Virtual Asset and Initial Token Offerings Services (Custody of Client Assets) Rules 2022

Government Notices 2022 2451 Government Notice No. 175 of 2022 THE VIRTUAL ASSET AND INITIAL TOKEN OFFERINGS SERVICES ACT FSC Rules made by the Financial Services Commission under section 52 of the Virtual Asset and Initial Token Offerings Services Act PART I – GENERAL PROVISIONS

1. Citation These rules may be cited as the Virtual Asset and Initial Token Offerings Services (Custody of Client Assets) Rules 2022.
2. Interpretation “Act” means the Virtual Asset and Initial Token Offerings Services Act; “Alternative Provider” means a person to whom virtual assets are transferred in the event of the failure of the Virtual Asset Custodian; “Fails” “Failure” “Failed” refers, in respect of a virtual asset service provider, to the appointment of a liquidator, or any equivalent procedure in any relevant jurisdiction; “internal custody record check” means a check as to whether the Virtual Asset Custodian’s records and accounts of the virtual assets held by the Virtual Asset Custodian (including those deposited with any Third Party Custodian) correspond with the Virtual Asset Custodian’s obligations to its clients to hold those virtual assets; “liquidator” shall have the meaning set out at section 338 of the Insolvency Act;

2452 Government Notices 2022 “private key” means the information which gives the holder of that information control over crypto assets held on the blockchain; “relevant Acts” has the same meaning as in the Financial Services Act; “Third Party Custodian” means a person that is either licenced in Mauritius as a Virtual Asset Custodian, or operates from an establishment outside of Mauritius and holds an equivalent licence with a regulator in that jurisdiction; “wallet” means any storage device or mechanism for holding private keys; 3. Scope of the rules (1) These rules shall apply to all virtual asset service providers that carry out business in or from Mauritius, and which have custody of one or more virtual assets for one or more clients. (2) References to the act of “holding” virtual assets, or virtual assets being “held”, or to “hold” virtual assets, refer to the ability to exercise of control over the virtual assets, by use of a private key or other equivalent mechanism. (3) These rules shall be read in conjunction with the Act, applicable Acts, relevant Acts and guidelines which the Commission may issue from time to time. PART II – GENERAL REQUIREMENTS 4. The General requirements (1) A Virtual Asset Custodian shall, when holding virtual assets belonging to clients, make adequate arrangements so as to safeguard clients’ ownership rights, especially in

Government Notices 2022 2453 the event of the Virtual Asset Custodian’s insolvency, and to prevent the use of those virtual assets belonging to a client on the Virtual Asset Custodian’s own account except with the client’s express consent. (2) A Virtual Asset Custodian shall establish, implement and maintain adequate organisational arrangements to minimise and mitigate the risk of the loss or diminution of clients’ virtual assets, or the rights in connection with those virtual assets. PART III – HOLDING VIRTUAL ASSETS 5. Holding virtual assets (1) A Virtual Asset Custodian shall effect appropriate registration or recording of who has legal title and rights of access to virtual assets it holds in custody. (2) A Virtual Asset Custodian may hold virtual assets with a nominee company which is controlled by – (a) the Virtual Asset Custodian; (b) an undertaking in the same corporate group as the Virtual Asset Custodian; or (c) a Third Party Custodian. (3) A Virtual Asset Custodian needs to be clear in its agreements with clients regarding the basis on which it holds virtual assets for clients, and in particular whether they are held– (a) on a segregated basis, in which case the Virtual Asset Custodian needs to clearly identify and segregate virtual assets belonging to different clients;

2454 Government Notices 2022 (b) on an omnibus basis, in which case the Virtual Asset Custodian needs to ensure at all times that the total amount and type of virtual assets held for clients at all times matches the amounts it has agreed to hold for its clients. (4) A Virtual Asset Custodian holding virtual assets with a nominee company or depositing virtual assets with a Third Party Custodian shall accept the same level of responsibility to its clients and the Commission as the Virtual Asset Custodian would itself have if holding virtual assets directly. 6. Hardware and software (1) A Virtual Asset Custodian shall ensure that any software and hardware it uses in holding virtual assets is reliable, resilient and compatible with the virtual assets being held, and in this respect shall consider – (a) the impact of the software architecture of the wallets used to hold virtual assets, as well as generally the interoperability of software used to hold virtual assets; (b) the ability to ensure security using cryptographic keys, hard and cold wallet storage, password protection and encryption. 7. Technology audits (1) AVirtualAsset Custodian shall appoint a suitably qualified and experienced independent third party professional to carry out an annual audit of the Virtual Asset Custodian’s hardware and software used to hold virtual assets. (2) A Virtual Asset Custodian shall provide, not later than 3 months after the closing date of every financial year,

