Introduction
This policy provides a framework for conducting transactions involving digital assets or cryptocurrencies within our organization. It aims to ensure that all transactions are carried out securely, transparently, and in compliance with applicable laws and regulations. The policy covers transaction authorization, security measures, anti-money laundering (AML) and know your customer (KYC) procedures, record-keeping, and reporting requirements.
1. Scope and Applicability
1.1 Scope
This policy applies to all employees, contractors, and agents of the organization involved in digital asset or cryptocurrency transactions.
It covers all types of digital asset transactions, including purchases, sales, transfers, and exchanges.
1.2 Applicability
The policy is applicable to transactions conducted on behalf of the organization, including those involving corporate assets and client funds.
2. Transaction Authorization
2.1 Approval Process
All digital asset transactions must be authorized by designated personnel as defined in the organization’s authorization matrix.
Transactions exceeding a specified threshold require dual approval to ensure additional oversight.
White-listing of wallet addresses created and approved by separate parties.
Ensuring users are restricted to designated IP addresses.
Independent viewing access for fund administrator via API for all transactions.
2.2 Verification of Counterparties
Counterparties involved in transactions must be verified through due diligence processes to ensure their legitimacy and compliance with regulatory requirements.
A list of approved counterparties will be maintained and regularly updated.
3. Security Measures
3.1 Wallet Management
Digital assets must be stored in secure wallets, with a preference for cold storage solutions to minimize the risk of hacking.
Access to wallets must be restricted to authorized personnel only, with multi-factor authentication (MFA) enabled.
3.2 Private Key Management
Private keys must be securely stored and backed up using encrypted storage solutions.
A disaster recovery plan for private keys must be in place, including secure backup and recovery procedures.
3.3 Transaction Security
Transactions should be conducted using secure, reputable platforms and exchanges that adhere to industry standards.
Encryption protocols must be used to protect transaction data from unauthorized access and tampering.
4. AML/KYC Compliance
4.1 AML Policy
The organization must establish and maintain an AML policy in line with relevant laws and regulations to prevent money laundering and terrorist financing.
An AML officer will oversee the implementation and enforcement of the AML policy.
4.2 KYC Procedures
Comprehensive KYC procedures must be implemented to verify the identity of all clients and counterparties involved in digital asset transactions.
Periodic reviews and updates of KYC information must be conducted to ensure ongoing compliance.
4.3 Transaction Monitoring
Transactions must be monitored for suspicious activity, with any unusual or potentially illicit activity reported to the relevant authorities.
Automated monitoring systems should be employed to detect and flag suspicious transactions in real time.
5. Record-Keeping and Reporting
5.1 Record-Keeping
Detailed records of all digital asset transactions must be maintained, including transaction details, counterparties, authorizations, and supporting documentation.
Records must be stored securely and retained for a minimum period as required by law.
5.2 Reporting Requirements
Regular reports on digital asset transactions must be prepared and reviewed by designated personnel to ensure transparency and accountability.
Significant transactions or suspicious activities must be reported to the relevant regulatory authorities in compliance with legal requirements.
5.3 Audit and Review
Periodic audits of digital asset transactions and related processes must be conducted to ensure compliance with this policy and identify areas for improvement.
The findings of audits and reviews should be documented, and corrective actions implemented as necessary.
6. Risk Management
6.1 Risk Assessment
Regular risk assessments must be conducted to identify, evaluate, and mitigate risks associated with digital asset transactions.
Key risk factors include market volatility, cybersecurity threats, regulatory changes, and operational risks.
6.2 Risk Mitigation Strategies
Diversification of digital asset holdings to spread risk and avoid over-concentration.
Implementation of robust cybersecurity measures to protect against hacking and unauthorized access.
Regular updates to risk management policies and procedures in response to emerging threats and industry best practices.
7. Training and Awareness
7.1 Employee Training
All employees involved in digital asset transactions must receive regular training on this policy, AML/KYC procedures, cybersecurity practices, and regulatory compliance.
Training programs should be updated regularly to reflect changes in the regulatory landscape and emerging risks.
7.2 Awareness Campaigns
Periodic awareness campaigns should be conducted to reinforce the importance of compliance with this policy and promote a culture of security and integrity.
8. Policy Review and Updates
8.1 Regular Review
This policy must be reviewed at least annually to ensure its continued relevance and effectiveness.
Updates to the policy will be made as necessary to address changes in the regulatory environment, market conditions, and best practices.
8.2 Approval of Changes
All changes to this policy must be approved by senior management and communicated to all relevant personnel.
Conclusion
Having a policy for each digital asset fund is important to set out the framework for protecting the funds assets and investors. There are a number of controls that can be put in place and ultimately having the board of directors sign off annually or when any changes are made to the policy is good practice form a governance perspective. If third-party systems are being used then a risk assessment should be conducted on this. For the CV5 Digital platform, we routinely assist the many fund managers we work with to develop policies and procedures specific to the size, scope, strategy and risks associated with a particular fund.
Comments