Dr. Ikramul Haq & Abdul Rauf Shakoori
Crypto assets are no longer confined to speculative trading. They are steadily becoming part of the core architecture of modern finance, shaping payments, remittances, capital markets, and the tokenization of tangible assets. Blockchain-based infrastructure increasingly substitutes traditional intermediaries, compelling regulators and central banks worldwide to confront a fundamental reality: digital assets are now embedded in the financial system.
The central regulatory question has therefore shifted. It is no longer whether crypto should exist, but how it should be governed. At the heart of this governance challenge lies custody. Control over private keys is control over assets. Custody has thus emerged as the primary institutional risk point in the digital asset ecosystem and the cornerstone of credible regulation.
Unregulated crypto markets do not disperse risk; they concentrate it. In the absence of formal oversight, risks accumulate within exchanges, wallets, and custodial platforms operating outside prudential supervision. Repeated market failures, platform collapses, cyber breaches, and misappropriation of client funds have demonstrated that loosely regulated crypto ecosystems generate systemic vulnerabilities. This experience explains why global regulatory approaches have shifted from permissive tolerance to structured supervision.
Across jurisdictions, regulators pursue three core objectives: protection of client assets, preservation of financial system stability, and legal certainty for institutions. These objectives underpin the emerging global consensus that custody is not a peripheral service but the institutional foundation of digital finance.
Global Regulatory Architecture
Crypto regulation follows a broadly consistent institutional logic. The first step is legal classification. Jurisdictions define crypto assets as property, financial instruments, payment instruments, or hybrid assets, thereby determining how existing financial laws apply. Licensing regimes follow, requiring crypto service providers to operate as regulated entities—whether as Virtual Asset Service Providers (VASPs), Crypto Asset Service Providers (CASPs), or licensed financial intermediaries. Anti-money laundering frameworks are then integrated, including customer due diligence, transaction monitoring, and implementation of the Fancial Action Task Force (FATF) Travel Rule.
Consumer protection rules add disclosure obligations, complaint mechanisms, and liability standards. Prudential regulation completes the framework through governance requirements, capital standards, cybersecurity obligations, and business continuity planning. Within this structure, custody occupies a central position. Unlike exchanges or transaction facilitators, custodians bear legal responsibility for safeguarding assets. Operational risk, legal risk, cyber risk, and consumer risk converge at the point of custody. This convergence explains why regulators increasingly treat crypto custody as equivalent to banking custody or securities depository services.
Core Elements of Custody Regulation
Modern custody frameworks rest on verifiable legal and technical standards. Asset segregation is mandatory, ensuring that client assets remain separate from a custodian’s own balance sheet. Legal recognition of beneficial ownership protects customer assets in the event of insolvency.
Robust key management systems—using multisignature arrangements, cold storage, and hardware security modules—are standard regulatory expectations. Governance requirements mandate internal controls, compliance units, independent audits, and board oversight. Operational resilience rules impose disaster recovery planning, cybersecurity protocols, and incident reporting obligations. Continuous regulatory reporting ensures supervisory visibility. These requirements are not aspirational. They are embedded in law and supervisory practice across major financial jurisdictions.
Comparative Jurisdictional Approaches
The European Union has adopted the most comprehensive framework through the Markets in Crypto-Assets Regulation (MiCA). It establishes licensed Crypto Asset Service Providers with specific authorization for custody. Custodians must segregate assets, maintain operational safeguards, meet governance standards, and comply with enforceable consumer protection obligations. Passporting rights allow licensed custodians to operate across all EU member states, firmly treating custody as a regulated financial service.
The United States regulates custody through existing financial laws rather than a single crypto statute. Federally chartered banks may provide crypto custody under guidance from the Office of the Comptroller of the Currency, while state trust charters authorize crypto trust companies. Securities laws impose custody obligations on broker-dealers, and FinCEN applies AML requirements. Despite its fragmented structure, the US system treats custody as a fiduciary function subject to supervision.
Singapore regulates custody under the Payment Services Act, supervised by the Monetary Authority of Singapore. Custodial services require licensing, asset protection measures, operational safeguards, and AML compliance.
Switzerland applies custody regulation through the DLT Act and FINMA supervision. Digital assets are legally recognized, and custodians operate as regulated financial intermediaries. Licensing, governance, asset protection, and institutional supervision mirror traditional financial custody models.