Government Notices 2022 2455 a written report setting out the methodology and results of the technology audit performed under paragraph (1), including listing any recommendations or areas of concern. (3) A Virtual Asset Custodian shall keep a record of the basis on which the Virtual Asset Custodian for has determined that the third party auditor is independent, suitably qualified and sufficiently experienced to carry out the annual audit under paragraph (1). This record shall be kept for a minimum of 7 years from the date of the annual audit it relates to. (4) A Virtual Asset Custodian shall, at least every 7 years, change the third party used to carry out the annual audit carried out under paragraph (1). 8. Using virtual assets for own account (1) A Virtual Asset Custodian shall not use a client’s virtual assets for its own account or the account of any other person or client of the Virtual Asset Custodian, unless– (a) the client has given express prior consent to the use of the virtual assets on specified terms; and (b) the use of that client’s virtual assets is restricted to the specified terms to which the client consents. (2) A Virtual Asset Custodian shall not use virtual assets held on an omnibus basis for its own account or for the account of any other person unless, in addition to the conditions set out in paragraph (1) – (a) each client whose virtual assets are held together in an omnibus account has given express prior consent in accordance with paragraph (1)(a); or

2456 Government Notices 2022 (b) the Virtual Asset Custodian has in place systems and controls which ensure that only virtual assets belonging to clients who have given express prior consent in accordance with paragraph (1)(a) are so used. (3) For the purposes of obtaining the express prior consent of a client under this rule, the consent shall be clearly evidenced in writing and the signature of the client or an equivalent alternative means of affirmative execution is required. (4) Clients’ consent may be given once at the start of the commercial relationship, as long as it is sufficiently clear that the client has consented to the use of their virtual assets. (5) A record of the consent provided shall be kept to evidence clearly what the client agreed to and to ascertain at all times the status of the virtual assets being held. (6) A Virtual Asset Custodian shall take appropriate measures to prevent the unauthorised use of virtual assets for its own account or the account of any other person. (7) Where a Virtual Asset Custodian uses virtual assets for its own account, the records of the Virtual Asset Custodian shall include details of the client on whose instructions the use of the virtual assets has been effected, as well as the number of virtual assets used belonging to each client who has given consent, so as to enable the correct allocation of any loss. 9. Third party security interests (1) A Virtual Asset Custodian shall not grant any security interest, lien or right of set-off to another person over a

Government Notices 2022 2457 clients’ virtual assets unless condition under paragraph (a) or (b) is satisfied – (a) the security interest, lien or right of set-off is in respect of debts which relate to– (i) one or more of the Virtual Asset Custodian’s clients; or (ii) the provision of services by that other person to one or more of the Virtual Asset Custodian’s clients; or (b) the virtual assets have been deposited with a Third Party Custodian and– (i) the security interest, lien or right of set-off is required by the applicable law of a third country jurisdiction in which the virtual assets are held; (ii) the Virtual Asset Custodian discloses information to the client so that the client is informed of the risks associated with these arrangements; and (iii) the Virtual Asset Custodian has taken reasonable steps to determine that holding virtual assets subject to that security interest, lien or right of set-off is in the best interests of the Virtual Asset Custodian’s clients. (2) Under paragraph (1)(a), a security interest, lien or right of set-off to facilitate the clearing or settlement of transactions referring to clients of the Virtual Asset Custodian may be regarded as being granted in order to recover debts that relate to the provision of services to one or more clients.

