Custody Policy - EEA

The Custody Policy

‍
System Pay Services (Malta) Limited (“BVNK EU”) is a private limited liability company registered pursuant to the laws of Malta, with company registration number C66961 and registered address at Ruby Workspaces Office 3, Pendergardens, Triq Sant’Andrija, San Giljan STJ9023, Malta. 

BVNK EU is authorised as a crypto-asset service provider (“CASP”) under the Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta) by the Malta Financial Services Authority (the “MFSA”) to provide the following crypto-asset services:

• providing custody and administration of crypto-assets on behalf of clients; 
• exchange of crypto-assets for funds;
• exchange of crypto-assets for other crypto-assets;
• providing transfer services for crypto-assets on behalf of clients.

BVNK EU’s Custody Policy (the “Policy”) aims to provide an understanding of BVNK EU’s: 

• overall approach to the custody of its client’s crypto-assets including management, storage, access, and security; 
• overarching custody solution for crypto-assets; and
• procedures and controls to ensure the proper safekeeping of client’s crypto-assets, accountability, backup, recovery steps and reconciliation.
  ‍

BVNK EU’s Custody Policy is designed to outline the high-level custody management principles in relation to crypto-assets which are held and/or controlled by BVNK EU in respect of its clients.

‍

General Principles

he General Principles governing BVNK EU’s custody of crypto-assets are the following:

• Segregation: Crypto-assets held on behalf of clients are legally segregated from BVNK EU’s own assets. This ensures that BVNK EU’s creditors do not have recourse to its client’s crypto-assets, particularly in the event of insolvency. 
• Protection and Use: Crypto-assets held on behalf of our clients are safeguarded against unauthorised use, misappropriation, theft, or loss, and will not be used for third-party transactions, investments or proprietary trading. 
• Right of Ownership: BVNK EU’s clients have full ownership rights over the crypto-assets held by BVNK EU on their behalf, even when held within a common pool. 
• Delegation & Outsourcing: BVNK EU does not appoint any sub-custodians for safekeeping of crypto-assets. Where BVNK EU elects to make use of a sub-custodian for the safekeeping of crypto-assets, its clients will be informed. 
• Liability: BVNK EU is only liable to its clients for the loss of any crypto-assets held on their behalf as a result of an incident that is attributable to BVNK EU. In such instances, BVNK EU’s liability is capped at the market value of the crypto-asset at the point in time the loss occurred. Incidents not attributable to BVNK EU include any event that occurred independently of the services or operations provided by BVNK EU. 
  ‍

‍

Custody Platform

BVNK EU maintains a technological infrastructure and a comprehensive security framework to ensure the highest level of protection for crypto-assets held in custody. 

BVNK EU has implemented secure and multi-layered security measures for the storage and all movements of its client’s crypto-assets. Key elements of BVNK EU’s security measures include: 

• Secure key generation within a highly secure and controlled environment;
• Secure storage of private cryptographic keys within certified Hardware Security Modules (“HSMs”) or equivalent secure cryptographic devices (e.g., secure enclaves on dedicated hardware);
• Strict access controls and permissions based upon principles of least privilege and clear segregation of duties;
• Strong data encryption of all sensitive data both at rest and in transit; and
• Robust key backup and recovery procedures.
  ‍

In respect to the wallet structure, BVNK EU utilises “warm wallets” which are designed to enable real-time access to crypto-assets, supporting rapid transaction processing and timely user withdrawals, whilst maintaining optimum security. BVNK EU regularly reviews its approach to wallets based on evolving threats and client requirements to determine whether the use of other types of wallets (e.g. cold wallets) would be more suitable to ensure the safekeeping of crypto-assets. 

Should BVNK EU’s custody arrangements materially change, its clients will be informed of such changes.

‍

Reconciliation of Client Crypto-Assets and Record Keeping

BVNK EU adopts a thorough reconciliation process. BVNK EU completes regular reconciliations between company records, client records, and distributed ledger holdings. This ensures accurate asset allocation and full alignment with client entitlements. 

BVNK EU keeps adequate and well-documented records in compliance with the applicable laws. 

‍

Risk Management Framework

BVNK EU has implemented a comprehensive risk management framework. The framework is designed to identify, assess, manage, monitor and report on all risks relating to the BVNK EU’s crypto-asset services. The scope of such a framework includes, but is not limited to, operational risks and ICT risks (including cyber-security threats). 

Operational risks include human errors, process failures, and physical security risks. ICT risks include cyber-security threats, system downtime, data integrity risks and third party risks.

To appropriately manage and mitigate identified risks, BVNK EU:

• Employees a multi-layered cyber-security framework;
• Enforces strict access controls;
• Follows a comprehensive incident response plan; and
• Implements robust network security measures.
  ‍

‍

Reporting of Client Crypto-Assets

Clients receive statements of holdings at least every three (3) months and upon reasonable request indicating the balance, the value, and any transfer of crypto-assets during the relevant period. 

BVNK EU ensures that its clients can access their transaction history on a real-time, continuous basis, via the dedicated user interface.

BVNK EU will inform its clients as soon as possible of any operations involving their crypto-assets that require a response or action.

‍

Return of Client Crypto-Assets

To ensure the safe return of client’s crypto-assets, BVNK EU maintains verification protocols, secure transfer methods, detailed records and timely executions. 

Any delays to processing client crypto-asset requests will be communicated with reasons provided and alternative arrangements suggested where necessary.