Feedback Paper on Supporting Growth with Digital Finance

1 Feedback Paper Response to the Commission’s Consultation on Supporting Growth with Digital Finance July 2026

2 TABLE OF CONTENTS Executive Summary.............................................................................................................3

1. Changes to the Existing Framework and Definitions for VASP Activities ............4
2. Stablecoins ..................................................................................................................10
3. Fund Tokenisation .....................................................................................................10
4. Tokenised Securities ..................................................................................................11
5. Custody .......................................................................................................................12
6. Insurance.....................................................................................................................15
7. Banking .......................................................................................................................19
8. Enhancing Anti- Financial Crime Compliance Through Technology ..................20
9. Legal Certainty...........................................................................................................26
10. Other Feedback ..........................................................................................................28 Implementation and Engagement ....................................................................................29 Appendix 1. s40 (VASP) Notice ........................................................................................31 Appendix 2. Updated Lending Credit & Finance Rules & Guidance...........................34 Appendix 2a. Marked up version of Part 10, VASP Rules..........................................35 Appendix 2b. Clean version of revised Part 10 VASP rules .......................................42

3 Executive Summary As part of its Digital Finance Initiative, in December 2025, the Guernsey Financial Services Commission (“the Commission”) launched a Consultation Paper, Supporting Growth with Digital Finance (“the CP”). The consultation attracted strong stakeholder engagement, highlighting the growing importance of digital finance and the Bailiwick of Guernsey (“Bailiwick” or “Guernsey”)’s reputation as a trusted international financial centre. Overall, feedback was positive and constructive. Respondents confirmed that Guernsey’s existing legal and regulatory framework is already well placed to support innovation in digital finance. In particular, the Bailiwick’s technology-neutral approach, combined with proportionate regulation and a robust anti-financial crime regime, was seen as a key strength. At the same time, stakeholders identified areas where greater clarity or targeted enhancements would support further growth. In response, the Commission is taking a series of practical steps to support innovation in digital finance, while maintaining high standards. Most notably, the Commission is: • publishing a Guidance Note on Tokenisation of Investments and Other Assets in the Bailiwick of Guernsey (“Guidance Note on Tokenisation”), providing clarity on how the existing framework applies to tokenised funds, securities, and other assets. This is intended to give firms greater clarity and confidence to innovate within a clear and well￾understood regulatory environment; • planning to work with the States of Guernsey to refine the virtual asset service provider (“VASP”) framework to improve clarity and reduce complexity. This includes enabling existing licensees to trade, hold, invest or custody virtual assets without an additional dual licence, thus decreasing regulatory burdens and enabling existing licensees to expand their services; • supporting the adoption of emerging technologies, including “smart contracts”, to enhance financial services; and • introducing simple and targeted reporting requirements to gather information on digital finance-related activity within the Bailiwick. The CP covered a wider range of Digital Finance policy areas. In May 2026, the Commission published a feedback paper and updated sections of the Handbook on Countering Financial Crime (AML/CFT/CPF) (“the Handbook”) to further support the use of technology to combat financial crime. The Commission is also progressing plans to develop a proportionate regulatory framework for stablecoins, reflecting strong industry support for a clear and credible approach in this area. We plan to issue stablecoin feedback and rules during Autumn 2026. Taken together, the outcomes of the consultation underline Guernsey’s strong reputation as a well-regulated and forward-looking jurisdiction. The measures outlined are designed to ensure that the Bailiwick continues to improve as an attractive and competitive location for digital finance.

4

1. Changes to the Existing Framework and Definitions for VASP Activities Background In the opening section of the CP, the Commission sought views on proposed changes to both the Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 (“LCF Law”) and its rules and guidance. These changes seek to simplify and clarify the operation of the Law in respect of Virtual Assets and Virtual Asset Service Providers (VASPs) to enhance opportunities for digital asset business and encourage growth. Overall, there was broad support for the changes, and the Commission intends to proceed as planned, although with some revisions in the detail of the proposals. Where changes to the Law are proposed, the Commission plans to work closely with the Law Officers of the Crown and Policy and Resources Committee of the States of Guernsey (“P&R”) to help advance the relevant regulations. Throughout this feedback statement the Commission refers to virtual assets, digital finance, digital assets and cryptoassets. The term virtual assets should be read as defined under the LCF Law, whereas the terms digital finance, digital assets and cryptoassets are used as general, non￾legally defined terms. Cryptoassets are primarily considered to be cryptocurrencies, whereas digital assets typically refer to a broader term or class of asset. Consultation Paper Question Proposed changes to LCF Law Q 1.1 Do respondents agree with the proposed change to the definition of virtual asset service provision in the Law? And the consequential repeal of the exemption contained in the s40 Notice of disapplication? This change removes from regulation activities carried out by individuals on their own behalf. As currently drafted, the LCF Law requires persons to be licensed if carrying out specified activities in connection with Virtual Assets and does not exclude persons acting on their own behalf. At present, such activities are exempted from licensing by virtue of the s40 “Notice of Disapplication”1 (“s40 Notice”) which removes the requirement for individuals who are, for example, trading cryptoassets on their own behalf, to be licensed under the LCF Law. In the CP we proposed that the law should be clarified so that licensing is required only when providing services for and on behalf of another person. Overview of Feedback Received The change was supported by most respondents. The additional wording highlighted in the box below, will provide improved clarity for investors and digital businesses wishing to set up in the Bailiwick. 1 LCF Disapplication Notice

5 Conclusion and Way Forward The Commission will continue to progress the proposed changes. The Commission will work with P&R to request that it issue regulations which will amend the LCF Law to specify that the requirement for a VASP licence applies to the activities set out in the LCF Law only when carried out “for and on behalf of another natural or legal person”. Bailiwick of Guernsey, Lending, Credit and Finance Law 2022: Part III We propose that the LCF Law be revised by adding the text highlighted in yellow: 17.(1) Subject to the provisions of this Law, persons shall not provide or carry on, offer to provide or carry on or hold themselves out as being willing to provide or carry on, by way of business, in or from within the Bailiwick, for or on behalf of another natural or legal person, any of the following services or activities in relation to virtual assets– (a) exchange between virtual assets and fiat currencies, (b) exchange between one or more forms of virtual asset, (c) transfer of virtual assets, (d) safe-keeping and/or administration of virtual assets or instruments enabling control over virtual assets, (e) participation in and provision of financial services relating to an issuer's offer and/or sale of a virtual asset (including, without limitation and by way of example, an initial coin offering), whether by the issuer of the asset or a service provider affiliated or unaffiliated with the issuer in respect of the issue, offer, sale, distribution, ongoing market circulation and trading of the asset (including book-building, underwriting and market making), (f) any other service or activity or class or description thereof in respect of virtual assets specified for the purposes of this Law by regulations of the Committee, except under the authority of and in accordance with the conditions of a licence granted by the Commission under section 23 (a "Part III VASP licence"). Consequently, exemption (I) in the VASP section of the s40 Notice will become redundant. The Commission will amend the “Notice of Disapplication” to remove the relevant exemption when the LCF Law change takes effect. Consultation Paper Question Proposed changes to the Lending, Credit and Finance Rules and Guidance, 2023 (“LCF Rules”): VASP Licensing & Retail Customers Q 1.2 Do respondents agree with the proposed changes to the rules? If not, are other changes required? Do respondents agree that the rule restricting the offer of services to wholesale and institutional customers should be removed? What do respondents consider to be the appropriate consumer safeguards and protections for VASP activity in respect of retail customers?

6 The original LCF Rules included rules which restricted the way VASPs could be licensed and on the customers for which they could carry out services. Specifically, persons carrying out VASP activities, including those licensed under other regulatory laws, were (i) required to hold a VASP licence in addition to any other licence needed; and (ii) limited to offering services to wholesale and institutional customers. In the CP, the Commission proposed removing restrictions by deleting the following rules: LCF Rules: 10.1 (1) Holders of licences, issued under any of the regulatory Laws, who carry on activities regulated under Part III VASPs, must hold a Part III VASP Licence. 10.2 (1) Part III VASP licensees are only permitted to provide VASP services to institutional and wholesale counterparties. Overview of Feedback Received Respondents were strongly supportive of the changes. There was broad support for removing the requirement for existing licensees to hold an LCF VASP licence if carrying out the specified activities, and for deleting Rule 10.2 (1) restricting the offer of services to institutional and wholesale counterparties. Conclusion and Way Forward The Commission will delete Rule 10.1 (1). While this does not eliminate the need for additional licences in all cases, it increases flexibility for the Commission to offer limited permissions to conduct VASP activities where appropriate. The Commission will delete Rule 10.2 (1) which prevents VASP licensees from providing services to retail customers. This is a significant change. It means firms licensed and regulated by the Commission will be able to offer digital finance services to retail customers. A small number of responses pushed back against this, considering cryptoassets too complex or too risky for retail customers. Nevertheless, complexity and risk in investments is not unique to digital finance and virtual assets, and the Commission does not consider this sufficient reason to continue to deny retail investors the opportunity to invest in this sector. The Commission takes the view that this is an important area of growth and it is important that Guernsey firms and investors have access to this broader market. Other feedback suggested that there should be enhanced conduct rules for firms which deal with retail customers. However, many of these issues are already addressed through the requirements of the minimum criteria for licensing (including competence and governance), through rules for safeguarding of client/customer money and the Principles of Conduct of Finance Business which apply to all licensees, as do requirements for robust AML/CFT/CPF controls. At this time the Commission does not propose to impose additional conduct rules for firms dealing with retail customers. Nevertheless, as set out in the CP, the Commission expects that licensees will take appropriate steps to look after customers and apply resources commensurate

7 with the increased level of protection owed to such customers and firms should note that the Principles for Conduct of Finance Business apply to all licensees in respect of their customers. In June 2025 the Commission detailed its expectations for funds with crypto asset exposure, including the suitable safeguards that need to be in place for retail customers. These principles are also relevant to VASP licensees providing retail services: • Customers should be well informed of risks and be able to bear any potential losses; • Consideration should be given to the regulated status of service providers, including any custodian; and • There should be detailed consideration in the Business Risk Assessment2 to ensure appropriate compliance monitoring, testing and risk management processes are in place. To ensure that the Commission knows which regulated firms are offering/providing/conducting virtual asset business directly with retail customers, licensees offering these services will need to notify the Commission. Consultation Paper Question Changes to VASP Guidance Q 1.3 Do respondents agree with the changes to the guidance on the definition of virtual assets? Are there any other changes suggested which would remove ambiguity or further improve clarity? In the CP, the Commission highlighted that some existing guidance was not as helpful as intended and could cause confusion. It proposed removing unnecessary or unhelpful guidance. Specifically, the CP highlighted the following guidance, intended to clarify VASP activities, has given rise to unintended consequences, with some non-VASP activities regulated under other regulatory laws, being considered to require dual licensing. Guidance for deletion (from the guidance box on page 74 of the consolidated LCF Rules, following Rule 10.2) “Digital representations of fiat currency and general securities or derivatives is intended to cover digital records of ownership, such as bank accounts in digital form and digital security registers. It would also include central bank digital currencies. It would not include stablecoins or virtual asset securitisations of real assets. If in doubt, please contact the Commission.” Overview of Feedback Received Respondents were strongly in favour of this proposal. Some suggested adding guidance that certain types of assets would not be treated as Virtual Assets, including stablecoins and directly tokenised Category 1 and Category 2 controlled investments. Several requests were also made 2 Financial Crime Business Risk Assessment.

