4.6.1. Systems, controls and procedures

(1) A Digital Asset Service Provider must ensure that it implements systems and controls necessary to address the risks, including cybersecurity-related risks, to its business. The relevant systems and controls should take into account such factors that include the nature, scale and complexity of the Digital Asset Service Provider’s business, the diversity of its operations, the volume and size of its business and the level of risk inherent in its business.

(2) A Digital Asset Service Provider must have adequate systems and controls to enable it to calculate and monitor its capital resources and its compliance with the requirements in DAA 4.2. The systems and controls must be in writing and must be appropriate for the nature, scale and complexity of the Digital Asset Service Provider’s business and its risk profile.

(3) A Digital Asset Service Provider must employ appropriate and proportionate systems, resources, and procedures to ensure the continued and regular performance of its services and activities.

(4) If the issuer of a Fiat stablecoin decides to discontinue providing services and activities, such as issuing the Fiat stablecoin, the issuer of a Fiat stablecoin must present a plan to the AFSA for such discontinuation, for the AFSA’s approval, and comply with any requirements imposed by the AFSA in relation to such discontinuation.

(5) Issuer of a Fiat stablecoin must identify sources of operational risks and minimise those risks through the development of appropriate systems, controls and procedures.

(6) Issuer of a Fiat stablecoin must have internal control mechanisms and effective procedures for risk management.

4.6.2. Technology governance and risk assessment framework

(1) A Digital Asset Service Provider must implement a technology governance and risk assessment framework which must be comprehensive and proportionate to the nature, scale, and complexity of the risks inherent in their business model.

(2) The technology governance and risk assessment framework must apply to all technologies relevant to a Digital Asset Service Provider’s business and clearly set out the Digital Asset Service Provider’s cybersecurity objectives.

(3) A Digital Asset Service Provider must ensure that its technology governance and risk assessment framework is capable of determining the necessary processes and controls that it must implement in order to adequately mitigate any risks identified.

(4) A Digital Asset Service Provider must ensure that its technology governance and risk assessment framework addresses appropriate governance policies and system development controls, such as a development, maintenance and testing process for technology systems and operations controls, back-up controls, capacity and performance planning and availability testing.

4.6.3. Cyber-security matters

A Digital Asset Service Provider must take reasonable steps to ensure that its IT systems are reliable and adequately protected from external attack or incident.

4.6.4. Cyber-security policy

(1) A Digital Asset Service Provider must create and implement a policy which outlines their procedures for the protection of its electronic systems.

(2) A Digital Asset Service Provider must ensure that its cyber-security policy is reviewed at least annually by its Chief Information Technology Officer.

(3) The cyber-security policy must, as a minimum, address the following areas:

(a) information security;

(b) data governance and classification;

(с) access controls;

(d) capacity and performance planning;

(e) systems operations and availability concerns;

(f) systems and network security, consensus protocol methodology, code and smart contract validation and audit processes;

(g) systems and application development and quality assurance;

(h) physical security and environmental controls, including procedures around access to premises and systems;

(i) customer data privacy;

(j) procedures regarding the facilitation of Digital Asset transactions initiated by a Client including considering multi-factor authentication or any better standard for Digital Asset transactions that—

(i) exceed transaction limits set by the Client, such as accumulative transaction limits over a period of time; and

(ii) are initiated after a change of personal details by the Client, such as the address of a Digital wallet;

(k) procedures regarding Client authentication and session controls including the maximum incorrect attempts for entering a password, appropriate time-out controls and password validity periods;

(l) procedures establishing adequate authentication checks when a change to a Client’s account information or contact details is requested;

(m) vendor and third-party service provider management;

(n) monitoring and implementing changes to core protocols not directly controlled by the Digital Asset Service Provider;

(o) incident response, including root cause analysis and rectification activities to prevent reoccurrence;

(p) governance framework and escalation procedures for effective decision-making and proper management and control of risks and emergency incidents, including responses to ransomware and other forms of cyberattacks; and

(q) hardware and infrastructure standards, including network lockdown, services/desktop security and firewall standards.