Crypto custody is embedded into Switzerland’s financial market structure. Japan regulates custody under the Payment Services Act and Financial Services Agency oversight. The licensed custodians must segregate assets, protect consumers, and comply with strict operational rules. Japan’s model reflects a high trust regulatory system where crypto services are supervised as formal financial institutions.
Hong Kong regulates custody through the Virtual Asset Service Provider regime under the Securities and Futures Commission. The custodians must be licensed, meet capital requirements, maintain governance structures, and comply with risk management standards. Custody is treated as a regulated financial service under securities law principles.
The United Arab Emirates operates custody regulation through ADGM and DIFC frameworks and central bank oversight. The licensed custodians operate under formal regulatory regimes with AML compliance, operational controls, and supervisory reporting. Crypto custody is integrated into financial free zone governance structures.
The United Kingdom is developing a formal custody regime under the Financial Conduct Authority. Draft safeguarding and custody rules apply trust structures, asset segregation, and consumer protection standards similar to securities custody. The UK approach treats crypto custody as financial infrastructure.
Brazil regulates custodians under its virtual asset’s framework supervised by the central bank. Licensing, consumer protection, and AML compliance are mandatory. Custody services are legally defined and institutionally supervised.
Antigua and Barbuda regulates custody under the Digital Assets Business Act, requiring licensing, regulatory supervision, AML policies, and audit obligations. Custody is formally recognized as a regulated business activity.
Policy Implications for Emerging Markets
For emerging economies, the implications are clear. Regulatory absence fosters shadow financial systems, consumer exploitation, capital flight, and exposure to financial crime. Excessive restriction, on the other hand, drives activity underground and encourages regulatory arbitrage. The strategic objective must be structured regulation that integrates crypto into the formal financial system.
Pakistan should align its crypto framework with established global practices by placing custody at the center of regulation. Regulating custody first builds institutional trust without encouraging speculative excess. It enables systemic risk control, consumer protection, and alignment with FATF obligations.
Pakistan currently lacks a comprehensive custody framework. Digital assets should be legally defined, and custody designated as a regulated financial service. Custodians should operate under fiduciary or trust-based structures, with mandatory asset segregation, legal recognition of beneficial ownership, and central bank or securities regulator supervision. Licensing should require governance frameworks, cybersecurity systems, and continuous regulatory reporting aligned with international standards.
Custody models should prioritize bank-based custody, trust company custody, and licensed digital custodians. Banks offer compliance infrastructure and institutional credibility.
Trust structures provide legal asset protection, while licensed digital custodians contribute technological specialization under regulatory oversight.
Institutional coordination is critical. Regulation should involve the State Bank of Pakistan, SECP, FIA, FMU, and NADRA for identity integration and monitoring. A unified supervisory framework would reduce fragmentation and enhance consistency.
Economic and Institutional Impact
Structured custody regulation would modernize remittance systems, strengthen financial inclusion, enable digital trade, attract institutional investment, and enhance regulatory credibility. Formal custody rules would shift crypto activity from informal markets into regulated channels, reducing systemic risk while enabling innovation.
Custody is not a technical issue. It is the institutional foundation of digital finance. Jurisdictions that regulate custody effectively do not suppress innovation; they structure it. Pakistan can design a framework that treats crypto as financial infrastructure rather than speculative risk. By anchoring regulation in custody, Pakistan can protect consumers, strengthen institutions, advance economic modernization, and secure its place in the evolving global financial system.
_____________________________________________________________
Dr. Ikramul Haq, Advocate Supreme Court, specializes in constitutional, corporate, environment, media, ML/CFT related laws, IT, intellectual property, arbitration and international tax laws. He holds LLD in tax laws with specialization in transfer pricing. He was full-time journalist from 1979 to 1984 with Viewpoint and Dawn. He served Civil Services of Pakistan from 1984 to 1996.
He established Huzaima & Ikram in 1996 and is presently its chief partner. He studied journalism, English literature and law. He is Chief Editor of Taxation. He is country editor and correspondent of International Bureau of Fiscal Documentation (IBFD) and member of International Fiscal Association (IFA).
He is Visiting Faculty at Lahore University of Management Sciences (LUMS) and member Advisory Board and Visiting Senior Fellow of Pakistan Institute of Development Economics (PIDE).
