JCBA Publishes Draft Security Best Practices for Crypto Asset Clients, Comprising 347 Items with Key Management as an Independent Domain

According to CoinPost, the Security and Systems Committee of the Japan Cryptocurrency Business Association (JCBA) announced on October 20 the establishment of a Working Group (WG) on Crypto Asset Custody Management and released a draft of the "Practice Set" detailing security countermeasures for principals. The draft contains 347 items across ten major domains, including governance, personnel and physical security, BCP, and re-delegation management, while listing "Key Management and Signature Operation" as a distinct category. Principal service models are classified into five types: Holding, Intervention, Supply, Reference, and Others, and are accompanied by an Excel-based self-assessment questionnaire and a tracking ledger for verification documents. The JCBA emphasized that generic third-party assurance reports, such as SOC2, fall short in adequately assessing crypto asset-specific risks, particularly those related to private key lifecycle management.