4.7.1. Requirements related to a reserve of assets

(1) Issuer of a Fiat stablecoin must make reserve assets available for examination and for verification of the issuer of a Fiat stablecoin's disclosures on the AFSA’s request.

(2) Issuer of a Fiat stablecoin must fully back such stablecoin with reserve assets, meaning that the value of the reserve assets must at all times be at least equal to the nominal value of all outstanding units of the Fiat stablecoin in circulation.

(3) Issuer of a Fiat stablecoin must issue stablecoins whose reserve assets consist of only one of the following fiat currencies (“reference assets”):

(a) Australian dollar;

(b) British pound sterling;

(c) Canadian dollar;

(d) Chinese yuan renminbi;

(e) European euro;

(f) Japanese yen;

(g) New Zealand dollar;

(h) Norwegian krone;

(i) Swedish krona;

(j) Swiss franc;

(k) United States dollar; or

(l) any other currency, except for Kazakhstani tenge, agreed with the AFSA.

(4) Issuer of a Fiat stablecoin must ensure that the reserve of assets is operationally segregated from the issuer of a Fiat stablecoin’s proprietary assets and from the reserve of assets of other Fiat stablecoins.

(5) The reserve of assets must be composed and managed in such a way that the liquidity risks associated with the permanent redemption rights of the holders are addressed.

(6) Issuer of a Fiat stablecoin that offers two or more categories of Fiat stablecoins to the public must operate and maintain segregated pools of reserves of assets for each category of Fiat stablecoins. Each of these pools of reserve of assets must be managed separately.

(7) Issuer of a Fiat stablecoin must determine the aggregate value of reserve assets by using market prices. Their aggregated value must be at least equal to the aggregate value of the claims on the issuer of a Fiat stablecoin from holders of Fiat stablecoins in circulation.

(8) Issuer of a Fiat stablecoin must conduct monthly reconciliation of each Fiat stablecoin to demonstrate that the Fiat stablecoin is fully backed with reserve assets.

(9) The reconciliation must include the information that the issuer of a Fiat stablecoin meets requirements under DAA 4.7.1 and DAA 4.7.3.

Guidance:

If an issuer of a Fiat stablecoin accepts fiat currency from a Client in exchange for giving them Fiat stablecoins. The fiat currency held by the issuer would be considered as Client Money, and the issuer of a Fiat Stablecoin would need to comply with the Client Money provisions in the COB.

4.7.2. Independent audit

(1) Issuer of a Fiat stablecoin must mandate an independent third party audit of the reserve assets annually but not later than four months after the close of its financial year.

(2) The result of the audit conducted under (1) must be provided to the AFSA without delay, at the latest within 4 weeks of the reference date of the valuation. The result of the audit must be published within three weeks of the date of the provision of the result of the audit to the AFSA.

(3) The AFSA may instruct the issuer of a Fiat stablecoin to delay the publication of the result of the audit in the event that:

(a) the issuer of a Fiat stablecoin has been required to implement a recovery arrangement;

(b) the issuer of a Fiat stablecoin has been required to implement a redemption plan;

(c) it is deemed necessary to protect the interests of holders of a Fiat stablecoin;

(d) it is deemed necessary to avoid a significant adverse effect on the financial system of the AIFC;

(e) the AFSA considers appropriate in pursuing the Regulatory Objectives.

(4) The valuation referred to in DAA 4.7.1 (7) at market prices must be made by using mark-to-market.

(5) When using mark-to-market:

(a) the reserve asset must be valued at the more prudent side of the bid and offer unless the reserve asset can be closed out at mid-market; and

(b) only good quality market data must be used. The issuer of a Fiat stablecoin must record the basis on which they deem market data of good quality, and ensure that such data is assessed on the basis of all of the following factors:

(i) the number and quality of the counterparties;

(ii) the volume and turnover in the market of the reserve asset; and

(iii) size of the reserve of assets.

(6) If the use of mark-to-market is not possible or the market data is not of sufficient quality, a reserve asset must be valued conservatively by using mark-to-model.