8 for the provision of definitions, for example, “fiat currency”, “general securities”, and “derivatives”. It was further suggested that case studies be provided for common use cases to help provide clarity. Conclusion and Way Forward The Commission will delete the guidance referred to above, from the relevant box on page 61 of the LCF Rules. To further aid regulatory clarity the Commission has also, alongside this feedback paper, published a guidance note on tokenisation. In the consultation responses there were requests for specific terms to be defined, however, the Commission does not consider it appropriate to introduce another glossary of terms. Defining terms which are in common usage and have clear English definitions, such as “fiat currency”, risks confusion and may have unintended consequences. The Commission will continue to consider regulation of digital assets based on their actual usage and application rather than seek to narrowly categorise types of token or asset. Consultation Paper Question Separate Environmental & Sustainability reporting for VASPs Q 1.4 Are respondents content that s.10.3 of the LCF rules, the VASP specific environmental declaration, should be deleted? In the CP, the Commission proposed deleting Rule 10.3 of the LCF Rules which required separate environmental reporting for VASPs. As noted in the CP this was introduced when there was an expectation that similar provisions would be required in other sectors. However, the focus has shifted to a more flexible corporate approach to reporting following the International Sustainability Standards Board (“ISSB”) reporting standards. The rule was also drafted in a Bitcoin-centric era with more modern blockchain technologies now being more energy efficient. This rule is, therefore, no longer required. Overview of Feedback Received Respondents were strongly in favour, with no disagreement to this proposal. The general view was that retaining separate environmental and sustainability reporting requirements for VASPs places Guernsey at a competitive disadvantage relative to other jurisdictions that do not impose equivalent obligations. Moreover, it is at odds with the approach adopted by the Commission under its other regulatory laws and the approach adopted more widely internationally. Conclusion and Way Forward The environmental rules specific to VASPs will be deleted to bring practice into line with the Commission’s other regulatory laws which do not have specific separate environmental requirements. Accordingly, Section 10.3 of the LCF rules, including the requirement for separate VASP sustainability returns, will be deleted.

9 Firms may continue to report in line with the ISSB standards and group practice. Consultation Paper Question Mining, Validation and IT services provisions for VASPs Q 1.5 Is the clarification of the guidance in respect of mining and validation activities helpful? If not, what other guidance would be suggested? As set out in the CP, the Commission does not regulate the use of blockchain or distributed ledger technology (“DLT”) and there are no regulatory requirements for licensing for firms providing IT or support services for VASPs. Overview of Feedback Received Respondents suggested that clarity on staking arrangements and validator reward models, supported by worked examples, would be beneficial, as would discussion of “staking-as-a-service” offerings. Some questioned whether the distinction drawn between running a validation node and acting as a validator is meaningful in practice, noting that a validator would ordinarily be operating a validation node. As a general point, respondents suggested that the publication of a clear, scenario-based table setting out which digital asset activities require licensing would be helpful, and note that, given the pace of change in this area, regular updates to guidance and interpretative materials would assist firms in remaining aligned with regulatory expectations. Conclusion and Way Forward The Commission does not generally consider that mining or validation activities would require a VASP licence. Certain activities, such as staking, may require a VASP licence depending on circumstances and for whom the activity is being carried out. At this time we are not issuing further guidance in relation to mining or validation activities. In most cases the position is clear and licensing is not required. However, in the Commission’s experience of the more complex proposals it has seen, each has its own unique characteristics and would not necessarily fit easily in a table of standard scenarios. Where firms are uncertain about the licensing implications of more complex or novel proposals, they can discuss their proposals with the Commission and utilise its Innovation Sandbox + Concierge. Consultation Paper Question Providing advice on Virtual Assets Q 1.6 Is the clarification of the position in respect of advice on Virtual Assets helpful? If not, what additional guidance would be helpful? In the CP, the Commission noted that it had been asked by firms whether a VASP licence would be required in order to provide general advice in respect of virtual assets or overall portfolio management including digital/virtual assets.

10 Overview of Feedback Received There was strong agreement in support of clarification and additional guidance on what would constitute a VASP activity in connection with advising. Respondents sought clarification that firms offering “general advice” and advising on the inclusion of virtual assets as part of an investment portfolio or wealth management practice would not require a separate VASP licence. One respondent suggested introducing a voluntary “light touch” licence to provide governance comfort for firms. Conclusion and Way Forward Firms do not require a separate VASP licence to advise on virtual assets and the Commission will issue the following FAQ on its website to clarify this. The Commission does not intend to introduce “voluntary” licences for unregulated activities. Q: Do I need a VASP licence to provide advice in connection with virtual assets? No, providing general advice on virtual assets, for example as part of managing an overall portfolio or more general investment advice, is not a VASP regulated activity. However, providing investment advice is regulated in other ways. (i) Providing investment advice in connection with controlled investments is a restricted activity under the PoI Law, and may therefore require a PoI licence; and (ii) “providing individual or collective portfolio management services or advice” is a financial firm business (FFB) activity under part III (s16) of the LCF Law. A VASP licence would only be required if advice is offered in connection with the promotion or issue of a particular virtual asset. For example, promoting the initial issue of a virtual asset such as a cryptocurrency. 2. Stablecoins We intend that feedback and rules arising from the Stablecoin section of the CP will follow during Autumn 2026. 3. Fund Tokenisation Background In 2024, the Commission issued guidance confirming that fund tokenisation is permitted in the Bailiwick, including the use of DLT to maintain the register of unitholders. The guidance emphasised that all existing regulatory obligations must continue to be met. At that time, the guidance limited activity to private blockchain infrastructure. Through the CP, the Commission proposed revising its position to permit the use of public blockchains. The Commission recognises the risks associated with public blockchains, including, for example technology failure, cybersecurity threats, and inappropriate exposure of

11 complex or ill-suited products to retail investors. However, its view is that these can be mitigated through appropriate controls. Consultation Paper Question Q 3 Do respondents agree with the proposed amendment of collective investment scheme guidance to permit the use of a public blockchain? Overview of Feedback Received Respondents expressed strong support for the proposed amendment to permit the use of public DLT as the register of holders of units in Bailiwick registered or authorised collective investment schemes. Moreover, respondents generally acknowledged that public blockchains (or, more broadly, DLT) introduce novel or heightened risks but agreed that these can be managed through an effective governance and control framework. Conclusion and Way Forward Effective immediately, the Commission is revising its position to permit the use of public blockchains. To effect this change and, also provide guidance to stakeholders, it is rescinding its 14 May 2024 Policy Statement - Approach to Fund Tokenisation and the corresponding FAQ (“What is the Commission’s approach to Fund Tokenisation?) and has, alongside this feedback paper issued a Guidance Note on Tokenisation, which includes an illustrative, non￾exhaustive summary of potential benefits and risks associated with tokenisation. Finally, the Commission has amended the Form 152 (Investment Vehicles Return) to include a simple question to capture whether a fund or non-fund investment vehicle issues shares (or equivalent interests) in tokenised form. An equivalent question was also added to the online Applications and Authorisations Portal for new fund applications. 4. Tokenised Securities Background The Commission’s position is that tokens that convey rights consistent with a Category 2 Controlled Investment will be treated as such and regulated under the Protection of Investors (Bailiwick of Guernsey) Law, 2020 (“PoI Law), whether in tokenised issuances (for example, shares) or indirect structures where a Guernsey vehicle issues tokenised securities linked to underlying real-world assets. In its CP, the Commission proposed issuing guidance confirming this treatment, signalled that it may consider legislative amendment to expressly include tokenised securities within the PoI Law, and communicated an intention to clarify that such securities do not constitute virtual assets for VASP purposes. It also suggested enhancements to disclosure expectations of tokenisation-specific risks and to reporting to the Commission. Consultation Paper Questions Q 4.1 Do you agree that guidance should be issued confirming that tokenised securities, provided that the definition of a Category 2 Controlled Investment is met, fall within scope of the PoI Law? Q 4.3 Do respondents agree that the PoI Law should be amended to clarify the treatment of tokenised general securities and derivatives?