2458 Government Notices 2022 (3) Where security interests, liens or rights of set-off are granted by a Virtual Asset Custodian over virtual assets, or where the Virtual Asset Custodian has been informed that they are granted, these shall be recorded in client contracts and the Virtual Asset Custodian’s own books and records to make the ownership status of virtual assets clear, such as in the event of an insolvency. PART IV – DEPOSITING VIRTUAL ASSETS WITH THIRD PARTIES 10. Depositing virtual assets with a Third Party Custodian (1) A Virtual Asset Custodian may deposit virtual assets held by it on behalf of its clients into an account or accounts opened with a Third Party Custodian, but only if it exercises all due skill, care and diligence in the selection, appointment and periodic (and at least annual) review of the Third Party Custodian and of the arrangements for the holding and safekeeping of those virtual assets. (2) When depositing virtual assets held by it on behalf of its clients with a Third Party Custodian, the Virtual Asset Custodian shall ensure that such Third Party is subject to equivalent regulations as the Virtual Asset Custodian. (3) A Virtual Asset Custodian shall present its assessment as to the basis on which a Third Party is subject to equivalent regulations, and present this assessment to the Commission for notification before depositing virtual assets with the Third Party Custodian. The Commission also has the right from time to time to publicly list those jurisdictions whose regulations are deemed equivalent for the purposes of this rule.

Government Notices 2022 2459 (4) When a Virtual Asset Custodian makes the selection, appointment and conducts the periodic review referred to under this rule, it shall take into account inter alia – (a) the expertise and market reputation of the Third Party Custodian; (b) the Third Party Custodian’s performance of its services to the Virtual Asset Custodian; (c) the arrangements that the Third Party Custodian has in place for holding and safeguarding virtual assets; (d) the capital or financial resources of the Third Party Custodian; (e) the credit-worthiness of the Third Party Custodian; (f) any other activities undertaken by the Third Party Custodian and, if relevant, any affiliated company; (g) anything else that could adversely affect clients’ rights; (h) whether the Third Party Custodian has the appropriate regulatory permissions; and (i) any legal requirements related to the holding of those virtual assets that could adversely affect clients’ rights. (5) A Virtual Asset Custodian shall take the necessary steps to ensure that any client’s virtual assets deposited with a Third Party Custodian are identifiable separately from the applicable assets belonging to the Virtual Asset Custodian and from the applicable assets belonging to that Third Party Custodian, by means of differently titled accounts or other equivalent measures that achieve the same level of protection.

2460 Government Notices 2022 11. Agreements with third-parties (1) A Virtual Asset Custodian shall enter into a written agreement with any Third Party Custodian with whom it deposits clients’ virtual assets. This agreement shall, at minimum – (a) set out the binding terms of the arrangement between the Virtual Asset Custodian and the Third Party Custodian; (b) be in force for the duration of that arrangement; and (c) clearly set out the service(s) that the Third Party Custodian is contracted to provide. (2) A Virtual Asset Custodian shall consider carefully the terms of the agreement with the Third Party Custodian, which shall address the following issues (where relevant) – (a) that legal title to the virtual assets does not belong to the Virtual Asset Custodian; (b) that the Third Party Custodian will hold or record virtual assets belonging to the Virtual Asset Custodian’s client separately from any applicable asset belonging to the Virtual Asset Custodian or to the Third Party Custodian; (c) the arrangements for registration or recording of the virtual asset, if this will not be registered in the Virtual Asset Custodian’s client’s name; (d) the restrictions over the circumstances in which the Third Party Custodian may withdraw assets from the account;

Government Notices 2022 2461 (e) the procedures and authorities for the passing of instructions to, or by, the Virtual Asset Custodian; (f) the procedures for the claiming and receiving of dividends, interest payments and other entitlements accruing to the Virtual Asset Custodian’s client; and (g) the provisions detailing the extent of the Third Party Custodian’s liability in the event of the loss of a virtual asset caused by the fraud, wilful default or negligence of the Third Party Custodian or an agent appointed by him. 12. Records (1) A Virtual Asset Custodian shall make a record of the grounds upon which it satisfies itself as to the appropriateness of its selection and appointment of a Third Party Custodian. The Virtual Asset Custodian shall make the record on the date it makes the selection or appointment and shall keep it from that date until seven years after the Virtual Asset Custodian ceases to use the Third Party Custodian to hold virtual assets belonging to clients. (2) A Virtual Asset Custodian shall make a record of each periodic review of its selection and appointment of a Third Party Custodian that it conducts, its considerations and conclusions. The Virtual Asset Custodian shall make the record on the date it completes the review and shall keep it from that date until seven years after the Virtual Asset Custodian ceases to use the Third Party Custodian to hold virtual assets belonging to clients.

