JCBA Organizes 347 Items for Management of Outsourced Cryptocurrency Assets, Establishing Key Management as an Independent Domain

Key Points of This Article

• JCBA publishes draft of security measures for outsourcing partners
• Five categories for handling private keys
• After soliciting opinions, revisions will consider trends in amended Financial Instruments and Exchange Act

Adapting Existing Guidelines from the Perspective of Outsourcing Partners

On the 20th, the Japan Cryptocurrency Business Association (JCBA) announced the establishment of a working group (WG) focused on managing outsourced operations related to cryptocurrency assets. They also published a draft of a "Practice Collection" summarizing the security measures that outsourcing partners should implement.

The focus is on cases where important systems such as wallets, key management, and transaction signature management are entrusted to external businesses. Existing guidelines, including the "Reoccurrence Prevention Inspection List Concept" from the Japan Virtual Currency Exchange Association (JVCEA), have been written for cryptocurrency exchange operators who outsource. The Practice Collection reinterprets these requirements from the perspective of what the outsourcing partners providing the systems should undertake.

The total number of items is 347. Each item is paired with examples of potential risks, points for verification, and examples of documentation that should be provided, described using vocabulary commonly used in audit practices.

Key Management, Signature Operations, and Five Provision Types

The scope of the organization covers ten areas, including governance, human and physical security, BCP (Business Continuity Planning), and management of subcontractors. Among these, the unique area of "key management and signature operations" is treated as an independent domain, addressing key generation and storage, separation of cold and hot wallets, and verification at the time of withdrawal.

The provision types for outsourcing partners are divided into five categories: "holding type," "intermediary type," "supply type," "reference type," and "other." Whether or not the private key is held and the extent of direct impact on the system serve as the criteria for classification. Guidelines for verification items for each type are provided to prevent excessive demands or omissions in verification. A "self-assessment sheet" that displays applicable items when a partner selects their type, and an "audit trail management ledger" for managing verification documents are included as Excel files.

JCBA points out that general third-party assurance reports like SOC2 cannot adequately evaluate the unique arrangements for managing the lifecycle of private keys. The aim is to create a foundation where stakeholders, including the Financial Services Agency and audit firms, can discuss using the same terminology by aligning the verification items that were previously disparate between exchange operators and outsourcing partners.

Background of Incidents Involving Outsourcing Partners

In the industry, the practice of outsourcing wallet management and signature systems to external specialized businesses has become established. JCBA recognizes that cyberattacks targeting such outsourcing partners and asset leaks have been frequent in recent years, stating that "strengthening the entire supply chain is an urgent task." While JCBA does not mention specific incidents, it notes that in May 2024, approximately 48.2 billion yen worth of Bitcoin (BTC) was leaked from DMM Bitcoin. The National Police Agency has identified the incident as being perpetrated by a North Korean hacker group, revealing that the attackers had contacted employees of a company that develops wallet management software.

The WG is chaired by Mayu Suda, a partner at PwC Japan LLC, and includes participants from wallet operators and audit firms. The draft will solicit opinions from exchange operators, wallet service providers, and audit firms, and will be revised considering the trends in the establishment of ordinances and guidelines under the amended Financial Instruments and Exchange Act. Opinions are accepted through a dedicated form on the JCBA website. The materials are available on the official JCBA website.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.