12 Q 4.4 Do respondents agree that the Prospectus Rules be amended to require disclosure of any additional risks associated with the offering of tokenised security? Do respondents agree that licensed fiduciaries should report annually on any tokenisation activity they are servicing? Overview of Feedback Received Respondents were broadly supportive of the Commission’s proposal to issue guidance confirming that tokenised securities fall within scope of the PoI Law where they meet the definition of a Category 2 Controlled Investment. Several respondents requested that the guidance include practical examples, with some suggesting it be expanded into a single, consolidated source covering tokenisation more broadly (including tokenisation of securities and collective investment schemes (“CIS” or “funds”). Most respondents also supported amending Schedule 1 of the PoI Law to explicitly include tokenised securities, although some respondents considered this unnecessary given the existing framework. There was also general support for enhancements to the Prospectus Rules and Guidance, 2025 (“the Prospectus Rules”) to address tokenisation-specific risks, albeit with a preference among some respondents for a principles-based approach rather than prescriptive requirements. Respondents also supported periodic reporting by licensed fiduciaries on tokenisation activity, subject to proportionality. Conclusion and Way Forward Having considered the range of respondents’ views, today, the Commission is issuing a Guidance Note on Tokenisation covering both tokenised securities and funds. Among other things, that note confirms that tokenised securities fall within the scope of the PoI Law where they meet the definition of a Category 2 Controlled Investment. It also reiterates that Guernsey’s existing legislative framework is sufficiently broad and technology-neutral to accommodate tokenised securities and tokenised funds. Considering this latter point, the Commission has concluded that no changes to the PoI Law, nor the Prospectus Rules, are necessary. That said, the Guidance Note on Tokenisation addresses disclosure expectations included in the legislative framework, noting that risk exposures directly affecting investors and introduced through tokenisation should be transparently disclosed to investors. Finally, the Commission will introduce simple annual reporting requirements for fiduciary licensees on tokenisation-related activity they service, with further detail to be provided in due course. 5. Custody Background At present, depending on the nature of the activity, custody may fall within the scope of the PoI Law, the LCF Law, or both. In the CP, the Commission raised the possibility of reducing dual licensing requirements by making changes to the LCF Law. This was intended to permit those licensed under the PoI Law to carry out safe keeping of digital assets without the need for an additional VASP licence under the LCF Law.

13 Principle 6 of the Commission’s Principles of Conduct of Finance Business, applicable to all persons licensed by the Commission, states that: “Where a financial institution has control of or is otherwise responsible for assets belonging to a customer which it is required to safeguard, it should arrange proper protection for them, by way of segregation and identification of those assets or otherwise, in accordance with the responsibility it has accepted”. In the case of the Protection of Investors regime this Principle is expanded upon in the Client Assets requirements of the Conduct of Business Rule 9.1. The VASP regime addresses custody of virtual assets in Rule 10.4 on Safekeeping of customer virtual assets. Both regimes are broadly consistent and seek the key outcomes of asset safeguarding, asset segregation and asset identification. Consultation Paper Question Licensing of Custodians of Digital Assets Q 5.2.1 Do respondents agree with the proposed change to section 17 of the LCF Law to permit PoI licensees to act as custodians of digital assets? Do respondents agree with the proposal that where a person licensed under the PoI Law acts as custodian of digital assets that such person, in respect of such assets, will additionally be subject to VASP Rule 10.4 on Safekeeping of customer virtual assets? Overview of Feedback Received Respondents were generally supportive of the Commission’s proposals to permit PoI licensees to act as custodians of digital assets without requiring a complementary licence under the LCF Law, subject to compliance with Rule 10.4 of the LCF Rules. However, some respondents favoured retaining dual licensing, suggesting that adjustments to fees or scope of application of the LCF Rules could reduce complexity. Some respondents also proposed additional requirements relating to capital, insurance, and operational controls, as well as further guidance on custody arrangements. The Commission notes that the minimum criteria for licensing requires capital and insurance to be commensurate with the nature, scale and complexity of activities. Firms which custody digital assets (including virtual assets) are therefore required to reflect associated risks when determining their capital and insurance needs. Conclusion and Way Forward Having considered all feedback received on the licensing of custodians of digital assets, the Commission will progress with the change it proposed in the CP. Specifically, it will pursue framework changes to permit PoI licensees to act as custodians of digital assets without requiring a complementary LCF/VASP licence. Further, the Commission has concluded that it will extend the principle of reducing dual licensing by also enabling existing PoI and insurance licensees to trade, hold or invest in virtual assets in the course of carrying on restricted activities without an additional VASP licence. This is a significant change, decreasing the regulatory burden and enabling existing licensees to expand their services more easily.

14 To implement this efficiently, instead of proceeding with amendments to Section 17 of the LCF Law, the Commission will consult with P&R with a view to issuing a notice under Section 40 of the LCF Law (“s40 (VASP) Notice”). Further consultation on the s40 (VASP) Notice For the sake of simplicity and clarity, the Commission plans to issue a s40 (VASP) Notice which consolidates the disapplication provisions related to LCF Part III (VASP) licensing into a single notice. The Commission invites feedback on the specific drafting of the proposed new s40 Notice, a draft copy is attached to this Feedback Paper. Comments can be emailed to dfi@gfsc.gg by 31 August 2026. Please contact the Commission if you would like to discuss this further. The s40 (VASP) Notice requires that persons wishing to benefit from the disapplication must meet certain conditions. Among these is the requirement to notify the Commission of the intention to carry out (for example) safe-keeping of virtual assets and the Commission will maintain a register of persons who have notified the Commission of their intention to do so. They must also meet the minimum criteria for licensing which apply to LCF licensees carrying out VASP activities and follow the relevant rules which apply to VASPs in respect of these activities. This means that firms will be expected to have suitable knowledge and skills to undertake the activity, and that they have appropriate insurance and capital. The requirements of the Handbook and the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 will continue to apply to the relevant virtual asset activity. Consultation Paper Question Licensed fiduciaries safekeeping of digital assets Q 5.3 What are respondents’ views on the additional risks faced by, and appropriate corresponding controls required by, a licensed fiduciary ‘self-custodying’ digital assets as trustee? Overview of Feedback Received Respondents identified several key risks, alongside mitigating controls, including: Examples of Additional Risks Examples of Controls • Management and loss of private keys • Concentration of control and key person risk • Finality of transfers • Third-party risk • Operational resilience • Multi-person authorisation • Segregation of digital assets and wallet structures mapped to individual trusts with appropriate reconciliation • Documented and tested procedures for key compromise and cyber incidents • Board approval of digital asset self-custody policy

15 Some respondents also called for additional guidance, notification requirements and more prescriptive standards, including in relation to wallet infrastructure (for example, mandating the type and grade of storage or wallets used), and the use of third-party custodians. Conclusion and Way forward In relation to fiduciary self-custody, firms are expected to assess their capabilities and implement appropriate controls, taking into account the risks identified. The existing framework is considered sufficient, and no new prescriptive requirements are proposed. That said, the Commission will introduce targeted reporting for fiduciary licensees undertaking self￾custody or servicing structures holding digital assets; this will help the Commission identify any growing trends. 6. Insurance Background In the CP the Commission discussed the use of “smart contracts” to effect insurance contracts and the use of tokenised Insurance Linked Securities (“ILS”). The Commission proposed further guidance to confirm that the use of such arrangements would not, on its own, constitute VASP activity by the insurer or insurance manager and that tokenised securities issued by insurers (ILS issued by special purpose insurers (“SPIs”)) would not fall within the scope of the VASP regime. Consultation Paper Question Use of “smart contracts” for insurance Q 6.1 Do respondents agree that DLT and “smart contracts” may be used to effect contracts of insurance and the proposed guidance that this would not be a VASP activity? Are there any other regulatory changes or clarifications which would support the use of digital finance & innovation in the insurance sector more broadly? (An example would be the treatment of stablecoins or cryptocurrency as payment of premium) Overview of Feedback Received Respondents were strongly supportive of the opportunity to use DLT and “smart contracts” to effect contracts of insurance and almost all agreed that such contracts do not constitute virtual assets and that this should not be considered a VASP activity. Several respondents sought clarification regarding whether insurance premiums and payments could be made using stablecoins or cryptocurrencies. A small minority of respondents were opposed to the payment of premiums in cryptocurrencies, citing concerns regarding financial crime risk and volatility. Respondents also queried the treatment of stablecoins and virtual assets for solvency purposes.

16 Conclusion and Way Forward Innovation and smart contracts The Commission supports the use of innovative approaches including “smart contracts” to effect insurance contracts. It considers that there may be significant opportunities in this area, particularly in respect of parametric insurance and reinsurance contracts. There is no bar to using them for direct insurance, but insurance firms and intermediaries will need to ensure that customers understand the arrangements in place and how they will operate. Stablecoin or cryptocurrency payments The Commission does not prohibit firms from accepting payment for insurance premiums in the form of stablecoins or cryptocurrency, and accepting such payments would not require a VASP licence to be held by the insurer, its intermediary or insurance manager. In accepting payments in this form, firms will need to recognise the risks and potential volatility of cryptocurrencies and ensure that they are comfortable taking on such risks and have in place the appropriate AML/CFT/CPF safeguards. Making insurance payouts in digital form (i.e., paying out on insurance contracts in stablecoins or cryptocurrency) may be more unusual but again there is no specific bar to firms doing so. This is potentially more complex than simply accepting payments because it is likely to require insurers to purchase or hold in reserve suitable stablecoins or cryptocurrency, or to hedge its exposure to such payouts. As above, firms will need to ensure appropriate AML/CFT/CPF safeguards but this would not, on its own, constitute activity requiring a VASP licence. Carrying on virtual asset activities in the course of insurance business As covered in Section 5 (Custody) of this feedback paper, the Commission proposes to add a new category to the s40 (VASP) Notice disapplying the requirement to hold a VASP licence for insurance licensees who hold, transfer or invest in virtual assets in the course of carrying on insurance business as defined in Schedule 5 of the Insurance Business Law. This material change reflects the Commission’s commitment to decreasing regulatory burden where appropriate and enabling existing licensees to expand their services. Further consultation on the s40 (VASP) Notice For the sake of simplicity and clarity, the Commission plans to issue a s40 (VASP) Notice which consolidates the disapplication provisions related to LCF Part III (VASP) licensing into a single notice. The Commission invites feedback on the specific drafting of the proposed new s40 (VASP) Notice, a draft copy is attached to this Feedback Paper. Comments can be emailed to dfi@gfsc.gg by 31 August 2026. Please contact the Commission if you would like to discuss this further The s40 (VASP) Notice requires that persons wishing to benefit from the disapplication must meet certain conditions. Among these is the requirement to notify the Commission of the intention to carry out (for example) holding or transferring virtual assets and the Commission will maintain a register of persons who have notified the Commission of their intention to do so. They must also meet the minimum criteria for licensing which apply to LCF licensees