2462 Government Notices 2022 PART V – RECORDS AND ACCOUNTS 13. Records and accounts (1) A Virtual Asset Custodian shall keep such internal records and accounts as necessary to enable it at any time and without delay to distinguish virtual assets held for one client from virtual assets held for any other client, and from the Virtual Asset Custodian’s own applicable assets. Records shall be client-specific. (2) A Virtual Asset Custodian shall maintain its internal records and accounts in a way that ensures their accuracy, and in particular their correspondence to the virtual assets held for clients and that they may be used as an audit trail. (3) The requirement that records and accounts are internal means that they are maintained by the Virtual Asset Custodian itself, and shall be separate to any records the Virtual Asset Custodian may have obtained from any third parties, including any Third Party Custodian with whom it may have deposited virtual assets. 14. Internal custody record checks (1) A Virtual Asset Custodian shall perform an internal custody record check as regularly as is necessary but without allowing more than two months to pass between each internal custody record check. (2) A Virtual Asset Custodian shall only use its internal records in order to perform an internal custody record check. This means that a Virtual Asset Custodian shall not base its internal custody record checks on any records that the Virtual Asset Custodian may have obtained from any third parties, such as those with whom it may have deposited virtual assets.

Government Notices 2022 2463 15. Evaluating internal record and account checks (1) A Virtual Asset Custodian shall – (a) establish a process that evaluates – (i) the completeness and accuracy of the Virtual Asset Custodian’s internal records and accounts, in particular whether sufficient information is being completely and accurately recorded by the Virtual Asset Custodian to enable it to ensure that it has a client-specific virtual asset record, and can readily determine the total of all the virtual assets that it holds for its clients; and (ii) whether the Virtual Asset Custodian’s systems and controls correctly identify and resolve all discrepancies in its internal records and accounts of virtual assets held by the Virtual Asset Custodian for clients; (b) run the evaluation process established under (a) on the date of each internal custody record check; and (c) promptly investigate and, without undue delay, resolve any causes of discrepancies that the evaluation process reveals. (2) The evaluation process shall correctly identify and resolve at least the following types or causes of discrepancies – (a) items in the Virtual Asset Custodian’s records and accounts that might be erroneously overstating or understating the virtual assets held by the Virtual Asset Custodian;

2464 Government Notices 2022 (b) processing errors; and (c) IT errors, including software issues that could lead to inaccurate records. 16. External custody reconciliations (1) A Virtual Asset Custodian shall conduct, on a regular basis, reconciliations between its internal records and accounts of virtual assets held by the Virtual Asset Custodian for clients and those of any third parties with whom those virtual assets are held. (2) A Virtual Asset Custodian shall conduct external custody reconciliations as regularly as necessary but allowing no more than two months to pass between each external custody reconciliation. (3) External custody reconciliations shall be performed for each virtual asset held by the Virtual Asset Custodian for its clients. 17. Independence of person performing checks and reconciliations Whenever possible, a Virtual Asset Custodian shall ensure that checks and reconciliations are carried out by a person (for example an employee of the Virtual Asset Custodian) who is independent of the production or maintenance of the records to be checked and/or reconciled. 18. Frequency of internal custody record checks and external custody reconciliations (1) When determining the frequency at which it will undertake its internal custody record checks and external custody reconciliations, a Virtual Asset Custodian shall have regard to –