He has coauthored with Huzaima Bukhari many books that include, Tax Reforms in Pakistan: Historic & Critical Review, Towards Broad, Flat, Low-rate, and Predictable Taxes (third edition, 2024), Pakistan: Enigma of Taxation, Towards Flat, Low-rate, Broad and Predictable Taxes (revised/enlarged edition of December 2020), Law & Practice of Income Tax, Law , Practice of Sales Tax, Law and Practice of Corporate Law, Law & Practice of Federal Excise, Law & Practice of Sales Tax on Services, Federal Tax Laws of Pakistan, Provincial Tax Laws, Practical Handbook of Income Tax, Tax Laws of Pakistan, Principles of Income Tax with Glossary and Master Tax Guide, Income Tax Digest 1886-2011 (with judicial analysis).
He is author of Commentary on Avoidance of Double Taxation Agreements, Pakistan: From Hash to Heroin, its sequel Pakistan: Drug-trap to Debt-trap and Practical Handbook of Income Tax. Two books of poetry are Phull Kikkaran De (Punjabi 2023) and Nai Ufaq (Urdu 1979 with Siraj Munir and Shahid Jamal).
He regularly writes columns/article/papers for many Pakistani newspapers and international journals and has contributed over 3000 articles on a variety of issues of public interest, printed in various journals, magazines and newspapers at home and abroad.
X (formerly Twitter): DrIkramulHaq
_______________________________________________________________
Abdul Rauf Shakoori, Advocate High Court, is a subject-matter expert on AML-CFT, Compliance, Cyber Crime and Risk Management. He has been providing AML-CFT advisory and training services to financial institutions (banks, DNFBPs, Investment companies, Money Service Businesses, insurance companies and securities), government institutions including law enforcement agencies located in North America (USA & CANADA), Middle East and Pakistan. His areas of expertise include legal, strategic planning, cross-border transactions including but not limited to joint ventures (JVs), mergers & acquisitions (M&A), takeovers, privatizations, overseas expansions, USA Patriot Act, Banking Secrecy Act, Office of Foreign Assets Control (OFAC).
Over his career he has demonstrated excellent leadership, communication, analytical, and problem-solving skills and have also developed and delivered training courses in the areas of AML/CFT, Compliance, Fraud & Financial Crime Risk Management, Bank Secrecy, Cyber Crimes & Internet Threats against Banks, E–Channels Fraud Prevention, Security and Investigation of Financial Crimes. The courses have been delivered as practical workshops with case study driven scenarios and exams to ensure knowledge transfer.
His notable publications are: Rauf’s Compilation of Corporate Laws of Pakistan, Rauf’s Company Law and Practice of Pakistan and Rauf’s Research on Labour Laws and Income Tax and others.
His articles include: Revenue collection: Contemporary targets vs. orthodox approach, It is time to say goodbye to our past, US double standards, Was Due Process Flouted While Convicting Nawaz Sharif?, FATF and unjustly grey listed Pakistan, Corruption is no excuse for Incompetence, Next step for Pakistan, Pakistan’s compliance with FATF mandates, a work in progress, Pakistan’s strategy to address FATF Mandates was Inadequate, Pakistan’s Evolving FATF Compliance, Transparency Curtails Corruption, Pakistan’s Long Road towards FATF Compliance, Pakistan’s Archaic Approach to Addressing FATF Mandates, FATF: Challenges for June deadline, Pakistan: Combating the illicit flow of money, Regulating Crypto: An uphill task for Pakistan. Pakistan’s economy – Chicanery of numbers. Pakistan: Reclaiming its space on FATF whitelist. Sacred Games: Kulbhushan Jadhav Case. National FATF secretariat and Financial Monitoring Unit. The FATF challenge. Pakistan: Crucial FATF hearing. Pakistan: Dissecting FATF Failure, Environmental crimes: An emerging challenge, Countering corrupt practices .
X (formerly Twitter): Abdul Rauf Shakoori
The recent publication, coauthored by these writes with Huzaima Bukhari is:
Pakistan Tackling FATF: Challenges & Solutions, available at:
https://aacp.com.pk/book-detail/pakistan-tackling-fatf-challenges-and-solutions-35
https://www.amazon.com/dp/B08RXH8W46