(7) The mark-to-model must accurately estimate the intrinsic value of the reserve asset, based on all of the following up-to-date key factors:

(a) the volume and turnover in the market of that reserve asset;

(b) the size of the reserve of assets; and

(c) market risk, interest rate risk, and credit risk attached to the reserve asset.

(8) When using mark-to-model, the amortised cost method must not be used.

4.7.3. Custody of reserve assets

(1) Issuer of a Fiat stablecoin must establish, maintain and implement custody policies, procedures and contractual arrangements that ensure at all times that:

(a) the reserve assets are not encumbered nor pledged as Collateral;

(b) the reserve assets are held in custody;

(c) the issuer of a Fiat stablecoin has prompt access to the reserve assets to meet any redemption requests from the holders of Fiat stablecoins;

(d) concentration risk in the custody of reserve assets is mitigated and there is appropriate contingency planning in the event that a custodian is unable to perform its obligations; and

(e) concentration risks in the reserve assets are avoided; and  

(e) there is proper due diligence of the robustness of the custodian used, including as regards ensuring that there is a credible and comprehensive wind-down plan in place for each custodian used.

(2) Issuer of a Fiat stablecoin that issues two or more categories of Fiat stablecoins must have a custody policy for each pool of reserve of assets.

(3) Issuer of a Fiat stablecoin must operate and maintain only one custody policy per category of Fiat stablecoin.

(4) The reserve assets must be held in custody by no later than 5 working days after the issuance of the relevant Fiat stablecoins.

(5) A Person providing custody services must be a Person different from the issuer of a Fiat stablecoin.

(6) Issuer of a Fiat stablecoin must ensure that the Digital Asset Service Provider appointed as a custodian of the reserve assets has the necessary licences, expertise and market reputation to act as a custodian of such reserve assets, taking into account the accounting practices, safekeeping procedures and internal control mechanisms.

(7) The contractual arrangements between the issuer of a Fiat stablecoin and custodians must ensure that the reserve assets held in custody are protected against claims of the custodians’ creditors.

(8) The custody policies and procedures referred to in (1) must set out the selection criteria for the appointments of custodians of the reserve assets and the procedure to review such appointments at least annually.

(9) A custodian must comply with the rules relevant to Providing Custody, including those set out in chapter 8 of the COB (or, to the extent that the custodian is not based in the AIFC, in accordance with the rules of the jurisdiction of the custodian as well as any additional requirements which the AFSA may deem relevant to ensure that equivalent protections are in place as those provided by the Legal Framework provided by the AFSA).

4.7.4. Investment of reserve assets

(1) Issuer of a Fiat stablecoin must ensure that it has sufficient uninvested reserve assets to be able to meet the issuer of the Fiat stablecoin’s ongoing obligations under DAA 4.7.1 at all times.

(2) The instruments which the issuer of a Fiat stablecoin invests the reserve assets into must be held in custody in accordance with DAA 4.7.3.

(3) Issuer of a Fiat stablecoin must hold at least 95% of reserve assets denominated in the reference assets in:

(a) cash or cash equivalents including central bank reserve deposits, bank deposits and Central Bank Digital Currency, which must comprise at least 30% of reserve assets; or

(b) highly liquid financial instruments with minimal market risk, credit risk, and concentration risk, which could be liquidated rapidly with minimal adverse market impact, including the following:

(i) debt securities with residual maturity of 90 days or less, issued by governments or central banks of the reference assets specified in DAA 4.7.1(3) or local or international government agencies;

(ii) repurchase agreements with a maturity of 7 or less which are backed by (i) above; and

(iii) short-term government money market funds.

(4) Issuer of a Fiat stablecoin may invest up to 5% of reserve assets in precious metals. If an issuer of a Fiat stablecoin invests in precious metals, a 20% haircut applies to such investment.

(5) All losses, including fluctuations in the value of the financial instruments referred to in (3), must be borne by the issuer of a Fiat stablecoin.

(6) All profits or losses and any counterparty or operational risks that result from the investment of the reserve of assets must be borne by the issuer of a Fiat stablecoin.