Government Notices 2022 2465 (a) the frequency, number and value of transactions which the Virtual Asset Custodian undertakes in respect of clients’ virtual assets; and (b) the risks to which clients’ virtual assets are exposed, such as the nature, volume and complexity of the Virtual Asset Custodian’s business and where and with whom virtual assets are held; (c) A Virtual Asset Custodian shall review the frequency at which it conducts internal custody record checks and external custody reconciliations at least annually to ensure that it continues to comply with the Virtual Asset and Initial Token Offerings Services (Custody of Client Assets) Rules, and has given due consideration to the matters in paragraph (1). The Virtual Asset Custodian shall record the date and the actions it took in relation to this review. (2) A Virtual Asset Custodian shall make and retain records sufficient to show and explain any decision it has taken when determining the frequency of its internal custody record checks and external custody reconciliations. Subject to paragraph (4), such records shall be retained indefinitely. (3) If any decision under paragraph (3) is superseded by a subsequent decision under that rule then the record of that earlier decision need only be retained for a further period of five years from the subsequent decision. 19. Time period for holding records Unless otherwise stated, a Virtual Asset Custodian shall ensure that every record made under these rules are retained for a period of seven years starting from the later of –

2466 Government Notices 2022 (a) the date it was created; and (b) if it has been modified since the date it was created, the date it was most recently modified. PART VI – SHORTFALLS AND DISCREPANCIES 20. Discrepancies (1) When a Virtual Asset Custodian identifies a discrepancy as a result of carrying out an internal custody record check or external custody reconciliation, the Virtual Asset Custodian shall – (a) promptly take all reasonable steps both to investigate the reason for the discrepancy and resolve it without undue delay; (b) take appropriate steps for the treatment of any shortfalls until that discrepancy is resolved; and (c) where the discrepancy has arisen as a result of a breach of these rules, the Virtual Asset Custodian shall ensure it takes sufficient steps to avoid a reoccurrence of that breach. (2) A discrepancy shall not be considered resolved until it is fully investigated and corrected, and any associated shortfall is made good by way of the Virtual Asset Custodian ensuring that – (a) it is holding the virtual assets that the Virtual Asset Custodian ought to be holding for each of its clients; and (b) its own records, and the records of any relevant other person (such as a Third Party Custodian with whom

Government Notices 2022 2467 the Virtual Asset Custodian deposited the virtual assets) are accurate. 21. Treatment of shortfalls (1) Thisrule applies where a VirtualAsset Custodian identifies a discrepancy as a result of, or that reveals, a shortfall, which the Virtual Asset Custodian has not yet resolved. (2) Subject to paragraphs (3) and (4), until the discrepancy is resolved a Virtual Asset Custodian shall do one of the following – (a) allocate a sufficient number of its own applicable virtual assets to cover the value of the shortfall and hold them for the relevant clients in such a way that the applicable virtual assets, or the proceeds of their liquidation, will be available for distribution for the benefit of the relevant clients in the event of the Virtual Asset Custodian’s Failure and, in doing so– (i) ensure that the applicable assets are clearly identifiable as separate from the Virtual Asset Custodian’s own property and are recorded by the Virtual Asset Custodian in its client￾specific virtual asset record as being held for the relevant client; (ii) keep a record of the actions the Virtual Asset Custodian has taken under this rule which includes a description of the shortfall, identifies the relevant affected clients, and lists the applicable virtual assets that the Virtual Asset Custodian has appropriated to cover the shortfall; and

2468 Government Notices 2022 (iii) update the record made under paragraph (2) (ii) whenever the discrepancy is resolved and the Virtual Asset Custodian has re-appropriated the applicable assets; or (b) appropriate a sufficient amount of its own money to cover the value of the shortfall, hold it for the relevant client, in which case the Virtual Asset Custodian shall – (i) ensure the money is segregated from the Virtual Asset Custodian’s own funds and recorded as being held for the relevant client; (ii) keep a record of the actions the Virtual Asset Custodian has taken under this rule which includes a description of the shortfall, identifies the relevant affected clients, and specifies the amount of money that the Virtual Asset Custodian has appropriated to cover the shortfall; and (iii) update the record made under paragraph (2)(b) (ii) whenever the discrepancy is resolved and the Virtual Asset Custodian has re-appropriated the money; or (c) appropriate a number of applicable virtual assets in accordance with paragraph (a) and an amount of money in accordance with paragraph (b) which, in aggregate, are sufficient to cover the value of the shortfall. (3) The value of a shortfall shall be determined as the previous day’s closing mark to market valuation, or if none is available in relation to a particular virtual asset, the most