17 carrying out VASP activities and follow the relevant rules which apply to VASPs in respect of these activities. This means that firms will be expected to have suitable knowledge and skills to undertake the activity, and that they have appropriate insurance and capital. The requirements of the Handbook and the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 will continue to apply to the relevant virtual asset activity. Additional FAQs The Commission has also, alongside this feedback document, issued guidance (in the form of FAQs as set out below) for insurers on the use of stablecoins and virtual assets as payment for premiums and for payout of claims. As there is no barrier within the existing rules to such activity the Commission does not see any specific need to amend regulatory rules. FAQs Can insurance firms receive premiums in stablecoins or cryptocurrency? Yes, firms may accept payments in stablecoins or cryptocurrency and would not be classed as a VASP for so doing. There is nothing in the Commission’s rules to prohibit firms from accepting payment for insurance premiums in stablecoins or cryptocurrency. Insurance firms must recognise the risks involved in using alternative payment methods and also the potential volatility of cryptocurrencies. There must also be appropriate AML/CFT/CPF safeguards in place when receiving funds via stablecoins or cryptocurrency. Can insurance firms pay out claims in stablecoins or cryptocurrency? Yes, provided it is acceptable to the insured party. The Commission does not prohibit firms from paying out claims in stablecoins or cryptocurrency. Insurance firms must recognise the risks involved in using alternative payment methods and also the potential volatility of cryptocurrencies. There must also be appropriate AML/CFT/CPF safeguards in place when distributing funds via stablecoins or cryptocurrency. Can policy limits in a contract of insurance be expressed in cryptocurrency? Yes, if the premium will be accepted and/or payout will be made in that cryptocurrency. Firms should make customers aware of the possibility of conversion risk during all parts of the contract. For example, if a policy limit is expressed in both a fiat amount and the corresponding amount in cryptocurrency, the firm should make clear that amounts paid out in cryptocurrency may not equal the fiat amount at the point of payout. Treatment of stablecoins and virtual assets for insurance solvency purposes The Commission does not currently have specific rules which address the treatment of stablecoins in its solvency calculations. However, the Commission is open to the inclusion of suitable stablecoins for insurance solvency purposes. Suitable stablecoins means those which are properly reserved, always backed by appropriate reserve assets, redeemable on demand and suitably liquid. Insurance solvency requirements as a topic fall outside the direct focus of this consultation and subsequent feedback paper, however the starting point for the Commission’s approach is that

18 the treatment of stablecoins and virtual assets in general in the insurance framework should mirror their treatment in line with the Basel Committee on Banking Supervision’s (“BCBS”) approach in banking capital rules. While thus far we have not seen specific demand for stablecoins or other virtual assets to be permitted in solvency calculations, there may be requests to do so in future. The Commission will keep its rules under review to ensure they appropriately consider the accommodation of, for example, stablecoins without compromising its existing high standards for prudential regulation. Consultation Question SPIs and Tokenised ILS Q 6.2 Do respondents agree that guidance should be issued confirming that tokenised Insurance Linked Securities issued by SPIs do not fall within scope of the LCF Law? What additional regulatory changes or clarifications might be required to support the use of digital technology by SPIs? Overview of Feedback Received Respondents agreed that issuing tokenised ILS should not require a VASP licence and welcomed the Commission’s proposal to issue guidance to this effect. A number of suggestions were made by respondents regarding methods by which the Commission could help support the use of digital technology used by SPIs. This included requesting clarification of the regulatory treatment of “smart contract” based parametric trigger mechanisms within ILS structures, and amending the virtual assets definition to specifically exclude digital representations of ILS. Conclusion and Way Forward The Commission is, alongside this feedback paper, issuing FAQs confirming that tokenised ILS do not constitute virtual assets for the purposes of VASP licensing. The Commission notes the comments in respect of the use of “smart contracts” for trigger mechanisms within parametric insurance and ILS. It considers that such arrangements would fall within the existing insurance rules and are effectively an automation of existing contract and trigger mechanisms. There is nothing within the existing rules to bar such arrangements and no additional permissions or rule changes would be required. These arrangements would not fall within scope of the LCF or VASP rules. FAQs Can insurers use tokenised ILS contracts? Yes, the Commission is supportive of innovation in digital finance. Do tokenised Insurance Linked Securities (ILS) constitute virtual assets for the purpose of VASP licensing?

19 No, going forward, the Commission would not consider tokenised ILS to be a virtual asset for the purpose of VASP licensing. 7. Banking Background In the CP, we asked respondents about the treatment of cryptoassets and stablecoins under the banking framework’s capital rules. The Commission approached this from the perspective that banks should be permitted to hold digital assets on their balance sheet, that their treatment should be proportionate to the risks involved and in line with international standards. The BCBS treatment of digital assets distinguishes between different types of cryptoassets. In the BCBS classification, “Group 1” assets are those which are appropriately backed and linked to traditional assets and effectively stabilised. “Group 2” are all other cryptoassets, including unbacked cryptoassets (for example, bitcoin). The BCBS adopts a more generous approach to “Group 1” assets, for which there are no strict limits and whose risk weighting may be treated in line with the underlying assets, than for “Group 2” for which there are strict exposure limits and a very high capital risk weighting (1250%). Consultation Paper Question Q 7 What are respondents’ views on the adoption of specific capital rules for banks’ exposures to cryptoassets? How might banks’ exposures to licensed stablecoins be treated under this regime? Overview of Feedback Received Respondents supported the adoption of specific capital rules, and most felt they should mirror or closely align with the BCBS approach. There was a wider range of views on stablecoins. Some suggested that stablecoins should be considered equivalent to cash, others that they should be considered as “Group 1a” cryptoassets in the BCBS classification and therefore treated in line with the underlying assets. The overall tone of responses was broadly in favour of the BCBS approach, with less onerous treatment of stablecoins than unbacked cryptoassets. Conclusion and Way Forward The Commission’s existing approach aligns with the Basel framework. Nevertheless, there is recognition that the current Basel framework may be overly restrictive in respect of some digital assets and that it may not be sustainable in the longer term. The Commission intends to maintain its broad alignment with the Basel framework as that is important for the Bailiwick’s international standing. The Commission considers that it is perfectly reasonable for banks to hold digital assets on their balance sheet subject to appropriate disclosure of on (and off) balance sheet exposures. The treatment of individual digital assets will depend on their precise nature but broadly:

20 • Soundly backed stablecoins (that is, those issued by Guernsey-regulated issuers and those which comply with the US GENIUS Act) will be treated in line with the underlying reserve assets, subject to a requirement for such assets to be sufficiently liquid and unencumbered; • Other cryptoassets will be considered on their merits and risk weighted in line with the BCBS approach, but with an asset risk weighting of 1250% for any exposure in excess of 1% of tier 1 capital. While the Commission does not consider that all stablecoins are equal or that they should automatically be treated on a par with traditional deposits, it recognises that the risks associated with fully reserved stablecoins (that is, stablecoins that are 100% backed by suitable liquid assets with transparency as to the underlying assets) are materially different to the risks of unbacked cryptoassets. In line with this, banks may hold appropriately regulated and reserved asset-backed stablecoins on their balance sheets. Where such stablecoins meet the necessary criteria to be classified within “Group 1a” of the BCBS classification, banks may look through to the underlying reserve assets for their capital treatment. The Commission recognises that digital assets, however well backed and liquid their underlying assets, impose potentially new and unique risks compared to traditional assets. Banks will therefore be required to disclose holdings of digital assets in line with the BCBS classification. The Commission will require banks that wish to hold stablecoins to a value of more than 10% of their tier 1 capital to seek the Commission’s approval. The Commission’s bank reporting (BSL2) forms will be amended to include provisions for reporting digital assets. Stablecoins issued by issuers that hold appropriate reserve assets to maintain the stability of their value may qualify as Group 1a assets, be risk weighted accordingly and used for credit risk mitigation. Where there is appropriate transparency, banks may look through to the underlying reserve assets. Where the underlying assets (for example, cash, gilts or short-term repurchase agreements) meet the relevant criteria (such as for immediate availability) they may be permitted to be considered as High Quality Liquid Assets (“HQLA”). Stablecoins issued by Guernsey regulated payment stablecoin issuers will fall within Group 1 and are likely to be “Group 1a” within the BCBS classification, which means that banks may look through to the underlying reserve assets and the stablecoins may be considered in the same way as the underlying assets. The Commission will appropriately amend bank returns and reporting requirements to address the measurement, monitoring and governance of exposures to digital assets, along with policy procedures and controls for addressing issues and risks associated with digital assets. 8. Enhancing Anti- Financial Crime Compliance Through Technology Background

21 The CP explored how DLT, including “smart contracts”, could support customer due diligence (“CDD”) and monitoring. It also explored centralised CDD (including “portable KYC”) to enable sharing of customer information across firms. While domestic models exist, the development of solutions suitable for an international client base remains at an early stage, and views were sought on how these could evolve. Consultation Paper Questions DLT – “smart contracts” Q 8.2.1 What use could be made of “smart contracts” within a business’s anti￾money laundering, counter-terrorist financing and counter proliferation functions? Q 8.2.2 Where there is a use, please describe how a smart contract could be used, covering what controls or measures could be embedded within it and how that achieves compliance with requirements, such as obligations to identify and verify customers, including where enhanced customer due diligence applies for high-risk customers? Q 8.2.3 What are the challenges to a firm in developing and implementing blockchain technology for compliance use, including compatibility or integration issues with existing technologies in use within its control framework, such as document management and screening systems? Q 8.2.4 What areas of the Handbook could be enhanced to encourage take up of this technology within a firm’s AML/CFT/CPF controls. If so, how can those areas of the Handbook be enhanced? Q 8.2.5 What risks are there in the application of “smart contracts” within a firm’s AML/CFT/CPF controls? How might they be mitigated? Q 8.2.6 Are there specific money laundering, terrorist financing or proliferation financing risks presented by stablecoins, tokenised funds and securities and/or custody of digital assets which should be specifically considered in the Handbook? Overview of Feedback Received 8.2.1 Respondents saw “smart contracts” as a means of: • embedding controls into token transfers particularly through gating mechanisms (for example, restricting issuance/transfer of tokens to verified or “whitelisted” wallet addresses and blocking transfers where CDD is incomplete; and • confirming investor eligibility, for example completeness, of appropriate CDD or jurisdictional location.