(7) If an issuer of a Fiat stablecoin invests a part of the reserve of assets, it must describe in detail the investment policy and contain an assessment of how that investment policy can affect the value of the reserve of assets.

(8) Issuer of a Fiat stablecoin must, at all times, manage reserve assets effectively and prudently, at least by:

(a)maintaining reserve assets only with custodians, as agreed with the AFSA during the authorisation process:

(i) appropriately and validly authorised to hold the specific type of reserve assets; and

(ii) that segregate reserve assets maintained by them from their own funds;

(b) ensuring newly added reserve assets are held in accordance with their custody arrangements;

(c) putting in place policies and procedures to ensure reserve assets can be promptly accessed and converted into the reference assets at all times, for the purpose of processing and completing any redemption requests in accordance with DAA 4.11.2; and

(d) conducting regular risk assessments to evaluate the appropriateness of the composition of reserve assets in ensuring compliance with DAA 4.7.1(2).

(9) Issuer of a Fiat stablecoin must insert provisions in their agreements with the relevant financial services firms to ensure the AFSA has priority access to reserve assets, to the further extent permitted by applicable laws, for the purposes of the AFSA fulfilling its regulatory obligations.

4.8.1. Content and form of the white paper

(1) A Digital Asset white paper for a Fiat stablecoin must contain all of the following information:

(a) information about the issuer of a Fiat stablecoin;

(b) information about the Fiat stablecoin;

(c) information on the rights and obligations attached to a Fiat stablecoin;

(d) information on the underlying technology used to operate the Fiat stablecoin;

(e) information on risks;

(f) information on the reserve of assets;

(g) the method and all factors used to calculate the value of reserve assets; 

(h) the initial value and composition of the reserve assets;

(i) the conditions and the procedure to purchase stablecoins and redeem such stablecoins against reserve assets; 

(j) details of the arrangements for the custody and management of the reserve assets;

(k) the rights provided to holders of the stablecoin;

(l) a summary of the redemption policies; and

(m) any other information that the AFSA requires..

(2) All information in the white paper referred to in (1):

(a) must be fair, clear and not misleading;

(b) must not contain material omissions; and

(c) must be presented in a concise and comprehensible form.

(3) The white paper must not contain any assertions on the future value of the Fiat stablecoin.

(4) The white paper must contain a clear and unambiguous statement that:

(a) the Fiat stablecoin may lose their value in part or in full;

(b) the Fiat stablecoin may not always be transferable; and

(c) the Fiat stablecoin may not be liquid.

(5) The white paper for a Fiat stablecoin must contain a statement from the management body of the issuer of a Fiat stablecoin confirming that the white paper complies with the requirements of this Part and that, to the best knowledge of the management body, the information presented in the white paper:

(a) is in accordance with the facts; and

(b) makes no material omission likely to affect any decision to participate in the Fiat stablecoin.

(6) The white paper must contain a summary that in brief and non-technical language provides key information about the offer to the public of the Fiat stablecoin or about the intended admission of the Fiat stablecoin to trading on a Digital Asset Trading Facility.

(7) The summary must be presented and laid out in easily understandable words and in a clear and comprehensive form, using characters of readable size.

(8) The format and content of the summary of the white paper must provide, in conjunction with the white paper, appropriate information about the characteristics of the Fiat stablecoins concerned in order to help potential holders of the Fiat stablecoins to make an informed decision.

(9) The summary must indicate that:

(a) the holders of a Fiat stablecoin have a redemption right at any moment; and

(b) the conditions of redemption.

(10) The summary must contain a warning that:

(a) it should be read as an introduction to the white paper; and

(b) the potential holder should base any decision to purchase a Fiat stablecoin on the content of the whole white paper.

(11) Before the publication of the white paper no marketing communications or Financial Promotions can be made. This restriction does not affect the ability of the issuer of a Fiat stablecoin to conduct market soundings.

