraphs 46 and 47: Arranging Custody
Paragraph 46 makes it a regulated activity to arrange "for one or more persons to carry on the activity described in paragraph 43". An exchange that routes client assets to a third-party custodian, a wealth platform that onboards clients to a custody provider, or a fund manager that appoints a custodian for its clients may be Arranging Custody even though it never holds keys.
Paragraph 47 contains the exclusion. An "introducer" does not Arrange Custody by introducing a person to a "custodian" authorised by GFSO or a Non-GMC Regulator to provide custody, "if the introducer is not connected with the custodian" (para. 47(1)). An introducer is connected if the custodian is in the same Group, or if the introducer "is remunerated by the custodian or a member of the custodian's Group for making the introduction" (para. 47(2)). A referral to a regulated custodian for no fee is outside the perimeter. A referral for a fee, or to an affiliate, is inside.
What the Act says about client assets and insolvency
The Act deals with client assets through a rule-making power and a set of audit obligations.
Client Money. Section 4(1) empowers GFSO to make Rules for the handling of "Client Money" held by a Licensed Firm, which may "make provision which results in that money being held on trust (which may be one or more separate trusts)". Section 4(2) protects a bank at which a client account is kept from constructive trustee liability unless it pays out with knowledge that the payment is wrongful or after deliberately failing to make enquiries. "Client Money" is defined as money held by a Licensed Firm "that is to be handled in accordance with Rules made under section 4" (s. 258). The Act's trust mechanism is therefore for money. It does not, on its face, deem virtual assets held in custody to be held on trust; how tokens are held, segregated and protected is left to the Safe Custody Rules in COBS Chapter 15, referred to in GEN 6.6.7, and to the terms of the custody agreement.
Audit. GEN 6.6.1(4) requires a Licensed Firm that "is permitted to hold or control Client Investments or Provide Custody in or from GMC" to arrange a Safe Custody Auditor's Report. Under GEN 6.6.7 the auditor must state whether the firm maintained throughout the year "systems and controls to enable it to comply with the Safe Custody Rules in COBS Chapter 15", whether the Safe Custody Investments "are registered, recorded or held in accordance with the Safe Custody Rules", and whether there were "any material discrepancies in the reconciliation of Safe Custody Investments". A firm holding Client Money must also procure a Client Money Auditor's Report confirming that Client Money "is identifiable and secure at all times" and pooled or segregated in accordance with COBS Chapter 14 (GEN 6.6.6). Reports are submitted annually within four months of the financial year end (GEN 6.6.2).
Insolvency. Protection of custodied virtual assets on the custodian's insolvency is governed by the received law. Under the Application of Laws Act 2024, the Insolvency, Restructuring and Dissolution Act 2018 applies in GMC (item 10 of Schedule A), and the received common law and equity apply so far as suited to GMC's circumstances (s. 3). Whether client tokens fall outside a custodian's estate will turn on the property and trust analysis under that received law and on how the custody arrangement is documented. This is the single most important drafting point in a GMC custody agreement.
Systems and controls under GEN
GEN Principle 9 (GEN 2.2.9) is the governing standard: "Where a Licensed Firm has control of or is otherwise responsible for assets or money belonging to a Client which it is required to safeguard, it must arrange proper protection for them in accordance with the responsibility it has accepted." GEN Chapter 3 gives that principle operational content. The rules most relevant to a virtual asset custodian are:
- General requirement. Systems and controls, "including but not limited to financial and risk systems and controls", that ensure the firm's affairs are managed effectively and responsibly, with regular reviews (GEN 3.3.1).
- Segregation of duties. Key duties and functions must be segregated so that the same individual does not perform conflicting functions (GEN 3.3.3). For a custodian this maps onto key generation, key storage, transaction approval and reconciliation.
- Risk management. Systems to identify, assess, mitigate, control and monitor risks (GEN 3.3.4), and a designated individual to advise the Governing Body on them (GEN 3.3.6).
- Outsourcing. A firm that outsources functions directly related to regulated activities "is not relieved of its regulatory obligations" and the outsourced function "shall be deemed as being carried out by the Licensed Firm itself" (GEN 3.3.31). Material outsourcing must be notified to GFSO and documented in a written contract (GEN 3.3.32). Sub-custodians, wallet-infrastructure vendors and key-management providers all fall here.
- Business continuity. Arrangements to continue functioning after an unforeseen interruption, "kept up to date and regularly tested" (GEN 3.3.33).
- Records and financial crime. Records capable of reproduction on paper within three business days (GEN 3.3.34), and systems to deter, prevent and report fraud and other Financial Crimes against the firm and its clients (GEN 3.3.38).