22 These respondents cautioned that firms should ensure their existing internal systems can interact effectively with DLTs and that, while such technologies can enhance oversight mechanisms, it is important to maintain appropriate human oversight. They noted that improper implementation or system malfunction could pose prudential risks to the financial market and increase financial crime risk. Key use cases cited by respondents included: • automated sanctions screening and blocking; • automated Travel Rule3 compliance, and automatic triggers for enhanced due diligence (“EDD”) based on customer or jurisdictional risk indicators. Respondents highlighted controls such as: • enforced completion of CDD before wallet or account activation; • automated monitoring alerts to support the detection of unusual transactions or activity; and • audit functions to test automated reporting against underlying data and confirm that AML/CFT/CPF assessments have been completed. Several respondents noted the potential for immutable and readily accessible automated compliance attestations, exception-based reporting (including automatic blocks pending review where requirements are not met), and programmed prompts to refresh or revalidate CDD when needed. Respondents highlighted challenges in implementing and integrating “smart contracts”, including increased operational complexity, data protection considerations, and the need for specialised skills and operational resilience. Additional responses also focused on the need to segregate data between on-chain and off-chain storage. 8.2.2 Respondents generally agreed that “smart contracts” can support AML/CFT/CPF compliance by embedding preventative controls at the point of issuance, activation or transfer, such as gating transactions until CDD is complete, blocking activity where sanctions or high￾risk indicators arise and triggering enhanced due diligence for higher risk relationships. The prevailing view was that “smart contracts” should enforce outcomes that follow AML/CFT/CPF requirements, rather than perform CDD or EDD themselves, with identity verification, risk assessment and judgement staying off-chain. Respondents also emphasised the importance of strong governance, auditability, data protection safeguards and human oversight and cautioned against over-reliance on automation. 8.2.3 Overall, respondents said that the principal challenges in developing and implementing blockchain technology for compliance use relate less to on-chain code and more to integrating DLT workflows into existing control frameworks and off-chain document management. Compatibility issues were often linked to reliance on legacy systems for document management, sanctions screening, client onboarding and transaction monitoring, which may 3 This refers to the information that is to accompany payment or value transfers and related messages in accordance with Recommendation 16 of the Financial Action Task Force (“FATF”) Standards.

23 operate on batch processing and offer limited API connectivity (for example, interactions between different software and hardware solutions). This was noted as requiring middleware, data transformation and reconciliation. Respondents also highlighted practical delivery constraints, namely upfront cost and development timelines, with disproportionate impacts on smaller firms noted, as well as shortages of specialist skills spanning compliance and “smart contract” engineering, reliance on third-party vendors and wallet or platform providers, challenges with cross-chain interactions, and the use of public platforms, which some respondents noted could be mitigated through private platforms. A further set of challenges related to governance and assurance, including ensuring that “smart contracts” operate as intended through testing, code review, version control and change management, evidencing auditability, and maintaining resilience where compliance data and decisions are split across on-chain and off-chain components. Respondents also raised data protection and cross-border data considerations, including tensions between immutability and rights of correction or erasure, reinforcing a preference to keep personal data off-chain. In addition, several responses emphasised that “smart contracts” cannot assess intent or behavioural risk, underscoring the importance of human oversight, even where automated controls are deployed. 8.2.4 Respondents were broadly supportive of the enhancements to the Handbook proposed under question 8.1 of the CP and suggested further enhancements. Respondents said that uptake of blockchain and smart contract-enabled controls could be supported by greater clarity in the Handbook, while emphasising that the Handbook should retain its outcomes-focused approach. In particular, respondents sought explicit confirmation within the Handbook that technology-enabled AML/CFT/CPF controls, including DLT-based solutions, are acceptable where they achieve outcomes equivalent to traditional methods, in addition to the clearer guidance being provided on how electronic identification and verification tools can be used within CDD and when reliance on such evidence is appropriate. A further theme was the need for practical guidance on governance and assurance for automated controls, covering oversight, auditability, code review and change management, incident handling, and the circumstances in which human intervention is expected. Respondents also noted that many implementations will be hybrid in nature, combining on￾chain enforcement with off-chain screening, document management and analytics. In addition, respondents highlighted the value of clearer expectations on data protection, including keeping personal data off-chain and recording only non-identifying attestations on-ledger, acceptable methods of demonstrating control over blockchain addresses, and, where preferable to detailed Handbook amendments, the development or recognition of external standards, certifications or kitemarks, supported by early engagement with the Commission. 8.2.5 Respondents to this question identified over-reliance on automation as the key risk in applying “smart contracts” within AML/CFT/CPF controls, noting that such tools cannot substitute for human judgement, particularly in nuanced or high-risk cases. A related theme

24 was that “smart contract” controls are only as reliable as the code and the external inputs on which they depend, giving rise to risks from coding errors and weaknesses in data quality or data sources. Proposed mitigations centred on clear accountability and human oversight, supported by defined escalation frameworks and override mechanisms. Respondents also highlighted operational risks relating to governance, cyber security and data protection, and the need to keep smart contract logic aligned with evolving legal requirements. Proposed mitigations included secure development and testing practices, independent audit, robust access controls with monitoring and logging, contingency planning and fail-safes, and keeping personal data off-chain as best practice. 8.2.6 Respondents broadly indicated that no fundamental restructuring of the Handbook is needed to address risks associated with stablecoins, tokenised funds and securities, or the custody of digital assets, as they pose risks similar to more traditional arrangements. That said, respondents noted that clarification and guidance may be helpful in addressing risks specific to digital assets, including the speed and cross-border nature of stablecoin transactions, provenance, jurisdictional risks, traceability in self-hosted and un-hosted wallets and decentralised environments, and potentially the implementation of mechanisms to enable law enforcement authorities and financial institutions to monitor transactions and, where appropriate, freeze or burn tokens. Conclusion and Way Forward 8.2.1 The Commission believes that well-scoped and well-implemented “smart contracts” can enhance the efficiency and effectiveness of AML/CFT/CPF controls, while maintaining appropriate “human in the loop” oversight. Respondents identified a range of use cases for “smart contracts” in areas such as CDD, customer and transaction monitoring, sanctions screening and compliance monitoring. The Commission highlights, however, that “smart contracts” cannot entirely replace human judgement, and firms should avoid over-reliance on automated solutions to discharge AML/CFT/CPF compliance duties. For example, where automated sanctions screening is based on third-party lists, firms should ensure that data remains accurate and up to date. See Section 9 (Legal Certainty) for further information on the validity of “smart contracts”. 8.2.2 “Smart contracts” can offer rigorous controls throughout the transaction life cycle, from pre-coded rules to the immediate blocking of suspicious activity. The Commission recognises the potential benefits that “smart contracts” can bring to compliance. Effective implementation involves integration with existing digital infrastructure and the need for appropriately trained staff. 8.2.3 Both the implementation and maintenance of blockchain technology can be costly and time-consuming. Firms, particularly smaller ones, need a clear understanding of the process from start to finish and of the implications of adopting such technology. Ultimately, it is for each firm to decide whether bringing blockchain technology in-house is justified and alternative mechanisms to guidance, such as industry workshops or roundtables, could be a

25 more flexible and proportionate approach to addressing emerging questions and reducing the immediate need for formal guidance. 8.2.4 The Commission intends that the Handbook can continue to apply proportionately to firms of all sizes and to new and emerging technologies, without granular governance and assurance requirements. These issues are already addressed under the Commission’s principles-based Code of Corporate Governance. The Commission also notes calls for clearer expectations around data protection, which have been shared with the Office of the Data Protection Authority. 8.2.5 The Commission’s view is that technology cannot be relied upon in isolation. Risks can be mitigated through standard procedures such as project management, staff training, user testing and ongoing compliance monitoring to identify and address technical issues. This is a standard process which should be applied to all technology. 8.2.6 The Commission agrees that following the recent technology amendments to the Handbook in May, no major reform to the Handbook is needed, as it already requires firms to ensure that their risk assessments, monitoring systems and governance frameworks are adapted to address the characteristics and risks presented by digital assets. The Commission will consider whether further guidance should be added to the Handbook to cover the risk factors highlighted by respondents around stablecoins and un-hosted wallets, as well as to refer to relevant international publications, such as the FATF Targeted Report on Stablecoins and Un￾hosted Wallets. Consultation Paper Questions DLT - centralised CDD Q 8.3.1 How might a token be used in introduced customer relationships where the firm is relying on certain elements of the due diligence undertaken by another regulated firm to verify the identity of the customer and beneficial owner, and how might testing of this introduction be achieved? (see Chapter 10 of the Handbook on Introduced Business) Q 8.3.2 How might such a “portable KYC” token be developed which multiple financial services businesses with the appropriate permission could access to undertake their due diligence? Please elaborate on what regulatory elements could assist and what elements detract from such a development. How might such a central utility be established for a financial sector with an international client base? Overview of Feedback Received Respondents were cautiously supportive of using tokens in introduced business, primarily as a means of evidencing completed CDD without storing personal data on-chain. Views differed