4.8.2. Modification of the white paper

(1) Issuer of a Fiat stablecoin must inform in writing the AFSA of any intended change of the issuer of a Fiat stablecoin’s business model likely to have a significant influence on the purchase decision of any actual or potential holder of a Fiat stablecoin, which occurs after the authorisation or approval of the white paper. Such changes may include:

(a) the governance arrangements, including reporting lines to the management body and risk management framework;

(b) the reserve assets and the custody of the reserve assets;

(c) the rights granted to the holders of a Fiat stablecoin;

(d) the mechanism through which Fiat stablecoins are issued and redeemed;

(e) the protocols for validating the transactions in Fiat stablecoins;

(f) the functioning of the issuer of a Fiat stablecoin’s proprietary DLT, where the Fiat stablecoins are issued, transferred and stored on such a DLT;

(g) the mechanisms to ensure the liquidity of Fiat stablecoins, including the liquidity management policy for issuers of Fiat stablecoins;

(h) the arrangements with third parties, including for managing the reserve assets and the investment of the reserve, the custody of reserve assets, and, where applicable, the distribution of Fiat stablecoins to the public;

(i) the complaint handling procedure; or

(j) the money laundering and terrorist financing risk assessment and general policies and procedures.

(2) The AFSA must be informed in writing 30 working days before the intended changes take effect.

(3) The AFSA must grant its approval or refuse to approve the draft modified white paper within 30 working days following the acknowledgement of receipt.

(4) During the examination of the draft modified white paper, the AFSA may request an issuer of a Fiat stablecoin to provide any additional information, explanations or justifications on the draft modified white paper.

(5) If the AFSA requests additional information, the time limit of 30 working days must commence only when the AFSA has received the additional information requested.

(6) Where approving the modified white paper, the AFSA may require the issuer of Fiat stablecoins:

(a) to put in place mechanisms to ensure the protection of holders of Fiat stablecoins, when a potential modification of the issuer of a Fiat stablecoin’s operations can have a material effect on the value, stability, or risks of the Fiat stablecoins or reserve assets;

(b) to take any appropriate corrective measures to address concerns related to financial stability, the smooth operation of payment systems, or market integrity.

4.8.3. Liability of issuers of Fiat stablecoins for the information given in the white paper

(1) If an issuer of a Fiat stablecoin or its management or supervisory bodies has breached requirements set out in DAA 4.8.1(2), by providing in its white paper or in a modified white paper information which is not complete, fair or clear or by providing information which is misleading, a holder of such Fiat stablecoins or bodies can claim for damage arising from the breach.

(2) To demonstrate that the issuer has breached DAA 4.8.1 (2), a holder of Fiat stablecoin must present evidence indicating that the issuer of Fiat stablecoins has breached DAA 4.8.1(2) and that such breach had an impact on the holder’s decision to buy, sell or exchange the said Fiat stablecoin.

(3) No claim for damages arising from information provided in a summary (whether in its original form or as translated) may be made by a holder of Fiat stablecoins unless:

(a) the summary is misleading, inaccurate or inconsistent when read together with the other parts of the white paper; or

(b) the summary does not provide, when read together with the other parts of the white paper, key information in order to aid potential holders when considering whether to purchase such Fiat stablecoins.

4.8.4. Publication of the white paper

(1) Issuer of a Fiat stablecoin must publish on its website its white paper as approved and as modified.

(2) The approved white paper must be publicly accessible by no later than the starting date of the offer to the public of the Fiat stablecoins or the admission of those tokens to trading on a Digital Asset Trading Facility.

(3) The approved white paper and the modified white paper must remain available on the issuer of a Fiat stablecoin’s website for as long as the Fiat stablecoin is available to the public.

4.11.1. Ongoing information to holders of Fiat stablecoins

(1) Issuer of a Fiat stablecoin must in a clear, accurate and transparent manner disclose at least once a quarter, on a publicly and easily accessible place on its website, the amount of Fiat stablecoins in circulation, and the value and the composition of the reserve assets.

(2) The published information must demonstrate that the reserves:

(a) are at least equal in value to the notional value of outstanding Fiat stablecoins in circulation (that value is calculated by multiplying the number of Fiat stablecoins in circulation by the purported pegged Fiat Currency value);

(b) are denominated in the reference currency; and

(c) are held in segregated accounts with properly regulated custodians.