The Act adds two statutory limits on what may be held. Section 5A(4) provides that no person may carry on a regulated activity involving the "custody of a Virtual Asset or Fiat-Referenced Token which is an algorithmic stablecoin token, a privacy token, or any digital asset employing similar technology". Section 5B allows GFSO to direct that no custody of a specified token take place for a period, with written notice and a right to make representations. A custodian should expect to confine itself to "Accepted Virtual Assets", tokens that in GFSO's opinion meet the requirements set under s. 5A (s. 258). The Virtual Asset Guidance published by GFSO applies in addition.
Licensing
Custody is licensed through the standard GFSO process (see our guide to the GFSO application process), ending with In-Principle Approval, satisfaction of pre-conditions and issue of the Financial Services Licence. GEN 5.5.1 requires a Senior Executive Officer, Compliance Officer and Money Laundering Reporting Officer, resident in GMC or Bhutan (GEN 5.5.2). Capital requirements are set by GFSO under the Threshold Conditions (s. 28) and the Prudential rulebook; Basnet Law can confirm the current figures.
Practical checklist / Next steps
- Determine whether the firm can move client assets (keys, signing thresholds, contract control). If yes, para. 43 applies; if it only refers clients to a custodian, analyse para. 46 and the para. 47 introducer exclusion.
- Confirm that no token to be held is an algorithmic stablecoin or privacy token (s. 5A(4)) and build s. 5B into the token onboarding policy.
- Obtain COBS Chapters 14 and 15, GEN, AML and the Virtual Asset Guidance from GFSO and design wallet architecture, segregation and reconciliation to them.
- Draft the custody agreement with the insolvency analysis under the received law in mind: whose property the tokens are, how they are identified, and what "equivalent assets" means.
- Document key management with segregated duties (GEN 3.3.3), risk ownership (GEN 3.3.6) and tested continuity plans (GEN 3.3.33).
- Put every sub-custodian and infrastructure vendor through the outsourcing rules (GEN 3.3.31–3.3.32) and notify material arrangements.
- Engage an auditor early: the Safe Custody Auditor's Report (GEN 6.6.7) is an annual deliverable from the first year.
Frequently asked questions
Does a non-custodial wallet provider need a GMC licence?
Paragraph 43 turns on "safeguarding" assets "belonging to another". Software that never gives the provider the ability to move client assets does not, on the face of the paragraph, safeguard them. Designs involving shared keys or recovery mechanisms need case-by-case analysis with GFSO.
Is pooled (omnibus) custody allowed?
Paragraph 43(2)(b) makes clear that an arrangement under which assets may be transferred subject to replacement with equivalent assets is still custody, so pooled models are within the licence. Whether pooling is permitted for a given client type, and how it must be recorded, is governed by the Safe Custody Rules in COBS Chapter 15 and the Client Money rules in COBS Chapter 14.
Do I need a separate licence to refer clients to a custodian?
Only if the referral amounts to Arranging Custody under para. 46. An introduction to a custodian authorised by GFSO or a foreign regulator is excluded by para. 47 if the introducer is not in the custodian's Group and is not paid by the custodian for the introduction.
Are client tokens protected if the custodian fails?
Section 4 addresses trusts of Client Money. For virtual assets, protection is built from the Safe Custody Rules in COBS Chapter 15, the property analysis under the law received through the Application of Laws Act 2024 and the terms of the custody agreement.
Key takeaways
- Providing Custody (para. 43) expressly covers safeguarding and administering Virtual Assets; uncertificated title and substitution arrangements do not take a model outside it.
- Arranging Custody (para. 46) catches referrals unless the para. 47 unconnected-introducer exclusion applies.
- Paras 44 and 45 are narrow: valuation, FX and document handling are not "administration", and the trustee exclusion is lost if the custody is separately remunerated.
- The Act bans custody of algorithmic stablecoins and privacy tokens (s. 5A(4)) and lets GFSO stop custody of a specific token (s. 5B).
- Client asset protection is built from GEN Principle 9, COBS Chapters 14 and 15, the Safe Custody Auditor's Report and the custody agreement.
This article is general information about the law of the Gelephu Mindfulness City Special Administrative Region as at the date above. It is not legal advice and does not create a lawyer–client relationship.
You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.
References
- Financial Services Act 2025, ss. 4, 5A(4), 5B, 16, 28, 258 (definitions of Virtual Asset, Financial Instrument, Client Money, Accepted Virtual Asset), 259; Schedule 1, paras 2(2), 43, 44, 45, 46, 47, 74, 75, 76, 77, 79, 81, 82
- GEN Rulebook 2026 (Version 1.0), Rules 2.2.9, 3.3.1, 3.3.3, 3.3.4, 3.3.6, 3.3.31, 3.3.32, 3.3.33, 3.3.34, 3.3.37, 3.3.38, 3.3.39, 5.2.7, 5.5.1, 5.5.2, 6.6.1, 6.6.2, 6.6.6, 6.6.7
- Application of Laws Act 2024, ss. 3, 4 and Schedule A (item 10, Insolvency, Restructuring and Dissolution Act 2018)