Government Notices 2022 2469 recently available valuation. However, if the value of a virtual asset is volatile or difficult to value, a Virtual Asset Custodian shall consider whether it is appropriate to set aside an additional amount to cover any likely change in the value of the shortfall. (4) If the Virtual Asset Custodian, where justified, concludes that another person is responsible for the discrepancy, regardless of any dispute with that other person, or that the discrepancy is due to a timing difference between the accounting systems of that other person and that of the Virtual Asset Custodian, the Virtual Asset Custodian shall take all reasonable steps to resolve the situation without undue delay with the other person. (5) Until the discrepancy is resolved the Virtual Asset Custodian shall consider whether it would be appropriate to notify the affected client of the situation, and may take steps under paragraph (2) for the treatment of shortfalls until that discrepancy is resolved. (6) In considering whether it shall notify affected clients under paragraph (3), a Virtual Asset Custodian shall act honestly, fairly and professionally in accordance with the best interests of its clients. (7) A Virtual Asset Custodian that has failed is not required to take steps under paragraph (2) in relation to the Virtual Asset Custodian’s own applicable assets or money in so far as the legal procedure for the Virtual Asset Custodian’s Failure prevents the Virtual Asset Custodian from taking any such steps.

2470 Government Notices 2022 PART VII – VIRTUAL ASSET CUSTODIAN FAILURE 22. Disapplied rules after Failure The following rules do not apply to a Virtual Asset Custodian following its failure – Part V – Records and Accounts. 23. Checks and reconciliations after Failure (1) A Virtual Asset Custodian shall perform an internal custody record check and an external custody reconciliation that relates to the time of its Failure as soon as reasonably practicable after its Failure. (2) Whenever possible, a Virtual Asset Custodian shall ensure that checks and reconciliations are carried out by a person (for example an employee of the Virtual Asset Custodian) who is independent of the production or maintenance of the records to be checked and/or reconciled. (3) The reference point for the internal custody record check and the external custody reconciliation shall be the precise point in time at which the Virtual Asset Custodian’s Failure occurred. (4) If any records and accounts of relevant third parties relating to the time of the Virtual Asset Custodian’s Failure are unavailable, the Virtual Asset Custodian shall use the next available records and accounts to perform the external custody reconciliation. (5) A Virtual Asset Custodian shall perform further internal custody record checks and external custody reconciliations as regularly as is necessary to ensure that the Virtual Asset

Government Notices 2022 2471 Custodian remains in compliance with these rules, as well as having regard to – (a) the frequency, number and value of transactions which the Virtual Asset Custodian undertakes in respect of clients’ virtual assets; and (b) the risks to which clients’ virtual assets are exposed, such as the nature, volume and complexity of the Virtual Asset Custodian’s business and where and with whom virtual assets are held. 24. Disposal of virtual assets after a Failure (1) A Virtual Asset Custodian shall not dispose of a virtual asset where this would breach its obligations under the Act, these rules, the law applicable to any Third Party Custodian used by the Virtual Asset Custodian, or any agreement the Virtual Asset Custodian has entered into. (2) Before a Virtual Asset Custodian takes any steps to dispose of a virtual asset it shall – (a) subject to paragraph (3), attempt to return it to the relevant client or transfer it to an Alternative Provider for safekeeping on behalf of the client; and (b) subject to paragraph (4), take reasonable steps to notify the client of the Virtual Asset Custodian’s proposed course of action for disposing of the virtual asset. (3) A Virtual Asset Custodian is not required to attempt to return or transfer a virtual asset under paragraph (2)(a) where the client to whom the virtual asset belongs has

2472 Government Notices 2022 confirmed to the Virtual Asset Custodian that it disclaims all its interests in the virtual asset. (4) A Virtual Asset Custodian is not required to notify a client under paragraph (2)(b) where – (a) the Virtual Asset Custodian is able to return the virtual asset to the relevant client or transfer it to an Alternative Provider; or (b) the client to whom the virtual asset belongs has confirmed to the Virtual Asset Custodian that it disclaims all its interests in the virtual asset. 25. Taking reasonable steps to notify clients (1) Taking reasonable steps to notify the client of the Virtual Asset Custodian’s proposed course of action for disposing of the virtual assets include the following course of conduct – (a) determining, as far as reasonably possible, the correct contact details for the client by using any available means to determine the correct contact details for the relevant client (including telephoning the client, searching internal records, media advertising, searching public records, mortality screening, using credit reference agencies or tracing agents); (b) writing to the client at its last known address either by post or by electronic mail – (i) to inform it of the Virtual Asset Custodian’s intention to dispose of the virtual asset;