(3) Issuer of a Fiat stablecoin must publish as soon as possible on a publicly and easily accessible place on its website a brief, clear, accurate and transparent summary of the audit report and the full and unredacted audit report in relation to the reserve assets.

(4) Issuer of a Fiat stablecoin must as soon as possible and in a clear, accurate and transparent manner disclose on its website any event that has or is likely to have a significant effect on the value of the Fiat stablecoin, or on the reserve assets.

4.11.2. Redemption rights

(1) Issuer of a Fiat stablecoin must grant holders redemption rights at all times on the issuer of a Fiat stablecoin, and on the reserve assets when the issuer is not able to comply with its obligations.

(2) Holders should be able to redeem their Fiat stablecoins at any moment and at par value to the referenced asset.

(3) Issuer of a Fiat stablecoin must ensure that all requests made by holders, with valid client agreements with the issuer of a Fiat stablecoin, to redeem the Fiat stablecoin at par are processed and completed:

(a) promptly and no later than five business days of any such requests; or

(b) if the trading or settlement of the reserve assets is subject to significant disruption events beyond the control of an issuer of a Fiat stablecoin to issue the Fiat stablecoin, promptly and no later than five business days of the trading or settlement of reserve assets no longer being significantly impacted by such disruption events.

(4) Issuer of a Fiat stablecoin is allowed to charge a reasonable fee for processing and completing redemption requests. The redemption fee must be clearly disclosed on the website of the issuer of a Fiat stablecoin and must be proportionate and commensurate with the actual costs incurred by the issuer of a Fiat stablecoin in completing the redemption request.

(5) Issuer of a Fiat stablecoin must establish, maintain and implement clear and detailed policies and procedures setting out:

(a) the conditions, including thresholds, periods and timeframes, for holders of a Fiat stablecoin to exercise this right;

(b) the mechanisms and procedures to ensure the redemption of the Fiat stablecoins;

(c) the valuation, or the principles of valuation, of the Fiat stablecoins and of the reserve assets when this right is exercised by the holder of a Fiat stablecoin;

(d) the settlement conditions when this right is exercised; and

(e) measures the issuer of a Fiat stablecoin is taking to adequately manage increases or decreases of the reserve, to avoid any adverse impacts on the market of the assets included in the reserve.

4.11.3. Ongoing capital

(1) In addition to DAA 4.2(b), an issuer of a Fiat stablecoin must ensure that it maintains at all times ongoing capital resources in the amount of 2% of the average outstanding Fiat stablecoins in relation to each category of Fiat stablecoin issued by it.

(2) The ongoing capital referred to in 4.11.3(1) should consist of the Common Equity Tier 1 items and instruments.

(3) If an issuer of a Fiat stablecoin offers more than one category of Fiat stablecoins, the amount of the average outstanding Fiat stablecoins should be the sum of the average amounts of the reserve assets backing each category.

Guidance:

The term ‘average outstanding Fiat stablecoins’ refers to the average amount of reserve assets at the end of each calendar day, calculated over the preceding 6 (six) months. If the relevant period does not exceed 6 (six) months, an issuer of a Fiat stablecoin should calculate the average outstanding Fiat stablecoins based on the actual data.

4.11.4. Prohibitions

(1) Issuer of a Fiat stablecoin is prohibited from granting any interest to holders of the Fiat stablecoin.

(2) For the purposes of this Rule, any remuneration or any other benefit related to the length of time during which a holder of a Fiat stablecoin holds such a Fiat stablecoin must be treated as interest.

(3) The interest includes net compensation or discount, with an equivalent effect of an interest received by the holder, directly from the issuer or through third parties, directly associated with the Fiat stablecoin or through the remuneration or pricing of other products.

(4) The issuance of stablecoins that aim or purport to maintain a stable value via protocols that provide for the increase or decrease of the supply of such stablecoins or other digital assets in response to changes in demand is prohibited.