On the morning of Friday, May 31, 2019, many eyes were on the SEC in connection with their Strategic Hub for Innovation and Financial Technology (FinHub) panels on securities issues relating to digital assets, including custody. In keeping with the common adage that the law in digital assets is akin to the seven-year multiple associated with canines, the Wyoming Banking Commission (WBC) released its draft regulations later that same afternoon for banks within the state of Wyoming that seek to provide custody of digital assets. These draft regulations facilitate sound banking practices with the custodial needs of market participants in the digital asset space, further cementing Wyoming’s leadership role in blockchain in the United States. Broad highlights of the draft regulations are described here.

Approval by Wyoming Banking Commissioner

Wyoming banks seeking to provide custody of digital assets − including newly created Special Purpose Depository Institutions (SPDIs) under recently enacted law − must apply to the WBC at least 60 days prior to custody activity for approval to do so. Banks must provide the WBC with:

• An outline of the custodial services to be rendered

• The identity of the auditor that has been retained for the custody audit

• A review of the financial condition of the bank to demonstrate that custody of digital assets will not affect the soundness of the bank

• An operational risk mitigation plan.

In addition, banks must undergo annual testing for cybersecurity and penetration of security media, along with anti-money-laundering and know your customer (AML/KYC) procedures. Where a bank seeks to employ outsourced providers or services for certain aspects of custodial services, that bank must demonstrate that it has performed a reasonable level of due diligence on the provider and the services it seeks to render.

Custodial Customers

Banks may provide custody of digital assets of clients and others. In the case of a bank client with an account at the bank, the digital assets are to be held in the name of that client in line with common precepts of account segregation under Rule 206-4(2) of the Investment Advisers Act of 1940. Likewise, in the case of a non-client of a bank or a “client of a client” (e.g., an exchange holding digital assets of its own customer), the bank must be named as an agent or trustee of the digital assets. Custody in a suitable bailment structure is to be chosen by the client, including but not limited to the ability of the custodian to honor written transaction instructions from that client.

Best Execution of Transactions

Wyoming banks that choose to provide custody of digital assets must take reasonable steps that transactions undertaken on behalf of customers to purchase or sell such assets adhere to concepts of “best execution.” That is, a bank must take into account the mark-up/mark-down, commissions and services provided by a broker-dealer or exchange to ensure that such transactions are consummated as economically as possible. The draft rules in their current state suggest that best execution procedures must be addressed at the application stage with the WBC. Banks also will be required to have sound valuation methodology for digital assets from reliable sources.

Block Source Code

Following the concept of “control” of digital assets in Wyoming’s recently enacted Uniform Commercial Code provisions, custodians and their clients are to agree on the protocols for maintenance and application of block source code in the event of “forks” of digital assets (any temporary or permanent divergence in blockchain). Custodians will have an obligation to inform clients of forks and their intent to provide custody of assets under old block source code versus new block source code.

Wyoming Law Applies Without Exception

Agreements for custody of digital assets by banks in Wyoming must (1) designate Wyoming law to apply, (2) designate Wyoming as the venue for the resolution of any disputes, (3) agree that all transactions are deemed to have taken place in Wyoming and (4) agree that assets in custody at the bank are indeed located in Wyoming.

Means of Storage of Assets

Assets (keys) are generally to be held in “cold” storage unless “hot” storage is needed to facilitate a transaction by a customer. For “cold” storage to be deemed as lawful custody, a bank must have physical security that requires at least two authorized key holders with security badges and at least two of the following multifactor authentication methods: (1) personal knowledge via a login or PIN, (2) an access card or other computer program and (3) biometrics. Access to the physical storage facility shall be limited to authorized persons through multifactor identity verification, which shall be verified annually by the independent public accountant, consistent with industry best practices. Prospective employees involved with these tasks will need to submit to background and security checks.

Management of Cash Balances

The cash balances of clients whose accounts hold digital assets may be invested in, among other things, debt securities rated AAA or above and gold. Cash balances are not limited to being trading in U.S. Treasury securities.

Limited Lending

Banks that are not SPDIs may engage in digital asset lending in limited circumstances. Digital asset lending is restricted solely to the department of the bank providing custodial services. The duration of the digital asset loan portfolio is to match the duration of the cash portfolio into which customer cash is invested.

Note: This summary is intended as a basic overview of the provisions that market participants may initially consider in evaluating the usefulness of Wyoming’s digital custody regulations and is by no means exhaustive. The draft regulations are subject to a 30-day comment period and will likely go into effect July 1, 2019.