Operational and cyber resilience.

Treats tokenised securities as securities and sets expectations on ownership and technology risk for intermediaries dealing in them.

The core VASP regime: a Certificate of Authority for exchange, transfer and custody services. Minimum capital is ₱50 million with custody and ₱10 million without, plus AML, travel rule, cybersecurity and consumer protection duties.

The SEC alleges that Bitkub's daily net capital reports hid the effect of a May 2021 hack of about 1.7 billion baht in customer assets. Bitkub remains on the SEC licence register.

Registration rules for platforms trading DFAs and crypto: KZT 200 million charter capital, board-approved operating rules, a three-year business plan and cybersecurity testing before launch. The register, on the Russian version of the page, lists only KASE.

Designated Grinex as the successor to Garantex and Old Vector, the Kyrgyz issuer of the rouble-backed A7A5 token, along with other firms in Russia and Kyrgyzstan.

Binding custody rules for financial asset service licensees: client assets in trust in segregated accounts, a custody officer, a register updated at least daily, multi-party (e.g. multisig) approval of transfers, quarterly checks by an independent accountant and controls on outsourced custodians. Published 19 July 2026, in force six months after publication (January 2027).

127 draft articles on platform operators, custodians, brokers and offer providers, client dealings and investor protection, marketing, outsourcing, financial guarantees, audits and cybersecurity. Comment closed on 28 January 2026; the final instructions had not been published by 5 October 2026.

Announces the mandatory technical controls for crypto firms under the Capital Markets Law, covering hot and cold wallet security, key management, governance and business continuity.

Sets the two-stage licensing process (establishment then operating permit), ownership and management rules, internal controls, IT systems, independent audit and proof-of-reserves audits.

Sets out what the BMA expects in a DABA licence application, from the legal vehicle, head office and staffing to outsourcing, insurance, capital and custody. It names SAC, ISAC and trust structures as bankruptcy-remote options firms have used.

Invited proposals for a joint pilot testing whether supervisory requirements can be built into DeFi infrastructure. The BMA lists Chainlink Labs, Hacken, Bluprynt and Apex as participants in the pilot.

Proposes a standalone cybersecurity rule for VASPs covering risks such as wallet infrastructure, private keys, smart contracts and third-party technology, beyond the cross-sector rule applied to VASPs since 2023.

Governance, capital, risk management, cybersecurity and listing rules for licensed custodians and platforms. Capital must be the higher of a risk-based amount or six months' fixed overheads; conduct sections moved to the Market Conduct Rule in February 2026.

Findings from a review of 11 registered VASPs between September 2024 and February 2025, citing weaknesses in board composition, succession planning, business continuity, cybersecurity and custody arrangements.