Crypto Custody: What ASIC’s Updated Guidance Means for Fund Managers
The New Standard of Trust: What ASIC’s RG 133 Update Mandates for Australian Crypto Custody
The era of ad hoc digital asset custody in Australia is officially over. The Australian Securities and Investments Commission (ASIC) has delivered a clear regulatory signal, significantly updating its Regulatory Guide 133 (RG 133): Funds management and custodial services: Holding assets. This decisive revision formally extends the regulator's minimum standards to the custody of crypto-assets where they constitute financial products, fundamentally reshaping operational requirements for responsible entities and custodians [1.1, 1.6]. For organisations like fund managers and high-growth fintechs, this guidance isn't just about ticking compliance boxes; it’s about establishing a new, verifiable benchmark of trust with institutional clients.
The Non-Negotiables of Institutional Custody
The core of the updated RG 133 focuses on risk mitigation that accounts for the unique technical challenges of digital assets.
- Segregation and Client Protection: ASIC mandates that client crypto-assets must be segregated on the blockchain and held on trust, distinct from the custodian’s own holdings [1.2, 1.6]. This principle is vital, ensuring that in the event of insolvency or system failure, client assets remain identifiable and protected—a fundamental tenet of Australian financial services law.
- Cold Storage and Key Security: The guidance explicitly prefers solutions that protect private key material using hardware devices that are physically isolated (cold storage) over internet-connected systems (hot wallets) [1.1]. The security of these private keys—the 'title deeds' to the assets—is paramount, requiring robust physical security and effective backup/recovery practices, often geographically distributed.
- Governance and Independent Verification: Custodians must demonstrate robust cyber and physical security practices, internal governance, and comprehensive risk management. Critically, these practices must be independently verified to an appropriate standard, such as SOC 1/2 or ISO 27001 [1.1, 1.6]. This external assurance provides investors with confidence that systems are not just claimed to be secure, but proven to be so.
The Orbitra Advantage: Building Trust from the Ground Up
For infrastructure providers, RG 133 underscores the need for specialist expertise and infrastructure [1.1]. Our Electronic Wallet Security System is designed specifically to meet these heightened expectations. By implementing institutional-grade hot/cold wallet separation and multi-signature access controls, Orbitra helps responsible entities not only comply with the letter of the law but exceed the operational integrity demanded by ASIC. Furthermore, the requirement to perform due diligence on third-party service providers (like exchanges) and ensure they meet equivalent AUSTRAC registration and AML/CTF standards [1.1, 1.6] reinforces the need for fully auditable, compliant service partners across the value chain.
The updated RG 133 is a necessary maturation of the Australian digital finance landscape. By clearly defining the ‘good practices’ for crypto custody, ASIC is actively paving the way for larger, regulated institutional capital to enter the market with confidence. For firms ready to meet this challenge, this guidance is an opportunity to solidify their position as trustworthy leaders in the region.
References:
[1.1] Bits of Blocks. (2025, January 21). ASIC extends custody guidance to crypto assets.
[1.2] Charltons Quantum. (2024, December 10). ASIC Reinforces Custodial Standards: Insights into the Updated Regulatory Guide 133.
[1.6] KWM. (2025, January 15). Crypto custody: ASIC expands its Regulatory Guidance under RG 133.