Firms should narrate the background for creating a digital assets policy and how it is intended to be used. It is important for the firm to set out their strategy for the diverse types of digital assets products and services being offered. This section should also introduce the concept of digital assets and how digital assets operate with or without the use of blockchain technology. Firms should narrate the rationale for having a centralised, overarching digital assets policy to provide a summary view of the firm’s view on the use of DLT and its current and upcoming future activity in relation to digital assets. The overview should cover at a very high level the global geopolitical and regulatory digital assets landscape with reference to the firm’s business model. Firms should consider cross-referencing to a set of definitions of different types of digital assets, to differentiate between (as a minimum) digital versions of traditional assets, stablecoins and cryptocurrencies. This may be in the policy scope section below, or elsewhere in the policy.

Firms should clearly outline how they define the term ‘digital assets’ for their business and where this definition has been derived from (i.e., from industry standards or regulation). It may be relevant for the firm to expand on their digital assets strategy in relation to this policy. This will include more detail on the types of digital assets and technology being used: Examples of this are:

• Digitally native assets issued using DLT (e.g., tokens)
• Traditional finance products or services that are being tokenised (e.g., tokenised bonds)
• Derivative or exchange traded products referencing cryptocurrencies (e.g., Bitcoin ETFs)

The firm should define their process for how it categorises and manages the below in relation to digital assets activity:

• Prohibited activities
• Activities permitted in limited circumstances
• Generally permitted activities

Refer to the requirement to follow the governance processes described in the policy that are specific to use of DLT and/or interacting with digital asset products or services. Additionally, there should be guidance on any individuals or teams that may be exempt from this policy.

Internal communication: There may be instances where teams within the organisation desire to create digital assets related products or services but are unaware of similar products being created by other teams within the firm. Information on the various digital asset projects that are occurring around the firm should be communicated clearly with the whole firm once no longer designated as confidential. This function could sit with the internal communications team or perhaps more appropriately with the digital assets team who can collaborate with the internal comms team to distribute key updates. We discuss more detail on roles and responsibilities in the following section.

External communication: Once the overall digital assets strategy for the firm is agreed, a clear line for external communications should be agreed. This will allow both any marketing materials and communications with the media to align with the internal strategy. It can also be used for internal guidance on items such as employee training regarding posting on social media when discussing digital assets.

Firms may establish separate digital assets teams solely responsible for all digital assets related activity within the business. Accordingly, firms should outline how these teams will work with other areas of the business. One way to do this would be to identify the key 1st, 2nd, and 3rd line stakeholders within the organisation responsible for managing digital assets activity within their units and ensure regular communication between business units. There may be a need for roles that take accountability for certain digital asset related activity. The firm should describe the roles and responsibilities in relation to digital asset activity including escalation channels where applicable. Whilst all the roles listed below are not necessary for all firms, there would be a need to have a person responsible for the coordination of any activity.

Examples roles noted below are:

• Head of Digital Assets
• Head of Digital Asset Risk Management
• Head of Digital Assets Compliance
• Head of Digital Asset Financial Crime Risk
• Head of Digital Asset Custody
• Head of Digital Assets Technology
• Head of Digital Assets Platforms / Product
• Head of Internal Audit Technology (with responsibility for Digital Asset/DLT audits)

One of the roles above should also be appointed as the digital assets policy owner. This person would be responsible for ensuring that this policy is being applied in practice. Additional responsibilities including annual policy reviews, updates, and approvals. These roles reflect the various policies and procedures that would need consider digital assets and their underlying technology in one way or another. Each firm will need to consider if a standalone role would be most appropriate, or whether the responsibility should be added to the scope of a pre-existing role (for example the Head of Digital Assets Technology role may be carried out by the existing Head of Technology or CTO).

The firm should outline how this policy aligns to the wider risk management framework (if applicable) for managing digital assets risks. This may include the policy’s objective to be an overarching document summarising the bank’s stance and exposure to digital assets, while referencing a detailed set of wider documentation specific to digital assets (e.g. risk registers or risk and control matrices). Alternatively, it may cross-refer to a separate risk appetite statement regarding digital assets, depending on the firm’s approach.

Firms should identify the key control frameworks used to manage digital assets activity by 1st and 2nd Lines of Defence (LODs) within the organisation. This may include 2nd line risk and compliance teams with a mandate to incorporate digital assets activity within their existing control frameworks and/or newly created risk and compliance teams mandated to create standalone control frameworks. There should be information on the key monitoring programs use to monitor and report on digital assets activity across business lines and by 2nd line risk and compliance teams.

Within a governance and oversight section of the digital assets policy the firm should provide details on the robust framework for managing digital assets, encompassing clear approval processes for new initiatives, a strong link to the firm's risk appetite, and considerations for evolving regulatory landscapes. This includes detailing the lifecycle of digital asset proposals, specifying approval gates and stakeholders, and addressing the potential need for a dedicated digital asset approval committee. Additionally, the policy should clarify the firm's stance on public versus private blockchains, acknowledging client demand while outlining the current preference for private or hybrid models due to regulatory uncertainties. Furthermore, the policy should address the unique risks associated with third-party providers in the digital asset space, detailing a robust due diligence process for onboarding Virtual Asset Service Providers (VASPs) or Crypto-assets Service Providers (CASPs) that goes beyond standard approaches.

There should be reference to a detailed repository of digital assets related policies and guidelines across other business areas. An example of this would be references to the underlying technology (like DLT) that may reside within the firms ICT and Information Security policies. Further reference could be made to:

• Digital assets risk management framework (which includes risk appetite)
• Technology-related policies e.g., Access policy, change management policy, security policy.
• Third party risk management frameworks e.g., outsourcing policy.
• Due Diligence processes for onboarding of VASPs or CASPs.
• Digital assets regulations applicable to the firm.
• Personal Account Dealing policy for requirements related to holding and trading of crypto assets like cryptocurrencies.
• Financial Crime Risk Management e.g., AML, KYC requirements.
• Credit risk policy and how these are amended when clients make use of digital assets.
• Confidential information policy.
• Conflicts of interest policy.