26 on where responsibility should sit, though many emphasised that the relying firm should retain accountability, supported by clear standards and robust testing. A small minority opposed their use. There was broader support for “portable KYC” based on a centralised CDD utility, seen as a way to reduce duplication while maintaining firm-level decision-making. Key enablers identified included clear regulatory guidance, common standards and liability clarity, while legal uncertainty, data protection and cross-border issues were viewed as the main barriers. Respondents generally envisaged a regulator-supported, permissioned platform or consortium, aligned with global digital identity frameworks. Conclusion and Way Forward The Commission welcomes the feedback and recognises the potential for blockchain to support reliable introducer frameworks, subject to robust testing, clear CDD accountability and appropriate data protection. Tokens are understood to act as pseudonymised identifiers linking to off-chain CDD records. The feedback will inform potential future updates to Chapter 10 of the Handbook. The Commission also notes broad support for “portable KYC” solutions. While it does not have a mandate to oversee a central utility, it would support any Bailiwick initiative by helping to shape regulatory expectations and ensuring alignment with the Handbook. 9. Legal Certainty Background The Commission supports the sensible use of innovative technology, focusing on the substance of financial services activities and the adequacy of related controls. Guernsey’s legal framework, including the Electronic Transactions (Guernsey) Law, 2000 (“ET Law) and the Electronic Transactions (Electronic Agents) (Guernsey) Ordinance, 2019 (“2019 ET Ordinance”), confirms the legal validity and enforceability of electronic instruments and contracts. Through the CP, the Commission welcomed views on whether any legal enhancements may be appropriate. Consultation Paper Question Q 9 Does the jurisdiction’s underlying legal framework (outside the supervisory laws) provide the certainty around the use of digital assets and digital finance? What further improvements might be made to improve legal certainty around the use of digital assets and digital finance? Overview of Feedback Received Respondents generally considered Guernsey’s legal framework sufficiently flexible to accommodate digital assets, while suggesting incremental refinements and clarifications. Key areas included: Topic Feedback Received

27 Cross-border dispute mechanisms Service out of the jurisdiction in disputes involving pseudonymous defendants should be expressly permitted, noting recent developments in case law in both the UK and other common law jurisdictions4 . Legal status of digital assets as property Consider confirming via explicit legislation that digital assets can be objects attracting personal property rights (including trust property). Treatment of “smart contracts” The ET Law should: • confirm that a “smart contract” constitutes a binding contract, provided standard contract formation requirements are met. • explicitly address the enforceability of self-executing contract arrangements, distinct from electronic agents. Updates to the Electronic Transactions (Exemptions) Order, 2001 (“2001 ET Order”) The list of exceptions set out in the 2001 ET Order could benefit from modernisation. Insolvency treatment of digital assets Generally, it is important for there to be clear treatment of digital assets and private keys in insolvency, including confidence that segregated client assets or reserves may be held in trust. Enforceability of security interests over such assets The legal framework could more explicitly confirm that security interests over digital assets are enforceable. Conclusion and Way Forward Feedback received reinforces the Commission’s view that Guernsey already has a strong legal foundation for digital finance activity. For clarity, the Guidance Note on Tokenisation, issued alongside this Feedback paper, includes a section outlining aspects of the existing legal and regulatory framework that support innovation in digital finance. That section confirms that the Companies (Guernsey) Law, 2008 and the Limited Partnerships (Guernsey) Law, 1995 permit company records, including registers of members or limited partners, to be maintained in electronic form, provided they are capable of being reproduced in hard copy (for membership registers) or in a legible form (for registers of partnership interest) on request. Accordingly, where such records are natively issued and maintained on a blockchain, a parallel off-chain register is not required under Guernsey law. On this basis, the Commission has concluded that no broader changes to the legal framework and regulatory framework are needed to support digital finance activity in the Bailiwick. 4 Examples of such developments include the English High Court’s approval of service of court documents to an anonymous party by way of non-fungible token (“NFT”) in the case of Osbourne v Persons Unknown Category A [2023] EWHC 39. (KB), and the similar approval of the District Court of New York of service of court documents to an anonymous party by way of an NFT sent to a Bitcoin wallet in the case of LCX AG v. John Does Nos. 1–25 (S.D.N.Y., 2022).

28 One possible exception relates to the 2001 ET Order, which was most recently updated on 14 April 2026, albeit with limited changes. Considering developments in digital adoption (for example, in relation to declarations of trust), the Commission considers that there may be merit in reviewing the scope of existing exemptions. Feedback on this point has been shared with the States of Guernsey for consideration. 10. Other Feedback Background The CP set out a range of proposals intended to support digital finance in the Bailiwick. In this section of that paper, the Commission invited views on more areas where regulatory policy could be introduced or adapted to support high-quality digital finance activity. Consultation Paper Question Q 10 Are respondents aware of other areas of regulatory policy that might be created or amended that would facilitate good quality digital finance activity in the Bailiwick? If so, please provide details. Do you have any other comments? Overview of Feedback Received Respondents used this question to provide feedback across a range of topics. Where comments were provided, respondents generally suggested targeted clarification or guidance (for example, on outsourcing and third-party service providers), proportionate refinements, and highlighted benefits of international alignment for Guernsey’s digital finance framework. Overall, responses were supportive of the Commission’s overarching principle, as included in the CP, of “same activity, same risk, same regulatory outcome”, as well as its open and collaborative approach. Several respondents stressed the importance of cross-border access, including alignment or equivalent with frameworks in other jurisdictions (notably the US and UK). Some respondents said it was important the Commission remained open to innovation, including emerging models such as decentralised autonomous organisation (“DAO”) and DeFi, and asked for more policy clarity. Some raised more specific points, including whether annual regulatory fees could be paid in cryptoassets. Conclusion and Way Forward The Commission appreciates the breadth of feedback received and is encouraged that respondents did not identify fundamental gaps or material barriers within the existing framework. Suggestions for clarification, guidance and incremental refinement have been noted and will inform policy development. While some respondents highlighted potential value in further clarity for DAO and DeFi models, the Commission does not currently intend to introduce a specific policy framework in this area.

29 Market access is a priority for the Commission, in line with the Finance Sector Growth Strategy 2035 report (February 2026). The Commission sees that international alignment supports cross￾border activity and will take this into account in any refinements, while maintaining Guernsey’s position as a trusted and agile jurisdiction. The Commission is conscious that digital innovation is ever evolving and remains open to further engagement as appropriate, including in emerging areas such as tokenised deposits and vaults. The Commission is also supportive in principle of permitting payment of annual regulatory fees in a Guernsey-regulated stablecoin, subject to appropriate safeguards and adjustment for conversion costs. Implementation and Engagement Digital finance presents many of the same risks as traditional finance, although these may arise to a different degree and may introduce additional technology-related considerations, including reliance on outsourcing arrangements with third-party providers not traditional to finance. The Commission is not seeking to create a risk-free environment. Rather, it aims to support innovation while maintaining confidence in the Bailiwick and ensuring that risks are appropriately identified and managed. The actions set out in this paper have been developed with these objectives in mind. Feedback to the consultation consistently reinforced that the Bailiwick is a reputable jurisdiction in which to pursue innovative ideas in the digital finance space, supported by a strong regulatory framework, a clear legal environment, and a robust and internationally recognised AML/CFT/CPF regime, as reflected in the positive outcomes of the Bailiwick’s recent MONEYVAL assessment. The measures outlined in this paper are intended to build on this foundation and support the continued development of digital finance-related activity in a responsible and sustainable manner. Next steps include: • progressing the development of a stablecoin framework and working with the States of Guernsey to implement necessary legislative changes. Further feedback on this section of the CP will follow in Autumn 2026; • making targeted updates to various regulatory forms to improve data collection on digital finance-related activity; • continuing engagement with industry through the Digital Forum, including roundtables on emerging technologies, regulatory priorities, and strategic opportunities, as appropriate. Details of future roundtables will be published on the Commission’s website: Digital Finance Initiative — GFSC. Firms considering innovative business models are encouraged to engage with the Commission and consider its Innovation Sandbox + Concierge Service, which was enhanced following feedback received during the consultation. Further information is available on the Commission’s website: Innovation Sandbox + Concierge — GFSC.

30 The Commission thanks those who participated in the consultation and looks forward to continuing constructive engagement with stakeholders in support of the Bailiwick’s digital finance objectives.

31 Appendix 1. s40 (VASP) Notice Further consultation on the s40 (VASP) Notice For the sake of simplicity and clarity, the Commission plans to issue a s40 (VASP) Notice which consolidates the disapplication provisions related to LCF Part III (VASP) licensing into a single notice. The Commission invites feedback on the specific drafting of the proposed new s40 (VASP) Notice, Comments can be emailed to dfi@gfsc.gg by 31 August 2026. Please contact the Commission if you would like to discuss this further. Text which is new or revised from the previous notice is highlighted in blue.

32 DRAFT Notice with respect to the disapplication of the requirement to hold a licence under section 40 of the Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 (“s40 (VASP) Notice”) Pursuant to Section 40 of the Lending, Credit and Finance (Bailiwick of Guernsey) Law (“the Law”) and following consultation with the Policy & Resources Committee of the States of Guernsey in accordance with Subsection 40(1), the Guernsey Financial Services Commission (“the Commission”) intends to disapply the requirement to hold the following licences, issued under the Law, in the following specific circumstances. In this Note terms follow the definition given to them in the Law, except where a contrary position is expressed. In order to benefit from a disapplication of the licensing requirement in Part III of the Law provided for by this Notice (except for exemption (I) below), a person must: (i) Notify the Commission of their intention to carry out activities in connection with virtual assets both before commencing such activities and when they cease to do so; (ii) Follow the rules5 set out in Part 10 of the Lending, Credit and Finance Rules, 2023; (iii) Meet the minimum criteria for VASP licensing as set out in Schedule 4 to the Law; (iv) Follow the Principles of Conduct of Finance Business as set out in Schedule 1 to the Lending, Credit and Finance Rules, 2023; (v) Provide such information as may be requested from time to time by the Commission in annual returns and other returns, and on an ongoing, ad hoc basis. The requirement to hold a licence as a Virtual Asset Service Provider (VASP) in accordance with Part III of the Law is disapplied and the following classes of person do not require a licence under Part III of the Law: I. Persons who make investments, hold, or trade in virtual assets for their own benefit. Note that this disapplication will not apply to persons, or persons within groups, offering products or services related to virtual assets6 . II. Licensees, who hold a licence under the Regulation of Fiduciaries, Administration Businesses and Company Directors, etc (Bailiwick of Guernsey) Law, 2020, in the course of providing administration or management services, as services offered under that licence, to VASPs which either hold a Part III VASP licence issued under the Law or are exempt under (I). 5 The LCF VASP rules comprise pages 74-80 of the LCF Rules (Part 10, rules 10.1-10.4) which are under revision. The changes will delete rules 10.1, 10.2(1) and 10.3 and the initial section of guidance on page 74. 6 The Commission will work with the P&R Committee to request that it issues regulations to amend the LCF Law. Should this occur then exemption (1) will become redundant. See Section 1 for more detail.