Government Notices 2022 2473 (ii) to inform it of the consequences of the Virtual Asset Custodian’s proposed course of action in relation to the client’s ability to assert a claim in respect of that virtual asset; and (iii) to invite the client to submit a claim for that virtual asset; (c) where the client has not responded within 28 days of the communication under subparagraph (i), attempting to communicate the information in subparagraph (i) to the client on at least one further occasion by any means other than that used in subparagraph (i) including by post, electronic mail, telephone or media advertisement. (2) If after carrying out the steps in paragraphs (1)(a) and (1)(b), the Virtual Asset Custodian has obtained positive confirmation that none of the contact detailsit holdsfor the relevant client are accurate or, if utilised, the communication is unlikely to reach the client, the Virtual Asset Custodian does not have to comply with paragraph (1)(c). 26. Record keeping regarding virtual assets disposed after a Failure (1) After a Failure, a Virtual Asset Custodian shall make a record of any virtual asset disposed of at the time of the disposal. This record shall state – (a) the virtual asset that was disposed of; (b) the value of the consideration received for the virtual asset disposed of;

2474 Government Notices 2022 (c) the name and contact details of the client to whom the virtual asset was allocated, according to the Virtual Asset Custodian’s records at the time of making the record under this rule; and (d) the efforts applied by the Virtual Asset Custodian to determine the client’s correct contact details. (2) A Virtual Asset Custodian shall keep the record under paragraph (1) indefinitely. 27. Transfers of virtual assets (1) This rule applies where, instead of returning a virtual asset to a client, a Virtual Asset Custodian is able to transfer the virtual asset to an Alternative Provider for safekeeping on behalf of the client. (2) A Virtual Asset Custodian may transfer virtual assets to an Alternative Provider only if it exercises all due skill, care and diligence in the selection and appointment of the Alternative Provider taking into account inter alia – (a) the expertise and market reputation of the Alternative Provider; (b) the arrangements that the Alternative Provider has in place for holding and safeguarding virtual assets; (c) the capital or financial resources of the Alternative Provider; (d) the credit-worthiness of the Alternative Provider; (e) any other activities undertaken by the Alternative Provider and, if relevant, any affiliated company;

Government Notices 2022 2475 (f) anything else that could adversely affect clients’ rights; (g) whether the Alternative Provider has the appropriate regulatory permissions; and (h) any legal requirements related to the holding of those virtual assets that could adversely affect clients’ rights. (3) A Virtual Asset Custodian may only effect such a transfer if, in advance of the transfer, it has obtained a contractual undertaking from the Alternative Provider that – (a) the Alternative Provider will return the virtual asset to the client at the client’s request; and (b) the Alternative Provider will notify the client, within 14 days of the transfer of that client’s virtual asset having commenced – (i) of the applicable regulatory regime under which the virtual asset will be held by the Alternative Provider; and (ii) of any changes to the legal and regulatory protections provided to the client as a result of the transfer. PART VIII – COMMISSION NOTIFICATION REQUIREMENTS 28. Notification requirements (1) A Virtual Asset Custodian shall inform the Commission in writing without delay if – (a) it Fails;

2476 Government Notices 2022 (b) its internal records and accounts of the virtual assets held by the Virtual Asset Custodian for clients are materially out of date, or materially inaccurate or invalid, so that the Virtual Asset Custodian is no longer able to comply with the requirements of these rules; (c) it will be unable, or materially Fails, to take the steps required for the treatment of shortfalls; (d) it will be unable, or materially Fails, to conduct an internal custody record check in compliance with these rules; or (e) it will be unable, or materially Fails, to conduct an external custody reconciliation in compliance with these rules. 29. Commencement These rules shall be deemed to come into operation on 1 July 2022. Made by the Financial Services Commission on 28 June 2022.