The Japan Cryptoasset Business Association (JCBA) released a draft security guide on Oct. 20 for exchange wallet contractors, seeking to simplify assessments and address crypto risks that general audits may miss.
The guide sets out 347 review items across 10 areas, including third-party supplier management and controls over private keys and transaction signing. Each item identifies a potential risk and gives examples of evidence a contractor could provide during a review.
One area focuses specifically on key management and signing. It addresses how private keys are created and stored, the separation of hot and cold wallets, and withdrawal verification. JCBA sets out security measures according to the type of service a contractor provides.
The association groups providers into five service types based partly on whether they hold private keys or can affect a live system without the client’s approval. An accompanying spreadsheet lets contractors identify their service type, assess their controls and organize supporting records.
JCBA said exchanges currently use differing security questionnaires, creating work for providers that serve more than one client. It said a common guide could also make assessments easier for exchanges and auditors. Existing guidance, the association said, largely addresses the exchanges hiring contractors rather than the contractors themselves.
The group cited widespread outsourcing and cyberattacks on wallet and signing contractors among its reasons for developing the guide. It also said general audit reports such as SOC 2 may not fully assess controls specific to crypto assets.
The draft is guidance, not a legal requirement. JCBA is seeking comments from exchanges, service providers and auditors, and plans to revise the guide as rules, technology and cyber threats change. It has not given a date for a final version.