33 III. Licensees, who hold a licence under the Protection of Investors (Bailiwick of Guernsey) Law, 2020, in the course of providing administration or management services, as services offered under that licence, to VASPs which either hold a Part III VASP licence issued under the Law or are exempt under (I). IV. Licensees, who hold a licence under the Insurance Managers and Insurance Intermediaries (Bailiwick of Guernsey) Law, 2002, in the course of providing administration or management services, as services offered under that licence, to VASPs which either hold a Part III VASP licence issued under the Law or are exempt under (I). V. Licensees who hold a licence under the Protection of Investors (Bailiwick of Guernsey) Law, 2020 (‘PoI Law’) and who hold, transfer or invest in virtual assets in the course of carrying on restricted activity within the meaning of the PoI Law. VI. Licensees, who hold a licence under the Insurance Business (Bailiwick of Guernsey) Law, 2002, or under the Insurance Managers and Insurance Intermediaries (Bailiwick of Guernsey) Law, 2002, who hold, transfer or invest in virtual assets in the course of carrying on insurance business as defined in Schedule 5 of the IBL. Guidance The purpose of these provisions is to: • where appropriate, reduce the need for dual licensing where activities are carried out by persons licensed and regulated under PoI/Insurance Laws; • ensure that such activities are properly regulated and overseen; and • require that persons benefitting from the disapplication meet the minimum requirements for licensing in respect of VASP activities. Note that the Handbook on Countering Financial Crime7 and the relevant provisions of the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 will apply to persons carrying out these activities – irrespective of whether they are specifically licensed for that activity. 7 Handbook on Countering Financial Crime (AML/CFT/CPF) — GFSC

34 Appendix 2. Updated Lending Credit & Finance Rules & Guidance This appendix sets out changes to Part 10 of the Lending Credit & Finance, Rules and Guidance 2022 for LCF Part III (VASP) Licensees further to the Commission’s consultation paper on Digital Finance and this feedback paper. This Appendix contains: A. A marked up copy of the Part 10 (“VASP”) rules, highlighting the changes resulting from the Commission’s consultation and this feedback document. B. A black letter (clean) version of the revised rules. The revised rules are intended to come into effect on 1 October 2026 unless otherwise specified.

35 Appendix 2a. Marked up version of Part 10, VASP Rules Part 10: PART III VASP LICENCES 10.1 Requirements for multiple licences (1) Holders of licences, issued under any of the regulatory Laws, who carry on activities regulated under Part III VASPs, must hold a Part III VASP Licence. 10.2 Applications and regulated activities (1) Part III VASP licensees are only permitted to provide VASP services to institutional and wholesale counterparties. (2) Part III VASP licensees are prohibited from dealing in, trading in, or offering – (a) virtual assets, or virtual asset services, which aim to obscure the parties to the transaction; or (b) virtual assets, or virtual asset services, which aim to obscure the flow of the assets. Guidance While Part III VASP licensees may not deal directly with individuals, they may provide products and services that are intended for use by individuals, on the condition that such products and services are provided through a properly regulated intermediary. Part III VASP licensees will be required to seek the Commission’s written ‘no objection’ before appointing an intermediary to distribute their products or services. Part III VASPs must not offer products or services that are targeted at retail customers, even through an intermediary.

36 (3) Applications for licences must specify the VASP activities which the applicant intends to engage in. (4) Licensees must not engage in any VASP activities not specified on the original licence application, without the prior, written, approval of the Commission. (5) Part III VASP Licensees must only undertake the regulated activities permitted in accordance with their licence. Guidance Definition of virtual assets and virtual asset service providers The Law defines virtual assets and the activities that constitute being a virtual asset service provider when offered, or carried out, by way of business. These definitions should be interpreted broadly. The definition of ‘virtual assets’ (“VAs”) states that it does not include – “…digital representations of – (a) fiat currencies, or (b) general securities and derivatives within the meaning of category 2 in Schedule 1 to the Protection of Investors Law and other financial assets.” Digital representations of fiat currency and general securities or derivatives is intended to cover digital records of ownership, such as bank accounts in digital form and digital security registers. It would also include central bank digital currencies. It would not include stablecoins or virtual asset securitisations of real assets. If in doubt, please contact the Commission. The Law defines VASP activities as follows – “(a) exchange between virtual assets and fiat currencies, (b) exchange between one or more forms of virtual asset, (c) transfer of virtual assets, (d) safe-keeping and/or administration of virtual assets or instruments enabling control over virtual assets,

37 Guidance – continued (e) participation in and provision of financial services relating to an issuer’s offer and/or sale of a virtual asset (including, without limitation and by way of example, an initial coin offering), whether by the issuer of the asset or a service provider affiliated or unaffiliated with the issuer in respect of the issue, offer, sale, distribution, ongoing market circulation and trading of the asset (including book-building, underwriting and market making),…” These activities should also be interpreted broadly and generally in line with the definitions within the FATF Standards and Recommendations. Activity (a) of the definition of a VASP refers to any activity in which VAs can be given in exchange for fiat currency or vice versa. If parties can pay for VAs using fiat currency, or can pay using VAs for fiat currency, carrying out this activity when acting by way of business is acting as a VASP. Similarly, in activity (b), if parties can use one kind of VA as means of exchange or form of payment for another VA, carrying out this activity, when acting by way of business, is acting as a VASP. It should be emphasised that activities (a) and (b) include the above activities regardless of the role the business plays vis-à-vis its users as a principal, as a central counterparty for clearing or settling transactions, as an executing facility, or as an intermediary facilitating the transaction. A person does not have to carry out every element of the exchange or transfer in order to qualify as a VASP, so long as it conducts the exchange activity by way of business. Activity (c) of the definition of a VASP covers any activity that transfers ownership, or control, of a VA to another user, or transfers VAs between VA addresses or accounts held by the same user. “Transfer” includes moving a virtual asset from one virtual asset address or account to another. To help illustrate what this covers in practice, it is useful to consider the nature of the VA following a purported transfer. If a new party has custody or ownership of the VA, has the ability to pass control of the VA to others, or has the ability to benefit from its use, then transfer is likely to have occurred. This control does not necessarily have to be unilateral and multi-signature processes are not inherently excluded. Similarly, if a person maintains unilateral control of their assets at all times, this may indicate that “transfer” has not occurred. However, it could still fall under activity where it actively facilitates the transfer. This also includes transfers between and among users of the same VASP, including where a VASP uses an off-chain internal record￾keeping system, and the VA remains in the same on-chain omnibus wallet or account.

38 Guidance – continued As noted in the definition, activity (e) includes activities related to Initial Coin Offerings (“ICOs”) in particular, participation in an issuer’s offer, or sale of, VAs and the provision of financial services in relation to the same. For the avoidance of doubt, financial services include activity such as promoting the issue or sale of virtual assets. For clarity, the sole act of issuing a VA, entirely on its own, is not a VASP activity. However, any person who carries out activities of transfer or exchange, by way of business, in relation to that VA would be a VASP. The discrete act of creating VA software to issue a VA does not make the creator a VASP, unless the creator also performs the VASP activities mentioned in the definition by way of business. When considering whether a potential licensee is carrying out VASP activities, the Commission will take a functional approach by focussing on the real and economic effect of a potential licensee’s business model and activities – and less on terminology or legal structure. For example, outsourcing the carrying out of an activity to a group company, or third party, would not remove the need for a licence. However, providing services to a VASP, such as IT support services, cloud services, and administration services would not require a Part III VASP licence (if the service provider does not itself carry out any of the VASP activities). In most cases a merchant that accepts payment for goods or services in VAs, or a charity that accepts donations in VAs, would not be carrying out a VASP activity, as this is generally done by using an intermediary that converts the virtual assets into fiat currency. However, the firm that facilitates the payment between the purchaser and the merchant is likely to be carrying out VASP activities. Businesses and charities that accept virtual assets should take care that they are not used as a means to exchange VAs into fiat currency by, for example, bad actors making multiple purchases or transactions, in VAs, then requesting refunds in fiat currency. For the avoidance of doubt, VAs do not include – • a transaction in which a person grants value as part of a store or gift card, affinity or rewards programme, where said value cannot be taken from or exchanged with the person for legal tender, bank credit, or any digital asset; or • a digital representation of value issued by or on behalf a publisher of games and used solely within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform. The above bullet points should be read as a general description and guide, not a strict definition as there may well be a number of “on the edge” cases. If in doubt, firms should contact the Commission. Application and licensing process

39 10.3 Environmental declaration (1) Part III VASP Licensees must publish information, annually, about the environmental impact of the consensus mechanisms of each virtual asset (“VA”) with which they deal; the environmental declaration. (2) Where a consensus mechanism requires the material consumption of resources, such as electrical or computational power, the environmental declaration relating to that VA must include – (a) the carbon emissions and energy consumption of all VA transactions carried out by, or on behalf of, the licensee; (b) indirect carbon emissions generated by VA transactions carried out by, or on behalf of, the licensee; and Guidance – continued Application and licensing process The Commission intends to use its Saoundbox approach when considering potential Part III VASP licensees. As part of this process, when the Commission initially grants a licence to a VASP applicant it will, in most cases, have a limited duration and may be subject to a number of conditions. These conditions may include, without limitation – • restrictions on the volume of business the firm can carry out; • restrictions on the kinds of business the firm can carry out; • more frequent reporting requirements; and • additional capital and liquidity requirements. Following completion of the initial period of licensing, the Commission will decide whether to renew or extend the licence, how long for, and whether to amend any of the restrictions. Given the diverse nature of potential VASP business models and activities, as part of this process the Commission may set additional requirements based on the business model and risk profile of potential licensees. Capital and conduct requirements and Rules for a virtual asset exchange are likely to be very different to those for a virtual asset custodian, for example.

