Bermuda Tightens Digital Asset Custody Rules and Proposes DABA Amendments

Bermuda's Digital Asset Business Act, one of the first comprehensive crypto regulatory frameworks when it passed in 2018, is getting its first serious overhaul. The Bermuda Monetary Authority introduced binding custody rules in February 2025 and proposed DABA amendments that would expand its intervention powers. For an island that licensed Circle and Jewel Bank before most jurisdictions had written their first crypto guidance note, these changes signal a shift from attracting entrants to supervising them.

The custody rules

The BMA's custody rules, effective February 2025, impose three requirements that will force operational changes at most licensed custodians. Client assets must be segregated from the firm's own holdings. Pooling of client assets, a common practice for operational efficiency, now requires explicit client consent. And third-party custodians must undergo enhanced due diligence, not just at onboarding but on an ongoing basis.

The segregation requirement sounds basic. In practice, many crypto custodians have operated with omnibus wallet structures where client assets commingle. Unpicking those arrangements while maintaining service continuity is expensive and technically complex. Firms that built their custody architecture before these rules existed face the most work.

DABA amendments on the table

The BMA closed a public consultation on DABA amendments in December 2024, the first significant proposed changes since the Act passed. Three proposals stand out.

The definition of "control" over client assets is getting rewritten to capture arrangements that technically fell outside the original custody framework. BMA wants the power to require wind-down plans, additional capital, and liquidity buffers from individual licensees, without needing to amend the rules each time. And the Act would clarify what constitutes a "material change" to a firm's business plan, closing a gap where some licensees argued that adding new products did not trigger a notification requirement.

These are not cosmetic tweaks. The wind-down and capital powers give BMA a tool it currently lacks: the ability to intervene before a licensed entity becomes a problem rather than after.

Stablecoins get their own framework

Separately, the BMA published stablecoin guidance in November 2024 requiring issuers to maintain full reserves in high-quality liquid assets and submit monthly independent attestation reports. Monthly attestation, not quarterly. That frequency alone sets Bermuda apart from jurisdictions where reserve disclosures happen on looser schedules or not at all.

The guidance also targets the quality of reserves. HQLA means government securities and cash equivalents, not the mix of commercial paper and crypto-backed instruments that have caused problems elsewhere. Whether Bermuda can enforce this standard rigorously with its small supervisory team is an open question.

Who this affects

Bermuda's digital asset registry includes roughly two dozen active licensees across three classes. Class T (test) licenses cost USD 1,000 to apply for and run 3 to 12 months. Class M (modified) and Class F (full) licenses each cost USD 2,266 in application fees. Annual supervision fees range from USD 15,000 for non-custodial services to a minimum of USD 150,000 for custodial providers, with a ceiling at USD 450,000 or 0.075% of estimated client receipts.

For firms already licensed, the custody rules require immediate compliance. The DABA amendments, once finalized, will layer on additional obligations. An Operational Resilience Code is also in the pipeline with a compliance deadline of March 31, 2028.

Bermuda's pitch has always been that early regulation creates credibility. The 2025 changes test whether that credibility can survive tighter supervision without driving licensees to cheaper, lighter-touch jurisdictions. For FalconX, Circle, and the rest of the island's crypto roster, the costs of being early are starting to include the costs of staying.