40 (c) information regarding the method of calculation and the source of data used in the calculation. (3) The declaration must include gross emissions as well as mitigated emissions. (4) The licensee must ensure that, where estimations are used, this is noted and that they are prudent. (5)The period covered by the declaration must be the licensee’s financial year. Annual environmental disclosures must remain readily accessible to the public and, where the licensee chooses to meet its disclosure requirements by publishing information on its website, the location must be clear and easily accessible to the public. Guidance All disclosures should remain published and accessible. Licensees can make use of publicly available data and sources when calculating their emission and energy consumption but should consider the reliability of such sources and whether any assumptions are prudent and not overly optimistic. If data for part of the calculation is not available, licensees should work on a best efforts basis, while assuring any assumptions they make are prudent. Indirect carbon emissions generated by VA transactions include, but are not limited to, emissions from the production of e-waste. Examples of consensus mechanisms that consume resources include Proof of Work, which wastes computational power and electricity, and Proof of Space, which wastes storage space on electronic data storage systems (such as hard drives). The environmental declaration includes Scope 1, 2 and 3 emissions, as set out by the Task Force on Climate-related Financial Disclosures.

41 10.4 Safekeeping of customer virtual assets (1) A Part III VASP Licensee which has custody of a customer’s virtual assets must – (a) keep safe, or arrange for the safekeeping by an eligible custodian, of – (i) any documents of title; (ii) cryptographic keys; or (iii) any other means of control, either over the customer’s virtual assets or relating to them; (b) ensure that virtual assets, bought or held for a customer in the course of conducting its VASP business, are properly recorded in the customer’s name or, with the customer’s consent, in the name of an eligible custodian or nominee with the addition, where appropriate, of an account designation name, or number, which is unique to the customer; (c) ensure that customer entitlements, to virtual assets, are identifiable from those in the beneficial ownership of the licensee, and any other customer of the licensee; (d) not use a customer’s virtual assets for its own account unless it has obtained that customer’s explicit, prior, written consent; (e) where the licensee holds customers virtual assets with a nominee of the licensee, accept responsibility for the acts or omissions of that nominee; (f) not lend, or arrange the lending, of a customer’s virtual assets to a third party, unless – (i) the customer has consented, in writing, and the loan is subject to appropriate documented terms and conditions specific to the agreement with that customer; (ii) where customers virtual assets belonging to more than one customer are registered in the same name, each customer whose virtual assets are so registered has consented, in writing, to the lending of customer virtual assets registered in that name and each customer’s entitlement is clearly ascertained; (iii)adequate collateral is obtained and maintained for the duration of the loan, in accordance with any written instructions given by the customer; and (iv)the licensee arranges for all income, inclusive of dividends, fees, or commissions; other than any fees payable to the licensee for arranging the loan; either to be paid to the customer direct or to be received, by the licensee, on the customer’s account and treated as customer money unless the customer instructs otherwise.

42 Appendix 2b. Clean version of revised Part 10 VASP rules 10.1 Requirements for multiple licences [DELETED] 10.2 Applications and regulated activities (1) [DELETED] (2) Part III VASP licensees are prohibited from dealing in, trading in, or offering – (a) virtual assets, or virtual asset services, which aim to obscure the parties to the transaction; or (b) virtual assets, or virtual asset services, which aim to obscure the flow of the assets. (3) Applications for licences must specify the VASP activities which the applicant intends to engage in. (4) Licensees must not engage in any VASP activities not specified on the original licence application, without the prior, written, approval of the Commission. (5) Part III VASP Licensees must only undertake the regulated activities permitted in accordance with their licence. Guidance – VASP activities The Law defines VASP activities as follows – (a) exchange between virtual assets and fiat currencies, (b) exchange between one or more forms of virtual asset, (c) transfer of virtual assets, (d) safe-keeping and/or administration of virtual assets or instruments enabling control over virtual assets, (e) participation in and provision of financial services relating to an issuer’s offer and/or sale of a virtual asset (including, without limitation and by way of example, an initial coin offering), whether by the issuer of the asset or a service provider affiliated or unaffiliated with the issuer in respect of the issue, offer, sale, distribution, ongoing market circulation and trading of the asset (including book￾building, underwriting and market making),…” Guidance cont’d

43 These activities should also be interpreted broadly and generally in line with the definitions within the FATF Standards and Recommendations. Activity (a) of the definition of a VASP refers to any activity in which VAs can be given in exchange for fiat currency or vice versa. If parties can pay for VAs using fiat currency, or can pay using VAs for fiat currency, carrying out this activity when acting by way of business is acting as a VASP. Similarly, in activity (b), if parties can use one kind of VA as means of exchange or form of payment for another VA, carrying out this activity, when acting by way of business, is acting as a VASP. It should be emphasised that activities (a) and (b) include the above activities regardless of the role the business plays vis-à-vis its users as a principal, as a central counterparty for clearing or settling transactions, as an executing facility, or as an intermediary facilitating the transaction. A person does not have to carry out every element of the exchange or transfer in order to qualify as a VASP, so long as it conducts the exchange activity by way of business. Activity (c) of the definition of a VASP covers any activity that transfers ownership, or control, of a VA to another user, or transfers VAs between VA addresses or accounts held by the same user. “Transfer” includes moving a virtual asset from one virtual asset address or account to another. To help illustrate what this covers in practice, it is useful to consider the nature of the VA following a purported transfer. If a new party has custody or ownership of the VA, has the ability to pass control of the VA to others, or has the ability to benefit from its use, then transfer is likely to have occurred. This control does not necessarily have to be unilateral and multi-signature processes are not inherently excluded. Similarly, if a person maintains unilateral control of their assets at all times, this may indicate that “transfer” has not occurred. However, it could still fall under activity where it actively facilitates the transfer. This also includes transfers between and among users of the same VASP, including where a VASP uses an off-chain internal record-keeping system, and the VA remains in the same on-chain omnibus wallet or account. As noted in the definition, activity (e) includes activities related to Initial Coin Offerings (“ICOs”) in particular, participation in an issuer’s offer, or sale of, VAs and the provision of financial services in relation to the same. For the avoidance of doubt, financial services include activity such as promoting the issue or sale of virtual assets.

44 Guidance – continued For clarity, the sole act of issuing a VA, entirely on its own, is not a VASP activity. However, any person who carries out activities of transfer or exchange, by way of business, in relation to that VA would be a VASP. The discrete act of creating VA software to issue a VA does not make the creator a VASP, unless the creator also performs the VASP activities mentioned in the definition by way of business. When considering whether a potential licensee is carrying out VASP activities, the Commission will take a functional approach by focussing on the real and economic effect of a potential licensee’s business model and activities – and less on terminology or legal structure. For example, outsourcing the carrying out of an activity to a group company, or third party, would not remove the need for a licence. However, providing services to a VASP, such as IT support services, cloud services, and administration services would not require a Part III VASP licence (if the service provider does not itself carry out any of the VASP activities). In most cases a merchant that accepts payment for goods or services in VAs, or a charity that accepts donations in VAs, would not be carrying out a VASP activity, as this is generally done by using an intermediary that converts the virtual assets into fiat currency. However, the firm that facilitates the payment between the purchaser and the merchant is likely to be carrying out VASP activities. Businesses and charities that accept virtual assets should take care that they are not used as a means to exchange VAs into fiat currency by, for example, bad actors making multiple purchases or transactions, in VAs, then requesting refunds in fiat currency. For the avoidance of doubt, VAs do not include – • a transaction in which a person grants value as part of a store or gift card, affinity or rewards programme, where said value cannot be taken from or exchanged with the person for legal tender, bank credit, or any digital asset; or • a digital representation of value issued by or on behalf a publisher of games and used solely within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform. The above bullet points should be read as a general description and guide, not a strict definition as there may well be a number of “on the edge” cases. If in doubt, firms should contact the Commission.

45 10.3 Environmental declaration [DELETED] Guidance – continued Application and licensing process The Commission intends to use its Sandbox approach when considering potential Part III VASP licensees. As part of this process, when the Commission initially grants a licence to a VASP applicant it will, in most cases, have a limited duration and may be subject to a number of conditions. These conditions may include, without limitation – • restrictions on the volume of business the firm can carry out; • restrictions on the kinds of business the firm can carry out; • more frequent reporting requirements; and • additional capital and liquidity requirements. Following completion of the initial period of licensing, the Commission will decide whether to renew or extend the licence, how long for, and whether to amend any of the restrictions. Given the diverse nature of potential VASP business models and activities, as part of this process the Commission may set additional requirements based on the business model and risk profile of potential licensees. Capital and conduct requirements and Rules for a virtual asset exchange are likely to be very different to those for a virtual asset custodian, for example.

46 10.4 Safekeeping of customer virtual assets (1) A Part III VASP Licensee which has custody of a customer’s virtual assets must – (a) keep safe, or arrange for the safekeeping by an eligible custodian, of – (i) any documents of title; (ii) cryptographic keys; or (iii) any other means of control, either over the customer’s virtual assets or relating to them; (b) ensure that virtual assets, bought or held for a customer in the course of conducting its VASP business, are properly recorded in the customer’s name or, with the customer’s consent, in the name of an eligible custodian or nominee with the addition, where appropriate, of an account designation name, or number, which is unique to the customer; (c) ensure that customer entitlements, to virtual assets, are identifiable from those in the beneficial ownership of the licensee, and any other customer of the licensee; (d) not use a customer’s virtual assets for its own account unless it has obtained that customer’s explicit, prior, written consent; (e) where the licensee holds customers virtual assets with a nominee of the licensee, accept responsibility for the acts or omissions of that nominee; (f) not lend, or arrange the lending, of a customer’s virtual assets to a third party, unless – (i) the customer has consented, in writing, and the loan is subject to appropriate documented terms and conditions specific to the agreement with that customer; (ii) where customers virtual assets belonging to more than one customer are registered in the same name, each customer whose virtual assets are so registered has consented, in writing, to the lending of customer virtual assets registered in that name and each customer’s entitlement is clearly ascertained; (iii)adequate collateral is obtained and maintained for the duration of the loan, in accordance with any written instructions given by the customer; and (iv)the licensee arranges for all income, inclusive of dividends, fees, or commissions; other than any fees payable to the licensee for arranging the loan; either to be paid to the customer direct or to be received, by the licensee, on the customer’s account and treated as customer money unless the customer instructs otherwise.